Podcast: US Wireless Carrier Landscape

Ms_button_1_1
As a frequent traveler, I’m amazed that each country seems to have it’s oddities when it comes to mobile carriers. In some countries, mobile voice and mobile data is very cheap while in others just accross the border, the world looks quite different. Debi Jones of MobileJones.com and Mediaslaves has been nice enough to do the first in a series of podcasts discussing the state of wireless in different countries. Debi lives in California, so the US mobile landscape is the center of our discussions:

Part 1:

  • Coexistence of GSM and CDMA in the US
  • HSDPA deployment
  • Closed down CDMA handsets
  • The Nokia vs. Qualcomm battle
  • The Korean CDMA/UMTS situation
  • Price of wireless data

Podcast, MP3, 26 mins, 12 MB

Part 2:

  • Muni Wifi and combination of Cellular and Wifi Data plans
  • Wireless traveling in the US
  • A hotspot detector (check it out at CanaryWireless.com)
  • Wireless Instant Messaging, Yahoo Go!, Skype and Trillian
  • Verizon’s Walled Garden
  • Mobile phone multitasking on Nokia N-Series phones
  • Mobile phone design

Podcast, MP3, 28 mins, 13 MB

Some figures on Mobile Operator OPEX

Sometimes I find it really strange that a large part of wireless networks is everything but wireless. The only part which is really "wireless" is the radio channel between the user and the cell tower. Behind the base station data and voice is transferred over copper or fiber cables, or microwave links in some cases.

Kevin has come up with an interesting whitepaper on the evolution of the transmission network behind the base stations which is required to adapt the networks to the increasing demand for mobile data. Among many other things the following figures were quite interesting to me, especially when combined with an earlier post of mine on data usage of a mobile PC user and potential revenue generated per base station:

  • Cost of Running the Network: The percentage for running the network from the total operational expenditure (OPEX) is around 30%. On the other hand, 43% of the money goes to Marketing, Sales and Administration… (see figure 2 in the whitepaper). I wonder if (and where) the salaries of the various top executives (CEO, CTO, CMO,…) are included in the OPEX!? 😉
  • Backhaul Line Rental: On page 4, the whitepaper says that the line rental for a 2 MBit/s E-1 link used for most UMTS base stations today is about € 250.- per month. This amounts to about 1/3 of the 30% spent from the total OPEX on network operation.
  • Cost for Technical Personnel: The costs for technical personnel to run the network amounts to another third of the network operation costs. This is 10% of the overall OPEX. Not very much compared to the 43% for Marketing, Sales and Administration…

HSDPA backhaul over ADSL

Kevin Evans has put a post on his blog on HSDPA backhaul over ADSL. At first, it seems like a pretty good idea he says but has some second thoughts:

Kevin says Internet Service Providers (ISP) would probably be less than happy to connect HSDPA ADSL links to their  backbone. I agree! Cells where HSDPA is used heavily will pretty much use most of the bandwidth of an ADSL link for a considerable time per day. Consequently, such links would substantially increase the load of the ISPs ADSL backbone.

He then goes on to say that the alternative for mobile operators is to do their own ADSL backhauling. He thinks this is also not a good idea due to having to build an overlay network for backhauling next to the E-1s currently used for real time voice traffic. But why is it such a bad idea for operators to put their own ‘mini’ DSLAMs in central offices and have a little fiber there for backhauling? There is cost whatever you do, E-1, microwave, etc. so why not ADSL?

Some operators might have already decided to do this (speculation on my part). O2 Germany for example has said that they want to become an integrated fixed- and mobile telecommunication company, providing both high speed fixed line Internet access via DSL and high speed mobile Internet access via HSDPA. If they decide to build their own ADSL network, they can use it for both purposes.

As an alternative, Kevin suggests to use Ethernet for carrying both real time voice traffic and non real time background and streaming traffic generated by web browsing, podcast downloads, etc. But what about the distance you can cover with commercial Ethernet equipment today over phone cables?

When I first read about HSDPA over ADSL backhaul it immediately made sense to me due to the fact that ADSL has become a cheap technology to bridge larger distances than what is possible with other technologies. Have new long distance Ethernet technologies caught up in the meantime?

Whatever operators decide, I hope they decide quickly as HSDPA over 2 MBit/s E-1s is not going to make people happy.

It’s time for some mobile privacy!

I am sure that not even one person in a thousand has ever attempted to manage web browser cookies on the PC. I have to admit that I’ve been one of those 999 until recently. However, leaving the browser on its own to collect and send cookies as requested by web sites leaves the door wide open to advertisment companies and other institutions who love nothing more than to spy on where users are going in the web and what they are looking at. So I’ve set my cookie options in Firefox to only allow cookies from a few select web sites so I don’t have to log in everytime I go there. All other cookies are automatically deleted whenever I close the browser.

In the mobile world I would like to do the same thing. However, Opera for S60 has only very limited cookie privacy options. One can either delete all or none. Not good for me as I would like to keep some cookies like for example the one that keeps me logged into my mobile Flickr account.

Time for some action Opera!

French book on UMTS in its 3rd edition

07072006474_1
Silently, my fellow co-worker Pierre Lescuyer has updated his excellent book on UMTS called "Réseaux 3G" (3G networks) and the 3rd edition is now available in French. The new edition contains among other additions new chapters on HSDPA, HSUPA, IMS and MMS. Previous editions are also available in English and German.

Very well done, Pierre, congratulations!

5G New Radio Q&A

All answers have been held as short as possible and require an understanding and study of the corresponding chapter of the book.

Answer 1:

The basic concept of the 5G Non-Standalone architecture is to add a 5G NR cell as a speed booster to an existing LTE radio and core network. It is different from LTE carrier aggregation as the 5G cell acts independently from the LTE part of the connection. Data is transmitted over LTE and 5G NR simultaneously.

Answer 2:

TDD = Time Division Duplex, e.g. used in band n78. Uplink and downlink are transmitted over the same channel. FDD = Frequency Division Duplex, typically used in frequency bands in Europe < 3 GHz. Uplink and Downlink are separated in the frequency domain, i.e. they use different channels. Hence, uplink and downlink are transmitted simultaneously.

Answer 3:

In 5G NSA, data is transmitted over LTE and 5G NR at the same time. Typically the 5G gNB receives the data, splits a apart of it away and forwards it to the LTE part of the connection while it transfers another part itself.

Answer 4:

In the uplink direction LTE and 5G use different frequencies and one transmitter in the UE is required for each channel as data is transferred simultaneously over both legs of the connection in the uplink direction.

Answer 5:

In 5G NR, a UE does not necessarily need to support the full channel bandwidth and can be assigned only a part of the channel on the frequency axis. Also, a network might decide to assign different bandwidth parts to a UE to conserve power with a narrow BWP while only small amounts of data are transferred.

Answer 6:

The CORESET is the Control Region Set, i.e. the control regions the UE has to monitor on the channel for uplink and downlink assignments.

Answer 7:

Dynamic Spectrum Sharing (DSS) can be used to transmit LTE and 5G NR on the same channel. This way, the channel can serve older LTE only mobiles and newer 5G NR mobiles. This is done by transmitting the control channels of LTE and 5G NR in the channel at different times and by using several methods and signaling alignments for 5G NR devices to only notice the 5G transmissions while LTE devices only see the LTE signaling channels and reference signals.

Answer 8:

The LTE eNB and 5G NR gNB have independent schedulers and communicate over the X2 interface which each other. This way, handovers can be made independently as only the X2 connection is switched. In practice it often occurs that the LTE and 5G NR parts are served by different sites. The uplink/downlink data is split/combined at one of the two sites.

Answer 9:

The idea behind the Service Oriented Architecture is to leverage container technology in combination with microservices and stateless communication to build a highly adaptable, configurable and scalable 5G core network.

Answer 10:

5G registration management is performed by the Access Management Function and deals with authentication of subscribers and managing their presence in the network. Session management on the other hand is managed by the Session Management Function and deals with the establishment with user plane bearers between the mobile device and an external network such as the Internet.

Answer 11:

In RRC-Idle state, no active connection exists between the mobile device and the gNB over the air interface. Also, the signaling connection and the user data tunnel to the core network have been removed. In RRC-Inactive state, only the air interface connection is removed while the connection between the gNB and the core network remains in place. This significantly reduces signaling when connectivity needs to be restored.

Answer 12:

The idea of Network Slicing is to have a single end to end network and serve devices with different requirements in different ways. On the air interface, different parts of the channel can use different configurations. One part of the channel could be used for fast Internet access, while another part, that is configured differently could be used for slow but very reliable communication. Other parts of the network can be sliced in a similar manner.

Bluetooth Q&A

All answers have been held as short as possible and require an understanding and study of the corresponding chapter of the book.

Answer 1:
Bluetooth transfer speeds depend on how many users exchange data in a Piconet, how much data is exchanged by the individual users at a certain time and what kind of multislot packets are used. In the ideal scenario with only two devices in which only one device has a lot of data to send, a peak data rate of 723 kbit/s can be achieved for one of the two devices.

Answer 2:
FHSS (Frequency Hopping Spread Spectrum) sends each packet on a different channel (frequency). This avoids using the same channel for a prolonged amount of time which might already be in use by another network such as a Wireless LAN. FHSS also simplifies device configuration as no channel number has to be selected by the user in the Bluetooth settings. Bluetooth 1.2 introduces adaptive frequency hopping which avoids channels with high error rates caused by parallel transmissions from other networks. This reduces transmission errors and the influence on other networks in the same area while at the same time increasing the overall transmission speed.

Answer 3:
The Inquiry procedure is invoked to search for unknown Bluetooth devices in the area. If a Bluetooth device is visible to other devices it responds to an inquiry packet it detects by sending its device ID. A paging on the other hand is used to directly establish contact with a Bluetooth device which is already known. If a Bluetooth device only wants to be accessible for devices with which it has previously communicated with, it only responds to paging messages and never to inquiries.

Answer 4:
Bluetooth offers a number of power saving mechanisms and states: Connection hold: A device deactivates its transceiver for a certain time. Connection sniff: A device deactivates its transceiver for a certain time but checks at predefined times if the master device wants to resume communication. If not, the device automatically returns to the power save state. Connection park: The devices releases its device address and uses a very long timeout value before checking again if the master device would like to reestablish contact.

Answer 5:
The link manager has the following tasks: Establishment of an ACL, SCO or eSCO connection, configuration of the connection, activation of the enhanced data rate mode, execution of a master-slave roll change procedure, pairing, authentication and ciphering management, adaptive frequency hopping management, and activation of different power save modes when appropriate.

Answer 6:
The L2CAP layer’s protocol service multiplexer is used during connection establishment to select to which of several higher protocol layers to connect to. In addition, an individual connection ID is used on the L2CAP layer for each connection to identify packets. This allows two devices to establish several simultaneous connections between each other for different higher layer applications.

Answer 7:
The service discovery database contains information about all services offered by a Bluetooth device. Other devices can query this database during connection establishment to detect which services are offered and how certain parameters have to be set in order to access them.

Answer 8:
Each Bluetooth profile using the RFCOMM layer has to register with the Service Discovery database. If a remote device wants to use the service offered by the profile it has to query the database in order to retrieve the RFCOMM channel number which has been assigned to this profile. As the number is dynamically allocated the database has to be queried for every new connection.

Answer 9:
Authentication: Two Bluetooth devices are able to authenticate each other if they have previously been paired.
Authorization: This is a security mechanism on the application level and allows to restrict access to applications to certain remote devices. This way it can be ensured that only some of the previously authenticated devices can access certain services. It might be desirable for example that only the notebook of a user can use the dial up connection profile of a phone. Other devices are barred from this profile but are allowed to transfer files from and to the mobile phone.

Answer 10:
Bluetooth is a very versatile communication technology that can be used for a wide variety of different services. This ranges from services like exchange of electronic business cards and images to connecting headsets, mice and keyboards to PCs and tablets. The Bluetooth standard defines a number of profiles to ensure interoperability on the application level. A profile specifies how a service is supposed to work and in which way remote devices can communicate with it.

Answer 11:
The object exchange (OBEX) profile has been designed for a fast and simple transmission of files and objects between two Bluetooth devices. The OBEX profile is the basis for the file transfer profile, the object push profile and the synchronization profile.

Answer 12:
When using the hands-free profile, the hands-free set is only seen as a microphone and loudspeaker extension of the mobile phone. The connection to the network continues to be established by the mobile phone. The SIM access profile does just the opposite. With this profile, the mobile station is only used as a SIM card reader. All other functionalities including the GSM/UMTS transceiver are deactivated. The hands free set then uses the Bluetooth connection to access the SIM card and can perform all transactions between itself and the SIM card just as if the SIM card was directly inserted into the hands free-set. Such hands-free sets are more expensive than those just using the hands-free profile, as they have to contain a complete mobile phone unit including the GSM/UMTS module. This has the advantage, however, that an external antenna can be used. Furthermore, the mobile phone can be configured for the use of both the SIM access profile and the headset profile. While the mobile phone is used in the car, the hands-free set takes over. Once the user leaves the car and takes the mobile phone with him, incoming calls can automatically be redirected to the Bluetooth headset once again. This can not be done as easily with a hands free set in the car supporting the hands-free profile as the phone is unable to decide for incoming calls to which device to establish contact.

Answer 13 (2nd edition):
Removed, no longer relevant.

Answer 13 (3nd edition):
There are significant differences of classic Bluetooth and BLE on the air interface. While BT uses fast frequency hopping and 1 Mhz channels, BLE splits the 2.4 GHz ISM band into 40 channels of 2 MHz each and uses very slow frequency hopping. BLE only uses GFSK modulation and the datarate is not variable but fixed at 1 Mbit/s over a channel. This reduces the datarate to a few tens of kilobytes per second but in return significantly reduces power consumption.

Answer 14:
The aim in BLE is not to establish a transparent channel between two devices but to transfer small amounts of data as power efficiently as possible. Therefore data is transmitted in a way that could be compared to reading and writing variables on a remote system.

LTE and VoLTE Q&A

All answers have been held as short as possible and require an understanding and study of the corresponding chapter of the book.

Answers for the LTE and VoLTE chapters:

LTE Answer 1:
A 10 MHz FDD LTE channel is split into 600 sub-carriers.

LTE Answer 2:
X2 Handovers are performed directly between two eNodeBs while an S1 handover requires the help of the MME. S1 handovers are only used when two eNodeBs are unable to communicate with each other which should happen rarely in practice.

LTE Answer 3:
The MME performs the subscriber and connection management such as user authentication, location management, bearer establishment, etc. while the Serving-Gateway handles the user data (i.e. the IP packets) that are exchanged between a device and the Internet.

LTE Answer 4:
7 symbols on the time axis and 12 sub-carriers on the frequency access are grouped into a Resource Block which takes 0.5 ms to transmit. Two Resource Blocks are bundled together to form the smallest unit that can be scheduled to a user.

LTE Answer 5:
If the UE is in Idle state it has to use the random access channel to establish a connection to the network. When the network receives the request it assigns uplink resources to the device via the Physical Downlink Control Channel (PDCCH). The UE receives the assignment and can then make use of the assigned resources on the Physical Uplink Shared channel.

LTE Answer 6:
HARQ is a mechanism on Layer 2 of the radio protocol stack and ensures that faulty resource blocks are immediately retransmitted. ARQ works on the RLC layer further up in the protocol stack and ensures that larger chunks of data are repeated in case HARQ fails. While HARQ is always used, ARQ is not used for voice bearers (only IMS VoIP) as there is no time to retransmit complete VoIP packages due to the requirement to have low jitter and delay values for voice packets. For VoIP it is preferable to drop missing packets instead of repeating them.

LTE Answer 7:
A default bearer is usually assigned when the device is switched on. It serves as a bearer for Internet connectivity. A device can have several default bearer simultaneously, e.g. one for Internet connectivity and one bearer for IMS. In practice, devices usually only have one default bearer.

Dedicated bearers are established by services alongside default bearers such as the IMS to ensure a certain quality of service (minimal bandwidth, jitter, delay, precedence over other bearers) for voice, video and other time critical and delay sensitive streams.

LTE Answer 8:
Discontinuous Reception (and Transmission) is very useful in RRC connected state to reduce power consumption. Without DRX a UE has to observe the Downlink Control Channel frequently as resources could be assigned at any time. When DRX is activated the UE can turn off the receiver most of the time and only listen occasionally. This significantly reduces power consumption at the expense of slightly higher latency when data is only transmitted infrequently. Typical DRX values are a few hundred milliseconds for the activation time for DRX (after the reception of the last data frame) and activity times of a few milliseconds during an interval of several hundred milliseconds.

LTE Answer 9:
In Idle state no bearer is established to the network and the UE controls cell changes and changes to other radio networks when running out of LTE coverage autonomously.

LTE Answer 10:
When running out of LTE coverage there are several methods to guide the UE to another radio network (e.g. UMTS). An easy solution is to use a Cell Change Order which tells the UE to which UMTS cell to go. The connection is then interrupted and the UE searches the given cell, reads the system information and performs the required procedure to establish a connection in the other radio technology. This process typically takes a few seconds during which no data can be exchanged. This method is simple for implementing in the network and the mobile device but not suitable for applications such as VoLTE, for which the data bearer should be handed over between radio networks quickly. This is possible with LTE to UMTS (or GSM) handovers as the cell in the target network can be prepared for the incoming UE. The UE is then given specific instructions of how the target cell can be accessed which reduces the outage time to a few hundred milliseconds.

LTE Answer 11:
MME and S-GWs usually have the Gn GPRS interface implemented and can thus act as SGSNs and GGSNs towards 2G/3G PS core network equipment. In other words, they emulate behavior those network nodes understand so no software modifications are required in existing networks. It should be noted that in practice today, most network operators have merged corresponding 2G, 3G and LTE core networks into a single physical node and the interfaces between the logical components are handled internally.

LTE Answer 12:
This is done via the SGs interface which connects the MME to Mobile Switching Centers in the 2G/3G networks to deliver SMS over LTE and to perform a (CS = circuit switched) fallback to GSM or UMTS for incoming (and outgoing) voice calls.

LTE Answer 13:
Internet based voice services can not request special quality of service settings from the mobile core and access network (i.e. dedicated bearers, see above). Depending on the network load this can result in bad voice quality if voice packets are not preferred over other packets (e.g. from web browsing from the same or another UE) in loaded cells. Also, Internet based VoIP services can’t interact with the mobile network to perform handover to GSM or a circuit switched UMTS channel when the edge of a broadband wireless network has been reached. Operator voice services can hand over a call to GSM (Single Radio Voice Call Continuity).

LTE Answer 14:
eNodeBs have to have a high speed link to the core network to accommodate the high speed air interface data traffic. The best option is to use a fiber optic cable. If not available, other options are Ethernet based microwave links or VDSL links.


VoLTE Answer 1:

The main components of the IMS are the Serving Call Session Control Function (S-CSCF) that is the central node that handles all SIP messages. Usually, SIP messages are forwarded to an Application Server (AS) such as the Telephony Application Server that implements telephony functionality. The Proxy-CSCF sits between the S-CSCF and the mobile device and is used for tasks such as generating SIP messages for the UE when the UE is unable to do so (e.g. loss of coverage). The Interrogating CSCF (I-CSCF) is contacted when the UE sends an initial Register. It contacts the HSS (Home Subscriber Server) to get information on the user and then assignes a S-CSCF that will handle all subsequent communication.

VoLTE Answer 2:
During SIP registration an IPSec tunnel is established between the UE and P-CSCF. While encryption is optional, IPSec authentication ensures that only messages from the UE are accepted.

VoLTE Answer 3:
Preconditions are used to inform devices that a dedicated bearer has to be established for the speech path on one or both ends of a connection before a call can be further processed. In the core network, precondition messaging is used to trigger the establishment of the dedicated bearer.

VoLTE Answer 4:
The P-CSCF, which is a mobile network component, inserts the ‘asserted identity’, which is the device’s phone number (MSISDN), into SIP messages sent by the UE and then forwards those enriched SIP messages to the S-CSCF. This prevents the UE from forging its phone number.

VoLTE Answer 5:
As the payload of voice packets are small the IP, UDP, RTP header information makes up a large part of the overall packet. Therefore, header compression is used to significantly reduce this overhead which increases the number of simultaneous calls per cell.

VoLTE Answer 6:
Call forwarding settings are managed via the XCAP protocol between the UE and the network. XCAP is an XML protocol and different call forwarding options such all call forward no reply, call forward not reachable, etc. are XML encoded.

VoLTE Answer 7:
For emergency calls an IMS emergency bearer is established that is independent from the standard IMS bearer that is used for ordinary voice calls. The IMS emergency bearer is established with the highest priority in the radio and core network to guarantee emergency calls a high quality speech and signaling path even in fully loaded networks.

VoLTE Answer 8:
Unlike typical handovers that are controlled by the network, VoLTE to VoWifi handovers are controlled by the mobile device. When the device senses that LTE coverage is about to be lost, it establishes an IPSec tunnel to the evolved Packet Data Gateway (ePDG) and includes information during the tunnel establishment that allows the network to move the existing IMS bearer away from the current MME and S-GW to the ePDG. All IP packets of the connection are then automatically redirected to the ePDG and an ongoing voice call continues with only a short interruption during the redirection process.

VoLTE Answer 9:
VoWifi cellular preferred means that the UE will only connect to the ePDG and move the IMS bearer when no cellular coverage (LTE, 3G, 2G) is available. VoWifi Wifi preferred means that the IMS bearer is moved to Wifi as soon as a suitable Wifi connection is available.

VoLTE Answer 10:
MC-PTT only allows one person in a communication group to speak at a time. A central instance is required to control who is allowed to talk and deny requests from other parties if there is already another speaker in the call.