Martin – Page 245 – WirelessMoves

An IMS Morning at FOKUS in Berlin

Some encounters are interesting, fun, inspiring and enlightening on top. The recent meeting I had with Dragos Vingarzan, Alberto Diez and Bogdan Harjoc of Fraunhofer FOKUS NGNI can certainly be counted among them. For those of you who have not come accross FOKUS before, they are a German research institute under the roof of the Fraunhofer Gesellschaft and their group is working on IMS related topics. Here's a short roundup of what I've seen and what we discussed, which might be interesting to those of you working on any kind of IMS topic:

Over the years they have put together an impressive IMS setup. Not only have they developed an extensible IMS client, an IMS core network for testing purposes comprising all elements from the various CSCF's, an HSS, presence server, etc., etc., but they have built lots of tools around it from application server toolkits to stress test utilities. Also, they've put their setup to good use and developed a number of stunning IMS application prototypes. On top, their lab and software is open for any company wishing to test their components, devices or IMS backend software in an end to end system. HP, Ericsson, Nokia, Tektronix and many others are making frequent use of it.

Want to play around with an IMS core at home and have a look at the code? No problem, they offer their open source IMS core as a Vmware package that is ready to run with a Vmware player right from your PC.

Not only did I see my first real IMS VoIP call including policy interactions between the IMS network and a core network router, for which I was kindly provided with the pcap trace for some follow up investigations, but I was also shown a stunning combined IMS VoIP/Instant Messaging/Sharing/Collaboration application and a utility called SIPNuke that can easily simulate 10.000 SIP messages a second on an off the shelf notebook to make that IMS core or application server sweat.

If you want to see it for yourself you can do so on the 6th to the 7th November during the 4th International FOKUS IMS Workshop in Berlin. Here's the link for further information and registration.

Thanks Dragos, Alberto and Bogdan, it has been an exciting visit! I'll put some more detailed thoughs on the demos I've seen in one of the next blog entries.

Breakthrough for VoIP with Wideband Codecs?

I recently wondered why we are still using narrow band speech codecs for VoIP calls between two SIP devices. There were a number of interesting answers and as always the issue is multi-faceted. However, it seems that wideband codec capable devices are now appearing on the market and SIP phones such as the Siemens Gigaset 6XX are actually advertised with superior voice quality between two 'High Definition Sound Performance' (HDSP) phones these days. Here's a link to a web page that demonstrates the difference between today's voice quality and the wideband codec used by Siemens.

While it is difficult (but not impossible) to introduce wideband codecs in fixed and wireless circuit switched networks (e.g. due to the required tandem/transcoder free operation) things are pretty much straight forward in IP based networks. Here, devices negotiate the speech codec to be used directly and no interworking-, transcoding- and digitizing functions are required beyond the user's device that would force the use of a specific speech codec.

Let's hope we don't have to go through many years of fragmentation
where each vendor implements his own set of wideband codecs,
incompatible with those of the competition. But in the end I can very well imagine that wideband
codecs are the missing piece to bring a real breakthrough for
VoIP. So far, VoIP offers little to nothing beyond circuit switched telephony to the average user. With wideband codecs, however, I am sure most people will start convincing others to switch once they've been on a wideband conversation with someone.

For true success, an important additional requirement is that VoIP providers connect their registrar servers with each other to avoid the call being routed into the circuit switched national network first before being thrown back into the VoIP domain. When this happens, there is no transparent VoIP connection in place and consequently the smallest common denomitator, today's G.711 narrow band voice codec, is used for the call.

Well, maybe it's not so straight forward after all… As always, theory and practice…

Trapeze Networks: Giving Wifi an Edge (Literally)

Recently, I came across Trapeze Networks and the name instantly rung a bell. Yes, that's the company Matthew Gast works for, author of THE book on Wifi. Trapeze does a lot beyond the MAC header with Wifi and has a couple of features in their equipment I was not aware one could do with Wifi these days. I was especially amazed by the location tracking features they have put into their equipment.

By triangulation with several access points and some other tricks, it's possible to detect the location of a client device within a few meters. This feature can be put into good use for a number of applications:

Access Restrictions: It's possible to restrict network access for a set of users to specific parts of the coverage area, i.e. one can use the same Wifi infrastructure for both employees and guests. Besides restricting guests to pure Internet access it is also possible to limit their access to meeting rooms. This is not done on a per access point limitation but by triangulation, which means permission to use the network can be granted for a location that is much smaller than the coverage area of an access point. It's also possible to limit access to the network to the building, and stop anyone from accessing the network from the parking lot nearby.

Equipment Tracking: The location of active and passive WLAN Tags (e.g. have a look at AeroScout) can be monitored to track the location of equipment or devices.

Find rouge access points: One of the biggest threats to company security is employees bringing their own Wifi access points from home and connecting them to the network. If not properly secured they can be an open door into the company's intranet for anyone in range. With localization, the Trapeze access points can not only detect the presence of such access points and warn the network administrator but also include the approximate location of the equipment in the message.

Find unwanted devices or attackers: In case outsiders try to penetrate your network, the system can not only warn the administrator of such attacks but again include the location of the attacker, which is an invaluable help in large campus wide networks. Trapeze says their access points and controllers can detect over 200 different types of Wifi attacks and warn the administrator. The system even offers the possibility to "shoot back". I am not quite sure what that means in practice but I am sure it would be fun to find out more about this feature.

Also quite amazing are their tools for site surveys, maintaining the network, their features for VoIP over Wifi for QoS on the air interface (WMM), optimized routing of VoIP calls through the network, their 802.11n implementation in their new MP-432 access points, which by the way look like smoke detectors, etc. If you want to check out their site, bring some time, there is tons of good information to be discovered there.

T-Mobile USA and the HTC G1 Google Phone – An Interesting Couple

O.k. the HTC G1, or the first Google Android phone, is about to launch and everybody is looking at the Google side of things. But have a look on the other side of the equation: That phone has to use a network. And this network is going to be T-Mobile USA. The interesting thing about this is that this is one of the two networks on this planet that is using 1700 MHz UMTS. For the moment, they only have three very low end 3G phones (according to Wikipedia, see here, here and here) which must sell very well against insignificant competition such as the iPhone.

The HTC G1 will be even more than a quantum leap for T-Mobile USA, it will be the first phone which will use their 3G network in a meaningful way. The HTC page doesn't yet list a lot of network specifications on the device yet. I wonder if it will be dual band 3G, 1700 MHz for T-Mobile USA and 2100 MHz for the rest of the world or if the version announced for the UK will be a different hardware. But then, how about positively surprising me and delivering a Quad band UMTS device with 850, 1700, 1900 and 2100 MHz UMTS built in? Now that would be something, but I'd be really surprised.

I just had a look around which other phones do/will support 1700 MHz. Interestingly the Sony Ericsson X1 came up as 1700 Mhz + quad-band 3G capable. I wonder if T-Mobile USA will pick it up sooner or later!? Also interesting is the Wikipedia link on UMTS quad-band and UMTS tri-band. They give a pretty interesting overview which 3G phones work on more than one continent on speeds faster then EDGE. Nice to see that the list is growing. But what would really be nice for true world roamers are 5 bands. How would that be called? Quinband?

News from Wireless Austria

From a wireless perspective, it's always a pleasure to go to Austria because this is one of the most competitive markets for wireless Internet access I have yet been to. Here, the problem is not to find one good offer for prepaid wireless Internet access but to actually choose the best one among many offers.

The Status Quo Last Time

When I was last in Austria, I was happy to see that 3G networks are now also available in small rural towns, far away from bigger towns and highway routes. At the time, I could only use the 3G network there with my German Vodafone Websession SIM for 15 euros a day. My Yesss prepaid SIM card, which I had acquired for 50 euros and which gave me 3GB worth of data volume I could use over 12 months, was useless there, as their 3G network did not at the time and still has not expanded into this area. Since I am also staying in bigger cities where the SIM worked great, I was not too bothered.

From 50 Euros For The SIM Down To 15 Within One Year

In the meantime, competition has kicked in and the local incumbent, A1 (Mobilkom Austria) now has a similar offer with their b.free broadband SIM card for 15 euros, valid for one year, with a prepaid data volume of 1GB. Getting the SIM is as simple as walking into an A1 store, putting the cash on the counter and walking out with the SIM card 3 minutes later. Compared to the 50 euros I had to pay only a year earlier for a similar offer (although with 3GB data volume), this offer is much cheaper and A1's 3G network seems to reach much farther than ONE's, which is used by the YESSS SIM card.

The Competition Reacts

Yesss has reacted in the meantime and now offers the SIM card for €19.99 with the additional bonus compared to the b.free SIM to allow cheap voice calls for 6.8 cents a minute to all fixed and wireless destinations. If you don't have a 3G USB stick yet, they'll throw one in for 69 euros. The hardware is not locked to Yesss, so it can be used with other SIMs, too. And, best of all, it's available everywhere in Hofer supermarkets, I personally checked.

T-Mobile has also reacted and now offers a prepaid SIM card called "Free Willy" via Telering, but only together with a 3G USB stick. Technically, the 89 euro offer is cheaper than the others mentioned above but not interesting for those that already have a 3G USB stick.

Free Hotline

Another refreshing difference compared to other countries is that calls to the hotline are free. We had some older SIM cards for voice telephony and the price per minute was no longer competitive. I was reluctant to call the hotline, being used to horrendous per minute prices so I went into a shop to ask them to change it. They told me to call the free hotline and indeed, after just a couple of minutes and free of charge, we were in the new cheaper tariffs. Joy!

Great 3G Hardware For Cheap

Apart from a number of SIM cards for prepaid Internet Access, I am astonished about the unlocked 3G hardware available everywhere. Apart from the Huawei E160 3G USB stick for 70 euros that can be bought in Hofer supermarkets everywhere even without the Yesss SIM card (!), '3' has started selling the D100 Wifi/3G bridge for 99 euros. Great to give access to the Internet to more than one computer at a time. According to the web page, the bridge is not locked to a specific operator.

Postpaid Offers

For those living in the country and willing to go for a contract, '3' offers 3GB data volume for Internet access for 8 euros a month, or 15 GB for 16 euros, both prices apply if you bring your own 3G modem. Like all other offers mentioned above, there is no fine print excluding VoIP, IM or other applications and the contract can be terminated at any time. That leaves me breathless.

Another Austrian highlight is the introduction offer of Orange, who recently bought mobile network operator ONE. With their "Europe 0" tariff, any fixed line or mobile destination in Austria AND Europe can be called for 25 euros a month. Time is limited to 1000 minutes, i.e. over 16 hours. The kicker is that the offer is not limited to fixed line numbers!

Summary

Austria is clearly a very competitive market but nevertheless, I don't hear anyone screaming that they don't earn money. Beyond the pricing, it's also interesting that nobody is talking about blocking VoIP, P2P, IM or other services. And yet, things work nicely. Gives one something to think about.

The FACH Power Consumption Problem

In UMTS and HSPA, there are a number of different activity states on the air interface while data is exchanged with the network. During phases of high activity, the mobile device is usually put into dedicated state (Cell_DCH) and transmits/receives data on the high speed downlink shared channels and a dedicated uplink channel. During times of lower activity or to keep a physical connection open to resume data transfers quickly (e.g. the user clicks on a link after some time of inactivity) the network puts the connection into Cell_FACH (Forward Access Channel) state. While the FACH is quite slow, it reduces power consumption somewhat. However, not enough for all kinds of applications.

eMail Polling in 3G mode

While in Austria recently, I noticed that when using 3's UMTS network and Profilmail with a POP3 eMail polling interval of 5 minutes, my battery ran dry within 6 hours. Quite devastating and very short compared to GSM/GPRS/EDGE where the battery easily lasts a full day under the same conditions. With the help of Nokia's Energy Profiler I dwelled down to the bottom of the problem. It turns out that 3 leaves the air interface in DCH state for 20-25 seconds after the last data packet has been sent before putting it into the Cell_FACH state for 1 minute and 45 seconds. Afterwards, the air interface connection is put into Idle state. In Cell_DCH state, even if no data is transmitted, power consumption is around 1.5 watts. In Cell_FACH state, power consumption is still around 0.8 watts, while in idle state and backlight off, power consumption is "almost zero". Even if no eMail is sent/received, these values result in the radio being active for almost half the time of each 5 minute interval, resulting in an average power consumption "in the pocket" (i.e. backlight always off) of 0.5 watts on average. As the battery capacity is 4.4 Wh (that is watt hours), the result is that the battery is empty in just a couple of hours.

If noticed this behavior in 3G networks before but never in such an extreme. This is because most other 3 G networks I usually use have different activity timers. In most other networks, the Cell_DCH state is left after about 15 seconds and Cell_FACH after about 30-45 seconds. This of course decreases the browsing comfort because it often takes longer than 30-60 seconds to read a web page in which case the transition to from idle to Cell_DCH state takes longer than from Cell_FACH to Cell_DCH. On the other side, however, it increases the autonomy on a single battery charge.

eMail Polling in 2G mode

Polling eMails every 5 minutes while the mobile is locked to GPRS is much more efficient. Here, the mobile takes about 1.5 watts while communication is ongoing. However, power consumption goes down almost immediately after no data is sent or received. As a result the average power consumption is only 0.1 watts or only a fifth of the power consumption while in 3G mode.

Remedies

Reducing the 3G timers to lower values is no option since it would have a negative impact on the users experience. Maybe the enhanced FACH, which is not yet implemented in devices and networks, will help somewhat in the future. When looking at the specifications, however, it looks like it mainly addresses capacity and not so much mobile device power consumption. So that remains to be seen.

Another possibility is to switch from the POP3 pull approach to a push approach where the server starts communicating with the device only when a new eMail has been received or very infrequently to keep the TCP session open. Not sure how Blackberries receive their email, but it would be interesting to experiment a bit. IMAP push would be another option but unfortunately, Profimail does not support that extension.

Summary

An interesting case in which the 2G air interface is superior to 3G. How LTE and WiMAX fare in the same scenario is also in interesting question. LTE, for example, has a different air interface state model compared to 3G. Here, only active and idle state exist and active mode timers can be set by the network dynamically in a way to reduce the mobile's average radio activity time to almost the same values as when being in idle state. That should reduce power consumption somewhat if the base stations are clever enough to adapt the timers based on the traffic pattern observed. We shall see…

4G and Peak-Rate Marketing

Moray Rumney, Lead Technologist at Agilent Technology is quite outspoken about the negative impact of what he calls "Peak-Rate marketing in telecommunications", i.e. the gap between proclaimed (theoretical) data rates of wireless systems and realistic data rates and capacity achieved in practice. I fully agree with his arguments and will also discuss this topic in my next book. In the latest Agilent Measurement Journal, Moray looks at the topic again, this time from the point of view of how Femto cells could positively influence the data rate and capacity equation in the future. His argument is that the effect of adding a femto layer (Wifi or 3G/4G femto cells) in an overall network architecture increases throughput and overall capacity by orders of magnitude while increasing theoretic peak data rates of macro cells does relatively little in comparison. An article not to be missed, it starts on page 52! Also interesting from a wireless point of view is the article starting on page 25 about resolving design issues in HSPA mobile devices. Earlier issues of the journal can be found here.

MUROS – Packing 4 Voice Calls Into a Single GSM Timeslot

Back in 1992, the GSM world was simple. A carrier was divided into 8 timeslots and in those that were not used for broadcast information signaling, one voice call was carried. After some time, half rate channels were invented to put two calls in a single timeslot. At first, there was the HR codec which was inferior in speech quality but would use only use alternating instances of an assigned timeslot. But then, advances in coding technology gave rise to the Adaptive Multi Rate Codecs (AMR), and those codecs which fit into half a timeslot were, from a sound quality point of view, quite up to the Enhanced Full Rate voice quality. A nice move as voice capacity of the network effectively doubled.

And now, companies in 3GPP are attempting to again double the number of voice calls per timeslot to up to four! The work item is called MUROS (Multiple Users Reusing One Slot) and you can find some interesting papers about the concept HERE. The folder unfortunately also contains contributions to other topics discussed during this ad-hoc meeting so it’s a bit time consuming to find the papers on MUROS. For a start have a look at the following ones:

080007 – Details on Downlink DARP and Interference
080019 – Short Into to MUROS in Uplink and Downlink
080041 – A first draft of the 3GPP Technical Report which will result from this work

These papers give a first idea on how four voice calls could potentially be put into a single timeslot. Instead of further splitting up the timeslot in time, as was done for AMR half rate, two signals are to be emitted by the base station simultaneously. From a mobile station point of view one signal contains the user data and the other signal is perceived as noise. The mobile phone then has the task to filter out the noise (i.e. the data stream which is unwanted). In uplink direction, it is also foreseen that two mobiles transmit at the same time and that the base station uses interference cancellation and multi-user detection schemes to separate the two signals, potentially based on the use of different training sequences in the middle of the slot.

While at the moment different means are discussed of how the two signals can be told from each other on the receiving end it is clear that MUROS will not work with current mobile devices and also not with current mobile chipsets. Features like SAIC (Single Antenna Interference Cancellation) and DARP (Downlink Advanced Receiver Performance), both also discussed in 3GPP, will probably become the cornerstones for realizing MUROS.

While making this work on the radio layer is surely a formidable challenge, it will also prove to be tricky for radio resource management. Mobile can only tell the two signals apart under radio conditions that are favorable to them. The task of radio resource management will be to dynamically instruct the mobile to handover to ‘less used’ timeslots when signal conditions deteriorate. In the worst case, the mobile could even have to be handed over to a timeslot which it uses exclusively until radio conditions improve.

Should this feature be accepted and implemented it will keep GSM radio layer-, radio network, and chipset designers busy for quite some time to come.

Using Vista’s Firewall to Limit Traffic For Volume Restricted Access

It's great, all programs on my computer these days think they have to
automatically check for updates whenever they are started or sense that
a connection to the Internet has been established. I usually don't mind
and even welcome it. However, there are situations, especially when I
use volume restricted wireless 3G access such as Vodafone Websessions,
in which I don't want those multi-megabyte downloads. So I've switched
most update services to semi-manual or manual to control this behavior.
But even this sometimes doesn't stop the talkers.

Recently, the Windows update service told me it wanted to download a 30
MB .NET update. Sure, no problem, I was at home at the time, so please
go ahead I thought. However, it didn't as there must have been a
problem with the update service. So the originally agreed update only
started a couple of days later when I was abroad, hanging on a thin
line. No way to stop that 30 MB download, no task revealing itself as
the culprit that could be terminated, no nothing… Ugh, I was angry.

But here's the solution in case you have Windows Vista installed:
Go to the firewall configuration and set the profile which is used for
dial-up connections (in German it's called "Öffentliches Profil",
that's probably or "public profile" in English) to block all "outgoing
(TCP/UDP) connections". Then go to the outgoing rules section and
create new rules which allow only the programs you like such as
Firefox, your eMail program, etc. to establish outbound connections. In
a last step, assign these rules to the "public profile". No more nasty
connection requests and update dialogues while you are away.

LTE and the Voice Gap: CS Fallback

LTE surely is an exciting new radio technology and over time will become a worthy successor to GSM and UMTS. It will have a difficult start though, as it is lacking intrinsic support for the wireless killer application, voice calls. A number of different efforts are underway in 3GPP to fix this. I've reported before on IMS Centralized Services, which is elegant but unfortunately quite complex and CS Voice Services over LTE, which from my point of view would fix things with an acceptable amount of effort and complexity but is currently met with little love in the standards body.

A third initiative that, unlike CS Voice over LTE, has manged to become an active work item in 3GPP is to let the mobile device fall back to GSM or UMTS for incoming and outgoing voice calls. In 3GPP the technical specification that contains an overview of the feature is TS 23.272 'Circuit Switched (CS) fallback in Evolved Packet System (EPS)'.

From an overall architectural point of view I think this work item is rather a confession that there is still a long way to go until we have a real successor technology in place for voice. However, if it can do the job, who cares…

The technical specification of the feature is refreshingly clear how it is supposed to work. For those of you who don't want to go through the spec, here's a short overview of how things will work:

The Preparation Phase

When the GSM/UMTS/LTE capable device first connects to the EPS (the Evolved Packet System, i.e. to LTE), it indicates to the network that it wants to perform a "Combined Update". In practice this means that it requests from the network to also register its presence in the 2G/3G circuit switched network.

Registration of the mobile in the 2G/3G network is performed on behalf of the mobile device by the MME (Mobility Management Entity) network element which is part of the Access Gateway functionality. It connects back to a legacy Mobile Switching Center (MSC) via the SGs interface, which is an extension of the already known Gs interface between the SGSN and the MSC. In effect, the MME acts as an SGSN and the MSC thinks the device is attached to the 2G/3G network rather than the LTE network and performs a location update via the SGSN. This has been done for backwards compatibility so there are only few if any changes required on the MSC.

For the registration in the network, the MME has to give the MSC the 2G/3G Location Area ID (LAI) in which the mobile device is currently 'theoretically' located. Since the mobile can't tell the MME this value, it has to be computed out of the TAI, which is the corresponding identifier in LTE. In practice this creates a dependency between the TAI and the LAI, i.e. the location areas that describe a group of base stations in 2G/3G and LTE must be configured in a geographically similar way in order for the fallback to work later on.

The Execution Phase: Mobile Terminated Call

When a circuit switched call comes in for the subscriber it arrives at MSC. The MSC will then signal the incoming call via the Gs/SGs interface to the MME which is, in it's eyes, a 2G or 3G SGSN that can forward the notification to the mobile device on its behalf. From the MSC point of view this is a legacy procedure that already exists today.

If the mobile is in active state, the MME forwards the request immediately to the mobile device. If the mobile wants to receive the call it signals to the MME that it would like to be handed over to the 2G or 3G network in which it can receive the call. The MME then informs the base station that the mobile has to be handed over to the 2G/3G network.

Since there might still be an IP data transfer ongoing at the time of the handover, the standard gives the two options: Either the data transfer is suspended or the packet switched connection is handed over to the 2G/3G network. Here, it starts to get a bit complicated as some 2G networks might not be able to handle voice and data connections simultaneously. As a matter of fact, most GSM networks don't have this ability, called Dual Transfer Mode (DTM) today.

If the mobile is in idle state when the voice call comes in, the MME pages the mobile to reestablish radio contact. Once contact has been re-established, it forwards the information about the call. Since there is no data transfer ongoing at this time, no handover of the IP connection is required since the mobile can re-establish the packet switched connection itself once it is in the 2G/3G network.

The eNodeB has the possibility to request 2G/3G measurements from the device to have a better idea to which cell to hand over the mobile or it can do so blindly by sending it information about a preconfigured cell.

Once the mobile device is in the 2G or 3G cell (and the packet switched handover is done if it was performed) it answers to the initial paging via the legacy cell. In case the MME has made a mistake and the legacy cell is in a different location area than where the device was registered in the preparation phase, the specification also contains a mechanism to first perform a location update and then reroute the waiting voice call to the new location area or even to an entirely different MSC.

The Execution Phase: Mobile Originated Call

This procedure is very similar to the mobile terminated call example above. The difference is that there is no paging coming from the network for an incoming call and of course no paging response to the MSC after the device is in the legacy cell.

SMS and CISS

For receiving text messages, the mobile device can remain the LTE nework, the SMS is forwarded by the MSC to the MME via the Gs/SGs interface and from there via RRC signaling over the LTE radio network to the mobile device. Sending text messages works in a similar way, there is no need to fall back to a legacy network.

For call independent supplementary services (CISS) such as changing call forwarding configuration, checking prepaid balance via USSD messaging, etc., a fallback to the legacy network is required.

Summary

When looking at the description above it becomes clear that falling back to GSM or UMTS for voice calls is not quite as straight forward a process as one might think at first. On the legacy side of the network, however, little or no work is required since the LTE network, and specifically the MME, acts like a 3G SGSN and therefore all procedures already existing for 3G to 3G/2G handovers can be reused.

One question that remains and is even asked in the technical specification is how much time is added by this fallback mechanism to the call establishment time and if this additional time will have a negative impact on the user's perception of the service.

And from my personal point of view I wished 3GPP would have rather invested the time it took to come up with this feature into the CS voice over LTE proposal. But better this feature than nothing at all the pragmatist in me says.