Mobile Networks Overview (2G / 3G / 4G-LTE) with Focus on Core Network (CS / PS / EPC)

1. Mobile Networks
FUNDAMENTAL CONCEPTS AND OVERVIEW
Hamid Reza Bolhasani
EPC/CS/PS CORE SOLUTION ARCHTECT
MS, IT (COMPUTER NETWORKS)
BOLHASANI@GMAIL.COM
9 FEB 2017.

2. 2
Table of Contents
 History/Future
 Introduction of GSM
 Mobile Network Generations
 2G/3G/4G Fundamentals
 Evolution of Mobile Network
 EPC Introduction
 EPC-Core Structure
 Related Interfaces and Protocols
 4G/LTE Basic Scenarios
 LTE Special Concepts
 IoT/MVNO/V2X
 Question & Answer
 Conclusion

3. 3
 History

4. 4
 History

5. 5
 History / Telecommunication Networks
 PSTN
 PSDN
 WLL
 WiMAX
 NGN
 NGMN
 Cellular / Mobile Networks

6. 6
 History / PSTN
 PSTN (Public Switch Telephone Network) is the world’s collection of interconnected
voice-oriented public telephone networks, both commercial and government-owned.
It’s also referred as the Plain Old Telephone Service (POTS).
Switching
Office
CPE CPE
Transmission Facilities
Switching
Office

7. 7

8. 8
 History / PSTN Numbering Plan
Numbering Plan Area Central Office Station
N X X N X X X X X X
2-9 0-9 0-9 2-9 0-9 0-9 0-9 0-9 0-9 0-9

9. 9
 History / PSTN Signaling
Originating
CPE
Terminating
Switching
Office
Terminating
CPE
Originating
Switching
Office
Off-hook
Dial Tone
Dialed Digits
Off-hook
Off-hook (wink)
On-hook (wink)
Dialed Digits
Audible Ring Ringing
Answer Off-hook
Disconnect
Idle
1
2
4
3
5
7
6
6
8
9
10 10

10. 10
 History / NGN
Application/Management
Part
Session Part
(Call control)
Access Layer
Parlay/LDAP
SNMP
MGCP
Megaco/H.248
…
Application Servers
Management Servers
Softswitches
…
Media Gateways
API - Application Programming Interface

11. 11
 History / NGN
IP network
Softswitch
Application ServerNetwork Management
Server
Media Gateway
Multiservice Access
PSTN, GSM, ATM, ...
Services
Transport

12. 12
 History / NGN
SG
Media
Gateway
Network
Manager
IB AAA
SS7
Switch STP
PSTN/ISDN
SS7
Switch STP
PSTN/ISDN
Media
Gateway
Core IP Network (QoS)
Gatekeeper/
Proxy Server
API
(PARLAY/LDAP)
Application Server
MGCP/Megaco/H.248
SIGTRAN
SIGTRAN
Н.323/ IP Network
SS7
ISUP/MTP
SIP/SIP-T
H.323/BICC
RADIUS
ISUP
SIP
Softswitch
SG
Softswitch
MGC
SNMP

13. 13
 History – Push To Talk Systems
 Push-to-Talk (PTT) also known as press-to-transmit, is a method of having conversation
or talking on half-duplex communication lines, including two-way radio, using a
momentary button to switch from voice reception mode to transmit mode.

14. 14
 History - Cellular / Mobile Networks
 Cellular Network or Mobile Network is a communication network where the last link is
wireless. The network is distributed over land areas called cells, each served by at least
one fixed-location transceiver, known as a cell or base station.

15. 15
 History - Cellular / Mobile Networks

16. 16
 Growth of Mobile Network

17. 17
 Growth of Mobile Network

18. 18
 History
• 1G FDMA (NMT, AMPS, TACS) 80’s
- Voice (analog traffic, digital signaling)
• 2G TDMA (GSM, D-AMPS, PDC) and CDMA (IS-95) 90’s
- Voice, SMS, CS data transfer ~ 9.6 kbit/s (50 kbit/s HSCSD)
• 2.5G TDMA (GPRS) 00’s
- PS data transfer ~ 50 kbit/s
2.75G TDMA (GPRS+EDGE) 00’s
- PS data ~ 150kbit/s
• 3-3.5G WCDMA (UMTS) and CDMA 2000 00’s
- PS & CS data transfer ~ 14-42 Mbit/s (HSPA/HSPA+), Voice, SMS
• 3.9G OFDMA (LTE/SAE) 10’s
- PS Data and Voice (VoIP) ~ 100Mbit/s
• 4G IMT Advanced

19. 19
 2G/3G Overview
GSM /GPRS BSS
BTS
BSC
NodeB
RNC
PCU
UTRAN
SCP
SMS
SCE
PSTN
ISDN
Internet,
Intranet
MSC/VLR GMSC
HLR/AUC
SGSN
CG BG
GGSN
GPRS
Other PLMN
IPBB

20. 20
 2G (RAN)
 BTS (Base Station Transceiver)
BTS is a piece of equipment that facilitates wireless communication
between user equipment (UE) and a network. UEs are devices like
mobile phones (handsets), WLL phones, computers with wireless
Internet connectivity.
 BSC (Base Station Controller)
BSC is a critical mobile network component that controls one or
more base transceiver stations (BTS), also known as base stations or
cell sites. Key BSC functions include radio network management
(such as radio frequency control), BTS handover management and
call setup. It also carries transcoding of speech channels.

21. 21
 GSM Frequency Bands

22. 22
 ISM Bands

23. 23
 3G (RAN)
 NodeB
NodeB is a term used in UMTS equivalent to the BTS
(base transceiver station) description used in GSM.
 RNC (Radio Network Controller)
RNC is a governing element in the UMTS radio access
network (UTRAN) and is responsible for controlling the
NodeBs that are connected to it. The RNC carries out
radio resource management, some of the mobility
management functions and is the point where encryption
is done before user data is sent to and from the mobile.

24.  2G/3G/4G Terminology IMSI number
MCC MNC MSIN
3 digits 2/3 digits
Not more than 15 digits
IMSI (International Mobile Subscriber Identity)
NMSI
MCC：Mobile Country Code
MNC：Mobile Network Code
MSIN：Mobile Station Identification Number
NMSI：National Mobile Station Identity

25.  2G/3G/4G Terminology
 IMSI
 IMSI: International Mobile Subscriber Identity
 IMSI is a unique identifier allocated to each mobile subscriber
 Its code type is E.212
 IMSI can be saved in SIM, HLR and VLR and can be transferred through MAP and
Wireless interface.
 IMSI has almost 15 digits (0-9) such as 432129951460001

26.  2G/3G/4G Terminology
 TMSI
 TMSI: Temporary Mobile Subscriber Identity
 In order to ensure subscriber identity confidentiality, the VLR (Visiting Location
Register) and SGSN (Serving GPRS Support Node) may allocate TMSI to visiting
mobile subscribers.

27.  2G/3G/4G Terminology IMEI Number
TAC FAC spare
6 digits 2 digits
15 digits
IMEI (International Mobile Equipment Identity)
TAC：Type Approval Code
FAC：Final Assembly Code
SNR：Serial Number
spare：Standby bit
Example:490547403767335
SNR
6 digits 1 digits

28.  2G/3G/4G Terminology MSISDN number
CC NDC SN
National ( Significant ) Mobile Number
MSISDN：Mobile Station International ISDN number
CC： Country Code, China Country Code is 86
NDC：National Destination Code
SN： Subscriber Number

29.  2G/3G/4G Terminology LAI/GCI/SAI
Location Area Identity
MCC MNC LAC
Cell Global Identity
MCC MNC LAC CI
Service Area Identity
MCC MNC LAC SAC

30.  2G/3G/4G Terminology TAI/TAC
Tracking Area Identity
MCC MNC TAC

31. 31
 2G/3G CN (Core Network)
 Core Network is split into CS domain and PS domain. CS domain is based
on original GSM network. PS domain is based on original GPRS network.
 CS domain: used to provide Circuit-switched service. Network mode can
support TDM, ATM and IP. Physical entities include switching equipment
(such as MSC/VLR, GMSCs, HSS), and inter-working equipment (IWF).
 PS domain: used to provide Packet-switched service. Network mode is IP.
Physical entities include SGSN, GGSN, CG , BG etc.

32. 32
 2G/3G CN (Core Network)
 Function entity shared by CS domain and PS :
 MSC Server: Control layer, to realize MM
(Mobility Management), CM (Call Control),
MGC (Media Gateway Control).
 MGW: Bearer layer, to realize the exchange of
voice and media flow, and provide all kinds
sources, such as TC, EC, play announcement
and receive DTMF.
 SG: To realize signaling transfer from MTP (SS7
transmission layer) to SCTP/IP (SIGTRAN).

33. 33
 2G/3G CN (Core Network)
 HLR/HSS: To realize mobile subscriber
management and location information
management.
 VLR: To deal with all kinds of data
information of current mobile
subscriber.
 AUC: To store authentication
information of mobile subscriber.
 EIR: To store IMEI data of mobile
subscriber.
 SMS: Short Message Center.

34.  Scenario 1: Location Update
MS BSS MSC VLR HLR/AUC
Locating updating
request(IMSI)
Um BSSAP MAP MAP
A B D
Locating updating request
Update location area
(IMSI)
Send parameters(IMSI)
Authentication parameters
(RAND/SRES/Kc,IMSI)Authenticate
Authentication request
Authentication response Authentication response Update location
Inserte subscriber data
Subscriber data insertion ack.
cancel location
cancel location
ack.
PVLR
Update location ack.
(HLR?)
Set cyphering mode
Forward new TMSI
Update location area ack.CYPHER MODE COMMAND
CYPHER MODE COMPLETE
Location updating accepte
TMSI reallocation complete TMSI acknowledge
CLEAR COMMAND
CLEAR COMPLETE
imsi/tmsi,old lai,current
lai/gci

35.  Scenario 2: 2G Authentication
AUC HLR MSC/VLR MS
Store the authentication
key Ki of all subscribers
in HLR
SIM Card
Store authentication key
Ki, algorithms A3 and A8
Generate
authentication triplet
according to A3 and
A8 algorithms
Temporarily store
authentication
triplet, and deliver
the authentication
triplet to VLR upon
VLR’s request
Store the
authentication
triplets of all
accessed
subscribers
Access request
RAND
Ki
Algorithm
A3
Algorithm
A8
SRESMS Kc
SRESMSSRESAUC =？
Unequal:
authentication
fail
Equal:
authentication
succeeds
RAN/Kc/SRESAUC

36.  Scenario 3: GSM Basic Call Flow (1/2)
Um A B D
A Um
MSa BSSa MSC VLR HLR
BSSb MSb
channel requestRACH
SDCCH CM service request
(CKSN,IMSI/TMSI)
CM service req.)
CM service req.) Send parameters
(IMSI/TMSI)
Authentication para.
(IMSI,RAND/SRES/Kc)Authenticate
(RAND,CKSNn)
Authentication request(RAND,CKSNn)
Authentication response(SRES)
Authen. res.(SRES)
Set cyphering mode
Access req. accepted
(IMSI/MSISDN)
CM service accept
CIPHER MODE COMMAND(Kc)
CIPHER MODE COMPLETE
Setup ( MSISDN) Send info. for o/g call setup
Complete CallCall proceeding
ASSIGNMENT REQUEST
ASSIGNMENT COMPLETE
Send routing info req. (MSISDN, supplyment service info )
Provide roaming number req(IMSI)
Provide roaming number Ind
Send Routing infomation acknowledge
send info.for i/c call setup
page MS(LAI)
PAGING(LAI,IMSI)
Page responsePage response(LAI,GCI)

37.  Scenario 3: GSM Basic Call Flow (2/2)
Um A B D
A Um
MSa BSSa MSC VLR HLR
BSSb MSb
Process access req.
Send para.
(IMSI/TMSI)
Authen. para.
(IMSI,RAND/SRES/Kc)
Authenticate
(RAND,CKSNn)
Authentication request(RAND,CKSNn)
Authentication(SRES)
Authentication response(SRES)
Set cyphering mode
Access request accepted
Complete call
CIPHER MODE COMMAND(Kc)
CIPHER MODE COMPLETE
Setup （calling MSISDN）
Call confirmed
ASSIGNMENT REQUEST
ASSIGNMENT COMPLETE
Alerting
Connect
Connect acknowledge
Alerting
Connect
Connect acknowledge

38. 38
 2G/3G CN - PS Domain
 SGSN: To realize packet switching function,
signaling control function and route function of
packet service.
 GGSN: To realize inter-working with PS domain and
external data network.
SGSN GGSN(A)
MS
BSS
GPRS backbone
ISP A
ISP B
Internet/
IntranetGGSN(B)
DNS
• CG: To realize billing function of
packet service.
• BG: To realize inter-working of
two GPRS network and
guarantee the security of
network.

39. 39
 Evolution of Mobile Networks
2000/03 2001/03 2002/03 2005/12 2006/X
3GPP R99
-CN: TDM
3GPP R4
- CN: MSC
server and
MGW
3GPP R6
- IMS QoS,
Billing, FMC,
etc
3GPP R7
- IMS
enhance
3GPP R5
- CN: IMS
introduced
TISPAN R1
-- NGN/FMC, etc
TISPAN R2
-- NASS/RACS,
etc

40. 40
 R99 Architecture
GSM /GPRS BSS
BTS
BSC
NodeB
RNC
PCU
UTRAN
SCP
SMS
SCE
PSTN
ISDN
Internet,
Intranet
MSC/VLR GMSC
HLR/AUC
SGSN
CG BG
GGSN
GPRS
Other PLMN
IPBB

41. 41
 R4 Architecture
Control
Layer
Bearer
Layer
MSC
H.248

42.  R5 Architecture
GSM /GPRS BSS
BTS
BSC
NodeB
RNC
PCU
UTRAN
SCP
SMS
SCE
PSTN/PLMN
Internet,
Intranet
HLR/AUC/HSS
SGSN
CG BG
GGSN
GPRS
backbone
MGW MGW
VMSC Server GMSC Server
IP/ATM BackboneCS domain
PS
domain
Iu-CS
Iu-PS
IP backbone
MRFP
IMS domain
MGW
P-CSCF S-CSCF
MGCF
MRFC
IPBB

43.  EPC Introduction

44.  EPC Structure

45.  Functions of EPC
 MME: Mobility Management Entity
 Mobility Management
 Selection of S-GW and P-GW
 Tracking Area (TA) Management
 Authentication
 Bearer Management
 NAS Signaling
 MME Selection for HO with MME Change
 SGSN Selection for HO to 2G/3G Access Network
 Lawful Interception of Signaling Traffic

46.  Functions of EPC
 NAS (Non Access Stratum)
 EPS Mobility Management
 GUTI Reallocation
 Authentication
 Security Mode Control
 Identification
 Service Request, Paging, …
 EPS Session Management
 EPS bearer procedure
 Transaction-related procedures

47.  Functions of EPC
 TA (Tracking Area Identity)

48.  Functions of EPC
 S-GW: Serving Gateway
 Functioning as the local mobility anchor point for inter e-NodeB handovers
 Mobility anchoring for inter-3GPP mobility
 Supporting inter-operator charging based on QoS and QCI
 Accounting for inter-operator charging (For GTP based S5/S8)
 Supporting Packet Routing and Transfer
 Supporting transport level packet marking for uplink and downlink data
 Performing lawful interception

49.  Functions of EPC
 P-GW: Packet Data Network (P-GW) Gateway
 IP Address Allocation for UEs
 Uplink and Downlink Rate Enforcement based on APN-AMBR
 Uplink and Downlink Gateway Control based on Traffic
 Supporting Packet Marking for uplink and downlink data based on transfer priority
 DHCPv4 (Server/Relay) and DHCPv6 (Server) Functions
 Lawful Interception

50.  Functions of EPC
 HSS: Home Subscriber Server
 Supporting Authentication and Registration for Subscribers and Downloading User Profiles to MME
 Authentication and Registration for non-3GPP subscribers and distributing user profiles to AAA.
 Provide Roaming Restriction
 Provide Barring Services
 Providing Restrictions Over Access Network Types
 Supporting Diameter-based IP Networking

51.  Functions of EPC
 PCRF: Policy and Charging Rule Function
 The PCRF is mainly used for
prescribing rules for policy and
charging control.
 The PCRF is responsible for
terminating Gx and Rx interfaces.

52.  4G/LTE Basic Scenarios Scenario 1: Attach (1/2)

53.  4G/LTE Basic Scenarios Scenario 1: Attach (2/2)

54.  4G/LTE Basic Scenarios Scenario 2: Detach

55.  4G/LTE Basic Scenarios Scenario 3: S1-Release
 eNode-B Triggered
 User Inactivity
 Repeated RRC Signaling integrity check failure
 UE generated signaling connection release
 Unspecified Failure
 O&M Intervention
 MME Triggered
 Authentication Failure
 Detach
 Disallowed CSG Cell

56.  4G/LTE Basic Scenarios Scenario 4: Service Request (UE Triggered)

57.  4G/LTE Basic Scenarios Scenario 4: Service Request (Network Triggered)

58. 58
Thanks ForYour Attention!
Hamid Reza Bolhasani
bolhasani@gmail.com