Preface to Fourth Edition xv
1 Global System for Mobile Communications (GSM) 1
1.1 Circuit-Switched Data Transmission 2
1.1.1 Classic Circuit Switching 2
1.1.2 Virtual Circuit Switching over IP 3
1.2 Standards 4
1.3 Transmission Speeds 5
1.4 The Signaling System Number 7 6
1.4.1 The Classic SS-7 Protocol Stack 7
1.4.2 SS-7 Protocols for GSM 10
1.4.3 IP-Based SS-7 Protocol Stack 11
1.5 The GSM Subsystems 12
1.6 The Network Subsystem 12
1.6.1 The Mobile Switching Center (MSC), Server, and Gateway 13
1.6.2 The Visitor Location Register (VLR) 16
1.6.3 The Home Location Register (HLR) 17
1.6.4 The Authentication Center 21
1.6.5 The Short Messaging Service Center (SMSC) 23
1.7 The Base Station Subsystem (BSS) and Voice Processing 24
1.7.1 Frequency Bands 24
1.7.2 The Base Transceiver Station (BTS) 26
1.7.3 The GSM Air Interface 28
1.7.4 The Base Station Controller (BSC) 35
1.7.5 The TRAU for Voice Encoding 39
1.7.6 Channel Coder and Interleaver in the BTS 43
1.7.7 Ciphering in the BTS and Security Aspects 45
1.7.8 Modulation 48
1.7.9 Voice Activity Detection 48
1.8 Mobility Management and Call Control 50
1.8.1 Cell Reselection and Location Area Update 50
1.8.2 The Mobile-Terminated Call 51
1.8.3 Handover Scenarios 54
1.9 The Mobile Device 56
1.10 The SIM Card 58
1.11 The Intelligent Network Subsystem and CAMEL 63
Questions 65
References 66
2 General Packet Radio Service (GPRS) and EDGE 69
2.1 Circuit-Switched Data Transmission over GSM 69
2.2 Packet-Switched Data Transmission over GPRS 70
2.3 The GPRS Air Interface 72
2.3.1 GPRS vs. GSM Timeslot Usage on the Air Interface 72
2.3.2 Mixed GSM/GPRS Timeslot Usage in a Base Station 74
2.3.3 Coding Schemes 75
2.3.4 Enhanced Datarates for GSM Evolution (EDGE) 76
2.3.5 Mobile Device Classes 79
2.3.6 Network Mode of Operation 80
2.3.7 GPRS Logical Channels on the Air Interface 81
2.4 The GPRS State Model 84
2.5 GPRS Network Elements 87
2.5.1 The Packet Control Unit (PCU) 87
2.5.2 The Serving GPRS Support Node (SGSN) 88
2.5.3 The Gateway GPRS Support Node (GGSN) 90
2.6 GPRS Radio Resource Management 91
2.7 GPRS Interfaces 95
2.8 GPRS Mobility Management and Session Management (GMM/SM) 99
2.8.1 Mobility Management Tasks 100
2.8.2 GPRS Session Management 103
Questions 105
References 106
3 Universal Mobile Telecommunications System (UMTS) and High-Speed Packet Access (HSPA) 107
3.1 Overview 107
3.1.1 3GPP Release 99: The First UMTS Access Network Implementation 108
3.1.2 3GPP Release 4: Enhancements for the Circuit-Switched Core Network 111
3.1.3 3GPP Release 5: High-Speed Downlink Packet Access 111
3.1.4 3GPP Release 6: High-Speed Uplink Packet Access (HSUPA) 112
3.1.5 3GPP Release 7: Even Faster HSPA and Continued Packet Connectivity 113
3.1.6 3GPP Release 8: LTE, Further HSPA Enhancements and Femtocells 113
3.2 Important New Concepts of UMTS 114
3.2.1 The Radio Access Bearer (RAB) 114
3.2.2 The Access Stratum and Non-Access Stratum 115
3.2.3 Common Transport Protocols for CS and PS 116
3.3 Code Division Multiple Access (CDMA) 116
3.3.1 Spreading Factor, Chip Rate, and Process Gain 119
3.3.2 The OVSF Code Tree 120
3.3.3 Scrambling in Uplink and Downlink Direction 122
3.3.4 UMTS Frequency and Cell Planning 123
3.3.5 The Near-Far Effect and Cell Breathing 124
3.3.6 Advantages of the UMTS Radio Network Compared to GSM 126
3.4 UMTS Channel Structure on the Air Interface 128
3.4.1 User Plane and Control Plane 128
3.4.2 Common and Dedicated Channels 128
3.4.3 Logical, Transport, and Physical Channels 129
3.4.4 Example: Network Search 133
3.4.5 Example: Initial Network Access Procedure 135
3.4.6 The Uu Protocol Stack 137
3.5 The UMTS Terrestrial Radio Access Network (UTRAN) 142
3.5.1 Node-B, Iub Interface, NBAP, and FP 142
3.5.2 The RNC, Iu, Iub and Iur Interfaces, RANAP, and RNSAP 143
3.5.3 Adaptive Multirate (AMR) NB and WB Codecs for Voice Calls 148
3.5.4 Radio Resource Control (RRC) States 150
3.6 Core Network Mobility Management 155
3.7 Radio Network Mobility Management 156
3.7.1 Mobility Management in the Cell-DCH State 156
3.7.2 Mobility Management in Idle State 165
3.7.3 Mobility Management in Other States 166
3.8 UMTS CS and PS Call Establishment 168
3.9 UMTS Security 172
3.10 High-Speed Downlink Packet Access (HSDPA) and HSPA+ 174
3.10.1 HSDPA Channels 174
3.10.2 Shorter Delay Times and Hybrid ARQ (HARQ) 176
3.10.3 Node-B Scheduling 178
3.10.4 Adaptive Modulation and Coding, Transmission Rates, and Multicarrier Operation 179
3.10.5 Establishment and Release of an HSDPA Connection 181
3.10.6 HSDPA Mobility Management 182
3.11 High-Speed Uplink Packet Access (HSUPA) 183
3.11.1 E-DCH Channel Structure 184
3.11.2 The E-DCH Protocol Stack and Functionality 187
3.11.3 E-DCH Scheduling 189
3.11.4 E-DCH Mobility 191
3.11.5 E-DCH-Capable Devices 192
3.12 Radio and Core Network Enhancements: CPC 193
3.12.1 A New Uplink Control Channel Slot Format 193
3.12.2 Reporting Reduction 194
3.12.3 HS-SCCH Discontinuous Reception 195
3.12.4 HS-SCCH-less Operation 195
3.12.5 Enhanced Cell-FACH and Cell/URA-PCH States 196
3.13 Radio Resource State Management 197
3.14 Automated Emergency Calls (eCall) from Vehicles 198
Questions 199
References 200
4 Long Term Evolution (LTE) and LTE-Advanced Pro 203
4.1 Introduction and Overview 203
4.2 Network Architecture and Interfaces 206
4.2.1 LTE Mobile Devices and the LTE Uu Interface 207
4.2.2 The eNB and the S1 and X2 Interfaces 210
4.2.3 The Mobility Management Entity (MME) 213
4.2.4 The Serving Gateway (S-GW) 215
4.2.5 The PDN-Gateway 215
4.2.6 The Home Subscriber Server (HSS) 217
4.2.7 Billing, Prepaid, and Quality of Service 218
4.3 FDD Air Interface and Radio Network 219
4.3.1 OFDMA for Downlink Transmission 220
4.3.2 SC-FDMA for Uplink Transmission 222
4.3.3 Quadrature Amplitude Modulation for Subchannels 223
4.3.4 Symbols, Slots, Radio Blocks, and Frames 225
4.3.5 Reference and Synchronization Signals 226
4.3.6 The LTE Channel Model in the Downlink Direction 227
4.3.7 Downlink Management Channels 228
4.3.8 System Information Messages 229
4.3.9 The LTE Channel Model in the Uplink Direction 230
4.3.10 MIMO Transmission 233
4.3.11 HARQ and Other Retransmission Mechanisms 236
4.3.12 PDCP Compression and Ciphering 238
4.3.13 Protocol Layer Overview 239
4.4 TD-LTE Air Interface 240
4.5 Scheduling 242
4.5.1 Downlink Scheduling 242
4.5.2 Uplink Scheduling 246
4.6 Basic Procedures 247
4.6.1 Cell Search 247
4.6.2 Attach and Default Bearer Activation 250
4.6.3 Handover Scenarios 254
4.6.4 Default and Dedicated Bearers 259
4.7 Mobility Management and Power Optimization 260
4.7.1 Mobility Management in RRC Connected State 260
4.7.2 Mobility Management in RRC Idle State 263
4.7.3 Mobility Management and State Changes in Practice 265
4.8 LTE Security Architecture 267
4.9 Interconnection with UMTS and GSM 268
4.9.1 Cell Reselection between LTE and GSM/UMTS 268
4.9.2 RRC Connection Release with Redirect from LTE to GSM/UMTS 270
4.9.3 Handover from LTE to UMTS 271
4.9.4 Returning from UMTS and GPRS to LTE 271
4.10 Carrier Aggregation 272
4.10.1 CA Types, Bandwidth Classes, and Band Combinations 273
4.10.2 CA Configuration, Activation, and Deactivation 275
4.10.3 Uplink Carrier Aggregation 278
4.11 Network Planning Aspects 279
4.11.1 Single Frequency Network 279
4.11.2 Cell-Edge Performance 279
4.11.3 Self-Organizing Network Functionality 281
4.11.4 Cell Site Throughput and Number of Simultaneous Users 282
4.12 CS-Fallback for Voice and SMS Services with LTE 283
4.12.1 SMS over SGs 284
4.12.2 CS-Fallback for Voice Calls 285
4.13 Network Sharing - MOCN and MORAN 288
4.13.1 National Roaming 288
4.13.2 MOCN (Multi-Operator Core Network) 289
4.13.3 MORAN (Mobile Operator Radio Access Network) 290
4.14 From Dipoles to Active Antennas and Gigabit Backhaul 290
4.15 IPv6 in Mobile Networks 292
4.15.1 IPv6 Prefix and Interface Identifiers 293
4.15.2 IPv6 and International Roaming 295
4.15.3 IPv6 and Tethering 296
4.15.4 IPv6-Only Connectivity 297
4.16 Network Function Virtualization 298
4.16.1 Virtualization on the Desktop 299
4.16.2 Running an Operating System in a Virtual Machine 299
4.16.3 Running Several Virtual Machines Simultaneously 300
4.16.4 Virtual Machine Snapshots 300
4.16.5 Cloning a Virtual Machine 301
4.16.6 Virtualization in Data Centers in the Cloud 302
4.16.7 Managing Virtual Machines in the Cloud 303
4.16.8 Network Function Virtualization 303
4.16.9 Virtualizing Routers 305
4.16.10 Software-Defined Networking 305
4.17 Machine Type Communication and the Internet of Things 306
4.17.1 LTE Cat-1 Devices 307
4.17.2 LTE Cat-0 Devices and PSM 307
4.17.3 LTE Cat-M1 Devices 308
4.17.4 LTE NB1 (NB-IoT) Devices 308
4.17.5 NB-IoT - Deployment Options 309
4.17.6 NB-IoT - Air Interface 309
4.17.7 NB-IoT - Control Channels and Scheduling 310
4.17.8 NB-IoT Multicarrier Operation 311
4.17.9 NB-IoT Throughput and Number of Devices per Cell 312
4.17.10 NB-IoT Power Consumption Considerations 312
4.17.11 NB-IoT - High Latency Communication 313
4.17.12 NB-IoT - Optimizing IP-Based and Non-IP-Based Data Transmission 314
4.17.13 NB-IoT Summary 316
Questions 316
References 317
5 VoLTE, VoWifi, and Mission Critical Communication 321
5.1 Overview 321
5.2 The Session Initiation Protocol (SIP) 322
5.3 The IP Multimedia Subsystem (IMS) and VoLTE 326
5.3.1 Architecture Overview 326
5.3.2 Registration 328
5.3.3 VoLTE Call Establishment 330
5.3.4 LTE Bearer Configurations for VoLTE 332
5.3.5 Dedicated Bearer Setup with Preconditions 334
5.3.6 Header Compression and DRX 336
5.3.7 Speech Codec and Bandwidth Negotiation 337
5.3.8 Alerting Tone, Ringback Tone, and Early Media 340
5.3.9 Port Usage 340
5.3.10 Message Filtering and Asserted Identities 341
5.3.11 DTMF Tones 342
5.3.12 SMS over IMS 343
5.3.13 Call Forwarding Settings and XCAP 344
5.3.14 Single Radio Voice Call Continuity 346
5.3.15 Radio Domain Selection, T-ADS, and VoLTE Interworking with GSM and UMTS 349
5.3.16 VoLTE Emergency Calls 350
5.4 VoLTE Roaming 352
5.4.1 Option 1: VoLTE Local Breakout 353
5.4.2 Option 2: VoLTE S8-Home Routing 354
5.5 Voice over WiFi (VoWifi) 356
5.5.1 VoWifi Network Architecture 356
5.5.2 VoWifi Handover 359
5.5.3 Wi-Fi-Preferred vs. Cellular-Preferred 360
5.5.4 SMS, MMS, and Supplementary Services over Wi-Fi 360
5.5.5 VoWifi Roaming 361
5.6 VoLTE Compared to Fixed-Line IMS in Practice 362
5.7 Mission Critical Communication (MCC) 363
5.7.1 Overview 363
5.7.2 Advantages of LTE for Mission Critical Communication 364
5.7.3 Challenges of Mission Critical Communication for LTE 365
5.7.4 Network Operation Models 367
5.7.5 Mission Critical Push To Talk (MCPTT) - Overview 368
5.7.6 MCPTT Group Call Establishment 370
5.7.7 MCPTT Floor Control 371
5.7.8 MCPTT Group Call Types 372
5.7.9 MCPTT Configuration and Provisioning 372
5.7.10 eMBMS for MCPTT 373
5.7.11 Priority and Quality of Service 376
Questions 376
References 377
6 5G New Radio (NR) and the 5G Core 379
6.1 Introduction and Overview 379
6.1.1 Reasons for Initially Launching 5G as a Hybrid Solution 380
6.1.2 Frequency Range 1 and 2 381
6.1.3 Dynamic Spectrum Sharing in Low- and Mid-Bands 381
6.1.4 Network Deployments and Organization of this Chapter 382
6.2 5G NR Non-Standalone (NSA) Architecture 382
6.2.1 Network Architecture and Interfaces 382
6.2.2 3GPP 5G Deployment Options 1-7 and Dynamic Spectrum Sharing 385
6.2.3 Options 3, 3A, and Option 3X 387
6.2.4 Fronthaul Interface 388
6.3 5G TDD Air Interface 388
6.3.1 Flexible OFDMA for Downlink Transmission 390
6.3.2 The 5G Resource Grid: Symbols, Slots, Resource Blocks, and Frames 392
6.3.3 Synchronization and Reference Signals 393
6.3.4 Massive-MIMO for Beamforming and Multi-User Data Transfer 395
6.3.5 TDD Slot Formats 398
6.3.6 Downlink Control Channels 400
6.3.7 Uplink Channels 401
6.3.8 Bandwidth Parts 401
6.3.9 The Downlink Control Channel and Scheduling 403
6.3.10 Downlink Data Throughput in Theory and Practice 405
6.3.11 Uplink Data Throughput 407
6.3.12 TDD Air Interface for mmWave Bands (FR2) 407
6.4 5G FDD Air Interface 409
6.4.1 Refarming and Dynamic Spectrum Sharing 410
6.5 EN-DC Bearers and Scheduling 415
6.5.1 Split Bearers, Flow Control 416
6.5.2 Two UE Transmitter Requirement for EN-DC 417
6.6 Basic Procedures and Mobility Management in Non-Standalone Mode 418
6.6.1 Establishment of an LTE-Only Bearer as 5G Anchor 419
6.6.2 5G NR Cell Addition in Non-Standalone Mode 422
6.6.3 When to Show a 5G Indicator 426
6.6.4 Handover Scenarios 427
6.6.5 EN-DC Signaling Radio Bearers 430
6.6.6 5G Non-Standalone and VoLTE 430
6.7 Network Planning and Deployment Aspects 431
6.7.1 The Range of Band n78 431
6.7.2 Backhaul Considerations 432
6.8 5G NR Standalone (SA) Architecture and Basic Procedures 432
6.8.1 5G Core Network Functions 432
6.8.2 Network Interfaces 434
6.8.3 Subscriber and Device Identifiers 435
6.8.4 5G Core Network Procedures Overview 435
6.8.5 Connection Management 436
6.8.6 Registration Management Procedure 436
6.8.7 Session Management 437
6.8.8 Mobility Management 442
6.8.9 New Security Features 444
6.8.10 The 5G Core and Different RAN Deployments 446
6.8.11 5G and 4G Core Network Interworking 446
6.8.12 The 5G Core Network and SMS 451
6.8.13 Cloud Native 5G Core 451
6.9 The 5G Air Interface in Standalone Operation 454
6.9.1 RRC Inactive State 454
6.9.2 System Information Messages 455
6.9.3 Measurement Configuration, Events, and Handovers 456
6.10 Future 5G Functionalities 457
6.10.1 Voice Service in 5G 457
6.10.2 Ethernet and Unstructured PDU Session Types 459
6.10.3 Network Slicing 459
Questions 461
References 461
7 Wireless Local Area Network (WLAN) 465
7.1 Wireless LAN Overview 465
7.2 Transmission Speeds and Standards 465
7.3 WLAN Configurations: From Ad Hoc to Wireless Bridging 468
7.3.1 Ad Hoc, BSS, ESS, and Wireless Bridging 469
7.3.2 SSID and Frequency Selection 472
7.4 Management Operations 474
7.5 The MAC Layer 479
7.5.1 Air Interface Access Control 479
7.5.2 The MAC Header 482
7.6 The Physical Layer and MAC Extensions 483
7.6.1 IEEE 802.11b - 11 Mbit/s 484
7.6.2 IEEE 802.11g with up to 54 Mbit/s 486
7.6.3 IEEE 802.11a with up to 54 Mbit/s 488
7.6.4 IEEE 802.11n with up to 600 Mbits/s 489
7.6.5 IEEE 802.11ac - Wi-Fi 5 - Gigabit Wireless 497
7.6.6 IEEE 802.11ax - Wi-Fi 6 - High Efficiency Extensions 502
7.6.7 IEEE 802.11ad - Gigabit Wireless at 60 GHz 506
7.7 Wireless LAN Security 510
7.7.1 Wired Equivalent Privacy (WEP) and Early Security Measures 510
7.7.2 WPA and WPA2 Personal Mode Authentication 510
7.7.3 WPA and WPA2 Enterprise Mode Authentication - EAP-TLS 512
7.7.4 WPA and WPA2 Enterprise Mode Authentication - EAP-TTLS 513
7.7.5 WPA and WPA2 Enterprise Mode Authentication - EAP-PEAP 515
7.7.6 WPA and WPA2 Enterprise Mode Authentication - EAP-SIM 516
7.7.7 WPA and WPA2 Encryption 518
7.7.8 Wi-Fi-Protected Setup (WPS) 519
7.7.9 WPA3 Personal Mode Authentication 520
7.7.10 Protected Management Frames 522
7.8 IEEE 802.11e and WMM - Quality of Service 523
Questions 530
References 531
8 Bluetooth and Bluetooth Low Energy 533
8.1 Overview and Applications 533
8.2 Physical Properties 534
8.3 Piconets and the Master/Slave Concept 538
8.4 The Bluetooth Protocol Stack 540
8.4.1 The Baseband Layer 540
8.4.2 The Link Controller 546
8.4.3 The Link Manager 549
8.4.4 The HCI Interface 549
8.4.5 The L2CAP Layer 552
8.4.6 The Service Discovery Protocol 554
8.4.7 The RFCOMM Layer 556
8.4.8 Overview of Bluetooth Connection Establishment 557
8.5 Bluetooth Security 558
8.5.1 Pairing up to Bluetooth 2.0 559
8.5.2 Pairing with Bluetooth 2.1 and Above (Secure Simple Pairing) 560
8.5.3 Authentication 562
8.5.4 Encryption 563
8.5.5 Authorization 563
8.5.6 Security Modes 564
8.6 Bluetooth Profiles 565
8.6.1 Basic Profiles: GAP, SDP, and the Serial Profile 567
8.6.2 Object Exchange Profiles: FTP, Object Push, and Synchronize 568
8.6.3 Headset, Hands-Free, and SIM Access Profile 570
8.6.4 High-Quality Audio Streaming 574
8.6.5 The Human Interface Device (HID) Profile 577
8.7 Bluetooth Low Energy 577
8.7.1 Introduction 577
8.7.2 The Lower BLE Layers 579
8.7.3 BLE SMP, GAP, and Connection Establishment 581
8.7.4 BLE Authentication, Security, and Privacy 582
8.7.5 BLE ATT and GATT 583
8.7.6 Practical Example 585
8.7.7 BLE Beacons 587
8.7.8 BLE and IPv6 Internet Connectivity 588
Questions 589
References 590
Index 593
