domain.

This is realised by the introduction of a new platform, the IP Multimedia

Subsystem (IMS) that is added to the existing PS architecture.
In this chapter the basic aspects of the UMTS system are introduced with special emphasis
CHAPTER 2 on the Packet Switched Core Network and the IP Multimedia Sub-system. Two major
architectural views are presented, the network element centric perspective and the

The UMTS System interface-centric one. The first approach refers to the UMTS functional architecture, which
defines the system in a network centric manner by allocating with them the major system-
level management functions. The second, on the other hand, allude to the UMTS network
The Universal Mobile Telecommunications System (UMTS) is a third generation (3G) from an interface-centric view, focusing on the system protocols.
mobile communications system that provides a range of broadband services to the world of
wireless and mobile communications. This chapter presents an overview of the UMTS
architecture specified by the Third Generation Partnership Project (3GPP), focusing on the
network elements relevant to the study presented here.

The evolution towards an All-IP network, within the 3GPP, is occurring in several steps,
known as releases [6, 7]. Earlier UMTS specifications, with a relatively strong retention of
the current 2nd generation networks, were still switch centric. However, the introduction of
a new IP platform, when fully specified, will provide the UMTS system with multiple
wireless access options and full IP packet support.
The first version of the UMTS Specification, 3GPP Release 99, defines a system which
adopts much of the functionalities of the GSM/GPRS core network and introduces a new
wireless access technology, namely wideband code division multiple access (WCDMA).
This access technology increases the 2G systems capacity to higher data rates enabling the
support of advanced services. 3GPP Release 4, further optimizes the air interface, although
the major changes are targeted at the core network circuit switched domain, still present in
order to maintain full coverage for second-generation services. These changes result in the
separation of user data flows and their control systems into different physical entities, the
Mobile-services Switching Centre (MSC) and the Media Gateway (MGW) respectively.
Finally Release 5/6 provides a migration from conventional Circuit-Switched speech
services served by CS domain to enhanced IP-based services using a Packet-Switched

5 6
2.2 ARCHITECTURE OVERVIEW 2.2.1 UMTS Radio Access Network

The UMTS system consists of a number of logical network elements connected through UTRAN is subdivided into individual Radio Network Systems (RNSs), where each one is

open interfaces or access points. Functionally these elements are grouped into the Radio controlled by a Radio Network Controller (RNC) [10]. Within a RNS, the RNC is

Access Network (RAN, UMTS Terrestrial RAN - UTRAN) and the Core Network (CN) [8, connected to a set of NodeB elements, each of which can serve one or several cells.

9]. The UTRAN handles all radio-related functionality, Radio Resource and Mobility UTRAN is located between two new open interfaces, Uu and Iu. The Uu Interface is a

Management (RRM and MM). Whereas, the CN is responsible for switching and routing WCDMA radio interface through which the UE accesses the fixed part of the system. Iu

calls and data connections to external networks at the same time as managing session and connects the UTRAN to the CN.

mobility information, Communication and Mobility Management (CM and MM). The main task of UTRAN is to create and maintain Radio Access Bearers (RABs) for

The system is completed by the User Equipment (UE) or 3G terminal [8], which interfaces communication between User Equipment (UE) and the Core Network (CN). With RAB the

with the user and the radio interface. The high-level architecture is shown in Figure 2.1. CN elements are given an illusion of a fixed communication path to the UE.
While in GPRS/EDGE networks the logical link is defined between UE and SGSN, so-
UTRAN CN called Radio Access Bearers (RABs) are defined between UE and the UTRAN. Hence, the
RNS CS Domain
locations of several functions have been shifted from the SGSN which is part of the GPRS
Iub
Node B
Iub
3G MSC/VLR 3G GMSC CN to the Radio Network Controller (RNC) in UTRAN. A 3rd Generation Serving GPRS
RNC
HSS ISDN CSPDN Support Node (3G-SGSN) no longer comprises logical link management functions.
Node B
Iur PSTN

PS Domain
2.2.1.1 NodeB
Iub Gn Gi
Node B IMS NodeB is the physical unit for radio transmission/reception in cells. Depending on
Iub 3G SGSN 3G GGSN
UE RNC sectoring (omni/sectored cells), one or more cells may be served by a NodeB. NodeB
Node B
connects with the UE via the WCDMA Uu radio interface and with the RNC via the Iub
Radio Iu
(Uu) asynchronous transfer mode (ATM) – based interface.
Figure 2.1 - UMTS functional Architecture The main task of Node B is to perform the air interface Layer 1 processing (transfer

The collection of at least one logical network element of each type defines a UMTS Public information from transport to physical channels) although it also participates in some basic

Land Mobile Network (PLMN). The UMTS PLMN is a fully featured and operational Radio Resource Management (RRM) operation. However, RNC is where the radio

network, either on its own or together with other sub-networks, that provides land mobile resources are managed.

telecommunication services to the public. Each PLMN, typically established and operated
by a single operator, is connected to other PLMNs as well as to other types of networks,
such as Integrated Services Digital Network (ISDN), Public Switched Telephone Network
(PSTN), Internet, and so on.

7 8
2.2.1.2 Radio Network Controller
The Radio Network Controller (RNC) is the switching and controlling element of the
UTRAN located between the Iub and Iu interface. It also has a third interface called Iur for
inter-RNS connections.
The RNC interfaces the CN for both Packet-Switched and Circuit-Switched service
domains and also terminates the Radio Resource Control (RRC) protocol that defines the
messages and procedures between the mobile and UTRAN. The whole functionality of a
RNC can be grouped into two parts, UTRAN Radio Resource Management (RRM) and
control functions. The RRM is a collection of algorithms used to guarantee the stability of
the radio path and the QoS of radio connection by efficient sharing and managing of the
radio resources. The UTRAN control functions include all of the functions related to set-
up, maintenance and release of Radio Bearers including the support functions for the RRM
algorithms.
Logical Role of RNC
The RNC controlling one Node B (i.e. terminating the Iub interface towards the Node B) is
indicated as the Controlling RNC (CRNC) of the Node B. The CRNC is responsible for the
load and congestion control of its own cells, and also executes the admission control and
code allocation for new radio links to be established in those cells.
In case one mobile-UTRAN connection uses resources from more than one RNS, the RNCs
involved have two separate logical or functional roles:
• Serving RNC. The SRNC is the RNC that terminates both the Iu link for the
transport of user data and the corresponding RAN Application Part (RANAP)
signalling to/from the core network. The SRNC also terminates the Radio Resource
Control Signalling, that is the signalling protocol between the UE and UTRAN. The
SRNC may also be the CRNC of some Node B used by the mobile for connection
with UTRAN. One UE connected to UTRAN has only one SRNC.
• Drift RNC. The DRNC is any RNC, other than SRNC, that controls cells used by
the mobile. The DRNC is involved in the active connection through an inter-RNC
soft-handover. Each UE may have zero, one or more DRNCs.
9 10
2.2.2 UMTS Core Network
The UMTS Core Network (CN) can be seen as the basic platform for all communication
services provided to the UMTS subscribers. The basic communication services include
switching of circuit-switched calls and routing of packet data. In order to handle both types
of user traffic as well as the related signalling, the CN is functionally further divided into
two domains, circuit switched domain (CS domain) and packet switched domain (PS
domain).
2.2.2.1 Circuit Switched CN
The CS domain refers to the set of all CN entities offering a “CS type connection”. In such
connection dedicated network resources are allocated at connection establishment and
released at connection release.
The entities specific to the CS domain are the Mobile-services Switching Centre (MSC),
the Media Gateway and the Gateway MSC (GMSC). Release 4 explains in detail its
functionalities [9]; more detail is not provided as the CS domain is not the basis of the
investigation presented in this thesis.
2.2.2.2 Packet-Switched CN
On the other hand, the PS domain offers "PS type connection", which transports the user
information using autonomous concatenation of bits called packets. The information is split
into separated but related packets before being transmitted and is reassembled at the
receiving end.
The CN PS domain in UMTS has two basic network elements evolved from 2.5G General
Packet Radio System (GPRS), the Serving GPRS Support Node (SGSN) and the Gateway
GPRS Support Node [11, 12]. The GGSN is the node that is accessed by the packet data
network due to the evaluation of the PDP address. It contains routing information for PS-
attached users. The routing information is used to tunnel N-PDUs to the UE’s current point
of attachment, i.e. the SGSN. The GGSN may request location information from the HSS.
As mentioned earlier, the PS CN has been extended with the IP multimedia CN sub-system
(IM CN) functionality. This new platform enables PLMN operators to offer their
subscribers multimedia services based on Internet applications and protocols.
2.2.3 IP Multimedia Sub-system
The IP Multimedia CN sub-system (IMS) comprises all CN elements for provision of
multimedia services. This includes the collection of signalling and bearer related network
elements as defined in TS 23.002 [9] and TS 23.922 [13]. Such services are based on IETF
defined session control capability, which along with multimedia bearers utilises the PS
domain.
In order to achieve access independence and to maintain a smooth interoperation with wire-
line terminals across the Internet, the IP multimedia subsystem interfaces uses an IETF
defined protocol, the Session Initiation Protocol (SIP) [14].
The IM CN sub-system enables the convergence of, and access to, voice, video, messaging,
data and web-based technologies for the wireless user.
The IMS introduces three main logical network elements to the existing infrastructure: the
Call Session Control Function (CSCF), the Media Gateway Control Function (MGCF) and
the Media Gateway (MGW). The Home Subscriber Server (HSS) is also introduced
providing user profile information similar to that of today’s HLR.
2.2.3.1 Call Session Control Function
The Call Session Control Function (CSCF) is a SIP server that provides/controls
multimedia services for packet-switched IP terminals, both mobile and fixed. The Session
Control Function can take various roles as defined in 3GPP TS 23.228 [15]. It can act as
Proxy CSCF (P-CSCF), Serving CSCF (S-CSCF), Interrogating CSCF (I-CSCF), Breakout
Gateway CF (BGCF) or Multimedia Resource Function (MRF).
2.2.3.1.1 Proxy-CSCF
The Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IM CN
subsystem thus always located in the network where the UE resides. Its address is
discovered after or as a part of a successful PDP context activation. The P-CSCF forwards
SIP messages from UE to the specific I-CSCF or to the SIP server (S-CSCF) acting as a
SIP Proxy [14]. Furthermore, when the P-CSCF receives a SIP message containing Session
Description Protocol (SDP) information it triggers the Authorize QoS Resource procedure
[16]. Which will install the IP bearer level policy based on information from the SDP
payloads (end-points, bandwidth requirements, and characteristics of the media exchange).
2.2.3.1.2 Serving-CSCF

IP Multimedia Networks The Serving-CSCF (S-CSCF) is always assigned in the home network. It acts as a registrar
Legacy mobile
PSTN signalling Networks making information available through the location server (HSS) and subsequently performs

Mb Mb PSTN
the session control services for the registered endpoint. It handles the session states in the
BGCF CSCF
network for support of the services. As P-CSCF, the S-CSCF can also act as a SIP proxy
PSTN Mm
Mk Mk
server.
Mw
BGCF C, D,
Mj Gc, Gr
Mi 2.2.3.1.3 Interrogating-CSCF
Cx
IMS- HSS The Interrogating-CSCF (I-CSCF) is mainly the contact point within an operator’s network
MGCF CSCF
MGW Mg
Mn
for all IMS connections destined to a subscriber of that network operator, or a roaming
Mr Mw
Mb
subscriber currently located within that network operator’s service area. As the contact
MRFP MRFC P-CSCF UE
point, it accesses the HSS to resolve the SIP server addresses involved in the session (I-
Mp Gm

Mb Mb Mb IM Subsystem CSCF, BGCF or S-CSCF). It obtains the S-CSCF linked with the user in the registration
Go
procedure and the S-CSCF of the terminating counterpart in the session establishment.
Figure 2.2 – IM Subsystem entities

11 12
2.2.3.1.4 Breakout Gateway Control Function 2.2.3.4 Home Subscriber Server
The Breakout Gateway Control Function (BGCF) selects the network in which PSTN/CS The Home Subscriber Server (HSS) is the master database for 3G/UMTS Rel5/6 IP users.
Domain breakout is to occur forwarding the session signalling to another BGCF if it is a It contains the subscription-related information to support the network entities handling the
different one. Once in the network in which the inter-working with PSTN/CS domain is to IP session. This entity also integrates the Home Location Register (HLR) functionality for
occur, it selects a MGCF which will be responsible for such inter-working. Therefore this both packet and circuit domain, which is thereon considered as a HSS subset. As depicted
logical entity acts as a signalling entity for call/session control. in Figure 2.3 HSS provides heterogeneous information from core network diverse domains.
2.2.3.1.5 Multimedia Resource Function
The Multimedia Resource Function (MRF) is split into Multimedia Resource Function
HSS (HLR / UMS)
Controller (MRFC) and Multimedia Resource Function Processor (MRFP). MRFP controls
Subscription Location
the bearer on the Mb reference point and provides media stream resources to be controlled information information

by the MRFC.
Gr Gc Cx
2.2.3.2 Media Gateway (MAP (MAP
Mh
(IP based
based ) based ) interface)
The Media GateWay (MGW) terminates bearer channels from a circuit switched network
SGSN GGSN R-SGW CSCF
and media streams from a packet network.

2.2.3.3 Media Gateway Control Function Figure 2.3 – Basic HSS Structure
The Media Gateway Control Function (MGCF) entity controls the MGW and performs
translation at the call control signalling level between ISUP signalling, used in PSTN, and
SIP signalling, used in the UMTS multimedia domain.

13 14
2.3 UMTS PROTOCOL STRUCTURE 2.3.1 Transport Network Layer

The UMTS protocols are used to control the execution of network functions in a The transport network layer is the lowest of the UMTS protocol architecture thus providing

coordinated manner between the different UMTS domains. The general UMTS protocol facilities to transport and route both control and user traffic across all UMTS network

model is structured, as depicted in Figure 2.4, into horizontal layers and vertical planes, interfaces.

which are logically independent. The transport layer is subdivided into two protocols layers – the physical layer (L1) and the
data link layer (L2). The specified protocols can be grouped depending on the UMTS
UE Node B RNC SGSN GGSN
interfaces they refer to, UMTS radio interface or UMTS terrestrial interface. Figure 2.5
USER PLANE
CONTROL PLANE
illustrates the UMTS transport protocols (coloured blue).
System Network Layer
Radio Interface Terrestrial Interfaces
USER PLANE
CONTROL PLANE Uu Iub Iu
RRC/ RRC/ RANAP/ RANAP/
Radio Network Layer PDCP PDCP Iu FP Iu FP
USER PLANE
CONTROL PLANE

RLC RLC
Transport Network Layer
Layer 2
MAC MAC
Figure 2.4 - UMTS protocol internetworking architecture
FP FP
The horizontal decomposition separates (generic) transport aspects from (UMTS-specific) Layer 1
Transport
Layers
Transport
Layers
Transport Transport

mobile networking aspects by dividing the UMTS protocol into three layers. The lower WCDMA WCDMA
L1 L1
layer, named Transport network layer, is responsible for providing the general-purpose UE Node B SRNC CN

transport service for all UMTS network elements across the interfaces. Whereas, the Radio
network and the System network layer, which are by definition UMTS system-specific
protocols, divide UMTS system functionality among the network elements.
Within all three layers it is then possible to distinguish between control aspects and user
data transfer aspects, which creates the vertical structuring to the UMTS protocol model.
While the control plane protocols ensure system-wide control of communication resources
and services, the user plane protocols are used to transparently transmit user data.
The next section will give a detailed overview of the UMTS protocols as defined by 3GPP.
The different UMTS layers are analysed separately and if the data and user protocols
domains differ, detailed information is given.
Figure 2.5 - UMTS Transport network protocols
2.3.1.1 WCDMA Physical Layer
The physical layer of the UMTS radio interface is based on the WCDMA radio technology
[17], whereas terrestrial interfaces are typically based on digital transmission technology,
such as ATM, although they are open to operator definition.
In UTRAN the data generated at higher layers is carried over the air with transport
channels, which are mapped to different physical channels in the physical layer. Transport
channels are always unidirectional and either common (i.e., shared among several users) or
dedicated (i.e., allocated to a specific user). The following transport channels are defined in
WCDMA [18]:

15 16
 • Broadcast Channel (BCH) – Downlink common transport channel used to broadcast
specific system and cell information.
• Forward Access Channel (FACH) – Downlink common transport channel used to
carry control information and short user packets to a UE, the location cell of which is
known to the system.
• Paging Channel (PCH) – Downlink common transport channel that carries control
information to a UE, the location cell of which is not known by the system. When the
network initiate communication with the terminal, i.e. paging procedures, uses the
PCH.
• Random Access Channel (RACH) – Uplink common transport channel intended to
be used to carry control information such as requests to set up a connection and short
user packets from the terminal.
• Dedicated Channel (DCH) – Downlink or uplink dedicated channel used to carry
user data or control information intended for a given user.
Within UTRAN, the SRNC is responsible for the radio interface related activities for UE
on the WCDMA transport channel level and the Node Bs actually only maintain the
WCDMA physical channels as depicted in Figure 2.5.
2.3.1.2 Transport Network Protocols in Uu Interface
Over the Uu interface the L2 is defined with two specific UMTS link protocols, the
Medium Access Control protocol (MAC) [19] and the Radio Link Control protocol (RLC)
2.3.1.2 Transport Network Protocols over terrestrial Interfaces
Unlike in the radio interface the L2 transport network protocol for the UMTS terrestrial
interfaces use two major existing protocols suites, the ATM protocol and the TCP/UDP/IP
protocol family. Those non-specific UMTS protocols are introduced in the stack in
combination with some adaptation protocols, such AAL(n) for ATM and a GPRS tunneling
protocol (GTP) in the IP case. The IP-based transport is widely applied only within the CN
PS domain backbone network and at the Iu interface for PS domain user plane traffic
whereas the ATM transport protocol is dominating on the UTRAN side.
2.3.2 Radio Network Layer
The radio network protocols compose the next layer (L3) on top of the generic transport
network protocols discussed above. The radio network extends from UE across the access
network (UTRAN) and terminates at the edge nodes of the CN. Layer 3 protocols are
defined to perform UTRAN–specific signalling and control.
2.2.2.1 Radio Network Control Plane
The control plane protocols in the radio network layer execute all control needed for
management of radio access bearers (RABs). UTRAN-specific control protocols exist in
each of the four interfaces as depicted in the Figure 2.6.
Uu Iub Iur Iu

[20]. MAC is responsible for mapping logical channels, characterized by the type of data RRC NBAP NBAP RNSAP RNSAP RRC RANAP RANAP

transported, onto the appropriate transport channels. On the other hand, RLC provides
segmentation/reassembly of variable-length higher layer Protocol Data Units (PDUs) into
smaller RLC Payload Units (PUs) and it also provides error correction through packet
retransmission. These transport layers are present in both user and control plane but
offering different services to the upper-layers. On the control plane the RLC services,
known as Signalling Radio Bearers, are used by the RRC network layer; whereas on the
UE Node B DRNC SRNC CN
user plane are used by the service-specific protocol layers such Packet Data Convergence
Figure 2.6 - Control Plane Radio Network Protocols
Protocol (PDCP) on the PS domain.

17 18
The Radio Resource Control (RRC) protocol [21, 17] operates between the UE and the 2.3.3 System Network Layer
RNC. The main function of the RRC protocol is to control the radio bearers for user plane
traffic (RRM) using the signalling radio bearers established in the RRC connection Once the radio network protocols have facilitated the communication across the UTRAN
procedure. RRC also handles all higher-layer signalling belonging to the non-access sub-network by maintaining the communication path to the mobile terminals, it is the
stratum protocols (MM, CM, CM, etc.) and the mobility of user equipment in the connected system network protocols, which create the communication service to the users of those
mode (cell update, UTRAN registration area – URA - update and active set update). terminals. The system protocols operate on top of the radio network transparently through
the radio access (non-access stratum) and within the UMTS CN itself.
The Radio Access Network Application Part (RANAP) [22] allows the CN domain to
The non-access stratum refers to the group of control plane protocols, which controls
access the services provided by the UTRAN. It handles the control of the resources
the communication between UEs and CN [26]. The protocols in this group belong to two
between the RNC and the core network. It is located on top of the Iu signalling transport
sub-layers of the system network as shown in Figure 2.7.
layers (SS7 in the CS case or IP protocol stacks over ATM in the IP case).
The remaining Application Parts protocols, NodeB AP (NBAP) [23] and RNS AP
Uu Iu
(RNSAP) [24], maintain control plane signalling across the UTRAN Iub and Iur interfaces Session
SS SMS SM SS SMS SM
providing means for the two AP peers to communicate.
GPRS MM MM Context GPRS MM
2.2.2.2 Radio Network User Plane
The user-plane protocols are used to transfer user data along the radio access bearers Signalling Connection
established by the control plane. The UTRAN frame protocols (FP) carry the UMTS data
UE RNC SGSN
across the UTRAN interfaces (Iu, Iur & Iub) using the specific transport network.
In addition, on the WCDMA radio interface, the Packet Data Convergence Protocol Figure 2.7 - Control Plane System Layer Protocols

(PDCP) is required in order to get better spectral efficiency for services requiring IP
The lower Mobility Management (MM) sub-layers operates over the signalling connection
packets (PS domain). The PDCP, as defined in 3GPP 25.323 [25], makes the UMTS radio
provided by the radio network. On top of the MM sub-layer, the service specific
interface applicable to carry Internet Protocol (IP) data packets providing compression of
Communication Management (CM) protocols operate providing Session Management
redundant protocol control information, transfer of user data and multiplexing radio bearers
(SM), Supplementary service (SS) and GPRS Short Message Service (GSMS) for the PS
into one RLC entity.
CN domain.

On top of the above-mentioned UMTS network layer, for the data plane, reside the
application and transport layers, with IP defined protocols, necessary for the provision of
the end-to-end communication. However, as they are not UMTS signalling specific, their
operation analysis will be presented in the next chapter.

19 20