3G Wireless Network Architecture
UMTS vs. CDMA2000
Benjamin Ip
ELEN 6951
Wireless and Mobile Networking II
Columbia University
the success of GSM, and on the GSM
1 Abstract
operators existing investment in
Universal Mobile Telecommunications
infrastructure. The first stage of service
Service (UMTS) and CDMA2000 have
and network evolution is from today s
emerged as two of the full-fleged 3G
GSM systems, through the
wireless standards to support both the
implementation of GPRS, to commercial
radio and network functions based on the
UMTS networks (see Figure 1). The
IMT-2000 framework. This paper
UMTS core network can continue to use
surveys the two architectures in terms of
the current 2G network structure to
their radio access and core networks
process voice and packet data. The
technologies.
major introduction of UMTS are a new
air interface1 operating at around 2GHz,
and a packet-based network architecture
2 Overview
which supports both voice and data
UMTS and CDMA2000 standards are services.
designed to deliver wireless services
2.3.2 CDMA 2000
with better performance, greater cost-
effectiveness and significantly more
CDMA2000 is another wireless standard
content than the 2G counterpart.
designed to support 3G services as
Besides offering traditional voice
defined by the ITU and its IMT-2000
communication, 3G data capability
vision. It is evolved from the North
offers Internet and Intranet services for
American IS-95 cdma standard.
multimedia application, high-speed
CDMA2000 system uses 2.1GHz band
business transaction and telemetry.
and it maintains backward compatibility
by allowing current frequency bands of
800, 1800 and 1900 MHz to operate
seamlessly.
3 UMTS Network Architecture
A UMTS network consists of three
interacting domains (see Figure 2): User
Figure 1: Evolution of UMTS and
Equipment (UE), UMTS Terrestrial
CDMA2000
Radio Access Network (UTRAN), and
Core Network (CN). The UE is a
2.1 UMTS
mobile that communicates with UTRAN
via the air-interface. UTRAN provides
UMTS is the European member of the
the air interface access method for the
IMT2000 family of third generation
UE. CN provides switching, routing,
cellular mobile standards. The goal of
and transit for user traffic. It also stores
UMTS is to enable networks that offer
databases and provides network
true global roaming and to support a
management functions.
wide range of voice, data and
multimedia services. Data rates offered
by UMTS are: vehicular - 144 kbit/s;
pedestrian 384 kbit/s;in-building 2Mb/s.
1
UMTS uses wideband-cdma as the air-interface
The new UMTS networks will build on
access technology
From the specification and authentication algorithms, and
standardization point of view, both UE supports subscription information for
and UTRAN consist of completely new the ME. Figure 3 shows the Cu
interface that allows the USIM to
communicate with the ME .
USIM
Cu
ME
Figure 3: UE architecture
3.2 UMTS Terrestrial Radio
Access Network (UTRAN)
Figure 2: UMTS Network Architecture
A UTRAN consists of two distincts
elements: Node B and Radio Network
protocols, the design of which is based
Controller (RNC). The main functions
on the needs of the new W-CDMA radio
of the UTRAN archtecture are to:
technology. On the contrary, the
definition of CN is adopted from GSM
Support soft handoff and W-CDMA
network. This gives the system with
specific radio resource management
new radio technology a global base of
Share and reuse of voice and packet
known and rugged CN technology that
data interfaces (ie. Iu-CS and Iu-PS)
accelerates and facilitates its
Share and reuse of GSM
introduction, and enables such
infrastructure
competitive advantages as global
roaming.
Use ATM as the main transport
mechanism within UTRAN
3.1 User Equipment (UE)
A UE consists of two parts:
3.2.1 Node B
The Mobile Equipment (ME) is a
A Node B (logically corresponds to the
radio terminal used for
GSM Base Station) converts data flow
communicating over the Uu interface
between the Iub and Uu interfaces. Its
(air-interface).
main duty is to perform the physical
layer processing, e.g. modulation,
The UMTS Subscriber Identity
coding, interleaving, rate adaptation,
Module (USIM) is a smartcard that
spreading, etc.
stores subscribers identity and
encryption keys, performs
The serving RNC is the RNC that
3.2.2 Radio Network
terminates both the Iu and Iub links from
Controller (RNC)
the core network and user equipment
An RNC (logically corresponds to the
respectively. It performs L2 (MAC
GSM Base Station Controller) controls
layer) processing of data to/from the
the radio resources in its domain. RNC
radio interface. Mobility management
is the service access point for all services
functions such as power control, handoff
UTRAN providing to the Core Network.
decision, etc are also handled by the
It also terminates the Radio Resource
serving RNC. Note that one UE
Control Protocol (RRC) that defines the
connected to the UTRAN has one and
messages and procedures between UE
only one SRNC.
and UTRAN.
The drift RNC compliments the serving
A UTRAN may consist of one or more
RNC by providing diversity when the
Radio Network Sub-Systems (RNS). An
UE is in the state of inter-RNC soft
RNS is a sub-network within UTRAN
handoff (which requires two RNCs).
that consists of one RNC and one or
During the handoff, the drift RNC does
more Node B. RNCs which belongs to
not perform L2 processing; rather it
different RNS can be connected to each
routes data transparently between the Iub
other via the Iur interface.
and Iur interfaces.
The logical function of an RNC is
further divided into controlling, serving,
3.3 Core Network (CN)
and drift. The controlling RNC
UMTS CN is divided into circuit
administers the Node B for load and
switched and packet switched domains.
congestion control. It also executes
ATM is the transport mechanism to be
admission control and channel code
used in the UMTS core. In particular,
allocation for new radio links to be
ATM AAL 2 handles circuit and packet
established by the Node B.
switched signalling while AAL 5 is
designed for data delivery. The core
network consists of the following
elements inherited from the incumbent
Node B
RNC
GSM network:
Node B
3.3.1 Home Location Register
RNS
(HLR)
lub lur
An HLR is a database located in the
user s home system that stores the user s
Node B
service profile. A service profile is
RNC
created when a new user subscribes to
Node B
the system, and remained as long as the
RNS
subscription is active. It consists of
information such as user service type
Figure 4: UTRAN Architecture and roaming permission etc.
Network layer represents standard
3.3.2 Mobile Switching Center
transport technology selected for
and Vistor Location
UTRAN without any UTRAN-specific
Register (MSC/VLR)
changes.
The co-located MSC/VLR serves as both
the switch and database for the circuit
switch service. The MSC is used to
switch the circuit switch data while the
VLR function temporarily hold copies of
the visiting users service profile.
3.3.2 Gateway MSC (GMSC)
It is the gateway that connects the
UMTS PLMN2 with the external circuit
Figure 5: General UTRAN Protocol Model
switch networks. All incoming and
outgoing circuit switch connections go
through the GMSC
The vertical planes are further divided
into control, user, transport network
3.3.4 Serving GPRS Support
control, and transport network user
Node (SGSN)
planes. The control plane is used for all
UMTS-specific control signalling. It
SGSN has the similar functionality as
includes the Application Protocol
MSC/VLR except it handles packet
(RANAP in Iu, RNSAP in Iur, and
switch connections.
NBAP in Iub), and the signalling bearer
for transporting the Application Protocol
3.3.4 Gateway GPRS Support
messages. All information transmitted
Node (GGSN)
and received by the user such as a voice
GGSN has the same functionality as that call or packet data are transported via the
of GMSC except it handles the packet user plane. The Transport Network
switch connection. Control Plane is a plane that acts
between the control plane and the user
plane. It is used for all control signalling
within the transport layer. It includes the
4 UMTS Network Protocol
ALCAP protocol to set up the transport
Protocol structures in UTRAN terrestrial
bearers for the user plane. It also
interfaces are designed according to the
includes signalling bearer needed for the
same general protocol model. As shown
ALCAP. Noticed that the introduction
in Figure 5, the protocols are divided
of the transport network control plane
into horizontal layers and vertical planes.
makes it possible for the Application
Protocol in the Radio Network Control
The horizontal layer consists of two
Plane to be completely independent of
layers, the Radio Network Layer and the
the technology selected for the Data
Transport Network Layer. All UTRAN-
Bearer in the User Plane. Finally the
related issues are visible only in the
Transport Network User Plane handles
Radio Network layer, and the Transport
the data bearer and signalling bearer in
the user plane.
2
Public Land Mobile Network
Network-to-Network Interfaces (SAAL-
4.1 UTRAN-CN Interface: Iu
NNI). SAAL-NNI is further divided
The Iu interface bridges the UTRAN and
into Service Specific Co-ordination
CN. As can be seen in Figure 6 and 7,
Function (SSCF), Service Specific
the Iu can have two different instances,
Connection Oriented Protocol (SSCOP)
which are the Iu-CS for connecting
and ATM AAL-5 layers. SSCF and
UTRAN to circuit switched CN, and Iu-
SSCOP are specifically designed for
PS for connecting UTRAN to packet
signalling transport in ATM networks
switched CN. Since the two protocol
while AAL-5 is used for segmenting
structures are very similar, we focus
data into ATM cells.
mainly on Iu-CS.
The Transport Network Control Plane
4.1.1 Iu-CS
protocol stack consists of signalling
protocol for setting up AAL2
UMTS physical layer is not specified in
connections (Q.2630.1 and Q.2150.1)
the standard. It can be any off-the-shelf
running on top of the SS7 protocols
transmission technologies such as
similar to those aforementioned.
SONET, STM-1, and E1. However,
ATM is the transport mechanism to be
4.1.2 Iu-PS
used across all three planes of the
Transport Network Layer.
In the Transport Network User Plane, an
alternative IP-based signalling bearer is
specified. This signalling bearer consists
of M3UA, Simple Control
Transmmission Protocol (SCTP), and
Internet Protocol (IP). The SCTP layer
is specifically designed for signalling
transport in the Internet.
Figure 6: Iu-CS interface protocol stack
The Radio Network Layer Control Plane
protocol stack consists of RANAP
running on top of broadband SS7
protocols.
The Transport Network Layer User
Figure 7: Iu-PS interface protocol stack
Plane counterpart uses Signalling
Connection Control Part (SCCP),
In the Iu PS User Plane, multiple packet
Message Transfer Part (MTP3-b),
data flows are multiplexed onto one or
Signalling ATM Adaptation Layer for
several AAL5 Permanent Virtual
Circuits. The GPRS Tunnelling Protocol
4.2.1 Iur-1
(GTP-U) is the multiplexing layer that
Iur-1 provides the basic functionality of
provides identities for individual packet
RNSAP signalling needed for mobility
data flow. Each flow uses UDP
of users between two RNCs, excluding
connectionless transport and IP
exchange of any user data traffic. If this
addressing.
interface is not available, the only way
for a user connected to one RNC to
No protocols are required in the
utilize a cell in another RNC is to
Transport Network Control Plane since
disconnect itself from the first RNC.
establishing GTP tunnel requires only
Other services provided by Iur-1 include
identifier for the tunnel, and the IP
support of SRNC relocation, inter-RNC
addresses for both directions are already
registration area update, inter-RNC
included in the RANAP messages.
packet paging.
4.2 UTRAN-UTRAN Interface:
4.2.2 Iur-2
Iur
Iur-2 provides dedicated channel
The RNC-RNC interfaces shown in
between two RNCs to support the inter-
Figure 8 provides four distinct functions:
RNC soft handover and allow the
anchoring of the SRNC during when the
Basic Inter-RNC mobility
UE is utilizing the dedicated channels
Dedicated Channel Traffic
for as long as the user has an active
Common Channel Traffic connection to the circuit-switched
domain. To achieve this, the user plane
Global Resource Management
frame protocol for dedicated channels
For this reason, the Iur signalling
(DCH FP) is used to defines data frames
protocol Radio Network System
to carry user data and control frames to
Application Part (RNSAP) is divided
exhange measurement information.
into four different modules: Iur-1 thru
User data frames are normally routed
Iur-4
transparently between DRNC and
SRNC.
The Transport Network Control Plane
Protocol uses Q.2630.1 to set up AAL2
connections. Each dedicated channel is
conveyed over one transport connection,
except the coordinated DCH used to
obtain unequal error protection in the air
interface.
4.2.3 Iur-3
This functionality allows handling of
common and shared channel data
streams across the Iur interface. It
Figure 8: Iur interface protocol stack
requires the Common Transport Channel
module of RNSAP and the Iur Common
Transport Channel Frame Protocol In order to understand the above two
(CCH FP). The Q.2630.1 signalling protocols, the logical model of Node B
protocol of the Transport Network must be first understood. Referring to
Control Plane is needed if AAL2 Figure 10, a common signalling link
connections are used. exists between the RNC and the Node B.
There is also a set of traffic termination
4.2.4 Iur-4 point each controlled by a dedicated
signalling link. One traffic termination
Iur-4 provides signalling to support
point controls a number of mobiles
enhanced radio resource and O&M
having dedicated resources in the Node
features across the Iur interface. It is
B, and the corresponding traffic is
implemented via the global module of
conveyed through dedicated data ports.
RNSAP and does not require any User
Common data ports outside the traffic
Plane Protocol, since there is no
termination points are used to convey
transmission of user data across the Iur
RACH, FACH, and PCH traffic.
interface.
The User Plane Iub frame protocols
4.3 UTRAN-NODE B Interface:
define the structures of the frames and
Iub
the basic in-band control procedures for
every type of transport channel (ie.
The protocol stack of the RNC-Node B
RACH, FACH, and PACH). Finally,
interface is shown in Figure 9. The
Q.2630.2 signalling is used for dynamic
stack resembles the Iur interface. The
management of the AAL2 connections
main difference being that in the Radio
used in the User Plane.
Network and Transport Network Control
Planes SS7 stack is replaced by the
simpler SAAL-UNI as signalling bearer.
Figure 10: Logical Model of Node B
4.3.1 Common NBAP
The main function of Common NBAP is
the setup of the first radio link of one
Figure 9: Iub interface protocol stack
UE, and selection of the traffic
termination point. It also handles
The Iub signalling interface is divided
RACH, FACH, and PCH channels.
into two components: the common Node
B Application Part (NBAP) that defines
4.3.2 Dedicated NBAP
the signalling procedures across the
common signalling link, and the
When the RNC requests the first radio
dedicated NBAP that used in the
link for one UE via the C-NBAP, the
dedicated signalling link.
Node B assigns a traffic termination
point for handling of this UE context, visited AAA server using the IP protocol
and every subsequent signalling related within the IP network. The servers
to this mobile is exchanged with contacted by the PDSN or local AAA
dedicated NBAP procedures across the server may reside in other IP domains
dedicated control port of the given and be operated by other cellular
Traffic Termination Point. operators.
5.1 Mobile Station (MS)
5 CDMA2000 Network
The main function of the MS is to
Architecture
establish, maintain, and terminate voice
and data connections through the PDSN.
In cdma2000 architecture, mobile station
The MS establishes a connection by
(MS) gain access to a service provider
requesting the appropriate radio
network via the air interface to the Radio
resources from the RN. Once the
Network (RN). The service
connection is established, the mobile
station is responsible for maintaining
knowledge of radio resources, buffering
packets from the mobile applications
when radio resources are not in place or
are insufficient to support the flow to the
network. The mobile station optionally
supports encryption and protocols such
as Mobile IP and Simple IP.
5.2 Radio Network (RN)
The Radio Network consists of two
Figure 9: CDMA Netork Architecture
logical components: Packet Control
Function (PCF) and Radio Resources
provider network may be the user s
Control (RRC).
home access provider or, in roaming
cases, the visited access provider
The primary function of the PCF is to
network is used. Access mobility
establish, maintain, and terminate L2
management is achieved using existing
connection to the PDSN. It also
air interface procedures that include
communicates with the RRC to request
interactions with Visited Location
and manage radio resources in order to
Registers (VLR) and Home Location
relay packets to and from the mobile
Registers (HLR). Information about
station. During hard handoff to another
access service parameters are maintained
RRC, the serving PCF forwards its
in the access service profile stored in the
information to the target PCF to re-
HLR and cached in the VLR while the
establish packet data session to the
mobile station is registered in the service
PDSN. Finally PCF is responsible for
provider access network. There is an
collecting accounting information and
open interface defined between the RN
forward them to the PDSN.
and the Packet Data Serving Node
(PDSN) known as the R-P interface.
RRC supports authentication and
The PDSN interacts with the local or
authorization of the mobile station for
radio access. It also supports air
5.5 Authentication,
interface encryption to the mobile
Authorization, and
station.
Accounting (AAA)
AAA has different personalities
5.3 Packet Data Serving Node
depending on the type of network to
(PDSN)
which the AAA server is connected.
PDSN incorporates numerous functions
within one node. Routing packets to the
When an AAA server is connected to a
IP networks or directly to the HA is the
service provider network, its major role
major effort of PDSN. It assigns
is to pass authentication requests from
dynamic IP addresses and maintains PPP
the PDSN to the home IP network4, and
sessions to the mobile stations. It
authorize responses from the home IP
initiates authentication, authorization,
network to the PDSN. It also stores
and accounting to the AAA for the
accounting information for the MS and
mobile station packet data session3. In
provides user profiles and QOS
return, the PDSN receives user profile
information to the PDSN.
parameters of the mobile station from
the AAA. The user profile may contain
An AAA server connected to a home IP
differentiated services and security.
network authenticates and authorizes the
PDSN may optionally supports Foreign
mobile station based on requests from
Agent (FA) functionalities such as
the local AAA.
reverse tunneling, registration, and
dynamic home agent and home address
Finally, an AAA server provisioned in
assignment.
the broker network forwards requests
and responses between service provider
5.4 Home Agent (HA) network and the home IP network which
do not have bilateral associations.
Home Agent (HA) plays a major role in
implementing the Mobile IP protocol by
redirecting packets to the Foreign Agent
6 CDMA2000 Network
(FA), and receive and route reverse
Protocol
tunneled packets from the FA. HA
provides security by authenticating
CDMA2000 network supports two types
mobile station through Mobile IP
of protocol: Simple IP and Mobile IP.
registration. HA also maintains direct
connection with AAA in order to receive
Simple IP is deployed for service in
provisioning information for subscribers.
which the mobile user is assigned a
dynamic IP address from the local PDSN
and provided IP routing service by a
service provider network. The mobile
user can retain its IP address as long as it
is served by a RN which has
connectivity to the address assigning
3 4
An instance of continuous use of packet data The home network that provides IP based data
serviced by the user. services to the user.
PDSN. However, there is no IP address
6.1 Simple IP
mobility beyong this PDSN.
6.1.1 Point-To-Point (PPP)
Mobile IP provides IP routing service to
CDMA2000 usues PPP as the data link
a public IP network and/or secure IP
protocol. Only one PPP session is allow
routing service to predefined private IP
to be established between the MS and
networks. The mobile user is able to use
the PDSN. Figure 14 shows the network
either a static IP address or dynamically
protocols when Simple IP is deployed.
assigned IP address belonging to its
The PDSN initiates a PPP session by
home IP network HA. Regardless of
sending a LCP Configure-Request to the
whether the mobile is assigned a static or
mobile station immediately after an R-P
dynamic IP address, it should have a
session is established. There are two
static and persistent HA address to allow
circumstances in which a PPP session is
seamless handoff between RNs that are
terminated. First, if an R-P session is
connected to separate PDSNs. Figure 12
closed (either mobile or PDSN intends to
and 13 illustrates a Simple IP and
close the physical connection), the
Mobile IP network respectively.
packets buffered by the PDSN will be
discarded and an ICMP destination
unreachable packet is sent back to the
sender. Then the PPP session is
terminated. Second, if the PPP session
is idle for a certain period, the PDSN
will release the R-P session to the RN
and terminate the PPP session in order to
better utilize network resource.
Figure 12: Simple IP Network
Figure 10: Simple IP Protocol
6.1.2 Link Access Control
(LAC)
LAC runs on top of PPP. It consists of
five sub-layers: Authentication, ARQ,
Addressing, Utility, and Segmentation
and Reassembly. The Authentication
sub-layer is responsible for the initial
authentication and acts on only the
Figure 13: Mobile IP Network
Access Channel (i.e. MS to RN). The
ARQ sub-layer assured and unassured
delivery of data. Assured means protocol running above the MAC
received data are acknowledged, loss protocol.
and out-of-order data are selectively
retransmitted, and duplicate data are
6.1.4 Physical Layer
discarded. Addressing sublayer presents
The physical layer provides the air and
only on the common channels. Its
wired interface specific function such as
function is to assign and match sender
modulation/demodulation,
and receiver mobile addresses of the
coding/decoding, and power control.
following types: IMSI and ESN, ESN,
CDMA2000 physical layer consists of
IMSI, IMSI and ESN, TMSI. Utility
forward (RN to mobile) and reverse
sub-layer assembles and reasembles
(mobile to RN) radio channels that are
LAC PDU by adding message type,
derived from the 2G CDMA
encryption, radio environment report,
predecessors.
LAC padding and length, and arranging
LAC PDU with L3 PDU. Finally, SAR
6.2 Mobile IP
sublayer converts PDU to bitstream (and
vice versa), and adds message length and
Mobile IP (MIP) introduces a framework
CRC.
of procedures, messages, and message
formats that enables a mobile user to
6.1.3 Medium Access Control
change handoff from one PDSN to
another without requiring alteration of
(MAC)
its IP address, which would otherwise
MAC offers procedures for controlling
disrupt L3 and higher operations. MS,
access of data services to the physical
PDSN and HA all support Mobile IP
layer. MAC also guarantees reliable
agent advertisement, MIP extensions,
transmission over the Radio Link
reverse tunnelling, etc.
Protocol (RLP) which provides best-
effort delivery service. Besides
6.2.1 IP Security and Internet
maintaining data integrity, the MAC
Key Exchange Protocol
layer provides multiplexing of logical
(IPSec/IKE)
channels to/from physical channels
based on logical and physical mapping
IPSec provides security for transmission
table. MAC also enforced negotiated
of sensitive information over
QOS parameters by mediating conflict
unprotected networks such as the
requests from competing services and
Internet. IPSec acts at the network layer,
appropriately prioritizing access.
protecting and authenticating IP packets
Signalling Radio Burst Protocol (SRBP)
between participating IPSec devices.
is one of the MAC protocol used in
IPSec uses IKE to handle negotiation of
cdma2000 to communicate L3 signalling
protocols and algorithms based on local
function via LAC ARQ sub-layer on the
policy, and to generate the encryption
Access channel. Its responsibility is to
and authentication keys to be used by
select access mode and access
IPSec.
procedure. Another MAC control
chosen is the Radio Link Protocol (RLP)
Mobile IP authentication consists of
that comes with limited ARQ capability.
three parts:
It is designed to support reliable internet
 PDSN initiated access authentication
and authorization
HA initiated Mobile IP registration
authentication
FA and HA Security Association
For the first case, CHAP5 authentication
Figure 12: Mobile IP User Data Protocol
is used during PPP setup and Mobile IP
registration with FAC extension. For the
second case, PAP authentication with
7 Conclusion
Mobile Station key distribution are used
UMTS and CDMA2000 architecture
along with HA local authentication with
both share the same IMT-2000 vision to
statically configured key for MS-HA
provide high bandwidth wireless internet
security association. For the final case,
access. Although each approach
options is either to have no security
receives substantial influence from its
association, or have the following
predecessor, both architecture are
security keys:
designed to be IP-centric with well-
defined air and wire interfaces. The
Static configured FA-HA shared key
requirement of seamless convergence of
Dynamic distributed FA-HA shared
traditional voice transmission and
key
increasing demand of data delivery will
create new business opportunities for
IKE/IPSEC with statically shared
manufacturers, operators and providers
key
of content and applications.
IKE/IPSEC with dynamically
distributed from Home RADIUS
server
8 References
IKE/IPSEC with public certification
[1] 3GPP Technical Specification
as defined in X.509
25.401 UTRAN Overall Description
[2] 3GPP Technical Specification
25.410 UTRAN Iu Interface:
General Aspects and Principles
[3] 3GPP Technical Specification
25.420 UTRAN Iu Interface:
General Aspects and Principles
[4] 3GPP Technical Specification
25.430 UTRAN Iub Interface:
General Aspects and Principles
Figure 11: Mobile IP Control and IKE [5] 3GPP2 P.S0001-A Version 3.0.0
Protocol
Wireless IP Network Standard
5
Chanllenge Handshake Authentication Protocol
[6] 3GPP2 P.R0001 Version 1.0.0:
Wireless IP Architecture Based on
IETF Protocols
[7] 3GPP2 C.S0003-A: Medium
Access Control (MAC) Standard for
cdma2000 Spread Spectrum
Systems
[8] 3GPP2 C.S0004-0: Signaling Link
Access Control (LAC) Standard for
cdma2000 Spread Spectrum
Systems