Wireless principles and communication

UMTS Network Architecture

A UMTS network consist of three interacting domains; Core Network (CN), UMTS
Terrestrial Radio Access Network (UTRAN) and User Equipment (UE). The main function
of the core network is to provide switching, routing and transit for user traffic. Core network
also contains the databases and network management functions.

The basic Core Network architecture for UMTS is based on GSM network with GPRS. All
equipment has to be modified for UMTS operation and services. The UTRAN provides the
air interface access method for User Equipment. Base Station is referred as Node-B and
control equipment for Node-B's is called Radio Network Controller (RNC). UMTS system
page has an example, how UMTS network could be build.

It is necessary for a network to know the approximate location in order to be able to page user
equipment. Here is the list of system areas from largest to smallest.

 UMTS systems (including satellite)

 Public Land Mobile Network (PLMN)

1|W-CDMA (UMTS)
Wireless principles and communication

 MSC/VLR or SGSN
 Location Area
 Routing Area (PS domain)
 UTRAN Registration Area (PS domain)
 Cell
 Sub cell

Core Network:

The Core Network is divided in circuit switched and packet switched domains. Some of the
circuit switched elements are Mobile services Switching Centre (MSC), Visitor location
register (VLR) and Gateway MSC. Packet switched elements are Serving GPRS Support
Node (SGSN) and Gateway GPRS Support Node (GGSN). Some network elements, like EIR,
HLR, VLR and AUC are shared by both domains.

The Asynchronous Transfer Mode (ATM) is defined for UMTS core transmission. ATM
Adaptation Layer type 2 (AAL2) handles circuit switched connection and packet connection
protocol AAL5 is designed for data delivery.

The architecture of the Core Network may change when new services and features are
introduced. Number Portability DataBase (NPDB) will be used to enable user to change the
network while keeping their old phone number. Gateway Location Register (GLR) may be
used to optimise the subscriber handling between network boundaries. MSC, VLR and SGSN
can merge to become a UMTS MSC.

Radio Access:

Wide band CDMA technology was selected to for UTRAN air interface. UMTS WCDMA is
a Direct Sequence CDMA system where user data is multiplied with quasi-random bits
derived from WCDMA Spreading codes. In UMTS, in addition to channelisation, Codes are
used for synchronisation and scrambling. WCDMA has two basic modes of operation:
Frequency Division Duplex (FDD) and Time Division Duplex (TDD). UTRAN interfaces are
shown on UMTS Network page.

The functions of Node-B are:

 Air interface Transmission / Reception

 Modulation / Demodulation
 CDMA Physical Channel coding
 Micro Diversity
 Error Handing
 Closed loop power control

The functions of RNC are:

 Radio Resource Control

 Admission Control
 Channel Allocation

2|W-CDMA (UMTS)
Wireless principles and communication

 Power Control Settings

 Handover Control
 Macro Diversity
 Ciphering
 Segmentation / Reassembly
 Broadcast Signalling
 Open Loop Power Control

User Equipment:

The UMTS standard does not restrict the functionality of the User Equipment in any way.
Terminals work as an air interface counter part for Node-B and have many different types of
identities. Most of these UMTS identity types are taken directly from GSM specifications.

 International Mobile Subscriber Identity (IMSI)

 Temporary Mobile Subscriber Identity (TMSI)
 Packet Temporary Mobile Subscriber Identity (P-TMSI)
 Temporary Logical Link Identity (TLLI)
 Mobile station ISDN (MSISDN)
 International Mobile Station Equipment Identity (IMEI)
 International Mobile Station Equipment Identity and Software Number (IMEISV)

UMTS mobile station can operate in one of three modes of operation:

 PS/CS mode of operation: The MS is attached to both the PS domain and CS domain,
and the MS is capable of simultaneously operating PS services and CS services.
 PS mode of operation: The MS is attached to the PS domain only and may only operate
services of the PS domain. However, this does not prevent CS-like services to be offered over
the PS domain (like VoIP).
 CS mode of operation: The MS is attached to the CS domain only and may only operate
services of the CS domain.

UMTS IC card has same physical characteristics as GSM SIM card. It has several functions:

 Support of one User Service Identity Module (USIM) application (optionally more that
one)
 Support of one or more user profile on the USIM
 Update USIM specific information over the air
 Security functions
 User authentication
 Optional inclusion of payment methods
 Optional secure downloading of new applications

UMTS Services:

3|W-CDMA (UMTS)
Wireless principles and communication

UMTS offers teleservices (like speech or SMS) and bearer services, which provide the
capability for information transfer between access points. It is possible to negotiate and
renegotiate the characteristics of a bearer service at session or connection establishment and
during ongoing session or connection. Both connection oriented and connectionless services
are offered for Point-to-Point and Point-to-Multipoint communication.

Bearer services have different QoS parameters for maximum transfer delay, delay variation
and bit error rate. Offered data rate targets are:

 144 kbits/s satellite and rural outdoor

 384 kbits/s urban outdoor
 2048 kbits/s indoor and low range outdoor

UMTS network services have different QoS classes for four types of traffic:

 Conversational class (voice, video telephony, video gaming)

 Streaming class (multimedia, video on demand, webcast)
 Interactive class (web browsing, network gaming, database access)
 Background class (email, SMS, downloading)

UMTS will also have a Virtual Home Environment (VHE). It is a concept for personal
service environment portability across network boundaries and between terminals. Personal
service environment means that users are consistently presented with the same personalised
features, User Interface customisation and services in whatever network or terminal,
wherever the user may be located. UMTS also has improved network security and location
based services.

UMTS Security:
The security functions of UMTS are based on what was implemented in GSM. Some of the
security functions have been added and some existing have been improved. Encryption
algorithm is stronger and included in base station (NODE-B) to radio network controller
(RNC) interface , the application of authentication algorithms is stricter and subscriber
confidentially is tighter.

The main security elements that are from GSM:

 Authentication of subscribers
 Subscriber identity confidentially
 Subscriber Identity Module (SIM) to be removable from terminal hardware
 Radio interface encryption

Additional UMTS security features:

 Security against using false base stations with mutual authentication
 Encryption extended from air interface only to include Node-B to RNC connection
 Security data in the network will be protected in data storages and while transmitting
ciphering keys and authentication data in the system.
 Mechanism for upgrading security features.

Core network traffic between RNCs, MSCs and other networks is not ciphered and operators
can to implement protections for their core network transmission links, but that is unlike to
happen. MSCs will have by design a lawful interception capabilities and access to Call Data

4|W-CDMA (UMTS)
Wireless principles and communication

Records (SDR), so all switches will have to have security measures against unlawful access.

UMTS specification has five security feature groups:

 Network access security: the set of security features that provide users with secure
access to 3G services, and which in particular protect against attacks on the (radio) access
link;
 Network domain security: the set of security features that enable nodes in the provider
domain to securely exchange signalling data, and protect against attacks on the wireline
network;
 User domain security: the set of security features that secure access to mobile stations
 Application domain security: the set of security features that enable applications in the
user and in the provider domain to securely exchange messages.
 Visibility and configurability of security: the set of features that enables the user to
inform himself whether a security feature is in operation or not and whether the use and
provision of services should depend on the security feature.

UMTS specification has the following user identity confidentiality security features:
 User identity confidentiality: the property that the permanent user identity (IMSI) of a
user to whom a services is delivered cannot be eavesdropped on the radio access link;
 User location confidentiality: the property that the presence or the arrival of a user in a
certain area cannot be determined by eavesdropping on the radio access link;
 User untraceability: the property that an intruder cannot deduce whether different
services are delivered to the same user by eavesdropping on the radio access link.

Air interface ciphering/deciphering in performed in RNC in the network side and in mobile
terminals. Ciphering in function of air interface protocol Radio Link Control (RLC) layer or
Medium Access control (MAC) layer.

Cell search procedure:

During the cell search, the UE searches for a cell and determines the downlink scrambling
code and frame synchronisation of that cell. The cell search is typically carried out in three
steps:

Step 1: Slot synchronisation

During the first step of the cell search procedure the UE uses the SCH's primary
synchronisation code to acquire slot synchronisation to a cell. This is typically done with a
single matched filter (or any similar device) matched to the primary synchronisation code
which is common to all cells. The slot timing of the cell can be obtained by detecting peaks in
the matched filter output.

Step 2: Frame synchronisation and code-group identification

During the second step of the cell search procedure, the UE uses the SCH's secondary
synchronisation code to find frame synchronisation and identify the code group of the cell
found in the first step. This is done by correlating the received signal with all possible
secondary synchronisation code sequences, and identifying the maximum correlation value.
Since the cyclic shifts of the sequences are unique the code group as well as the frame
synchronisation is determined.

5|W-CDMA (UMTS)
Wireless principles and communication

Step 3: Scrambling-code identification

During the third and last step of the cell search procedure, the UE determines the exact
primary scrambling code used by the found cell. The primary scrambling code is typically
identified through symbol-by-symbol correlation over the CPICH with all codes within the
code group identified in the second step. After the primary scrambling code has been
identified, the Primary CCPCH can be detected and the system- and cell specific BCH
information can be read.
If the UE has received information about which scrambling codes to search for, steps 2 and 3
above can be simplified

Structure of synchronization channel

The Synchronisation Channel (SCH) is a downlink signal used for cell search. The SCH
consists of two sub channels, the Primary and Secondary SCH. The 10 ms radio frames of the
Primary and Secondary SCH are divided into 15 slots, each of length 2560 chips. Picture
above illustrates the structure of the SCH radio frame.

The Primary SCH consists of a modulated code of length 256 chips, the primary
synchronization code (PSC) is transmitted once every slot. The PSC is the same for every cell
in the system.

The Secondary SCH consists of repeatedly transmitting a length 15 sequence of modulated

codes of length 256 chips, the Secondary Synchronisation Codes (SSC), transmitted in
parallel with the Primary SCH. The SSC is denoted csi,k in figure 20, where i = 0, 1, …, 63 is
the number of the scrambling code group, and k = 0, 1, …, 14 is the slot number. Each SSC is
chosen from a set of 16 different codes of length 256. This sequence on the Secondary SCH
indicates which of the code groups the cell's downlink scrambling code belongs to.

Summary of the process:

6|W-CDMA (UMTS)
Wireless principles and communication

Channel Synchronisation Note

acquired
Primary Chip, Slot, Symbol 256 chips
SCH Synchronisation The same in all cells
Secondary Frame 15-code sequence of secondary synchronisation
SCH Synchronisation, codes.
Code Group (one of There are 16 secondary synchronisation codes.
64) There are 64 S-SCH sequences corresponding
to the 64 scrambling code groups
256 chips, different for different cells and slot
intervals
Common Scrambling code To find the primary scrambling code from
Pilot CH (one of 8) common pilot CH
PCCPCH 1) Super Frame Fixed 30 kbps channel
Synchronisation, 27 kbps rate
BCCH information. spreading factor 256
SCCPCH 2) Carries FACH and PCH channels
Variable bit rate

1) Primary Common Control Physical Channel

2) Secondary Common Control Physical Channel

3G Frequencies:
According to "WARC-92 frequencies for IMT-2000" resolution: "The bands 1885-2025 MHz and
2110-2200 MHz are intended for use, on a worldwide basis, by administrations wishing to
implement International Mobile Telecommunications-2000 (IMT-2000). Such use does not preclude
the use of these bands by other services to which they are allocated."

Here is the summary of UMTS frequencies:

1920-1980 and 2110-2170 MHz Frequency Division Duplex (FDD, W-CDMA) Paired uplink and
downlink, channel spacing is 5 MHz and raster is 200 kHz. An Operator needs 3 - 4 channels (2x15
MHz or 2x20 MHz) to be able to build a high-speed, high-capacity network.
1900-1920 and 2010-2025 MHz Time Division Duplex (TDD, TD/CDMA) Unpaired, channel spacing is
5 MHz and raster is 200 kHz. Tx and Rx are not separated in frequency.
1980-2010 and 2170-2200 MHz Satellite uplink and downlink.

Carrier frequencies are designated by a UTRA Absolute Radio Frequency Channel Number (UARFCN).
The general formula relating frequency to UARFN is:
UARFCN = 5 * (frequency in MHz)

Paging:

The Paging Channel (PCH) is a downlink transport channel. The PCH is always transmitted
over the entire cell. The transmission of the PCH is associated with the transmission of
physical-layer generated Paging Indicators, to support efficient sleep-mode procedures.

Paging Channel selection:

7|W-CDMA (UMTS)
Wireless principles and communication

System information block type 5 (SIB 5) defines common channels to be employed in Idle
mode. In a cell, a single or several PCHs may be established. Each Secondary Common
Control Physical Channel (SCCPCH) indicated to the UE in system information may carry up
to one PCH. Thus, for each defined PCH there is one uniquely associated PICH also
indicated.

In case that more than a single PCH and associated PICH are defined in SIB 5, the UE shall
perform a selection according to the following rule:
 The UE shall select a SCCPCH from the ones listed in SIB 5 based on IMSI as follows:

               "Index of selected SCCPCH" = IMSI mod K,

where K is equal to the number of listed SCCPCHs which carry a PCH (i.e. SCCPCHs
carrying FACH only shall not be counted). These SCCPCHs shall be indexed in the order of
their occurrence in SIB 5 from 0 to K-1.

"Index of selected SCCPCH" identifies the selected SCCPCH with the PCH and the uniquely
associated PICH to be used by the UE. If the UE has no IMSI, for instance when making an
emergency call without USIM, the UE shall use as default number IMSI = 0.

The UE may use Discontinuous Reception (DRX) in idle mode in order to reduce power
consumption. When DRX is used the UE needs only to monitor one Page Indicator, PI, in one
Paging Occasion per DRX cycle.

The Paging Indicator Channel (PICH) is a fixed rate (SF=256) physical channel used to
carry the paging indicators. The PICH is always associated with an S-CCPCH to which a
PCH transport channel is mapped. Picture below illustrates the frame structure of the PICH.
One PICH radio frame of length 10 ms consists of 300 bits. Of these, 288 bits are used to
carry paging indicators. The remaining 12 bits are not formally part of the PICH and shall not
be transmitted (DTX). The part of the frame with no transmission is reserved for possible
future use.

Structure of Paging Indicator Channel (PICH)

UMTS Interfaces:

8|W-CDMA (UMTS)
Wireless principles and communication

UMTS Time Slots:

UMTS has several different time slot configuration depending on the used channel. Here is
an example of DPCH (Dedicated Physical Channel) downlink and uplink time slot allocation.

TCP stands for Transmit Power Control, Feedback Information (FBI) is used for closed loop
transmission diversity. Transport Format Combination Indicator (TFCI) contains the
information relating to data rates. Pilot bits are always the same and are used for channel
synchronisation.

9|W-CDMA (UMTS)
Wireless principles and communication

UTRA Channels:

UTRA FDD radio interface has logical channels, which are mapped to transport channels,
which are again mapped to physical channels. Logical to Transport channel conversion
happens in Medium Access Control (MAC) layer, which is a lower sublayer in Data Link
Layer (Layer 2).

Logical Channels:
Broadcast Control Channel (BCCH), Downlink (DL)
Paging Control Channel (PCCH), DL
Dedicated Control Channel (DCCH), UL/DL
Common Control Channel (CCCH), UL/DL
Dedicated Traffic Channel (DTCH), UL/DL

10 | W - C D M A ( U M T S )
Wireless principles and communication

Common Traffic Channel (CTCH), Unidirectional (one to many)

Transport Channels:
Dedicated Transport Channel (DCH), UL/DL, mapped to DCCH and DTCH
Broadcast Channel (BCH), DL, mapped to BCCH
Forward Access Channel (FACH), DL, mapped to BCCH, CCCH, CTCH, DCCH and DTCH
Paging Channel (PCH), DL, mapped to PCCH
Random Access Channel (RACH), UL, mapped to CCCH, DCCH and DTCH
Uplink Common Packet Channel (CPCH), UL, mapped to DCCH and DTCH
Downlink Shared Channel (DSCH), DL, mapped to DCCH and DTCH

Physical Channels:
Primary Common Control Physical Channel (PCCPCH), mapped to BCH
Secondary Common Control Physical Channel (SCCPCH), mapped to FACH, PCH
Physical Random Access Channel (PRACH), mapped to RACH
Dedicated Physical Data Channel (DPDCH), mapped to DCH
Dedicated Physical Control Channel (DPCCH), mapped to DCH
Physical Downlink Shared Channel (PDSCH), mapped to DSCH
Physical Common Packet Channel (PCPCH), mapped to CPCH
Synchronisation Channel (SCH)
Common Pilot Channel (CPICH)
Acquisition Indicator Channel (AICH)
Paging Indication Channel (PICH)
CPCH Status Indication Channel (CSICH)
Collision Detection/Channel Assignment Indication Channel (CD/CA-ICH)

11 | W - C D M A ( U M T S )