2
`
`Wireless IP Network
`Architectures
`
`This chapter examines the wireless IP network architectures defined by 3GPP and
`3GPP2, respectively, and the all-IP wireless network architecture defined by
`MWIF.
`
`2.1 3GPP PACKET DATA NETWORKS
`
`This section discusses the 3GPP packet network architecture based on Release 5 of
`the 3GPP Technical Specifications. Release 5, completed in June 2002, was the
`latest release during the writing of this book. We will describe
`
`. 3GPP network architecture (Section 2.1.1)
`. Protocol reference model (Section 2.1.2)
`. Traffic and signaling bearers and connections for supporting packet-switched
`services (Section 2.1.3)
`. Packet Data Protocol (PDP) context (Section 2.1.4)
`. Steps for a mobile to access packet data network and services (Sections 2.1.5)
`. User packet routing and transport (Section 2.1.6)
`. How a mobile acquires IP addresses for accessing 3GPP packet data services
`(Section 2.1.7)
`. Key procedures used in the packet data network (Sections 2.1.8 through
`2.1.10)
`
`IP-Based Next-Generation Wireless Networks: Systems, Architectures, and Protocols,
`By Jyh-Cheng Chen and Tao Zhang. ISBN 0-471-23526-1 # 2004 John Wiley & Sons, Inc.
`
`33
`
`Page 1 of 88
`
`GOOGLE EXHIBIT 1020
`
`

`

`34
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`. Protocol stacks for packet data network (Section 2.1.11)
`. How to use a 3GPP packet network to access other IP networks (Section
`2.1.2)
`
`2.1.1 Network Architecture
`
`A public network administrated by a single network operator for providing land
`mobile services is referred to as a Public Land Mobile Network (PLMN). The
`conceptual architecture of a 3GPP PLMN is illustrated in Figure 2.1. It consists of
`one or more Radio Access Networks (RANs) interconnected via a Core Network
`(CN).
`A RAN provides radio resources (e.g., radio channels, bandwidth) for users to
`access the CN. Release 5 currently supports GSM/EDGE RAN (GERAN) and
`UMTS Terrestrial RAN (UTRAN). Work is underway on 3GPP to specify how to
`
`Fig. 2.1 3GPP conceptual network architecture (Release 5)
`
`Page 2 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`35
`
`support Broadband Radio Access Networks (BRANs), such as IEEE 802.11 [25],
`[35].
`A GERAN is divided into Base Station Subsystems (BSS). Each BSS consists of
`one or multiple Base Transceiver Stations (BTSs) and Base Station Controllers
`(BSCs). A BTS maintains the air interface. It handles signaling and speech pro-
`cessing over the air interface. A BSC controls the radio connections toward the
`mobile terminals as well as the wireline connections toward the CN. Each BSC can
`control one or more BTSs.
`A UTRAN is divided into Radio Network Subsystems (RNS). Each RNS
`consists of one or multiple Node Bs controlled by a Radio Network Controller
`(RNC). A Node B is a wireless base station, which is analogous to a BTS in GSM,
`and it provides the air interface with mobile terminals. An RNC, which is analogous
`to a BSC in GSM, controls the radio connections toward the mobile terminals and
`the wireline interfaces with the CN.
`The CN implements the capabilities for supporting both circuit-switched and
`packet-switched communication services to mobile users. These communication
`services include both basic services and advanced services. Basic circuit-switched
`services include switching of circuit-switched voice and data calls and call control
`functions for supporting basic point-to-point circuit-switched calls. Basic packet-
`switched services include the routing and transport of user IP packets. Advanced
`services, commonly referred to as supplementary services or value-added services,
`include any service that provides added value beyond the basic services. Examples
`of advanced circuit-switched services include prepaid calls, toll-free calls, call
`forwarding (e.g., forwarding a voice phone call to another phone or to an E-mail
`box), multiparty communications, and pay-per-view. Advanced packet-switched
`services may include all services or applications over IP networks beyond simple
`packet transport. Some examples are e-mail, World-Wide Web, location-based
`services, multimedia messaging services, networked gaming, and e-commerce.
`The CN is divided into the following functional building blocks [21], [23]:
`
`. Circuit-Switched (CS) Domain
`. Packet-Switched (PS) Domain
`. IP Multimedia Subsystem (IMS)
`. Information Servers
`
`Each RAN routes circuit-switched traffic to the CS CN domain and routes
`packet-switched traffic to the PS CN domain.
`
`2.1.1.1 Mobile Devices, Subscribers, and Their Identifiers A mobile
`device in GSM is called Mobile Station (MS), which is synonymous with User
`Equipment (UE) in UMTS.1 Figure 2.2 illustrates the functional architecture of a
`UE, which consists of Mobile Equipment (ME) and UMTS Subscriber Identity
`
`1In this book, MS and UE are used interchangeably.
`
`Page 3 of 88
`
`

`

`36
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`Fig. 2.2 Functional architecture of a user equipment (UE)
`
`Module (USIM) [13]. USIM is developed based on the Subscriber Identity Module
`(SIM) used in GSM systems. A ME, consisting of Mobile Termination (MT) and
`Terminal Equipment (TE), is the device a user uses to access the network services.
`TE provides functions for the operations of the access protocols. MT, on the other
`hand, supports radio transmission and channel management. Depending on
`applications, an MT may have a combination of different Terminal Adapters (TA).
`In realization, MT could also be a mobile handset and TE could be a laptop
`computer. It is also possible to integrate MT and TE in the same device.
`Each MT is identified by a globally unique International Mobile Station
`Equipment Identity (IMEI) [15].
`A mobile station may be configured to access the PS domain only, the CS
`domain only, or both the CS and the PS domains.
`Each subscriber to 3GPP network services is assigned a globally unique
`International Mobile Subscriber Identity (IMSI) as its permanent identifier. A
`subscriber uses its IMSI as its common identifier for accessing PS services, CS
`services, or both PS and CS services at the same time.
`A subscriber’s IMSI is stored on a USIM on a mobile station. A subscriber can
`move its USIM from one mobile station to another so that the subscriber can use
`different mobile stations to access the network while being identified by the
`network as the same subscriber.
`The network uses the IMSI to identify a subscriber and to identify the network
`services and resources used by a subscriber for billing purpose. A mobile’s IMSI
`may be used as the mobile’s identifier at multiple protocol layers in 3GPP, e.g., at
`the physical layer, link layer, and the network layer.
`An IMSI can consist of only numerical characters 0 through 9. It contains three
`parts as shown in Figure 2.3 [15]:
`
`Page 4 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`37
`
`Fig. 2.3 Structure of International Mobile Subscriber Identity (IMSI)
`
`. Mobile Country Code (MCC): The MCC uniquely identifies a mobile
`subscriber’s home country.
`. Mobile Network Code (MNC): The MNC uniquely identifies a mobile
`subscriber’s home PLMN in the mobile subscriber’s home country. The MNC
`can be two or three digits in length, depending on the value of the MCC.
`. Mobile Subscriber Identification Number (MSIN): The MSIN uniquely
`identifies a mobile subscriber within one PLMN.
`
`Allocation of MCCs is administrated by the ITU-T according to ITU-T Blue
`Book Recommendation E.212. MNC þ MSIN is commonly referred to as the
`National Mobile Subscriber Identity (NMSI). The NMSIs are allocated by the
`numbering administrations in each country. When more than one PLMN exists in a
`country, a unique MNC is assigned to each of these PLMNs.
`To reduce the need to transmit IMSI, which uniquely identifies a mobile
`subscriber, over the air, 3GPP uses a Temporary Mobile Subscriber Identity (TMSI)
`to identify a mobile whenever possible. A TMSI is a four-octet number assigned to
`a mobile temporarily by an MSC/VLR for circuit-switched services or by an SGSN
`for packet-switched services. The two most significant bits in a TMSI indicates
`whether the TMSI is for packet-switched services. A TMSI for packet-switched
`services is referred to as a Packet TMSI or P-TMSI. An MSC or SGSN uses a TMSI
`to uniquely identify a mobile. The TMSI will only be allocated in ciphered form.
`Furthermore, measures will be taken to ensure that the mapping between a mobile’s
`IMSI and TMSI is known only by the mobile and the network node (MSC or
`SGSN) that assigned the TMSI (Section 2.1.8). A mobile’s TMSI, instead of its
`IMSI, will then be used as the mobile’s identity whenever possible in signaling
`messages transmitted over the air. As only the mobile and the MSC or SGSN that
`assigned the TMSI to the mobile know the mapping between the mobile’s IMSI and
`TMSI and that a TMSI is valid only when the user is served by the MSC or SGSN
`that assigned the TMSI, the security impact of transmitting unencrypted TMSI over
`the air is lower than transmitting unencrypted IMSI.
`To send and receive IP packets over the PS CN, a mobile also needs to be
`configured with at least one IP address. The mobile may use multiple IP addresses
`simultaneously. However, a mobile is not required to have a valid IP address at all
`
`Page 5 of 88
`
`

`

`38
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`times while it is attached to the PS domain. Instead, a mobile may acquire an IP
`address only when it needs to activate packet data services over the PS CN.
`
`2.1.1.2 Circuit-Switched Domain in Core Network The CS domain
`consists of all the CN entities for providing circuit-switched voice and data services
`to mobile users. The CS CN domain is built on the GSM core network technologies.
`Its main network entities are:
`
`. Mobile-services Switching Center (MSC)
`. Gateway MSC
`. Visitor Location Register (VLR)
`. Home Subscriber Server (HSS), Equipment Identity Register (EIR), and
`Authentication Center (AuC)
`
`The MSC performs switching and call control functions needed to provide basic
`circuit-switched services to mobile terminals. In addition, it also performs mobility
`management functions, including location registration and handoff functions for
`mobile terminals. The MSC interconnects RANs to the CS CN domain. One MSC
`may interface with multiple GSM BSSs or UTRAN RNSs.
`In 3GPP Release 5, the CS CN made a significant improvement over the
`previous releases: It allows the switching and call control functions of an MSC to
`be separated and implemented on separate network entities:
`
`. MSC Server for handling call control and mobility management.
`. CS Media Gateway (CS-MGW)
`for handling circuit switching, media
`conversion, and payload processing (e.g., echo canceller, codec) and payload
`transport over the circuits.
`
`Separation of switching and call control allows switching and call control
`technologies to evolve independently. It also helps increase network scalability. For
`example, one MSC Server can support multiple CS-MGWs and new MSC Servers
`and/or CS-MGWs can be added to increase call control and/or switching
`capabilities.
`A dedicated MSC called Gateway MSC (GMSC) may be used to interface with
`external circuit-switched networks. A GMSC is responsible for routing a circuit-
`switched call to its final destination in external networks. The switching and call
`control functions of a GMSC can also be separated and implemented on separate
`network entities: CS-MGW for switching and media control and a GMSC Server
`for call control.
`A VLR maintains location and service subscription information for visiting
`mobiles temporarily while they are inside the part of a network controlled by the
`VLR. It tracks a visiting mobile’s location and informs the visiting mobile’s HLR
`of the mobile’s current location. It retrieves a visiting mobile’s service subscription
`
`Page 6 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`39
`
`information from the mobile’s HLR, maintains a copy of the information while the
`visiting mobile is inside the part of the network controlled by the VLR, and uses the
`information to provide service control for the visiting mobile.
`A VLR is typically integrated with each MSC because no open standard
`interface has been defined between an MSC and a VLR. The Mobile Application
`Part (MAP) [12] protocol is used for signaling between a VLR and an HLR.
`The other information servers HSS, EIR, and AuC are shared by the CS and the
`PS domains and will be discussed in Section 2.1.1.5.
`
`2.1.1.3 Packet-Switched Domain in the Core Network The PS CN
`domain provides the following main functions for supporting packet-switched
`services:
`
`. Network access control: Determines which mobiles are allowed to use the PS
`domain. These functions include registration, authentication and authoriz-
`ation, admission control, message filtering, and usage data collection.
`. Packet routing and transport: Route user packets toward their destinations
`either inside the same PLMN or in external networks.
`. Mobility management: Provides network-layer mobility management func-
`tions. These functions include tracking the locations of mobile terminals,
`initiating paging to determine an idle mobile’s precise location when the
`network has data to send to the mobile, and maintaining up-to-date CN routes
`to mobiles as they move.
`
`The PS domain is built on the GPRS network platform. As in GPRS, the 3GPP
`PS CN domain consists of two main types of network nodes:
`
`. Serving GPRS Support Node (SGSN)
`. Gateway GPRS Support Node (GGSN)
`
`An SGSN interconnects one or more RANs to a PS CN. A SGSN performs the
`following specific functions:
`
`. Access control: The SGSN is responsible for the first line of control over
`users’ access to the PS CN domain. The GGSN provides an additional line of
`control for access to the PS CN domain.
`. Location management: The SGSN tracks the locations of mobiles that use
`packet-switched services. It may report the location information to the HLR
`so that the location information may be used, for example, by the GGSN to
`perform network-initiated procedures to set up connections to mobiles.
`. Route Management: The SGSN is responsible for maintaining a route to a
`GGSN for each mobile and to relay user traffic between the mobile and the
`GGSN.
`
`Page 7 of 88
`
`

`

`40
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`. Paging: The SGSN is responsible for initiating paging operations upon
`receiving user data destined to idle mobiles.
`. Interface with service control platforms: The SGSN is the contact point with
`CAMEL functions for GPRS and IP-based services. CAMEL (Customized
`Applications for Mobile Enhanced Logic) [11] is a set of procedures and
`protocols that allow a network operator to provide operator-specific services
`to its subscribers even when the subscribers are currently in foreign networks.
`For example, CAMEL can be used to provide prepaid services, such as
`prepaid calls and prepaid Short Message Services (SMS).
`
`A GGSN serves as the interface between the PS CN domain and any other
`packet network (e.g., the Internet, an intranet, the 3GPP IP Multimedia Subsystem).
`One GGSN can be used to support both GERANs and UTRANs. A GGSN provides
`the following specific functions:
`
`. Packet routing and forwarding center: A GGSN acts as a packet routing and
`forwarding center for user packets. All user packets to and from a mobile in a
`PLMN will be sent first to a GGSN, which we will refer to as the mobile’s
`serving GGSN. The mobile’s serving GGSN will then forward these user
`packets toward their final destinations.
`. Route and mobility management: A mobile’s serving GGSN tracks the SGSN
`that is currently serving each mobile (which we will refer to as the mobile’s
`serving SGSN). The GGSN maintains a route to the mobile’s serving SGSN
`and uses the route to exchange the user traffic with the SGSN.
`
`IP is used as the basic protocol for transporting traffic between SGSNs and
`between an SGSN and a GGSN. IP is also the routing protocol between GGSNs and
`between a GGSN and any other IP network.
`Private IP addresses may be used to address the SGSNs and GGSNs inside a
`PLMN. When a PLMN uses private IP addresses, Network Address Translators
`(NATs) will be needed to translate between the private IP addresses used inside a
`PLMN and the public IP addresses used over the public network so that mobiles
`inside the PLMN can communicate with terminals outside the PLMN. Each PLMN
`may have multiple logically separated IP networks referred to as IP Addressing
`Domains. Each IP Addressing Domain may also use private IP addresses internally.
`Gateways and firewalls may be used to interconnect IP Addressing Domains.
`SGSNs and GGSNs are also identified by SGSN Numbers and GGSN Numbers
`respectively. SGSN Numbers and GGSN Numbers are used primarily with non-IP
`protocols, e.g., MAP or other SS7 (Signaling System 7)-based protocols. SGSNs
`and GGSNs may need to use such non-IP protocols to communicate, for example,
`with the HSS.
`
`2.1.1.4 IP Multimedia Subsystem 3GPP Release 5 introduced the IP
`Multimedia Subsystem (IMS) that provides core network entities for supporting
`
`Page 8 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`41
`
`real-time voice and multimedia IP services. The IMS uses the Session Initiation
`Protocol (SIP) [49]—an application-layer signaling protocol defined by the IETF—
`for signaling and session control for all real-time multimedia services. SIP will be
`discussed in more detail in Chapter 3.
`The use of standard IETF protocols allows the IMS to be implemented without
`relying on the signaling protocols designed for the traditional circuit-switched
`networks. It also facilitates interworking between the IMS and external IP
`networks.
`We will discuss the IMS architecture in greater detail in Chapter 3.
`
`2.1.1.5 Information Servers The information servers maintain information
`necessary for the network to operate and to provide services to users. The CS and
`the PS domains share the same set of critical
`information servers. These
`information servers are as follows:
`
`. Home Subscriber Server (HSS): The HSS is the master logical database in a
`PLMN that maintains user subscription information needed by the network to
`control the network services provided to the users. The main component of the
`HSS is the Home Location Registrar (HLR), which maintains, for example,
`users’ identities, locations, and service subscription information.
`. Authentication Center (AuC): The AuC is a logical entity that maintains the
`information needed by the network to authenticate each user and to encrypt
`the communication over the radio path. Network entities access the AuC via
`the HSS. This eliminates the need for defining individual interfaces between
`the AuC and every network entity that needs to access the AuC.
`. Equipment Identity Register (EIR): The EIR is a logical entity that maintains
`the IMEIs of the subscribers.
`
`2.1.2 Protocol Reference Model
`
`Figure 2.4 provides a closer look at the 3GPP network architecture and shows the
`protocol reference model for both PS and CS domains [23]. A 3GPP network
`consists of a large number of functional interfaces, which can be classified into the
`following groups for ease of understanding:
`
`. RAN Internal Interfaces: The main interfaces inside a GSM BSS are the Abis
`interface between BSC and BTS and the Um interface between the mobile and
`the BTS. The Abis interface is defined in the 48-series of the 3GPP Technical
`Specifications.
`The main interfaces inside a UTRAN are as follows:
`– Iub interface between the RNC and the Node B.
`– Iur interface between two RNCs inside a UTRAN or between an RNC in
`the UTRAN and a BSC in a GERAN. Iur is a logical signaling interface
`used to support mobility between RNCs. It may be implemented even in
`
`Page 9 of 88
`
`

`

`42
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`Fig. 2.4 3GPP network architecture and protocol reference model (Release 5)
`
`the absence of a physical direct connection between two RNCs (or
`between an RNC and a BSC). For example, if no physical direct
`the Iur
`connection between two RNCs exists,
`interface may be
`implemented by tunneling the Iur interface signaling messages from one
`RNC to another via the SGSNs.
`– Uu interface between mobile and Node B. The Uu interface is defined in
`the 24- and the 25-series of the 3GPP Technical Specifications.
`The Iub and the Iur interfaces are defined in the 25.4xx-series of the 3GPP
`Technical Specifications.
`
`. RAN-to-CN Interfaces: The GSM BSS may interface with the CS CN domain
`via either the A interface or the Iu-CS interface. The A interface is defined in
`the 48-series of the 3GPP Technical Specifications. The GSM BSS can
`interface with the PS CN domain via either the Gb interface or the Iu-PS.
`A UTRAN connects to the PS CN domain via the Iu-PS interface and
`connects to the CS CN domain via the Iu-CS interface. The Iu-CS and Iu-PS
`interfaces are defined in the 25.41x-series of
`the 3GPP Technical
`Specifications.
`
`Page 10 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`43
`
`The A and Gb interfaces were designed for second-generation wireless
`networks. In particular, the A interface is for connecting a GSM BSS to a
`second-generation MSC and the Gb interface is for connecting a GSM BSS to
`a second-generation SGSN. The A and Gb interfaces are therefore used to
`support pre-Release 5 mobile terminals.
`The Iu interfaces are used to support Release 5 mobile terminals. The CN is
`said to operate in the Iu mode if RANs connect to the CN via the Iu interfaces.
`A mobile can operate in one and only one of the following modes at any given
`time [16]:
`– A/Gb mode: Access the CS CN over the A interface and access the PS
`CN over the Gb interface.
`– Iu mode: Access the CS CN over the Iu-CS interface and access the PS
`CN over the Iu-PS interface.
`The rest of this book will focus on the Iu mode operations of the CN and the
`mobiles.
`. CS CN Internal Interfaces: The main interfaces inside the CS CN domain are
`as follows:
`– Interface B: A signaling interface for a MSC Server to exchange location
`information with a VLR. This interface is not standardized.
`– Interface C: A signaling interface for a GMSC to retrieve from the HLR
`routing information for a mobile. Signaling over this interface uses the
`MAP protocol.
`– Interface D: A signaling interface for the HLR and the VLR to exchange
`location and service subscription information. Signaling over this
`interface uses the MAP protocol.
`– Interface E: A signaling interface for supporting handoff between
`MSCs and for transporting SMS (Short Message Service) messages from
`one MSC to another. Signaling over this interface uses the MAP
`protocol.
`– Interface G: A signaling interface for supporting location registration
`when a mobile moves from one VLR area (a part of the network served
`by one VLR) to another. Signaling over this interface uses the MAP
`protocol.
`– Interface F: A signaling interface for an MSC Server to exchange data
`with the EIR. Signaling over this interface uses the MAP protocol.
`– Interface Nb: A transport interface used for bearer control and transport
`between CS CN entities. Different protocols may be used for the
`transport of different upper layer traffic. For example, RTP/UDP/IP
`may be used to transport Voice-over-IP traffic. RTP (Real-time
`Transport Protocol) is a protocol defined by the IETF for end-to-end
`transport of real-time audio and video data [26].
`– Interface Nc: A signaling interface for call control between MSC servers
`or between an MSC Server and a GMSC Server. A typical protocol used
`
`Page 11 of 88
`
`

`

`44
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`over this interface for call control is the SS7 ISUP. ISUP (ISDN User
`Part), a protocol of the SS7 protocol family, is used to set up, manage,
`and release circuits that carry voice and data calls over the public
`switched telephone network (PSTN). IP-based signaling protocols may
`also be used.
`. PS CN Internal Interfaces: These interfaces include (1) all the GPRS-specific
`interfaces that are defined in the 23-series and 24-series of the 3GPP
`Technical Specifications, (2) interfaces between a GGSN or SGSN and the
`MSC, and (3) interfaces between a GGSN or SGSN and the information
`servers shared by the PS and the CS domains. Some important PS CN
`interfaces are as follows:
`– Interface Gn: A signaling and transport interface used between an SGSN
`and a GGSN as well as between SGSNs in the same PLMN to support
`packet data transport and mobility.
`– Interface Gp: A signaling and transport interface used between SGSN
`and GGSN in different PLMNs. The Gp interface provides the
`the Gn
`interface plus
`security functions
`for
`functionality of
`communication between PLMNs.
`– Interface Gi: A standard IP interface between a GGSN (and the IMS)
`and other IP networks. The Gi interface uses IP as the network-layer
`routing protocol. From the external IP network’s point of view, the
`GGSN acts like a regular IP router and the 3GPP PS domain acts as a
`regular IP network.
`– Interface Gc: A signaling interface between the GGSN and the HSS that
`is used by the GGSN to retrieve from HSS location and service sub-
`scription information for a user so that the GGSN can determine how to
`handle the traffic to and from this user.
`– Interface Gr: A signaling interface between an SGSN and the HSS that is
`used by an SGSN to exchange location and other subscriber information
`with the HLR. For example, the SGSN can use the Gr interface to inform
`the HSS of a mobile’s current location. It can also use this interface to
`retrieve from HSS all the information needed for providing services to a
`mobile user. This includes, for example,
`information on a user’s
`subscribed services,
`information for controlling the user’s network
`access, etc. Signaling over this interface uses the MAP protocol.
`– Interface Gf : A signaling interface between the SGSN and the EIR that
`is used for the SGSN to exchange information with the EIR so that the
`SGSN can verify the IMEI supplied by a mobile user. Signaling over this
`interface uses the MAP protocol.
`– Interface Gs: A signaling interface between SGSN and MSC Server/
`VLR that allows the SGSN to send location information to the VLR in
`the CS domain and allows the MSC/VLR to send a paging request to the
`SGSN. It also allows the MSC/VLR to inform the SGSN that a mobile
`
`Page 12 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`45
`
`Fig. 2.5 Protocol reference model for 3GPP PS domain
`
`is using services handled by the MSC. This is a critical capability that
`allows close integration of the networking capabilities provided by the
`PS and the CS domains. Signaling over Interface Gs uses SS7 con-
`nectionless SCCP (Signaling Connection Control Part) protocol.
`
`The protocol reference model for the PS domain is illustrated in Figure 2.5,
`where the RAN is assumed to be UTRAN for illustration purpose. The main
`interfaces for supporting packet-switched services are the Gn, Gp, Gi, Gs, Gc, and Gr
`interfaces inside the PS CN domain, the Iu interface connecting a RAN with the PS
`CN domain, and interfaces inside a RAN (e.g., the Iub and Uu interfaces inside a
`UTRAN).
`
`2.1.3 Packet Data Protocols, Bearers, and Connections for Packet
`Services
`
`A mobile uses a Packet Data Protocol (PDP) to exchange user packets over a
`3GPP PS CN domain with other mobiles either inside the same 3GPP network or in
`other IP networks. In the rest of this book, we will assume that the PDP is IP unless
`stated otherwise explicitly.
`The PDP Packet Data Units (PDUs) (i.e., user packets) are transported inside a
`3GPP network over traffic bearers. A traffic bearer is a set of network resources and
`data transport functions used to deliver user traffic between two network entities. A
`traffic bearer can be a path, a logical connection, or a physical connection between
`two network nodes.
`The structure of traffic bearers for supporting packet-switched services is
`illustrated in Figure 2.6. For a mobile to send or receive user packets over a 3GPP
`PS CN, a dedicated path needs to be maintained between the mobile and its serving
`
`Page 13 of 88
`
`

`

`46
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`Fig. 2.6 3GPP bearers (connections) for supporting packet-switched services
`
`GGSN. We shall refer to this path as the 3GPP Bearer for the mobile. For example,
`a 3GPP Bearer in a UMTS network would be a UMTS Bearer.
`A 3GPP Bearer is constructed by concatenating a Radio Access Bearer (RAB)
`that connects a mobile over a RAN to the edge of the CN (i.e., a SGSN) and a CN
`Bearer that carries user traffic between the edge of the CN and a GGSN.
`
`. A RAB is a logical connection that is constructed by concatenating a Traffic
`Radio Bearer and an Iu Traffic Bearer.
`A Traffic Radio Bearer is a logical connection provided by the protocol
`layer immediately below the PDP layer for transporting user packets between
`a mobile and an RNC (or a BSC). An Iu Traffic Bearer is a logical connection
`provided by the protocol
`layer immediately below the PDP layer for
`transporting user packets between the RAN (i.e., an RNC or a BSC) and an
`SGSN.
`. A CN Bearer is a logical connection provided by the protocol
`layer
`immediately below the PDP layer for transporting user packets between an
`SGSN and a GGSN.
`
`A Traffic Radio Bearer, an Iu Traffic Bearer, and a CN Bearer collectively form a
`logical link immediately below the PDP layer for transporting user packets between
`the mobile and its serving GGSN.
`The Traffic Radio Bearers, Iu Traffic Bearers, Radio Access Bearers, and CN
`bearers are managed by different protocols and procedures. This creates several
`benefits.
`
`. The resource management requirements differ significantly in different parts
`of a 3GPP network, such as inside a RAN, a CN, and between a RAN and a
`CN. Separating the bearers in these parts of the network allows different
`protocols and procedures to be used to address the unique resource
`
`Page 14 of 88
`
`

`

`2.1 3GPP PACKET DATA NETWORKS
`
`47
`
`management needs in each part of the network. It also allows the technologies
`used in each part of the network to evolve with less dependency on each other.
`. Separating the bearers in these parts of the network facilitates mobility
`management. For example, when a mobile moves inside the service area of
`the same SGSN, new CN Bearer will not be needed for the mobile. This
`reduces the time it takes for a mobile to handoff from one RNC to another
`under the same SGSN. It also means that the GGSNs do not need to be aware
`of how mobility is managed inside each RAN. Instead, a GGSN only needs to
`keep track of which SGSN is currently serving a mobile.
`
`The Traffic Radio Bearers, Iu Traffic Bearers, and CN Bearers are supported by
`bearers provided by lower-layer protocols. The full protocol stacks for supporting
`Traffic Radio Bearers, Iu Traffic Bearers, and CN Bearers will be described in
`Section 2.1.11.
`Before network resources in a RAN or the PS CN can be allocated to provide
`packet-switched services to a mobile, a dedicated logical Signaling Connection
`needs to be established between the mobile and an SGSN. This signaling
`connection is used, for example, for the mobile to register with the PS CN domain,
`for the mobile to request
`the SGSN to establish CN Bearers, and for the
`establishment of Radio Access Bearers.
`As illustrated in Figure 2.7, the signaling connection between a mobile and an
`SGSN is constructed by concatenating a Signaling Radio Bearer between the
`mobile and the RAN (e.g., the RNC in a UTRAN) and an Iu Signaling Bearer
`between the RAN and the SGSN.
`The Signaling Radio Bearers and Traffic Radio Bearers for the same mobile are
`collectively referred to as a RRC connection. This is because the Radio Resource
`Control (RRC) protocol [16], [18] is used to establish, maintain, and release the
`Radio Bearers. A mobile will use a common RRC connection to carry the signaling
`and user traffic for both PS and CS services.
`
`Fig. 2.7 Signaling and traffic connections between mobile and SGSN
`
`Page 15 of 88
`
`

`

`48
`
`WIRELESS IP NETWORK ARCHITECTURES
`
`The Iu Signaling Bearers and the Iu Traffic Bearers for the same mobile are
`collectively referred to as a RANAP connection. This is because all these Iu Bearers
`are established, maintained, modified, changed, and released by the Radio Access
`Network Application Part (RANAP) protocol [20].
`The RNC is responsible for interconnecting the user’s RRC connection with the
`user’s RANAP connection to construct a signaling connection or a RAB between
`the mobile and the SGSN. In other words, the RNC acts as a protocol converter and
`converts between protocols used in the RAN and the CN.
`
`2.1.4 Packet Data Protocol (PDP) Context
`
`To send or receive user packets, a mobile needs to acquire and configure itself with
`a PDP Address (i.e., an IP address when the PDP is IP). A mobile may use multiple
`PDP addresses simultaneously. Before user packets destined to or originated from a
`PDP address can be transported over a 3GPP PS CN, a PDP Context for this PDP
`address has to be established and activated in the PS CN domain (i.e., on an SGSN
`and a GGSN) and on the mobile.
`A PDP Context maintained by a network node c