1Chapter 10UMTS Introduction to Universal Mobile
Telecommunications System23GQuality of ServiceQoS3G GSM Universal
Mobile Telecommunications SystemUMTS3UMTS UMTS 4Section 10.1UMTS
UMTS Overview 5UMTS UMTSUniversal Mobile Telecommunications
System3GPP (the 3rdGeneration Partner ship Project)3GPP
http://www.3gpp.org1988 199219951997 19981999RACE I Basic
studiesRACE II ATDMA CODITACTS/FRAMESFMA1: WTDMA FMA2:WCDMAETSI
Concept groupsETSI Decision: WCDMA for FDD
operation3GPPRelease-3Release-99Release-4Release-5Release-6Release-76UMTS
2MbpsQoSmutual authentication128 10-6multi-access service3G-324M
video call video telephony7UMTS Wideband Code Division Multiple
AccessWCDMAUMTSFDDTDD384kbps128kbpsATM8QoS InteractiveBest
effort/request/response3G Java Game/ MP3910-1GSM/GPRS/UMTS
2G/2.5GGSM / GPRSBearer Services- Voice- CS Data (CSD)9.6 kbps- PS
Data (PSD) 115 kbps CS2 - New coding scheme- packet switchedcore
network3GUMTS Rel-3Bearer Services- Voice- CSD64 kbps- PSD2 Mbps-
UTRA FDD/TDD 3.84 Mcps- ATM-based UTRAN- Alternative
IP-basedsignalling bearerUMTS Rel-4Bearer Services- Voice- CSD64
kbps- PSD2 Mbps- TD-SCDMA 1.28 Mcps- IP telephony MSC server Media
GatewayUMTS Rel-5Bearer Services- Voice- CSD64 kbps- PSD14.4 Mbps-
ALL IP core network- IP multimediasubsystem- IP RAN- High Speed
DownlinkPacket AccessHSDPAALL IP Network1010.1 Release-99 Release-4
Release-4 Release-99 Release-99 10.1.1 Release-4 10.1.2 10.1.2
Release-4 Release-99 Release-5 HSDPA 11Release-5 All-IP 12
Release-6 Release-7 9 11GSM UMTS GSM UMTSMobile Station (MS) User
Equipment (UE)Base Station Transceiver (BST)Node BBase Station
Controller (BSC)Radio Network Controller (RNC)Base Station
Subsystem (BSS)Radio Network Subsystem (RNS)Subscriber Identity
Module (SIM)Universal Subscriber Identity Module (USIM)12Section
10.1.1R99 The Architecture of Mobile Communication Network in
R9913Release-99Release-3UMTS R99 10-2 User EquipmentUE UMTS UMTS
Terrestrial Radio Access NetworkUTRAN Core NetworkCN service
network1410-2UMTS Node BNode BNode BNode BRNCRNCIubIurUTRAN(UMTS
Terrestrial RAN)USIMMEUECu3G MSC/VLR3G SGSNGMSCGGSNHLRPLMN,PSTN,
ISDN,...InternetCore NetworkUu IuIu-PSGn GiGrGcDDSystem
Architecture of 3GPP Release 99GsIu-PSIu-CSIu-CSRel99 radio
networkcore networkGPRS SGSNradio(RMM, handoff)RNC Iur soft
handoffExternal Network15User EquipmentUEUE Mobile EquipmentME UMTS
UMTS Subscriber Identity ModuleUSIMME USIM Cu UE Uu UTRAN 16UTRAN
(1/2)UE Radio Network SubsystemRNSRNS Radio Network ControllerRNC
Node BNode BNode BRNCIubRNSIuCSIuPSUu17UTRAN (2/2)Node B //softer
handoverpower controlRNCRadio Resource ManagementRRMRNCadmission
controlhandover controlload control10.418UTRAM RNC Iub Node BRNC
Iur RNCRNC Iu CS domain Iu-CS PS domain Iu-PSR99 UTRAN ATM19Core
NetworkCNPSTN/ISDN Internet Circuit Switched domainCS domainGSM
Packet Switched domainPS domainGPRS 20CS Domain MSC/VLRHLR GMSC R99
CS domain MAPSGSN HLR Gr SGSN MSC Gs MAP GGSN HLR Gc MAP 21PS
DomainSGSN GGSN SGSN GGSN Gn GTP IP GTPGPRS Tunneling ProtocolUMTS
Access Point NameAPNIP transparentGGSN IP non-transparentGGSN IP
DHCP RADIUS IP UE22UMTS (1/2)UMTS Control planeC-plane10-3 10-5
UMTS PS Domain User planeU-plane10-4 10-6 UMTS PS Domain 23UMTS
(2/2) Non-Access StratumNASCMMMGMM SM L3Layer 3 signaling Access
StratumASATMUuradio interface protocolIuASUTRAN2410-3UMTS
UTRANUECNNon-Access StratumAccess
stratumCMMMGMMSMRadioInterfaceProtocolsIuProtocolsCMMMGMMSMRadioInterfaceProtocolsIuProtocolsRadioUuIu2510-5UMTS
PS DomainRelayGMM / SM/ SMSRRCRLCMACL1GMM / SM/
SMSRANAPSCCPSignallingBearerATML1ATMAAL5MACSignallingBearerRLC
SCCPRRC RANAPAAL5UE RNS 3G SGSNUu Iu-PS26UMTSGPRS(a) Control plane
for UMTS Mobility ManagementSGSNradio, RRCRANAPUERNC, RNCSGSN(b)
Control Plane for GPRS Mobility
ManagementLLCMSSGSNRLCGMMLLCLowerlayerprotocolsBSSGPLowerlayerprotocolsGMMLLCLowerlayerprotocolsLowerlayerprotocolsRLC
BSSGPRelayMSUmSGSN BSSGbRRCGMMRLCLowerlayerprotocolsRANAPAAL
5ATMGMMSCCP RLC SCCPAAL5ATMLowerlayerprotocolsRRC
RANAPRelayMSUnSGSNRNSIuPS2710-4UMTS UTRAN UE CNNon-Access
StratumAccess
stratumRadioInterfaceProtocolsIuProtocolsRadioInterfaceProtocolsIuProtocolsRadioUuIuUuAS2810-6UMTS
PS DomainRelayApplicationE.g., IPPPPPDCPRLCL1 L1 ATMAAL5RLC
UDP/IPPDCP GTP-UUEUTRAN 3G GGSNUu Gn3G SGSNMAC MACRelayATM
L1L2UDP/IP UDP/IPGTP-U GTP-UAAL5E.g., IPPPPGTP-UUDP/IPL1L2Gi
Iu-PS29UMTSGPRS(a) User plane for UMTSUTRANIP over ATM,
GTP-UIPUEUTRANPDCPIP(b) User Plane for GPRSUESGSN,
LLCSNDCPIPL1RLCPDCPMACE.g.,
IP,PPPApplicationL1RLCPDCPMACATMUDP/IPGTP-UAAL5RelayL1UDP/IPL2GTP-UE.g.,
IP,PPP3G-SGSN UTRAN MSIu-PS Uu Gn
Gi3G-GGSNATMUDP/IPGTP-UAAL5L1UDP/IPGTP-UL2RelayRelayNetworkServiceGTP-UApplicationIPSNDCPLLCRLCMACGSM
RFSNDCPLLCBSSGPL1bisRLCMACGSM
RFBSSGPL1bisRelayL2L1IPL2L1IPGTP-UIPUm Gb Gn GiMS BSS SGSN
GGSNNetworkServiceUDP UDP30Section 10.1.2Rel-4The Architecture of
Mobile Communication Network in Rel-431Release-4Rel-3 UTRAN LCS TDD
TD-SCDMA CS domain IP 32Rel-4 (1/2)Rel-4 Rel-5 10-7Rel-4 bearer
independentIP telephonyMSC MSCMobile Switching Center ServerMSC
Servercall control Media GatewayMGWMSC Server GMSC GMSC MGW33Rel-4
(2/2)GERANGSM/EDGE RANEDGE BSS Iu 3G MSC12 UMTS All-IP
10-73410-7Rel-4 Rel-5 Application &ServiceLegacy
mobilesignaling networkMultimedia
IPNetworksPSTN/Legacy/ExternalApplication &ServiceAlternative
AccessNetworkSMS-GMSCSMS-IWMSCSM-SCSCPHSSEIRHSSTE MTBSS /GERANTE MT
UTRANR-SGWCSCFMRFCSCFMGCF T-SGWMGWR-SGWSGSN GGSNMGWMSG server GMSC
server T-SGW Signaling Signaling and Data Transfer InterfaceIu=
IucsRTP,AAL2Iu= IuRANAPRRUmUuIuIuGbIuIuIuACAPCAPMcD
CMhNcNbMcGiMcGiGiGiMrMgMmMwMsMhCxGcGrGfCAP35Section 10.2UMTS UMTS
Radio Access Technology 36UMTS (1/2)UMTS FDD TDD ITU-T UMTS 10-8
FDD 1920-1980MHz2110-2170MHz FDD /5MHz/190MHz TDD 1900-1920MHz
2010-2025MHz WCDMA 2100 37UMTS (2/2)1850-1910MHz 1930-1990MHz WCDMA
1900 10-3 UMTS FDD TDD 3810-8IMT2000 1850 1900 1950 2000 2050 2100
2150 2200 22501850 1900 1950 2000 2050 2100 2150 2200
2250MSSMSSPCSMSSMSSMSSMSSMSSMSSMSSMSSMSSMSSTDDTDDIMT 2000
ITUTaiwanR.O.C.EuropeChinaJapanUSAGSM1800GSM
1800GSM1800UMTSFDD-uplinkDECT TDDUMTSFDD-uplinkIMT 2000PHS IMT
2000IMT 2000UMTSFDD-downlinkUMTSFDD-downlinkIMT 2000IMT
2000ReserveMSSMobileSatellite ServicesA D B EF C A D B EF
C201018851805 18801920 1975 2010202520252025WLLWLL1980191818951990
2160217021102110217021653910-3 UMTS FDDTDD(1/2) UTRA FDD UTRA TDD
DS-CDMA TD-CDMA FDD TDD Asynchronous operation 5MHz 3.84 Mcps 15
slots/frame 10 msIQ/code multiplexing BPSKQPSKQPSK 4512
1248164010-3 UMTS FDDTDD(2/2) UTRA FDD UTRA TDDspreading
factormulti-codespreading factormulti-codemulti-slot Coherentbased
on pilot symbol Coherentbased on midamble Fast closed loop1500
Hzopen loop100200Hzclosed loop800 Hz Soft handover Hard handover
Hard handover Hard handoverDCADynamic Channel AllocationDCADynamic
Channel Allocation41Section 10.3Radio Interface Protocol42(1/3)UMTS
UE RNC radio link physical layer data link layer network
layer43(2/3) Media Access ControlMAC Radio Link ControlRLC
Broadcast and Multicast ControlBMC Packet Data Convergence
ProtocolPDCPBMC PDCP 44(3/3) Radio Resource ControlRRC RRC
RLCMACPDCP BMC MACRLCPDCPBMC MACRLCRRC
10-510-645L3controlcontrolcontrolcontrolLogicalChannelsTransportChannelsC-plane
signallingU-plane informationPHYL2/MACL1RLCDCNtGCL2/RLC
MACRLCRLCRLCRLCRLCRLCRLCDuplication avoidanceUuS
boundaryBMCL2/BMCcontrolPDCPPDCP L2/PDCPDCNtGCRadioBearersRRCRRC,
UE, RLC, MAC,IP, 46Section 10.3.6Radio Resource ControlRRC47RRC
MACRLCPDCPBMC MAC RRC10.4UE Mobility ManagementMM48PS Domain
(1/2)UMTS GPRS Routing AreaRARA URAUTRAN Registration
AreaUELARARAURAURAURAURAURAURAURARAURAcellcellcellcellcell (for
CS/PS domain)URA: UTRAN RA (for PS domain)RA: register area (for PS
domain)LA: location area (for CS domain)bigsmall49PS Domain (2/2)UE
UTRAN UE cell URA MSC/VLR SGSN UTRANGSM GPRSUMTSGPRSUMTSUMTSCell no
no no yes no yesURA - - no - no yesRA - no no yes yes noLA yes yes
yes no no no5010-15GSM/GPRS/UMTSEstablish RRCConnectionRelease
RRCConnection UTRA RRC Connected ModeUTRA:
Inter-RATHandoverGSM:HandoverEstablish RRCConnectionRelease
RRCConnectionURA_PCHCELL_PCHGSMConnectedModeEstablish
RRConnectionRelease RRConnectionIdle ModeCamping on a UTRAN cell
Camping on a GSM / GPRS cellGPRS Packet Idle
ModeGPRSPacketTransferModeInitiation oftemporaryblock flowRelease
oftemporaryblock flowCell reselectionCELL_DCH out of service in
serviceCELL_FACH out of service out of service in service
servicein51(1/2)10-15 GSM/GPRS/UMTS UE GSM GPRS UE GSM Radio
Resource connectionRR connectionidle modeGSMGSM connected mode UE
GPRS radio blockGPRSGPRS packet transfer mode52UE UTRAN RRC RRC
connectionUTRA RRC connected mode CELL_DCHCELL_FACHCELL_PCH URA_PCH
CS domain CELL_DCH UE UE 53- CELL_DCH UE DCH CS domainPS domain DCH
UTRAN DCH UE FACH PCH CELL_FACH CELL_PCH DCHCELL_DCH UE 54-
CELL_FACH UE FACH RACH PS FACH RACH UE CELL_FACH UTRAN UE PCH
CELL_PCHUE 55 CELL_PCH UEPCH UE UE Cell_PCH UTRAN UE URA_PCH
UTRAN56 URA_PCH UE PCH UE URA URA57Section 10.5Data Service in
Packet Switched Domain58UMTS GMMUMTS PS domain GPRS Mobility
ManagementGMMUE GPRS RA SGSN UE RA SGSN MM context PDP context MM
contextPDP context59GMM (1/2)UMTS PS domainGMM PS domainPS attach
procedures PS GPRS detach proceduresPS location management
procedure service request procedureUMTS 60GMM (2/2)
UMTSGPRSUMTS-GPRS intersystem-change procedureGSM/GPRS/UMTS GPRS
UMTS IP security procedureauthenticationP-TMSI reallocation P-TMSI
signature ciphering10-661Section 10.5.1Mobility Management in
Packet Switched Domain62PS DomainUE PS domain PS SGSN SGSN HLR SGSN
MM contextPS/CS Attach PS domain CS domain 6310-16PS/CS Attach
(1/2) 6d. Insert Subscriber Data6c. Cancel Location Ack6b. Cancel
Location 3. Identity Response 2.Identification
Response2.Identification Request1. Attach Request 5. IMEI Check 3.
Identity Request 4. Authentication 6a. Update Location 6f. Update
Location Ack6e. Insert Subscriber Data AckUE UTRAN New SGSN Old
SGSN GGSN HLR EIROldMSC/VLRNewMSC/VLRSGSNIMSI MM context UESGSN,
UEIMSIPS domainlocation update6410-16PS/CS Attach (2/2)7d. Cancel
Location Ack7c. Cancel Location7b. Update Location 7g. Update
Location Ack 7e. Insert Subscriber Data 7f. Insert Subscriber Data
Ack 7a. Location Update Request 7h. Location Update AcceptUE UTRAN
New SGSN Old SGSN GGSN HLR EIROldMSC/VLRNewMSC/VLR 9. Attach
Complete8. Attach Accept 10. TMSI Reallocation CompleteCS
domainlocation updateUE attachVLRTMSIUEGPRS AttachPS domain PDP
context Activation Procedure IPPS domainGMM65(1/2) RARA update
procedure RALARALACombined RA/LA update procedureRA update
procedure normal periodicUESGSN66(2/2)SGSN RA update procedure
SGSNRAintra-SGSN RA update procedureSGSN UE GGSN HLRRA update
SGSNRAinter-SGSN RA update procedureSGSN SGSN MM context PDP
contextsRNC SGSN SGSN6710-17SGSN RA (1/2) 3. SGSN Context Response
4. Security Functions 2. SGSN Context Request1. Routeing Area
Update RequestUE Old SRNS
GGSNOld3G-SGSNNew3G-SGSNHLRNewMSC/VLROldMSC/VLR 5. SGSN Context Ack
9. Update PDP Context Response 9. Update PDP Context Request 2a.
SRNS Context Request 2a. SRNS ContextResponse6. SRNS Data Forward
Command7. Forward Packets8. Forward Packetsnew SRNSSGSNIMSIMM
contextUEUE SGSNSRNC PCP context SRNCSGSNGGSNPDP contextSGSN HLR
SGSN PS domain 6810-17SGSN RA (2/2)UE Old SRNS
GGSNOld3G-SGSNNew3G-SGSNHLRNewMSC/VLROldMSC/VLR 11. Cancel Location
11. Cancel Location Ack10. Update Location 15b. Cancel
LocationCancel Location Ack 15d. Insert Subscriber Data 19. TMSI
Reallocation Complete 15f. Update Location Ack 16. Location Update
Accept18. Routeing Area Update Complete 17. Routeing Area Update
Accept 13. Update Location Ack 15a. Update Location14. Location
Update Request 12. Insert Subscriber Data 12. Insert Subscriber
Data Ack 15e. Insert Subscriber Data Ack 11a. Iu Release Command
11a. Iu Release Completenew SRNS 15c.PS domainlocation updateCS
domainlocation updateUE RA updateVLRTMSI69Section 10.5.2Session
Management in Packet Switched Domain70 (1/2)PS domain Session
ManagementSMIP IP PS domain PS SGSNGGSN PS 71 (2/2)SGSN GGSN PDP
context PDP context PDP PDP PDP PDP PDP APNAccess Point NameQoS PDU
PDCP-SNDPDCP-SNU PDP context activation10-18 PDP context
modification PDP context deactivation Secondary PDP context
activation10-197210-18PDP Context Activation 3G-GGSN5. Activate PDP
Context Accept2. Create PDP Context Response2. Create PDP Context
Request 1. Activate PDP Context Request3G-SGSNUTRAN UE3 Radio
Access Bearer Setup4 . Update PDP Context Reponse4 . Update PDP
Context Request7310-19Secondary PDP ContexActivation 3G-GGSN5.
Activate PDP Context Accept2. Create PDP Context Response2. Create
PDP Context Request 1. Activate Secondary PDP Context
Request3G-SGSNUTRAN UE3 Radio Access Bearer Setup4 . Update PDP
Context Reponse4 . Update PDP Context RequestSecondary PDP context
IPAPN QoS PDP context74Section 10.5.3SRNS Inter-SGSN SRNC
Relocation on Packet Swtiched Domain75RNC1 SGSN1RNC2 SGSN2 GGSN
SGSN1RNC1RNC2Node B RNCNode BNode BNode BNode
BSRNCDRNCIubIurIuUERNC SRNCServing RNC DRNCDrift RNCSGSN1 RNC1RNC2
SGSN2GGSN76RNC Controlling RNC (CRNC)Serving RNC (SRNC)Drift RNC
(DRNC)Node BNode BSRNCIubIuUENode BNode BNode BNode
BSRNCDRNCIubIurIuUENode BNode BNode BNode BRNCSRNCIubIurIuUE(c)Node
BNode BNode BNode BSRNCDRNCIubIurIuUE(d) (b)handoverSRNC CRNC Node
B DRNC //(a)77SRNC GGSNSGSN2RNC2Node BUE 10-20UE RNS RNC1 SRNS RNC2
SRNC 10-217810-20SRNS
GGSNSGSN2LA1,RA1UELA2,RA2SGSN1RNC1LA1,RA1UELA2,RA2(a) (b)SGSN1RNC1
RNC2 RNC2SGSN2GGSNaSRNS bSRNS(1) packet core network link (2) RNC1
(3) SRNC packet RNC (4) MS RNC2 SRNC. (5) PDP context (6) RNC1
link.7910-21SRNSRNC2 RNC1 SGSN1 SGSN2 GGSN2. Forward Relocation
Request3. Relocation Request1. Relocation Required5. Relocation
Command4. Forward Relocation Response3. Relocation Request
Acknowledge7. Relocation DetectUE10. Relocation Complete11. Forward
Relocation Complete8.UTRAN Mobility Information8. UTRAN Mobility
Information Confirm9. Update PDP Context Request12. Iu Release
Command12. Iu Release Complete6. Relocation CommitForwarding of
data9. Update PDP Context Response11. Forward Relocation Complete
Ack.13. Routing Area Update80Section 10.6Security Mechanism81GSM
i.e.UEBTSAbisintegrity protection82UMTS (1/2) UE RNC UMTS UIAUMTS
Integrity Algorithmf9 83UMTS (2/2) UMTSUEAUMTS Encryption
Algorithmf8 UE RNCNode B RNC 84AuC Quintet AVAV=(AUTN, RAND, XRES,
CK, IK) AUTN = (SQN AK) || AMF || MACAK = f5K(RAND)MAC = f1K(SQN ||
RAND || AMF) XRES = f2K(RAND) CK = f3K(RAND) IK =
f4K(RAND)AuCUEUEAuC85Quintet K: secrete key (in USIM & AuC)
AMF: Authentication and Key ManagementAuC RAND: 128-bit random
number SQN: : 48-bit sequence number 8610-22AuC Generate
SQNGenerate RANDf1 f2 f3 f4 f5AUTN := SQN AK || AMF || MACAV :=
RAND || XRES || CK || IK || AUTNRANDAMFMAC XRES CK IK
AKKSQN8710-23USIM K SQN RAND f1f2f3f4 f5 XMACRESCKIK AK SQN AKAMF
MAC AUTN MAC = XMAC SQN USINXMACMACVLR/SGSNRANDAUTHUEExpected
MACXRESUEXRES, IK, CK. UEXRES.8810-24UMTSUE RNC VLR/SGSN
HLR/AuCStartIntegrityStartIntegrityStartCiphering/DecipheringStartCiphering/Deciphering1.Initial
L3 message2a. Send Authentication info. req2b. Send Authentication
info. Ack(array[AUTN,XRES,RAND,CK,IK])3c. Authentication Failure
Report3e. Authentication Failure Report3a. Authentication Request
(AUTN,RAND)3b. Authentication Failure (AUTN error)3b.
Authentication Response(XRES)4a. Security mode command
(UIAs,IK,UEAs,CK,etc.)4a. Security mode command
(CN,domain,UIA,.)5a. Security mode complete5a. Security mode
completeL3UE UEVLR/SGSMUTRANRNCUE.. . 89Section
10.7Summary90SummaryIP3G UMTS R99QoSUMTSUMTSPS3G3G91Homework
