3GPP generations

1G

Global system for mobile communications (GSM)
analog
voice only
800/900 MHz, FDMA

2G

General packet radio service (GPRS)
- serving GPRS support node (SGSN)
  - tracks UE location
  - access control
  - logical link management
  - billing
- gateway GPRS support node (GGSN)
  - anchor point for mobility
  - translation between mobile and packet network
  - IP address assignment
  - default gateway for UE
  - QoS
- GPRS tunneling protocol
  - GTP-U: user data
  - GTP-C: control
voice + data: e-mail, paging, caller ID
circuit switched
1800 MHz, TDMA, 128 kbps
144 dB link budget
IPv4 only

2.5G

enhanced data rate for GSM evolution (EDGE)
faster speed
always-on for data
packet switched
IPv4 only

3G

packet switched
2 GHz, CDMA, 2 Mbps
base station is authenticated by clients
IPv4 only

Universal mobile telecommunications system (UTMS)

Evolution data only (EV-DO)

High-speed downlink packet acces (HSDPA)

3.5G
faster speed
OFDMA

4G

IP-based, native IPv6
OFDMA, 1 Gbps
control plane and user plane separation (CUPS)
- inline CUPS
  - VPP-based packet processing
- colocated
  - SGW and PGW are split into control (S/PWG-C) and user (S/PGW-U) planes
  - components in the same DC
- VNF-based
- NFV management and orchestration (MANO)

5G

usecases
- enhanced mobile broadband (eMBB)
  - 5G frequency bands ≡ extra capacity
  - 100 Mbps user data rate
  - 10 Tbps per km²
- massive machine-type communication (mMTC)
  - focus on low-power IoT
  - high connection density
- ultra-reliable low-latency communication (URLLC):
  - 1-25 µs latency
  - high speed: up to 500 km/h
5GC: 5G core network
- network slicing
- native CUPS, components in different DCs
- virtualization
- multi-Gbps support
- ultra-low latency
5G NR: 5G New Radio
- OFDM
- wider frequency range: 450 MHz – 100 GHz
- carrier: 24-52 GHz
- beamforming
5G non-standalone (NSA):
- E-UTRA-NR Dual Connectivity (EN-DC): 5G NR with LTE EPC
5G standalone (SA)

Slice

indicated by single network slice selection assistance information (S-NSSAI)
type (1 byte)
- 1 ≡ eMBB
- 2 ≡ URLLC
- 3 ≡ mMTC
differentiator (3 bytes): optional
can be configured by network or selected by UE from allowed range
UE stores NSSAI per public land mobile network (PLMN)
- previously stored values are overriden by new values

Time

sync
- global navigation satellite system (GNSS)
- SyncE: frequency sync
- PTP: phase sync
IEEE 802.1CM: time-sensitive networking
- profile A: strict priority queuing
- profile B: frame preemption
time skew
- between base stations: < 3 µs
- between backhaul nodes: < 1.5 µs

Components

User equipment (UE)

smart phone, computer, router
mobility management
session management
call control
radio monitoring + feedback to the network
identity management
bearer ≡ tunnel, connecting UE to PDN
indicates dual-carrier capability via a flag during registration

NodeB

components:
- antenna
  - can be integrated into RRH
- remote radio head (RRH): convert between optical and RF signals
  - amplification
  - filtering
- baseband unit (BBU)
  - proprietary platforms
eNodeB: LTE
gNodeB: 5G
fronthaul network carries digitized radio between RU and REC
- CPRI (common public radio interface)
- eCPRI: packet-based
- radio over Ethernet (RoE)

Splits

low level split (LLS): radio unit (RU) and BBU are some distance apart (10-20 km)
high level split (HLS): splits vBBU into distributed (DU) and centralized (CU) units with midhaul between them
option 2: 5GC + gNodeB
- HLS
- latency requirement: < 5 ms
  - DU: real-time function
    - can support multiple RRH
    - radio link control (RLC)
      - rate adaptation
    - medium access control (MAC)
      - scheduling: 1 ms airtime slot in LTE
    - physical layer control (PHY)
      - channel coding
      - modulation
  - CU: not real-time function
    - can support multiple DU
    - radio resource control
    - service delivery adaptation protocol (SDAP): NR only
    - packet data convergence protocol (PDCP)
    - header compression
    - over-the-air encryption
option 3:
- HLS
- eNodeB is primary
- vanilla: gNodeB connects to eNodeB via X2 interface, split on eNodeB
- option 3a: separate S1-U connection between gNodeB and packet core, separate paths for 2 bearers (4G and 5G)
- option 3x: user traffic bearer is split on gNodeB (UE → gNodeB → core and UE → eNodeB → gNodeB → core)
option 4: 5GC + gNodeB as primary
- HLS
option 5: 5GC + ng-eNodeB
- HLS
option 7: 5GC + ng-eNodeNB as primary
- LLS
- bit rate depends on user traffic
- vBBU
- latency requirement: < 150 µs
- less installation space and on-site power required
option 8
- LLS
- LTE centralized RAN
- TDM-based: constant bit rate (even in user traffic absense)
- latency requirement: < 100 µs

Mobile packet core (EPC) in LTE

Mobility management entity (MME)

roaming
session management
location management
idle-mode UE tracking
bearer activation/deactivation
gateway selection:
- hardcoded, APN DNS-based
- assigns UE to SGW
user authentication
- signalling termination point
- security keys management

Serving gateway (SGW)

termination point towards E-UTRAN
routing packets for UE: single SGW for UE at any point of time
mobility anchor during roaming
lawful interception
paging signal: wake up UE in idle state when packet arrives
QoS marking
traffic transfer from 2G/3G and PGW

Packet data network gateway (PGW)

termination point towards packet data network
IP network anchor point
- IP allocation to UE
- local IP pool
policy enforcement per-user
service-level charging and enforcement
- access control
- policing
lawful interception
DSCP marking
anchor point between 3GPP and non-3GPP: WiMAX, Wi-Fi
- can be more than one PGW per UE, if UE accesses multiple networks
NAT
DNS snooping
firewall

Policy and charging rules function (FCRF)

can reside within PGW
session-based pricing, speed tiers
data usage notifications

Home subscriber server (HSS)

Home Location Register (HLR) + Authentication Center (AuC)
central database for user- and subscription-related information
- users
- QoS
- APN bearer type
- authC and authZ
- international mobile subscriber identity (IMSI)
- mobile subscriber ISDN number (MSISDN)

Serving GPRS support node (SGSN)

Gateway GPRS support node (GGSN)

Interfaces

S1-U: dataplane connection between NodeB and SGW
S1-MME: control plane connection between NodeB and MME
S5: control and data plane between SGW and PGW
- different ports at L4
S6a: control plane between HSS and MME
S8: control and data plane between SGW and PGW
- different ports at L4
- PGW is outside home mobile network
- roaming access to remote APN
S11: control plane between MME and SGW
SGi: dataplane connection between PGW and packet network

Mobile packet core (5GC) in 5G

User plane function (UPF)

S/PGW in 5G
Cisco UPF
- vector packet processing (VPP)
- ultra services proxy (CUSP)
- ultra traffic optimization (CUTO)
different UP per PDN per UE

Access and mobility function (AMF)

part of MME in 5G
registration management
- if AMF is not known, default AMF determines target AMF
- AMF sends request to refresh UE identity if
  - UE authC fails
  - UE GUTI is unknown
- UE establishes PDU session only when necessary
- registration update timer (T3512): periodic UE identity refresh
access control
roaming
discovery: NRF, AUSF, UDM, PCF, SMF
requests slice info from NSSF

Session management function (SMF)

part of MME in 5G
IP address allocation to UE (DHCP)
ARP proxy
lawful intercept
selects UPF for UE based on service parameters, received via DNS NAPTR
- x-3gpp-sgw:x-s5-gtp+nc-nr
- x-3gpp-pgw:x-s5-gtp+nc-nr
- x-3gpp-pgw:x-gn+nc-nr
- x-3gpp-pgw:x-gp+nc-nr

Policy control function (PCF)

PCRF evolution, 5G

Authentication server function (AUSF)

performs authC
fetches authC vector from UDM

Unified data management (UDM)

authentication and subscription information store

Unified data repository (UDR)

subscriber and policy information store

Application function (AF)

Binding support function (BSF)

Charging support function (CHF)

Equipment identity register (EIR)

Network exposure function (NEF)

Network repository function (NRF)

stores info about all network functions and services
DNS proxy

Network slice selection function (NSSF)

provides AMF with slices available to UE based on Registration Request from UE

Network data analytics function (NWDAF)

SMS function (SMSF)

Security edge protection function (SEPP)

IP multimedia system (IMS)

multimedia over IP
- VoLTE, VoNR
- video
- text

WiMAX

worldwide interoperability for microwave access

Multiplexing

Code division multiple access (CDMA)

data + orthogonal code = signal
several clients can use time and frequency at the same time

Frequency division duplexing (FDD)

equal constant BW for uplink and downlink
suitable for voice
wide area without isolated hotspots
beamforming is rare: every antenna and frequency has its own weight

Time division duplexing (TDD)

adjustable BW, uplink ≠ downlink
suitable for packet data
sensitive to interference ⇒ for isolated hotspots
uses beamforming

Intersymbol interference (ISI)

when new signal is received on short path while old signal – on long path
solution
- forward error correction (FEC): add redundant information
- automatic repeat request (ARQ): ack/nack
- hybrid ARQ: FEC + ARQ
- increase symbol duration (OFDMA)

Multiple antennae

diversity
- receive diversity: several antennae on receiver, less errors in resulting received signal
- transmit diversity
  - closed loop: tuning using feedback
  - open loop: Alamouti technique
    - used on high speeds, because feedback from closed loop becomes irrelevant (arrives back too late)
- implemented when there is direct visibility
spatial mutliplexing
- implemented when no direct visibility (H are independent)
beamforming
- better at small distance between antennae (≈ λ)
- TDD is common, in FDD each frequency has own separate antennae weights

Alamouti technique

Spatial multiplexing

MIMO

single user (SU): only 1 user at a time
multi-user (MU): several users at a time