3G Wireless Network Architecture UMTS vs.

CDMA2000

Benjamin Ip ELEN 6951 Wireless and Mobile Networking II Columbia University

1 Abstract
Universal Mobile Telecommunications Service (UMTS) and CDMA2000 have emerged as two of the full-fleged 3G wireless standards to support both the radio and network functions based on the IMT-2000 framework. This paper surveys the two architectures in terms of their radio access and core networks technologies.

2 Overview
UMTS and CDMA2000 standards are designed to deliver wireless services with better performance, greater costeffectiveness and significantly more content than the 2G counterpart. Besides offering traditional voice communication, 3G data capability offers Internet and Intranet services for multimedia application, high-speed business transaction and telemetry.

the success of GSM, and on the GSM operators existing investment in infrastructure. The first stage of service and network evolution is from todays GSM systems, through the implementation of GPRS, to commercial UMTS networks (see Figure 1). The UMTS core network can continue to use the current 2G network structure to process voice and packet data. The major introduction of UMTS are a new air interface1 operating at around 2GHz, and a packet-based network architecture which supports both voice and data services.

2.3.2 CDMA 2000

CDMA2000 is another wireless standard designed to support 3G services as defined by the ITU and its IMT-2000 vision. It is evolved from the North American IS-95 cdma standard. CDMA2000 system uses 2.1GHz band and it maintains backward compatibility by allowing current frequency bands of 800, 1800 and 1900 MHz to operate seamlessly.

3 UMTS Network Architecture

Figure 1: Evolution of UMTS and CDMA2000

2.1 UMTS
UMTS is the European member of the IMT2000 family of third generation cellular mobile standards. The goal of UMTS is to enable networks that offer true global roaming and to support a wide range of voice, data and multimedia services. Data rates offered by UMTS are: vehicular - 144 kbit/s; pedestrian 384 kbit/s;in-building 2Mb/s. The new UMTS networks will build on

A UMTS network consists of three interacting domains (see Figure 2): User Equipment (UE), UMTS Terrestrial Radio Access Network (UTRAN), and Core Network (CN). The UE is a mobile that communicates with UTRAN via the air-interface. UTRAN provides the air interface access method for the UE. CN provides switching, routing, and transit for user traffic. It also stores databases and provides network management functions.

UMTS uses wideband-cdma as the air-interface access technology

From the specification and standardization point of view, both UE and UTRAN consist of completely new

authentication algorithms, and supports subscription information for the ME. Figure 3 shows the Cu interface that allows the USIM to communicate with the ME .

USIM

Cu ME Figure 3: UE architecture

3.2 UMTS Terrestrial Radio Access Network (UTRAN)

Figure 2: UMTS Network Architecture

protocols, the design of which is based on the needs of the new W-CDMA radio technology. On the contrary, the definition of CN is adopted from GSM network. This gives the system with new radio technology a global base of known and rugged CN technology that accelerates and facilitates its introduction, and enables such competitive advantages as global roaming.

A UTRAN consists of two distincts elements: Node B and Radio Network Controller (RNC). The main functions of the UTRAN archtecture are to:

Support soft handoff and W-CDMA

specific radio resource management

Share and reuse of voice and packet Share and reuse of GSM
infrastructure

data interfaces (ie. Iu-CS and Iu-PS)

Use ATM as the main transport

mechanism within UTRAN

3.1 User Equipment (UE)

A UE consists of two parts:

The Mobile Equipment (ME) is a

3.2.1

Node B

radio terminal used for communicating over the Uu interface (air-interface). Module (USIM) is a smartcard that stores subscribers identity and encryption keys, performs

The UMTS Subscriber Identity

A Node B (logically corresponds to the GSM Base Station) converts data flow between the Iub and Uu interfaces. Its main duty is to perform the physical layer processing, e.g. modulation, coding, interleaving, rate adaptation, spreading, etc.

3.2.2

Radio Network Controller (RNC)

An RNC (logically corresponds to the GSM Base Station Controller) controls the radio resources in its domain. RNC is the service access point for all services UTRAN providing to the Core Network. It also terminates the Radio Resource Control Protocol (RRC) that defines the messages and procedures between UE and UTRAN. A UTRAN may consist of one or more Radio Network Sub-Systems (RNS). An RNS is a sub-network within UTRAN that consists of one RNC and one or more Node B. RNCs which belongs to different RNS can be connected to each other via the Iur interface. The logical function of an RNC is further divided into controlling, serving, and drift. The controlling RNC administers the Node B for load and congestion control. It also executes admission control and channel code allocation for new radio links to be established by the Node B.

The serving RNC is the RNC that terminates both the Iu and Iub links from the core network and user equipment respectively. It performs L2 (MAC layer) processing of data to/from the radio interface. Mobility management functions such as power control, handoff decision, etc are also handled by the serving RNC. Note that one UE connected to the UTRAN has one and only one SRNC. The drift RNC compliments the serving RNC by providing diversity when the UE is in the state of inter-RNC soft handoff (which requires two RNCs). During the handoff, the drift RNC does not perform L2 processing; rather it routes data transparently between the Iub and Iur interfaces.

3.3 Core Network (CN)

UMTS CN is divided into circuit switched and packet switched domains. ATM is the transport mechanism to be used in the UMTS core. In particular, ATM AAL 2 handles circuit and packet switched signalling while AAL 5 is designed for data delivery. The core network consists of the following elements inherited from the incumbent GSM network:

Node B

RNC

Node B RNS

3.3.1

Home Location Register (HLR)

lub

lur

Node B

RNC

Node B RNS

Figure 4: UTRAN Architecture

An HLR is a database located in the users home system that stores the users service profile. A service profile is created when a new user subscribes to the system, and remained as long as the subscription is active. It consists of information such as user service type and roaming permission etc.

3.3.2 Mobile Switching Center and Vistor Location Register (MSC/VLR)

The co-located MSC/VLR serves as both the switch and database for the circuit switch service. The MSC is used to switch the circuit switch data while the VLR function temporarily hold copies of the visiting users service profile.

Network layer represents standard transport technology selected for UTRAN without any UTRAN-specific changes.

3.3.2 Gateway MSC (GMSC)

It is the gateway that connects the UMTS PLMN2 with the external circuit switch networks. All incoming and outgoing circuit switch connections go through the GMSC

Figure 5: General UTRAN Protocol Model

3.3.4 Serving GPRS Support Node (SGSN)

SGSN has the similar functionality as MSC/VLR except it handles packet switch connections.

3.3.4 Gateway GPRS Support Node (GGSN)

GGSN has the same functionality as that of GMSC except it handles the packet switch connection.

4 UMTS Network Protocol

Protocol structures in UTRAN terrestrial interfaces are designed according to the same general protocol model. As shown in Figure 5, the protocols are divided into horizontal layers and vertical planes. The horizontal layer consists of two layers, the Radio Network Layer and the Transport Network Layer. All UTRANrelated issues are visible only in the Radio Network layer, and the Transport
2

Public Land Mobile Network

The vertical planes are further divided into control, user, transport network control, and transport network user planes. The control plane is used for all UMTS-specific control signalling. It includes the Application Protocol (RANAP in Iu, RNSAP in Iur, and NBAP in Iub), and the signalling bearer for transporting the Application Protocol messages. All information transmitted and received by the user such as a voice call or packet data are transported via the user plane. The Transport Network Control Plane is a plane that acts between the control plane and the user plane. It is used for all control signalling within the transport layer. It includes the ALCAP protocol to set up the transport bearers for the user plane. It also includes signalling bearer needed for the ALCAP. Noticed that the introduction of the transport network control plane makes it possible for the Application Protocol in the Radio Network Control Plane to be completely independent of the technology selected for the Data Bearer in the User Plane. Finally the Transport Network User Plane handles the data bearer and signalling bearer in the user plane.

4.1 UTRAN-CN Interface: Iu

The Iu interface bridges the UTRAN and CN. As can be seen in Figure 6 and 7, the Iu can have two different instances, which are the Iu-CS for connecting UTRAN to circuit switched CN, and IuPS for connecting UTRAN to packet switched CN. Since the two protocol structures are very similar, we focus mainly on Iu-CS.

Network-to-Network Interfaces (SAALNNI). SAAL-NNI is further divided into Service Specific Co-ordination Function (SSCF), Service Specific Connection Oriented Protocol (SSCOP) and ATM AAL-5 layers. SSCF and SSCOP are specifically designed for signalling transport in ATM networks while AAL-5 is used for segmenting data into ATM cells. The Transport Network Control Plane protocol stack consists of signalling protocol for setting up AAL2 connections (Q.2630.1 and Q.2150.1) running on top of the SS7 protocols similar to those aforementioned.

4.1.1 Iu-CS
UMTS physical layer is not specified in the standard. It can be any off-the-shelf transmission technologies such as SONET, STM-1, and E1. However, ATM is the transport mechanism to be used across all three planes of the Transport Network Layer.

4.1.2 Iu-PS
In the Transport Network User Plane, an alternative IP-based signalling bearer is specified. This signalling bearer consists of M3UA, Simple Control Transmmission Protocol (SCTP), and Internet Protocol (IP). The SCTP layer is specifically designed for signalling transport in the Internet.

Figure 6: Iu-CS interface protocol stack

The Radio Network Layer Control Plane protocol stack consists of RANAP running on top of broadband SS7 protocols. The Transport Network Layer User Plane counterpart uses Signalling Connection Control Part (SCCP), Message Transfer Part (MTP3-b), Signalling ATM Adaptation Layer for
Figure 7: Iu-PS interface protocol stack

In the Iu PS User Plane, multiple packet data flows are multiplexed onto one or several AAL5 Permanent Virtual

Circuits. The GPRS Tunnelling Protocol (GTP-U) is the multiplexing layer that provides identities for individual packet data flow. Each flow uses UDP connectionless transport and IP addressing. No protocols are required in the Transport Network Control Plane since establishing GTP tunnel requires only identifier for the tunnel, and the IP addresses for both directions are already included in the RANAP messages.

4.2.1 Iur-1
Iur-1 provides the basic functionality of RNSAP signalling needed for mobility of users between two RNCs, excluding exchange of any user data traffic. If this interface is not available, the only way for a user connected to one RNC to utilize a cell in another RNC is to disconnect itself from the first RNC. Other services provided by Iur-1 include support of SRNC relocation, inter-RNC registration area update, inter-RNC packet paging.

4.2 UTRAN-UTRAN Interface: Iur

The RNC-RNC interfaces shown in Figure 8 provides four distinct functions:

4.2.2 Iur-2
Iur-2 provides dedicated channel between two RNCs to support the interRNC soft handover and allow the anchoring of the SRNC during when the UE is utilizing the dedicated channels for as long as the user has an active connection to the circuit-switched domain. To achieve this, the user plane frame protocol for dedicated channels (DCH FP) is used to defines data frames to carry user data and control frames to exhange measurement information. User data frames are normally routed transparently between DRNC and SRNC. The Transport Network Control Plane Protocol uses Q.2630.1 to set up AAL2 connections. Each dedicated channel is conveyed over one transport connection, except the coordinated DCH used to obtain unequal error protection in the air interface.

Basic Inter-RNC mobility Dedicated Channel Traffic Common Channel Traffic Global Resource Management
For this reason, the Iur signalling protocol Radio Network System Application Part (RNSAP) is divided into four different modules: Iur-1 thru Iur-4

4.2.3 Iur-3
This functionality allows handling of common and shared channel data streams across the Iur interface. It requires the Common Transport Channel module of RNSAP and the Iur Common

Figure 8: Iur interface protocol stack

Transport Channel Frame Protocol (CCH FP). The Q.2630.1 signalling protocol of the Transport Network Control Plane is needed if AAL2 connections are used.

4.2.4 Iur-4
Iur-4 provides signalling to support enhanced radio resource and O&M features across the Iur interface. It is implemented via the global module of RNSAP and does not require any User Plane Protocol, since there is no transmission of user data across the Iur interface.

In order to understand the above two protocols, the logical model of Node B must be first understood. Referring to Figure 10, a common signalling link exists between the RNC and the Node B. There is also a set of traffic termination point each controlled by a dedicated signalling link. One traffic termination point controls a number of mobiles having dedicated resources in the Node B, and the corresponding traffic is conveyed through dedicated data ports. Common data ports outside the traffic termination points are used to convey RACH, FACH, and PCH traffic. The User Plane Iub frame protocols define the structures of the frames and the basic in-band control procedures for every type of transport channel (ie. RACH, FACH, and PACH). Finally, Q.2630.2 signalling is used for dynamic management of the AAL2 connections used in the User Plane.

4.3 UTRAN-NODE B Interface: Iub

The protocol stack of the RNC-Node B interface is shown in Figure 9. The stack resembles the Iur interface. The main difference being that in the Radio Network and Transport Network Control Planes SS7 stack is replaced by the simpler SAAL-UNI as signalling bearer.

Figure 10: Logical Model of Node B

4.3.1 Common NBAP

Figure 9: Iub interface protocol stack

The Iub signalling interface is divided into two components: the common Node B Application Part (NBAP) that defines the signalling procedures across the common signalling link, and the dedicated NBAP that used in the dedicated signalling link.

The main function of Common NBAP is the setup of the first radio link of one UE, and selection of the traffic termination point. It also handles RACH, FACH, and PCH channels.

4.3.2 Dedicated NBAP

When the RNC requests the first radio link for one UE via the C-NBAP, the Node B assigns a traffic termination

point for handling of this UE context, and every subsequent signalling related to this mobile is exchanged with dedicated NBAP procedures across the dedicated control port of the given Traffic Termination Point.

visited AAA server using the IP protocol within the IP network. The servers contacted by the PDSN or local AAA server may reside in other IP domains and be operated by other cellular operators.

5.1 Mobile Station (MS) 5 CDMA2000 Network Architecture

In cdma2000 architecture, mobile station (MS) gain access to a service provider network via the air interface to the Radio Network (RN). The service The main function of the MS is to establish, maintain, and terminate voice and data connections through the PDSN. The MS establishes a connection by requesting the appropriate radio resources from the RN. Once the connection is established, the mobile station is responsible for maintaining knowledge of radio resources, buffering packets from the mobile applications when radio resources are not in place or are insufficient to support the flow to the network. The mobile station optionally supports encryption and protocols such as Mobile IP and Simple IP.

5.2 Radio Network (RN)

Figure 9: CDMA Netork Architecture

provider network may be the users home access provider or, in roaming cases, the visited access provider network is used. Access mobility management is achieved using existing air interface procedures that include interactions with Visited Location Registers (VLR) and Home Location Registers (HLR). Information about access service parameters are maintained in the access service profile stored in the HLR and cached in the VLR while the mobile station is registered in the service provider access network. There is an open interface defined between the RN and the Packet Data Serving Node (PDSN) known as the R-P interface. The PDSN interacts with the local or

The Radio Network consists of two logical components: Packet Control Function (PCF) and Radio Resources Control (RRC). The primary function of the PCF is to establish, maintain, and terminate L2 connection to the PDSN. It also communicates with the RRC to request and manage radio resources in order to relay packets to and from the mobile station. During hard handoff to another RRC, the serving PCF forwards its information to the target PCF to reestablish packet data session to the PDSN. Finally PCF is responsible for collecting accounting information and forward them to the PDSN. RRC supports authentication and authorization of the mobile station for

radio access. It also supports air interface encryption to the mobile station.

5.5 Authentication, Authorization, and Accounting (AAA)

AAA has different personalities depending on the type of network to which the AAA server is connected. When an AAA server is connected to a service provider network, its major role is to pass authentication requests from the PDSN to the home IP network4, and authorize responses from the home IP network to the PDSN. It also stores accounting information for the MS and provides user profiles and QOS information to the PDSN. An AAA server connected to a home IP network authenticates and authorizes the mobile station based on requests from the local AAA. Finally, an AAA server provisioned in the broker network forwards requests and responses between service provider network and the home IP network which do not have bilateral associations.

5.3 Packet Data Serving Node (PDSN)

PDSN incorporates numerous functions within one node. Routing packets to the IP networks or directly to the HA is the major effort of PDSN. It assigns dynamic IP addresses and maintains PPP sessions to the mobile stations. It initiates authentication, authorization, and accounting to the AAA for the mobile station packet data session3. In return, the PDSN receives user profile parameters of the mobile station from the AAA. The user profile may contain differentiated services and security. PDSN may optionally supports Foreign Agent (FA) functionalities such as reverse tunneling, registration, and dynamic home agent and home address assignment.

5.4 Home Agent (HA)

Home Agent (HA) plays a major role in implementing the Mobile IP protocol by redirecting packets to the Foreign Agent (FA), and receive and route reverse tunneled packets from the FA. HA provides security by authenticating mobile station through Mobile IP registration. HA also maintains direct connection with AAA in order to receive provisioning information for subscribers.

6 CDMA2000 Network Protocol

CDMA2000 network supports two types of protocol: Simple IP and Mobile IP. Simple IP is deployed for service in which the mobile user is assigned a dynamic IP address from the local PDSN and provided IP routing service by a service provider network. The mobile user can retain its IP address as long as it is served by a RN which has connectivity to the address assigning
4

An instance of continuous use of packet data serviced by the user.

The home network that provides IP based data services to the user.

PDSN. However, there is no IP address mobility beyong this PDSN. Mobile IP provides IP routing service to a public IP network and/or secure IP routing service to predefined private IP networks. The mobile user is able to use either a static IP address or dynamically assigned IP address belonging to its home IP network HA. Regardless of whether the mobile is assigned a static or dynamic IP address, it should have a static and persistent HA address to allow seamless handoff between RNs that are connected to separate PDSNs. Figure 12 and 13 illustrates a Simple IP and Mobile IP network respectively.

6.1 Simple IP 6.1.1 Point-To-Point (PPP)

CDMA2000 usues PPP as the data link protocol. Only one PPP session is allow to be established between the MS and the PDSN. Figure 14 shows the network protocols when Simple IP is deployed. The PDSN initiates a PPP session by sending a LCP Configure-Request to the mobile station immediately after an R-P session is established. There are two circumstances in which a PPP session is terminated. First, if an R-P session is closed (either mobile or PDSN intends to close the physical connection), the packets buffered by the PDSN will be discarded and an ICMP destination unreachable packet is sent back to the sender. Then the PPP session is terminated. Second, if the PPP session is idle for a certain period, the PDSN will release the R-P session to the RN and terminate the PPP session in order to better utilize network resource.

Figure 12: Simple IP Network

Figure 10: Simple IP Protocol

6.1.2 Link Access Control (LAC)

LAC runs on top of PPP. It consists of five sub-layers: Authentication, ARQ, Addressing, Utility, and Segmentation and Reassembly. The Authentication sub-layer is responsible for the initial authentication and acts on only the Access Channel (i.e. MS to RN). The ARQ sub-layer assured and unassured

Figure 13: Mobile IP Network

delivery of data. Assured means received data are acknowledged, loss and out-of-order data are selectively retransmitted, and duplicate data are discarded. Addressing sublayer presents only on the common channels. Its function is to assign and match sender and receiver mobile addresses of the following types: IMSI and ESN, ESN, IMSI, IMSI and ESN, TMSI. Utility sub-layer assembles and reasembles LAC PDU by adding message type, encryption, radio environment report, LAC padding and length, and arranging LAC PDU with L3 PDU. Finally, SAR sublayer converts PDU to bitstream (and vice versa), and adds message length and CRC.

protocol running above the MAC protocol.

6.1.4 Physical Layer

The physical layer provides the air and wired interface specific function such as modulation/demodulation, coding/decoding, and power control. CDMA2000 physical layer consists of forward (RN to mobile) and reverse (mobile to RN) radio channels that are derived from the 2G CDMA predecessors.

6.2 Mobile IP
Mobile IP (MIP) introduces a framework of procedures, messages, and message formats that enables a mobile user to change handoff from one PDSN to another without requiring alteration of its IP address, which would otherwise disrupt L3 and higher operations. MS, PDSN and HA all support Mobile IP agent advertisement, MIP extensions, reverse tunnelling, etc.

6.1.3 Medium Access Control (MAC)

MAC offers procedures for controlling access of data services to the physical layer. MAC also guarantees reliable transmission over the Radio Link Protocol (RLP) which provides besteffort delivery service. Besides maintaining data integrity, the MAC layer provides multiplexing of logical channels to/from physical channels based on logical and physical mapping table. MAC also enforced negotiated QOS parameters by mediating conflict requests from competing services and appropriately prioritizing access. Signalling Radio Burst Protocol (SRBP) is one of the MAC protocol used in cdma2000 to communicate L3 signalling function via LAC ARQ sub-layer on the Access channel. Its responsibility is to select access mode and access procedure. Another MAC control chosen is the Radio Link Protocol (RLP) that comes with limited ARQ capability. It is designed to support reliable internet

6.2.1 IP Security and Internet Key Exchange Protocol (IPSec/IKE)

IPSec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating IPSec devices. IPSec uses IKE to handle negotiation of protocols and algorithms based on local policy, and to generate the encryption and authentication keys to be used by IPSec. Mobile IP authentication consists of three parts:

 PDSN initiated access authentication

and authorization authentication

HA initiated Mobile IP registration FA and HA Security Association

For the first case, CHAP5 authentication is used during PPP setup and Mobile IP registration with FAC extension. For the second case, PAP authentication with Mobile Station key distribution are used along with HA local authentication with statically configured key for MS-HA security association. For the final case, options is either to have no security association, or have the following security keys:
Figure 12: Mobile IP User Data Protocol

7 Conclusion
UMTS and CDMA2000 architecture both share the same IMT-2000 vision to provide high bandwidth wireless internet access. Although each approach receives substantial influence from its predecessor, both architecture are designed to be IP-centric with welldefined air and wire interfaces. The requirement of seamless convergence of traditional voice transmission and increasing demand of data delivery will create new business opportunities for manufacturers, operators and providers of content and applications.

Static configured FA-HA shared key Dynamic distributed FA-HA shared

key key

IKE/IPSEC with statically shared IKE/IPSEC with dynamically

distributed from Home RADIUS server as defined in X.509

IKE/IPSEC with public certification

8 References
[1] 3GPP Technical Specification 25.401 UTRAN Overall Description [2] 3GPP Technical Specification 25.410 UTRAN Iu Interface: General Aspects and Principles [3] 3GPP Technical Specification 25.420 UTRAN Iu Interface: General Aspects and Principles [4] 3GPP Technical Specification 25.430 UTRAN Iub Interface: General Aspects and Principles

Figure 11: Mobile IP Control and IKE Protocol

[5] 3GPP2 P.S0001-A Version 3.0.0 Wireless IP Network Standard

Chanllenge Handshake Authentication Protocol

[6] 3GPP2 P.R0001 Version 1.0.0: Wireless IP Architecture Based on IETF Protocols [7] 3GPP2 C.S0003-A: Medium Access Control (MAC) Standard for cdma2000 Spread Spectrum Systems [8] 3GPP2 C.S0004-0: Signaling Link Access Control (LAC) Standard for cdma2000 Spread Spectrum Systems