FemtoIssues&Trend-niu

Size: px

Start display at page:

Download "FemtoIssues&Trend-niu"

敕快僪
4 years ago
Views:

The technology issues and the development trends of 3G Femtocell system 鄭靜紋 cw.

2 Outline An overview of UMTS Why Femtocell Femtocell key issues State of the art of Femtocell Conclusion 2010/01/30 2

3 Cellular Generations 2010/01/30 3

4 Mobile Communication Roadmap 2010/01/30 4

5 UMTS Universal Mobile Telecommunications System (UMTS) is one of the 3G mobile telecommunications technologies Mostly uses W-CDMA as the radio access tech Standardized by 3GPP 2010/01/30 5

6 UMTS Network Architecture UTRAN: UMTS Terrestrial Radio Access Network GERAN: GSM EDGE Radio Access Network 2010/01/30 6

7 3GPP R6/R7/R8 R6 HSDPA/HSUPA R7 HSPA R8 Femtocell (Home Node B)/ LTE 2010/01/30 7

8 Observations (1/3) The coverage problem Over 50% of mobile calls & 70% of mobile data traffic generated indoors. Unfortunately, homes are extremely difficult place to try to get a 3G signal. Source:V. Chandrasekhar et al, IEEE Comm. Mag., Sep /01/30 8

9 Observations (2/3) Q1 2009, 1/3 of mobile traffic associated with video Source: Cisco/Western Europe Mobile Operator, Mar /01/30 9

10 Observations (3/3) Source: TELUS Canada, Nov /01/30 10

11 Approaches Increase base station deployments Alternative technology WLAN, UMA WiMAX Femtocell 2010/01/30 11

12 What s Femtocell? It s a complementary 3G solution Short range (12~50m) & Low power (5~23 dbm) Low cost (<US$200) Over internet-grade backhaul (e.g., DSL) In licensed spectrum Works with any standard 3G phone Self-installing domestic access points With full operator management 2010/01/30 12

13 What a HNB looks like? 2010/01/30 13

14 Benefits of Femtocell For mobile network operators A cost-effective means of improving and expanding mobile network coverage & capacity High-quality signal in the homes Support aggressive traffics & the provision of new bundled service offerings For mobile users Improved residential coverage & performance Lower in-home call & mobile data charges Use one phone both in & out of the home 2010/01/30 14

Indoor deployments 60% - 70% of time indoors Targeted in-building services

15 Multi-tier network deployment Macro network Multi-sector, broad coverage High-speed mobility Small cells Pico/ Micro/ Femto Broadband experience Indoor deployments 60% - 70% of time indoors Targeted in-building services offerings Source 1: Continuous Computing, 2009 Source 2: Femto Forum, /01/30 15

16 Femtocell operation environment IP network Node B HNB-GW UMTS/LTE Core Network Broadband router Other 3GPP system HNB 2010/01/30 16

17 Femtocell subsystem HNB Offers Uu interface to the UE Provides RAN connectivity using the Iuh interface Supports RNC like functions Supports HNB & UE registration over Iuh HNB-GW Terminates Iuh from HNB Appears as an RNC to the CN using Iu interface Provide service to the HNB HNB & UE registration functions Iuh-UP service handling 2010/01/30 17

18 Femtocell enablers Three market and technology advances have led the femtocells to become a viable element in the evolution of mobile networks Widespread wired broadband Low-cost processors Flat architectures 2010/01/30 18

20 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 20

21 Access technologies Radio technologies UMTS (3G, 3.6~7.2Mbps between many mobile devices) LTE (4G, OFDM+MIMO) WiMAX (OFDM, compete with LTE) TD-SCDMA (TDD, China) 2010/01/30 21

22 Tasks of admission control (AC) Estimate whether a new call sacrifices the bearer requirements of existing calls. AC algorithm shall predict the load of the cell if a new call is admitted Handling of packet connections with bursty traffic Bit rate variation and the bursty-characteristics shall be taken into account when controlling both real time (circuit call) and non-real time (packet) traffics 2010/01/30 22

23 Approaches of Access Technologies MIMO (multi-input multi-output) Multipath diversity OFDM Wide band system OFDM + MIMO , n, HSDPA 2010/01/30 23

24 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 24

25 UTRAN architecture UTRAN Uu Iu UE Node B UTRAN RNC Iur Iu-CS/ Iu-PS UE Uu Node B Iu RNC Iu-CS/ Iu-PS UMTS core network * UTRAN: UMTS Terrestrial Access Network 2010/01/30 25

26 Femtocell deployment Femtocell Node B Macrocell Femtocell Femtocell 2010/01/30 26

27 Femtocell network architecture Uu Iu UE Node B RNC Iur Iu-CS/ Iu-PS UE Uu Node B Iu RNC Iu-CS/ Iu-PS UMTS core network Iu-CS/ Iu-PS Uu Iuh UE HNB/FAP HNB/FAP-GW Femtocell RAN * RAN: Radio Access Network 2010/01/30 27

28 Iuh interface model Uu Iuh Iu HNB Security Gateway HNB-GW Iu-hm HNB (Home Node B) HNB Gateway (HNB-GW) HMS HMS (HNB management system) Based on family of TR-069 family standards Facilitate HNB-GW discovery Provisions of configuration data to the HNB Perform location verification of HNB & assigns appropriate serving elements (SeGW, HMS, and HNB-GW) Security Gateway (SeGW) Terminates secure tunnel for TR-069 & Iuh Authentication of HNB Provides access to HMS & HNB-GW Source: 3GPP TS V ( ) 2010/01/30 28

29 Iuh interface protocol stack Source : 3GPP TS V /01/30 29

30 Femtocell key Issues Radio access technologies Network architecture& new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 30

31 Concept of RAB management RAB = RB + Iu Bearer RAM management shall maps the QoS requirements of RB and Iu Bearer 2010/01/30 31

32 From vocal system to radio resources 2010/01/30 32

33 Composition of WCDMA signals Uu interface 2010/01/30 33

34 Code resources Scrambling codes Every cell uses one scrambling code thus users can distinguish different cells DL: , UL: 2 24 Channelisation codes Orthogonal codes Every call/transaction requires a channelisation code to operate The common information the cell delivers towards UE consumes some channelisation codes 2010/01/30 34

35 Principle of admission control (Acceptable interference level) Expected capacity 2010/01/30 35

36 Radio resources in WCDMA radio network system A radio resource unit in WCDMA is defined by A carrier frequency, a code sequence, and a power level Radio resources Spectrum & bandwidth Frequency & transmission power Modulation & coding scheme Cell capability & capacity 2010/01/30 36

37 UL/DL inter-cell interference 2010/01/30 37

38 Interference scenarios Number Aggressor Victim Priority 1 UE attached to HNB Macro Node B Uplink yes 2 HNB Macro Node B Downlink yes 3 UE attached to Macro Node B HNB Uplink yes 4 Macro Node B HNB Downlink 5 UE attached to HNB HNB Uplink yes 6 Home Node B HNB Downlink yes 7 UE attached to HNB and/or HNB Other System 8 Other System UE attached to HNB and/or HNB Source: 3GPP TR V /01/30 38

39 Types of power control mechanism OLPC (Open Loop Power Control) Initial uplink from UE CLPC (Closed Loop Power Control) During an actual connection Inner loop (UE BS) 1500 times adjustment/sec Outer loop (UE RNC) 2010/01/30 39

40 Power control in the DL direction * TPC: Transport Power Control TFCI: Transport Format Combination Indicator 2010/01/30 40

41 The main UMTS network entities of RRM HNB comprises BS & RNC functions 2010/01/30 41

42 The objective of RRM To utilize scarce radio spectrum resources & radio network infrastructure efficiently Basic issues The number of users to be supported The service area The user s average transmission rate The desired QoS level 2010/01/30 42

43 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 43

44 HNB deployment Different deployment configurations Dedicated channel/ co-channel/ partial cochannel Access control Open/ semi-open/ closed access Fixed or adaptive (DL) maximum transmit power 2010/01/30 44

45 Partial co-channel deployment shared part clear part Macro Spectrum arrangement for Macro & HNBs Home NodeB frequency Macro Macro Spectrum arrangement for UTRAN Home Node Bs channel 1 channel 2 Source: 3GPP TR V /01/30 45

46 Femtocell initiation HNB initiation HNB-GW discovery & HNB register Cell reselection Automatic vs. Manual Separate HNB PLMN ID, equivalent PLMN, manual selection Using HCS (Hierarchical Cell Structure) 2010/01/30 46

47 Provisioning procedure for HNB HNB Security Gateway HMS HNB GW 1. Establish Secure tunnel 2. Location verification, HNB GW discovery, HNB Provisioning using TR Reliable Transport setup (SCTP) 4. HNB Registration procedure commences Source: 3GPP TS V /01/30 47

48 HNB configuration information Three types of parameters CN level parameters PLMN type, MCC, MNC, LAC, RAC, SAC, etc. Allowed IMSI list, CSG cell info, HNB location info RAN level parameters HSPA related, HCS related, cell re-/selection related, measurement related, neighbor lists RF level parameters Primary scrambling code, MaxHNBTxPower, MaxULTxPower (a UE can use on PRACH) 2010/01/30 48

49 OA&M remote control & autoconfiguration Enable zero touch, plug & play HNB installation & operation Reduce operation & maintenance cost of operators Empower dynamic device configuration, troubleshooting, firmware upgrades, user management, CPE reporting, and value-added service offering 2010/01/30 49

50 TR-069 network architecture OSS/BSS ACS Policy Operator s network Call center HNB-GW IP network Broadband router ACS: Auto Configuration Servers CPE: Customer Premises Equipment Managed CPE (HNB) 2010/01/30 50

51 TR-069 in brief CPE WAN Management Protocol (CWMP) Created by the Broadband Forum (DSL Forum) A bidirectional SOAP/HTTP based protocol provides communication between CPE & ACS TR-069 services CPE provisioning & authentication Device/service activation & monitoring CPE update & maintenance 2010/01/30 51

52 HNB/HNB-GW architecture with O&M interfaces Source: 3GPP TR V ( ) 2010/01/30 52

53 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management HNB deployment & configuration Femtocell detection Network security Development environment 2010/01/30 53

54 Procedure of cell detection Before initial access UE powered on (and enters Idle mode) UE begins cell search until find the right PLMN & cell Tunes to the control channel of the cell (camps on the cell) UE registers to the cell for its presentation If UE finds a more suitable cell in regular time interval (for cell selection/re-selection) UE reselects onto the cell and camps on it 2010/01/30 54

55 Femtocell SI broadcast MIB: Master Information Block SB: Scheduling Block SI : System Information SIB: System Information Block 2010/01/30 55

56 Network awareness Cell reselection Automatic vs. Manual Separate HNB PLMN ID, equivalent PLMN, manual selection Using HCS (Hierarchical Cell Structure) UE register HNB as a serving cell HNB as a drifting BS Seamless handover HNB must support UE speeds up to 30 km/h 2010/01/30 56

57 UE register for CSG HNB Source: 3GPP TS V /01/30 57

58 UE registration for CSG HNB Source: 3GPP TS V /01/30 58

59 UE with Chameleon UI Home Zone Source: INTRINSYC UX-Zone, /01/30 59

60 The neighboring cells Code allocation Scrambling code arrangement Management of neighbor cell information HCS, LAI, CSG_ID Broadcasting system information Limited size of neighboring cells CSG Cell Info may be supported by Rel-8 RRC 2010/01/30 60

61 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 61

62 Femtocell network architecture Uu Iuh Iu HNB HNB (Home Node B) HNB Gateway (HNB-GW) HMS (HNB management system) Based on family of TR-069 family standards Facilitate HNB-GW discovery Provisions of configuration data to the HNB Security Gateway OA&M HNB-GW HMS Iu-hm Perform location verification of HNB & assigns appropriate serving elements (SeGW, HMS, and HNB- GW) Security Gateway (SeGW) Terminates secure tunnel for TR-069 & Iuh Authentication of HNB Provides access to HMS & HNB-GW Source 1: 3GPP TS V ( ) Source 2: 3GPP TR V /01/30 62

63 System architecture of H(e)NB UE HNB unsecure link SeGW Operator s core network HNB GW OAM OAM UE HNB unsecure link SeGW Operator s core network OAM Source: 3GPP TR V /01/30 63

64 HNB registration HNB SeGW HNB-GW 1. HNB initialization 2. Establish secure tunnel 3. Establish reliable transport session (e.g., SCTP) 4. HNB register request (Location information on HNB identity) 5a. HNB register accept () 5b. HNB register reject (Reject cause) Source: 3GPP TS V /01/30 64

65 Common threats to Femtocell Compromise of HNB credentials Physical attacks on a HNB Configuration attacks on a HNB Protocol attacks on a HNB Attacks on the CN, location-based attacks User data and identity privacy attacks Attacks on radio resources & management 2010/01/30 65

66 HNB security architecture Source: 3GPP TR V /01/30 66

67 Integrity checking & ciphering mechanism Integrity checking Integrity key (Ik) stored in SIM/USIM Performed by RRC Ciphering/deciphering Ciphering mode, ciphering key (Ck), transmitting/receving activation time Performed by RLC & MAC Integrity check Ciphering L3 L2 L1 AS end entity RRC RLC MAC Physical layer RRC RLC MAC RRM & relay Physical layer RANAP HNBAP RUA SCTP Remote IP IPSec Data link UE HNB 2010/01/30 67

68 Authentication & security control 2010/01/30 68

69 Security feature groups HNB access security (I) Network domain security (II) HNB service domain security (III) UE access control domain security (IV) Only apply to legacy UE Access control for Rel-8 UE is based on CSG list and accomplished on the terminal and CN UE access security domain (V) 2010/01/30 69

70 HP, HPM, TrE Hosting party (HP) The party hosting the H(e)NB and having a contract with the PLMN operator Hosting party module (HPM) A module holding the credentials for authentication of the HP Trusted Environment (TrE) A trustworthy environment for the execution of software & the storage of sensitive data A TrE should be protected by a secure start-up process A TrE should securely store the HPM identity 2010/01/30 70

71 Countermeasures User authentication mechanism Mutual authentication & security tunnel establishment mechanism TrE of HNB Access control mechanism Protections mechanisms for environment security of HNB HPM authentication Location locking mechanism Clock synchronization security mechanism Security mechanism for OAM 2010/01/30 71

72 Femtocell key Issues Radio access technologies Network architecture & new protocols Radio resource management Femtocell deployment & configuration Femtocell detection Network security Development environment 2010/01/30 72

73 Issues of Femtocell development The availability of development platform Protocol stacks & software Applications 2010/01/30 73

74 State of the art of Femtocell development Femtocell access points (FAP/HNB) WCDMA, dual module LTE & HSPA+ SoC solution 5.5Mbps HSUPA (2ms TTI), 9.4Mbps HSDPA, 16 simultaneous active users Embedded secured backhauling over IP Rel-99, Rel-5, Rel-6 L1 FW/SW ready Femtocell Gateway 20,000 HNB capacity per FAP-GW Source: Femtocells World Submit in London Jun /01/30 74

75 Iuh interface protocol stack Source : 3GPP TS V /01/30 75

76 Protocol stacks Source: Continuous Computing, /01/30 76

77 Femtocell platforms Femtocell access points (FAP/HNB) WCDMA, dual module LTE & HSPA+ SoC solution 5.5Mbps HSUPA (2ms TTI), 9.4Mbps HSDPA, 16 simultaneous active users Embedded secured backhauling over IP Rel-99, Rel-5, Rel-6 L1 FW/SW ready Femtocell Gateway 20,000 HNB capacity per FAP-GW Source: Femto Forum London event, June /01/30 77

78 Handsets APIs Detection-Reporting-Policy Manager Switching Femto, Macro QoS Tariff Policy manager based switching LBS subscription Other network type connection (Wi-Fi, WiMax) Integrated with multiple OS API s compatible with multiple OS (Symbian, WinMo, CE, Linux, Android, Java) Ability to tailor low-level detection criteria Open and simple handset APIs Airvana, ip.access, Ubiquisys, Intrinsyc, etc. 2010/01/30 78

79 Development trends FMC The RAN and the customer IP network are the same Speed, scale, services Bandwidth demand IP devices multiplying Service & charging Source: Vodafone Hone Signal Booster, UK, Nov /01/30 79

80 Integration improves Femtocell economics Source: Qualcomm /01/30 80

81 Example of applications Femto-aware applications Femtozone: web/voice service in Femto coverage Connected Home: use Femtocell to route traffic locally between phone and a home LAN Femto-interactive applications In-home, on-demand streaming media from storage in the LAN Cache-and-carry media sync with home repository 2010/01/30 81

82 Examples of Femtocell applications Femtozone: web/voice service in femto coverage Connected Home: use Femtocell to route traffic locally between phone and a home LAN ip.access Ltd + picochip PC202 Source: ip.access 2010/01/30 82

PS PS GMM SM.zte.com.

WBUB-010-1 ZXWN PS V0411.zte.com. PS PS GMM SM.zte.com. PS TMSI Packet-Temporary mobile subscriber identification number P-TMSI) GPRS MS P- TMSI 4 BCD 3G TS 23.003 MSC SGSN SGSN P-TMSI 11 MSC TMSI 00 01