Universal Mobile Telecommunications

System (UMTS)

BEULAH A.
AP/CSE
Evolution : From 2G to 3G
2

 Services must be independent from radio access technology

and is not limited by the network infrastructure.
 Support of multimedia and all of its components.
 Increased data rate.
 Convergence of existing networks.
 Video Telephony.
 MP3 downloads.
 Potential good applications like TV on a mobile phone.
 However, to convert to UMTS, the network needs to be
reengineered from the ground up.
 Actually uses the lower 3 layers of the OSI model.

31-Jan-18
Evolution : From 2G to 3G
3

 GPRS – General Packet Radio Services

 2.5G protocol
 Involved only software changes to the GSM network.
 Used under utilized TDMA channels more effectively.
 Increased data rates to a max of 170 Kbps.
 EDGE – Enhanced Data rates for GSM Evolution.
 2.75G protocol.
 Required minimal hardware changes
 Added a new encoding scheme that allowed for more bits to be
added into each time slice.
 Data can now be passed optimally at 384 Kbps.
 Both of these use TDMA over GSM

31-Jan-18
UMTS
4

 3G Standard for Cellular Communication

 Uses W-CDMA (Wideband CDMA)
 5 MHz of bandwidth for each channel.
 Several thousand users can be supported on each cell site.

 Offers 11 Mbps download speeds in theory.

 Uplink speeds are much slower
 Most users are finding download throughput of about 384 Kbps.
 However, this is still much faster than the 14.4 Kbps optimally that GSM
offered.

31-Jan-18
UMTS - Standards
5

 The 3G standard was written by the International

Telecommunication Union (ITU)
 The standard is referred as IMT-2000 (International Mobile
Telecommunications for the year 2000)
 The key to the standards is the available data over the air
interface
 2 Mbps in fixed or in-building environments
 384 kbps in pedestrian or urban environments
 144 kbps in wide area mobile environments
 Variable data rates in large geographic area systems (satellite)

31-Jan-18
UMTS Architecture
6

 UE (User Equipment)
 UTRAN (UMTS Terrestrial Radio Access Network)
 Cell level mobility

 Radio Network Subsystem (RNS)

 Encapsulation of all radio specific tasks

 CN (Core Network)
 Inter system handover

 Location management if there is no dedicated connection between UE

and UTRAN
Uu Iu

UE UTRAN CN

31-Jan-18
UMTS Domains and Interfaces
7
Home
Network
Domain

Zu
Cu Uu Iu Yu
Mobile Access Serving Transit
USIM
Equipment Network Network Network
Domain
Domain Domain Domain Domain

Core Network Domain

User Equipment Domain Infrastructure Domain

 User Equipment Domain

 Assigned to a single user in order to access UMTS services
 Infrastructure Domain
 Shared among all users
 Offers UMTS services to all accepted users

31-Jan-18
UMTS Domains and Interfaces
8

 Universal Subscriber Identity Module (USIM)

 Functions for encryption and authentication of users
 Located on a SIM inserted into a mobile device
 Mobile Equipment Domain
 Functions for radio transmission
 User interface for establishing/maintaining end-to-end connections
 Access Network Domain
 Access network dependent functions
 Core Network Domain
 Access network independent functions
 Serving Network Domain
 Network currently responsible for communication
 Home Network Domain
 Location and access network independent functions

31-Jan-18
UMTS Radio Interface
9

 Spreading and scrambling of user data

 OVSF coding (orthogonal variable spreading factor)
 UMTS FDD frame structure (WCDMA)
 UMTS TDD Frame Structure

31-Jan-18
Spreading and scrambling of user data
10

 Constant chipping rate of 3.84 Mchip/s

 Different user data rates supported via different spreading factors
 higher data rate: less chips per bit and vice versa

 User separation via unique, quasi orthogonal scrambling codes

 users are not separated via orthogonal spreading codes
 much simpler management of codes: each station can use the same orthogonal spreading codes
 precise synchronization not necessary as the scrambling codes stay quasi-orthogonal

data1 data2 data3 data4 data5

spr. spr. spr. spr. spr.

code1 code2 code3 code1 code4

scrambling scrambling
code1 code2

sender1 sender2

31-Jan-18
OVSF coding
11

1,1,1,1,1,1,1,1
1,1,1,1 ...
1,1,1,1,-1,-1,-1,-1
1,1
1,1,-1,-1,1,1,-1,-1
1,1,-1,-1 ...
X,X
1,1,-1,-1,-1,-1,1,1
X 1
1,-1,1,-1,1,-1,1,-1
X,-X 1,-1,1,-1 ...
1,-1,1,-1,-1,1,-1,1
SF=n SF=2n 1,-1
1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 ...
1,-1,-1,1,-1,1,1,-1

SF=1 SF=2 SF=4 SF=8

31-Jan-18
UMTS FDD Frame Structure (W-CDMA)
12
Radio frame
W-CDMA
10 ms 0 1 2 ... 12 13 14 • 1920-1980 MHz uplink
38,400chips
• 2110-2170 MHz downlink
Time slot
• chipping rate:
3.840 Mchip/s
666.7 µs Pilot TFCI FBI TPC uplink DPCCH • soft handover
• QPSK
2560 chips, 10 bits
• spreading factor: UL: 4-256;
666.7 µs Data uplink DPDCH DL:4-512

2560 chips, 10*2k bits (k = 0...6)

666.7 µs Data1 TPC TFCI Data2 Pilot downlink DPCH

DPDCH DPCCH DPDCH DPCCH

FBI: Feedback Information
2560 chips, 10*2k bits (k = 0...7) TPC: Transmit Power Control
TFCI: Transport Format Combination Indicator
DPCCH: Dedicated Physical Control Channel
DPDCH: Dedicated Physical Data Channel
DPCH: Dedicated Physical Channel

31-Jan-18
Dedicated Physical Data Channel
13

 Offered Data Rates

 960 kbps, 480, 240, 120, 60, 30, and 15 kbps (spreading factor 256).

 960 kbps
 spreading factor 4,

 640 bits per slot,

 15 slots per frame,

 100 frames

666.7 µs Data
2560 chips

31-Jan-18
Typical UTRA-FDD uplink data rates
14

12.2 (voice) 64 144 384

User data rate [kbit/s]

DPDCH [kbit/s] 60 240 480 960

DPCCH [kbit/s] 15 15 15 15

Spreading 64 16 8 4

31-Jan-18
Dedicated Physical Control Channel
15

 Constant spreading factor 256

 Pilot is used for channel estimation.
 Transport Format Combination Identifier (TFCI) specifies
the channels transported within the DPDCHs.
 Feedback Information Field (FBI) supports soft handover.
 Transmit Power Control (TPC) is used for controlling the
transmission power of a sender
Time slot
666.7 µs Pilot TFCI FBI TPC

31-Jan-18
Dedicated Physical Channel
16

 Spreading factors between 4 and 512 are available

 data rates for data channels (DPDCH) within a DPCH are
 6 kbit/s (SF=512),

 24 kbit/s

 51 kbit/s
666.7 µs Data1 TPC TFCI Data2 Pilot
 90 kbit/s

 210, DPDCH DPCCH DPDCH DPCCH

2560 chips, 10*2k bits (k = 0...7)
 432,

 912,

 1,872 kbit/s (SF=4)

31-Jan-18
UMTS TDD Frame Structure
17
Radio frame
10 ms 0 1 2 ... 12 13 14

Time slot
666.7 µs Data Midample Data Traffic burst
GP
1104 chips 256 chips 1104 chips
GP: guard period
2560 chips 96 chips

TD-CDMA
• 2560 chips per slot
• spreading factor: 1-16
• symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction)

31-Jan-18
User Equipment Architecture
18

 User Equipment  any UMTS enabled mobile

device
 User Equipment Domain handles the access of the user
onto the UMTS services
USIM  USIM – User Services Identity Module
Cu  Extended SIM functionality
 Functions for user identification, authentication and
ME encryption
 Integrated into SIM card (of the established format)
 Most recent Mobile Equipment can handle both SIM and
USIM
UE  Mobile Equipment Domain responsible for air interface
 User interface for end-to-end connections

31-Jan-18
UE – User Equipment
19

 The UE is the counterpart of several nodes of the

architecture.
 As the counterpart of a node B, the UE performs
 Signal quality measurements, inner loop power control, spreading and
modulation, and rate matching.
 As a counterpart of the RNC, the UE
 Has to cooperate during handover and cell selection, performs
encryption and decryption, and participates in the radio resource
allocation process.
 As a counterpart of the CN, the UE
 Has to implement mobility management functions, performs bearer
negotiation, or requests certain services from the network.

31-Jan-18
 UTRAN Architecture
20
RNS
RNC: Radio Network Controller
RNS: Radio Network Subsystem UE1 Iub
Node B Iu

RNC CN
• UTRAN comprises several UE2
RNSs Node B

• Node B can support FDD or

TDD or both UE3

• RNC is responsible for Iur

handover decisions requiring Node B
Iub
signaling to the UE
• Cell offers FDD or TDD Node B
RNC

Node B

RNS
31-Jan-18
Radio Network Controller
21

 Call admission control

 The RNC calculates the traffic within each cell and decides, if additional
transmissions are acceptable or not
 Congestion control
 The RNC allocates bandwidth to each station in a cyclic fashion and must
consider the QoS requirements
 Encryption/Decryption
 The RNC encrypts all data arriving from the fixed network before
transmission over the wireless link (and vice versa)
 ATM switching and multiplexing, protocol conversion
 The connections between RNCs, node Bs, and the CN are based on ATM. An
RNC has to switch the connections to multiplex different data streams.
 Radio bearer setup and release
 An RNC has to set-up, maintain, and release a logical data connection to a UE
31-Jan-18
Radio Network Controller
22

 Code allocation
 The CDMA codes used by a UE are selected by the RNC
 Power control
 The RNC only performs a relatively loose power control (the outer loop).
 This outer loop of power control helps to minimize interference between
neighbouring cells or controls the size of a cell
 Handover control and RNS relocation
 Depending on the signal strengths received by UEs and node Bs, an RNC can
decide if another cell would be better suited for a certain connection
 Management
 The network operator needs a lot of information regarding the current load,
current traffic, error states etc. to manage its network

31-Jan-18
Node B
23

 Node B connects to one or more antennas creating one or

more cells.
 The cells can either use FDD or TDD or both
 An important task of a node B is the inner loop power
control to mitigate near-far effects.
 Node B also measures connection qualities and signal
strengths
 Node B can even support a special case of handover, a so-
called softer handover which takes place between different
antennas of the same node B

31-Jan-18
Core Network Architecture
24
VLR
BSS
BTS Abis Iu

BSC MSC GMSC

PSTN
BTS
Node B
IuCS
AuC
EIR HLR

GR
Node B
Iub

Node B
RNC SGSN GGSN
Gn Gi
Node B IuPS CN
RNS

31-Jan-18
Core Network Architecture
25
 The Core Network (CN) and thus the Interface Iu, too, are separated into two logical
domains:
 Circuit Switched Domain (CSD)
 Circuit switched service incl. signaling
 Resource reservation at connection setup
 GSM components (MSC, GMSC, VLR)
 IuCS
 Mobile Switching Centre (MSC)
 Switching CS transactions
 Visitor Location Register (VLR)
 Holds a copy of the visiting user’s service profile, and the precise info of the UE’s location
 Gateway MSC (GMSC)
 The switch that connects to external networks
 Home Location Register (HLR)
 Stores master copies of users service profiles
 Stores UE location on the level of MSC/VLR/SGSN
 Packet Switched Domain (PSD)
 GPRS components (SGSN, GGSN)
 IuPS
 Serving GPRS Support Node (SGSN) (Similar function as MSC/VLR)
 Gateway GPRS Support Node (GGSN) (Similar function as GMSC)
31-Jan-18
UMTS Handover
26

 Hard Handover
 Soft Handover
 Softer Handover

31-Jan-18
Hard Handover
27

 All the old radio links in the UE are removed before the
new radio links are established.
 Inter Frequency Handover
 Changing the carrier frequency, is a hard handover

 Receiving data at different frequencies at the same time requires a more

complex receiver
 Inter System Handovers
 Handovers to and from GSM or other IMT-2000 systems

31-Jan-18
Soft Handover
28

 Soft handover means that the radio links are added and
removed in a way that the UE always keeps at least one
radio link to the UTRAN
 Soft handovers are well known from traditional CDMA
networks as they use macro diversity, a basic property of
 CDMA

31-Jan-18
Support of Mobility: Macro Diversity
29

 UE can receive signals from up to

three different antennas, which may
belong to different node Bs.
 Downlink
UE Node B  The RNC splits the data stream and
forwards it to the node Bs.
 The UE combines the received data again.
 Uplink
 UE simply sends its data which is then
Node B RNC CN received by all node Bs involved.
 The RNC combines the data streams
received from the node Bs.
 The fact that a UE receives data
from different antennas at the same
time makes a handover soft.
 Moving from one cell to another is a
smooth

31-Jan-18
Softer Handover
30

 Softer handover is a special case of soft handover where the

radio links that are added and removed belong to the same
Node B

31-Jan-18
Handover Types in UMTS
31

UE1
Node B1 RNC1 3G MSC1
Iu
UE2
Node B2 Iub Iur

UE3 Node B3 RNC2 3G MSC2

UE4
BTS BSC 2G MSC3
Abis A

31-Jan-18
Handover Types in UMTS
32

 Intra-node B, intra-RNC
 UE1 moves from one antenna of node B1 to another antenna. This type of handover is
called softer handover.
 In this case node B1 performs combining and splitting of the data streams.

 Inter-node B, intra-RNC:
 UE2 moves from node B1 to node B2.
 In this case RNC1 supports the soft handover by combining and splitting data.

 Inter-RNC
 When UE3 moves from node B2 to node B3 two different types of handover can take place.
 internal inter-RNC handover and external inter-RNC handover.

 Inter-MSC
 MSC2 takes over and performs a hard handover of the connection.

 Inter-system
 UE4 moves from a 3G UMTS network into a 2G GSM network.
 This is hard handover.

31-Jan-18
QoS Classes
33

Traffic class Conversational Streaming Interactive Background

class class class

Fundamental Preserve time Preserve time Request Destination is

characteristics relation between relation response not expecting
information between pattern the data within
entities of the information a certain time
stream entities of the Preserve data
stream integrity Preserve data
Conversational integrity
pattern (stringent
and low delay)

Example of the Voice, Streaming Web browsing, Background

application videotelephony, multimedia network games download of
video games emails

31-Jan-18
Security and Authentication
34

 Security in GSM is weak by our todays standards, mostly broken

and only one way (client-to-network auth)
 Authentication in UMTS
 Basis is a common secret key K, which is only known by the USIM
(User Services Identity Module) in the UE and by the HLR/AuC of
the provider
 The VLR or SGSN which should authenticate the user requests from
the HLR/AuC 1..n AV(Auth Vectors)
 Each AV is a 5-tupel consisting of
 RAND (random challenge) and XRES (expected response) for the user
authentication
 CK (cipher key) for protection of confidentiality, IK (integrity key) for
protection of integrity, AUTN (auth token) for network authentication

31-Jan-18
Security and Authentication
35

31-Jan-18
Security and Authentication
36

 RAND and AUTN are sent to the UE/USIM, which checks AUTN
and computes the response RES to the challenge RAND
 RES is sent to the VLR/SGSN which compares it to XRES
 Integrity and confidentiality
 By request of MSC/VLR or SGSN the communication can be
encrypted with CK or IK between UE and RNC
 Encryption takes place on the RLC layer and prevents forgery of data
and encryption

31-Jan-18
Summary
37

 From 2G to 3G
 Architecture of UMTS
 UE

 UTRAN

 CN

 UMTS Handover
 UMTS Security

31-Jan-18
Test your understanding
38

 Any idea about Virtual Home Environment (VHE)??

 What type of handover will happen when a mobile handset

switch between 2G and 3G?

31-Jan-18
Reference
39

 Jochen H. Schller, “Mobile Communications”, Second

Edition, Pearson Education, New Delhi, 2007.

31-Jan-18