GPRS Functionality and Security Guide
GPRS Functionality and Security Guide
How it works
An O2 White Paper
Contents
                                                            3
2. GPRS network infrastructure
GPRS introduces a number of new functional elements        internet and Corporate Intranets. Each external network
that support the end to end transport of IP based packet   is given a unique Access Point Name (APN) which is used
data. GPRS was developed by the GSM standards bodies,      by the mobile user to establish the connection to the
resulting in a system with defined functionality,          required destination network.
interfaces and inter-network operation for roaming
support. The GPRS network architecture is shown in         The GSM Base Station Subsystem (BSS) is adapted to
Figure 1.                                                  support the GPRS connectionless packet mode of
                                                           operation. A new functional node called the Packet
Two major new core network elements are introduced:        Control Unit (PCU) is introduced (as part of the BSC)
the Serving GPRS Support Node (SGSN) and the Gateway       to control and manage the allocation of GPRS radio
GPRS Support node (GGSN). The SGSN monitors the            resources to mobile users.
state of the mobile station and tracks its movements
within a given geographical area. It is also responsible   In the context of this paper the term mobile station or
for establishing and managing the data connections         MS refers to GPRS devices – could be handsets, PC data
between the mobile user and the destination network.       cards, handheld devices (such as O2’s XDA devices)
                                                           or any other device that incorporates a GPRS radio
The GGSN provides the point of attachment between the      capability.
GPRS domain and external data networks such as the
                                                           Figure 1:
                                                           GPRS Network Architecture.
                                                                                                                     4
The architecture diagram shown in Figure 1 shows a
number of standardised network interfaces:
                                                               5
3. GPRS Operation
3.1. Subscription
The HLR is the repository for all network related
subscription information. The functionality of the HLR has
been enhanced to include GPRS details. Each user must
have at least one GPRS subscription record containing
information such as a list of networks (identified using
the APN) to which access is allowed and the subscribed
Quality of Service (QoS). Further optional information may
be stored such as the users’ static IP address.
                                                             6
3.2. GPRS Attach
The MS must in the first instance, be known to the
network. This is achieved using the GPRS attach procedure.
The attach procedure can be summarised as follows:
                                                             7
3.3. PDP Context Activation
In order to enable user data transfer, a Packet Data Protocol   3. The DNS server uses the APN information to
(PDP) Context must be activated in the MS, SGSN and                determine the IP address of a GGSN that will provide
GGSN. This procedure is initiated by the user and is               the required connectivity to the external network.
analogous to ‘logging on’ to the required destination              The GGSN IP address is returned to the SGSN.
network. The process is illustrated in Figure 2.
                                                                4. The SGSN uses the GGSN IP address to request a
1. The user will initiate the ‘logging on’ process using an        connection (tunnel) to the GGSN.
    application on the PC or MS.
                                                                5. The GGSN upon receipt of this request completes the
•    This signalling message includes key information             establishment of the tunnel and returns an IP address
     such as the APN of the external network to which             to be conveyed to the MS. The GGSN associates the
     connectivity is requested, the user’s identity and           tunnel with the required external network connection.
     any necessary IP configuration parameters
                                                                6. The SGSN sends an Activate PDP context response
     (e.g. for security purposes).
                                                                   message to the MS (including IP address) – packet
•    The SGSN receives the Activate PDP context message
                                                                   exchange can now commence.
     and check the user’s subscription record to
     determine if the request is valid.
                                                                Upon completion of this procedure, a virtual connection is
                                                                established between the MS and the GGSN. The GGSN also
2. If the request is valid, the SGSN sends a query
                                                                has an association between the tunnel and the physical
   containing the requested APN to the DNS server.
                                                                interface to the external network. Data transfer may now
                                                                take place between the MS and the external network.
                                                                Figure 2:
                                                                PDP Context Activation Process.
                                                                                                                          8
3.4. GPRS Context Deactivation and Detach
GPRS provides two additional, independent, procedures
that enable a PDP context to be deactivated and the
MS to disassociate itself from the network (i.e. detach).
An implicit context deactivation takes place if the MS
invokes the detach procedure. GPRS detach may be
performed when:
                                                            9
3.5. What happens to an incoming voice call during a GPRS data session?
The vast majority of GPRS devices (e.g. mobile handset,                 The diagram shown in Figure 3 illustrates the process. In
laptop datacard, O2 XDAII etc.) are categorised as being                this example the Call Line Identity (CLI) of the caller has
Class B mobile devices. Class B devices can be attached                 been recognised by the handset of the GPRS user, and
to both the GPRS and GSM networks, but they cannot                      therefore the caller’s name appears in the display. If the
transmit or receive on both simultaneously.                             user accepts the call the GPRS data session is suspended
                                                                        until the user ends the call.
If a mobile is in an active GPRS data session when an
incoming voice call is detected, the user will normally be              If the detach procedure is invoked, any active context
notified by an on-screen message, and will then have the                will be automatically deactivated.
option to suspend the data session and accept the call,
or continue with the data session and reject the call.
                                                             Peter
                              GPRS                                                                GPRS
                                Session
                                                                                     C               Session
                                                                     Answer
                             0                           GPRS
                                                                                                  GPRS
                                                 C       Pause                     OK                Session
                           12:42                                       Resume
                                                                       Figure 3:
                                                                       Voice Call is Received whilst a GPRS Data Call
                                                                       is in Progress.
                                                                                                                                  10
4. The importance of the
   access point name
Each data network connected to O2’s GPRS network is          •   Each label must start with an alphabetical character,
an ‘access point’, identified by a unique Access Point           but not with the strings “rac”, “lac” or “sgsn”.
Name (APN). The access point may be classed as either        •   Each label must end with an alphabetical character
private or public. This determines whether O2 carries out        or a digit.
a preliminary validation of the GPRS user’s subscription     •   The APN cannot end with the label “.gprs”.
record before forwarding their access request to that        •   O2 recommend that APNs should not exceed 22
data network.                                                    characters. The customer must ensure that any
                                                                 mobile devices they may use are capable of
•   Private access points provide companies with ‘closed         accepting the length of their APN.
    user group’ facilities. Any request for connection to    •   Where multiple APNs are used, each must be unique
    a private access point will be validated by checking         and comply with the above rules.
    the GPRS user’s subscription record includes the
    Access Point Name (APN) requested. If the user’s
    subscription record does not hold the APN, the
    request will be immediately rejected by O2, and not
    forwarded to the external data network. Companies
    still retain responsibility for the security of their
    network and authentication of GPRS users by means
    of user names, passwords, etc.
•   Public access points: O2 does not validate the
    subscription records of the GPRS user requesting
    access to a public access point, and may therefore
    forward requests for access from GPRS users
    unknown to the customer. The customer is
    responsible for the security of their network and
    authentication of GPRS users if required.
•   The APN must be in the form of a registered
    internet domain name (e.g. anycompany.co.uk or
    anycompany.com). In many instances organisations
    will already have a registered Internet domain name,
    which is used as the basis for that customer’s APN.
    An APN may be formed by adding a prefix to the
    registered domain name (e.g.
    gprs.anycompany.com).
•   The APN consists of one or more labels, each
    separated by a dot. Labels should consist only of
    alphabetic characters (A-Z and a-z), digits (0-9) and
    the dash (-). The case of alphabetic characters is not
    significant.
                                                                                                                      11
5. Connecting to the corporate
   LAN via GPRS
                                                             5.1. Overview
Currently, O2’s GPRS/3G portfolio consists of three          O2’s Bearer Service offers business customers a high
service offerings:                                           quality private mobile data connection to their own
                                                             private domain.
•   O2 Bearer Service: O2 provides private circuit(s) to
    connect the customer network to O2’s network.            O2’s Bearer Service can be used to support both GPRS
    The customer can select between 2 Bearer Service         and 3G data traffic (e.g. the same infrastructure supports
    products:                                                both 3G and GPRS users).
        a. DataLink – consists of a single leased line
        and a router installed on the Customer Premises.     The key aspects of O2’s Bearer Service are as follows:
        b. Resilient DataLink – resilience is provided via
        the use of two leased lines and two routers.         •   Each connection is defined by a unique, private
•   O2 Mobile Web service: full internet access                  Access Point Name (APN).
    is provided.                                             •   Connectivity is provided via a physical leased line that
•   O2 Mobile Web VPN service: this service was                  connects the O2 network with the customer’s LAN.
    specifically introduced to allow customers to access     •   Customers can define which Subscriber Identification
    their LAN environment via VPN technology.                    Module (SIM) cards are able to access their APN.
                                                             •   The service does not provide any direct access
                                                                 to the Internet.
                                                             •   All private Bearer Services connect to resilient GPRS
                                                                 Gateway Support Nodes (GGSN’s) in the O2 network.
                                                                                                                        12
This service is designed for customers that require a
private connection to their company LAN, which will
offer them the highest quality of service and most
consistent data communications performance.
                                                             13
5.2. DataLink
Standard connectivity for Bearer Service customers is
delivered via a single leased line (128 Kbit/s, 256 Kbit/s,
512 Kbit/s and 2 Mbit/s bandwidths are available),
terminating on a single router that is installed, at the
customer’s premises. Once installed, the router presents
a single Ethernet or Token Ring connection to the
customers LAN.
                                                                                      Radius   DHCP
                                                                                      Server   Server
                                                              GRE Tunnel
O2 Data Network
                                                       Leased Line
                                                                           Firewall               Corporate
                                                                                                  Network
Remote User
Each DataLink can support multiple APNs, each with its              Figure 4:
own Bearer Service definition. This is useful where                 At a top level, a typical GPRS/3G Bearer Service
customers wish to provide separacy of service to                    connection.
different internal departments, external customers or
application user bases.
                                                                                                                       14
5.3. Resilient DataLink
For those customers requiring the very highest levels of
availability, O2 offers a Resilient DataLink leased line
option to Bearer Service customers. Two links and
routers are provided as part of this solution.
                                                              15
5.4. O2 Mobile Web service
O2’s Mobile Web service is designed to enable O2’s                Internet addresses and enables organisations to
customers to access Internet content via the GPRS and             minimise the number of Internet IP addresses they
3G bearers (refer to Figure 5).                                   require (e.g. by using PAT companies can connect
                                                                  thousands of systems/users to the Internet via a few
The key aspects of the service are as follows:                    public IP addresses). The use of PAT has implications
                                                                  as although PAT provides many benefits, some
•   This is a public service and can be used by any O2            applications, including IPSec VPNs, can experience
    post-pay customer.                                            issues when PAT is being used.
•   The APN associated with the service is                    •   Devices are issued a dynamic, private unregistered IP
    “mobile.o2.co.uk”                                             address, which is not directly visible from the
•   Users are allocated a dynamic, private unregistered           Internet. This means that user’s devices are hidden
    IP address. However, it should be noted that users            from hackers and other undesirables and affords
    of O2’s Mobile Web service will be allocated a public         users some protection when accessing the Internet.
    IP address, via an O2 Internet facing firewall, when      •   By default Mobile Web users enjoy an optimised
    they access Internet resources. The public IP addresses       experience when accessing Internet content at no
    will be allocated in the range 193.113.235.161 to             extra cost. This network hosted optimisation can
    193.113.235.190.                                              speed up the delivery of Web pages by optimising
•   Users can surf the Internet, access FTP servers,              graphic images and compressing text content. It can
    access email and generally utilise Internet resources.        however degrade the image quality in Web pages
•   The service incorporates an optimisation capability           and interfere with some other Internet applications.
    which improves the performance of Internet                    If this is experienced, the optimisation platform can
    applications.                                                 be bypassed by changing the user name in the Mobile
                                                                  Web settings of the handset/device, as follows:
This service is similar to broadband services offered by
many Internet Service Providers to residential and business       – Default settings – includes optimisation:
customers but does have some important differences:                 • User name: faster
                                                                    • Password: password
•   The throughput performance available to users is              – No optimisation required:
    not fixed and will depend on a number of factors                • User name: bypass
    including the GPRS/3G device being used, how                    • Password: password
    many other people are using 3G/GPRS in the same
    area and the capabilities of the O2 network in a          The Mobile Web APN is associated with all new O2 post
    given geographic location – refer to section 7 for        pay SIM cards. If customers do not wish this APN to be
    further information.                                      available to users they should specify this requirement
•   The O2 Mobile Web service uses private IP addressing      prior to SIMs being provisioned.
    and Port Address Translation (PAT) when users
    access Internet resources. PAT was defined by the         O2 plan to introduce an anti-spam filtering capability in
    Internet Engineering Task Force (IETF) as a way to        the near future.
    convert private IP addresses to public routable
                                                                                                                      16
                                    GRE Tunnel
              O2 Data Network                               O2 Mobile Web Service
Leased Line
Firewall
                                                 Radius Server
                                          (allocates Private IP Addresses)
Remote User
                                                                                Internet
                                              Figure 5:
                                              Top Level Overview of O2’s Mobile Web Service.
                                                                                               17
5.5. O2 Mobile Web VPN service
O2’s Mobile Web VPN service was specifically developed                  – Once the VPN session is in place users will be
to allow customers to use their VPN solutions with GPRS                   able to browse the Intranet/Internet and
and 3G – assuming the customers VPN solution can be                          access other corporate resources – assuming
utilised via people connected to the Internet (refer to                      the corporate security policy allows such
Figure 6).                                                                   transactions to take place.
                                                                        – Split tunnelling will not work as users are not
The key aspects of the service are as follows:
                                                                             able to access Internet resources directly.
•   Users cannot directly “surf” the Internet, access FTP          Access to Mobile Web VPN can be requested via O2
    servers, access email or utilise Internet resources:           Customer Services and is usually provisioned within
    – At the request of customers the service was                  24 hours.
       set-up so only VPN protocols can be used when
       users first establish their GPRS or 3G connection
       e.g. the firewall associated with the service will
       block all other traffic.
                                                      GRE Tunnel
                                  O2 Data                            O2 Mobile Web VPN Service
                                  Network        Leased Line
                                                                                    Firewall
                                                                Radius Server
                                                                (allocates Public
                                                                  IP Addresses)
VPN Tunnel
Corporate Network
                                                                   Figure 6:
                                                                   A VPN Tunnel Established between a Remote User
                                                                   and the Corporate LAN.
                                                                                                                                18
6. How secure is GPRS?
2
 IRM were selected by O2 because they were in a unique position to provide expertise not only in IP based networks, but also in cellular networks. IRM are acknowledged as industry leaders in the
vulnerability and penetration testing space.
                                                                                                                                                                                                 19
7. Throughput performance of
   the GPRS Bearer
                                                                                                                         20
7.2. Multislot class of GPRS devices
GPRS devices have a multislot class which defines the       The GPRS network will always try to provide the
maximum achievable data rates that can be supported         maximum number of timeslots the device can support
by the device in both the uplink (e.g. out of the device)   regardless of how much data is to be transferred.
and downlink (e.g. into the device) directions.
                                                            Table 1 details the number of downlink and uplink slots
Often equipment manufacturers will indicate the             associated with the most common multislot classes. The
capabilities of their devices in the form of two numbers,   active slots parameter details the total number of slots
3+1 or 2+2 for instance. The first number indicates the     the GPRS device can use simultaneously for both uplink
amount of downlink timeslots that the mobile device         and downlink communications.
can support for data transfer and the second number
indicates the amount of uplink timeslots the device can
utilise to transmit data.
             1                             1                              1                              2
             2                             2                              1                              3
             3                             2                              2                              3
             4                             3                              1                              4
             5                             2                              2                              4
             6                             3                              2                              4
             7                             3                              3                              4
             8                             4                              1                              5
             9                             3                              2                              5
            10                             4                              2                              5
            11                             4                              3                              5
            12                             4                              4                              5
                                                            Table 1:
                                                            Attributes of a number of different GPRS
                                                            multislot classes.
                                                                                                                       21
7.3. GPRS coding schemes
Four coding schemes are defined for GPRS – although         •   The figures presented include some overhead (e.g.
only Coding Scheme 1 (CS-1) and Coding Scheme 2                 the actual data rate available to applications will be
(CS-2) are currently widely supported. Table 2 details          less than shown in the Table 2).
the data rates achievable for a given number of             •   The higher coding schemes offer the potential of
timeslots. However, the following should be noted:              increased data rates. However, these rates are at the
                                                                expense of some degree of data robustness, making
                                                                these schemes more susceptible to interference and
                                                                poor signal strength.
                                                            •   The cell radius for the higher coding schemes (CS3
                                                                and CS4) is smaller than that for CS1 and CS2
                                                                thereby reducing the effective area of coverage.
                                                            •   As detailed in the previous section the multislot class
                                                                of the GPRS device will define how many timeslots
                                                                can be used by a device.
                                                            Table 2:
                                                            GPRS Coding Scheme Data Rates.
                                                                                                                     22
Glossary of Terms
8. Glossary of terms
                                                                                                                  LAN               Local Area Network
APN              Access Point Name
                                                                                                                  MS                Mobile Station
BSC              Base Station Controller
                                                                                                                  MSC               Mobile Switching Centre
BSS              Base Station System
                                                                                                                  NAT               Network Address Translation
CG               Charging Gateway
                                                                                                                  PAT               Port Address Translation
CLI              Call Line Identifier
                                                                                                                  PCU               Packet Control Unit
CS               Coding Scheme
                                                                                                                  PDP               Packet Data Protocol
DHCP             Dynamic Host Configuration Protocol
                                                                                                                  PSPDN             Packet Switched Public Data Network
DNS              Domain Name Service
                                                                                                                  PSTN              Public Switched Telephone Network
FTP              File Transfer Protocol
                                                                                                                  QoS               Quality of Service
GGSN             Gateway GPRS Support Node
                                                                                                                  SIM               Subscriber Identity Module
GPRS             General Packet Radio Service
                                                                                                                  SGSN              Serving GPRS Support Node
GSM              Global System for Mobile Communications
                                                                                                                  URL               Uniform Resource Locator
HLR              Home Location Register
                                                                                                                  VLR               Visitor Location Register
IETF             Internet Engineering Task Force
                                                                                                                  VPN               Virtual Private Network
IP               Internet Protocol
                                                                                                                  WAN               Wide Area Network
ISDN             Integrated Service Digital Network
All Rights Reserved. No part of this document may be copied, photocopied, reproduced, translated or reduced to any electronic or machine readable form without the prior permission of O2 Limited.
23