Network Architecture for LTE and Wi-Fi Interworking

Transcription

1 Netmanias Technical Document: Network Architecture for and Interworking Network Architecture for and Interworking August 16, 2012 Chris Yoo , About NMC Consulting Group NMC Consulting Group was founded on year 2002 and is advanced, professional network consulting company which is specialized for Network area like FTTH, Metro Ethernet and /MPLS, Service area like TV, IMS and CDN lastly, Wireless network area like Mobile WiMAX, and.

2 Netmanias Technical Document: Network Architecture for and Interworking Table of Contents Overview Network Reference Model Authentication and Security EPS Bearer QoS Handover Overview Network Architecture Handover Comparison ( vs. ) Tunneling Technology for Mobile Network and Interworking Network Reference Model Authentication and Security Allocation Traffic Selector Status of KT, SKT & LG U+ and Requirements 2

3 Netmanias Technical Document: Network Architecture for and Interworking Overview: Network Reference Model -Uu S1- (S1-MME) GTP-U (S1-U) HSS Diameter (S6a) MME GTP-C (S11) SPR Diameter (Sp) PCRF Diameter (Gx) GTP-U/GTP-C (S5) OFCS GTP (Gz) OCS Diameter (Gy) (SGi) PDN = E-UTRN: EPC = SAE: MME,,, HSS, PCRF, SPR, OFCS, OCS EPS = + EPC : Long Term Evolution E-UTRAN: Evolved-UTRAN (Universal Terrestrial Radio Access Network) EPC: Evolved Packet Core SAE: System Architecture Evolution EPS: Evolved Packet System : User Equipment : Evolved Node B : Serving-Gateway : PDN-Gateway MME: Mobility Management Entity HSS: Home Subscriber Server PCRF: Policy and Charging Rule Function SPR: Subscriber Profile Repository OFCS: Offline Charging System OCS: Online Charging System PDN: Packet Data Network User device which has chip, antenna and USIM card (ex. Smartphone, USB modem, Router (Egg)) Local mobility anchor point of the data connections for inter handover and inter-3gpp handover MME Main control entity for the E- UTRAN (brain of EPS) User authentication mobility management: location, state (ECM/EMM) PCRF It makes policy decision for and provides PCC rules (QoS and charging rules) to OFCS It manages offline charging data (CDR) per /per SDF, which provided by Base station which provides It provides PDN access for wireless connection between Mobility anchor point for inter and EPC handover Encryption and integrity address assignment to protected of control/data Online/Offline Charging Copyright packet between NMC Consulting and Group. All rights QoS reserved. Enforcement HSS Central DB holding user profile: user ID(IMSI), authentication key, QoS profile, etc User profile is provisioned by B/OSS when user subscription SPR Database for PCRF, which maintains policy and charging rule of user It is provisioned by B/OSS when user subscription OCS It manages data volume (UL/DL bytes), time (connection time) and event based online charging data per /per SDF, which provided by 3

4 Netmanias Technical Document: Network Architecture for and Interworking Overview: Authentication and Security HSS EPS Authentication Vectors (RAND, AUTN, XRES, K ASME ) MME IMSI, K 1 1 Mutual Authentication K ASME K NASint /K NASenc 2 2 NAS Signaling Integrity/ Ciphering K 3 K RRCint /K RRCenc RRC Signaling Integrity/ Ciphering Mandatory Optional K UPenc User Authentication User Identification: IMSI (International Mobile Subscriber Identity) - Global Uniqueness - PLMN ID (MCC + MNC) + MSIN - Stored at USIM () and HSS (E-UTRAN) Authentication Key: K - Stored at USIM () and HSS (E-UTRAN) User Authentication Protocol: EPS-AKA User Authentication Process 1. When requests to attach network 2. MME obtains authentication vectors (RAND, AUTN, XRES, K ASME ) from the HSS 3. Mutual authentication between and MME - authenticates network (MME) - MME authenticates Security for Radio Interface After success of mutual authentication, security for radio interface is provided based on master key (K ASME ) 1. Control message between and MME: Encrypted (optional) and Integrity Protected (mandatory) 2. Control message between and : Encrypted (optional) and Integrity Protected (mandatory) 3. User data between and : Encrypted (optional) 3 User Plane Ciphering IMSI Assignment IMSI Format IMSI, K Subscriber gets and USIM card which includes IMSI IMSI is provisioned in HSS and SPR when user subscriptioin PLMN MCC MNC MSIN K ASME K NASint /K NASenc K K RRCint /K RRCenc K UPenc USIM Attach Request (IMSI) HSS SPR MME PCRF Network (E-UTRAN) 3 digits Max. 3 digits Max. 10 digits Max. 15 digits Example Korea SK Telecom 4

5 Netmanias Technical Document: Network Architecture for and Interworking Overview: EPS Bearer Control ECM Connection Plane RRC Connection S1 Signaling Connection S11 GTP-C S5 GTP-C User Plane Data Radio Bearer HSS MME S1 Bearer EPS Bearer S5 Bearer SPR PCRF EPS Bearer Logical transport channel between and the PDN for transporting traffic EPS Bearer = Data Radio Bearer (between and ) + S1 Bearer (GTP tunnel between and ) + S5 Bearer (GTP tunnel between and ) can distinguish by DRB ID in EPS bearer can distinguish by Tunnel Endpoint ID (TEID) can distinguish by TEID or address At least one EPS bearer per, and it may also have multiple EPS bears per in order to provide QoS differentiation (ex. bearer and Vo bearer) Two Types of EPS Bearer Default EPS Bearer Dedicated EPS Bearer Data Radio Bearer S1 Bearer S1 (GTP) S5 Bearer S5 (GTP) PDN () Application UL TFT à DRB ID DRB ID (DL) Payload S= D= DRB ID (DL) S1 TEID (DL) UDP GTP-U Payload S= D= S1 TEID (DL) S1 TEID (DL) S5 TEID (DL) UDP GTP-U Payload S= D= S5 TEID (DL) S5 TEID (DL) DL TFT (*,Dst =,*,*,*) S5 TEID ß DL TFT Payload S= ogle.com D= UL TFT DRB ID (UL) (Src =,*,*,*,*) Payload DRB ID (UL) S1 TEID (UL) Payload GTP-UUDP S1 TEID (UL) S5 TEID (UL) Payload GTP-U UDP Payload DRB ID (UL) S= Copyright NMC Consulting Group. All D= rights reserved. S1 TEID (UL) S= D= S5 TEID (UL) S= D= S= D= ogle.com 5

6 Netmanias Technical Document: Network Architecture for and Interworking Overview: QoS PDN Connection 1 (EPS Session 1) Resource Type QoS Parameters of EPS Bearer QoS Parameters of SDF addr 1 Dedicated Bearer for PDN 1 Dedicated Bearer for PDN 1 Default Bearer for PDN 1 GBR Non-GBR Non-GBR QCI QCI QCI ARP ARP ARP GBR MBR (UL/DL) (UL/DL) N- AMBR (UL/DL) -AMBR (UL/DL) QCI ARP MBR (UL/DL) GBR (UL/DL) QCI ARP MBR (UL/DL) QCI ARP MBR (UL/DL) QCI ARP MBR (UL/DL) QCI ARP MBR (UL/DL) SDF 5 SDF 4 SDF 3 SDF 2 SDF 1 PDN 1 QCI: QoS Class Identifier ARP: Allocation and Retention Priority GBR: Guaranteed Bit Rate MBR: Maximum Bit Rate N-AMBR: Access Point Name-Aggregate Maximum Bit Rate -AMBR: User Equipment-Aggregate Maximum Bit Rate Common QoS Parameter (Resource Type, QCI, ARP) Resource Type ARP QoS Parameter for GBR Bearer GBR (UL/DL) GBR (Guaranteed Bit Rate): A certain amount of bandwidth is reserved for this bearer Non-GBR: It does not have a fixed (reserved) bandwidth allocated for this bearer (Best Effort) QCI The class-based QoS concept (such as DSCP) where each EPS bearer is assigned a QCI (1 ~ 9) It defines packet forwarding treatment QoS characteristics which defines below parameters: - Resource Type (GBR or Non-GBR) - Packet Delay Budget (30ms ~ 300ms) - Packet Error Loss Rate (10-2 ~ 10-6 ) Priority for the allocation and retention of bearers, defined by 0 ~ 15 Bearers with high ARP are assigned low ARP value, and vice versa (ex. Vo emergency call service has low ARP value) In resource limitation situation, network use the ARP to prioritize establishment and modification of bearers with a high ARP over bears with a low ARP It also uses ARP to decide which existed bearers to drop in case of resource limitation Guaranteed (Reserved) bandwidth (bps) for GBR bearer MBR (UL/DL) Maximum allowed bandwidth (bps) for GBR bearer Any traffic in excess of the MBR may be discarded QoS Parameter for Non-GBR Bearer N-AMBR (UL/DL) Maximum allowed bandwidth (bps) for all non-gbr bearers associated with a specific N -AMBR (UL/DL) Maximum allowed bandwidth (bps) for all non-gbr bearers of a 6

7 Netmanias Technical Document: Network Architecture for and Interworking Overview: Handover Intra E-UTRAN Handover Source moving Target MME Inter E-UTRAN and Handover Source MME moving Target Basic Requirement of Handover address should not be changed Packet loss and reordering should be minimized during handover Handover Decision Handover decision is performed by serving (In case of, (STA) performs handover decision) Handover Decision Process 1. sends Measurement Report message to serving periodically (or event triggered) 2. Measurement Report message includes Radio signal strength from serving cell to Radio signal strength from neighbor cells to 3. Serving ENB decides handover based on information of Measurement Report message Type of Handover Inter E-UTRAN, and MME Handover MME MME Source moving Target Inter RAT Handover Source moving Target NodeB SGSN RNC NodeB Intra E-UTRAN: relocated, without changing MME and Inter E-UTRAN and MME: and MME relocated, without changing Inter E-UTRAN and : and relocated, without changing MME Inter E-UTRAN and MME and :, and MME relocated Inter RAT (E-UTRAN and GERAN/UTRAN): Handover between 3G and 7

8 Netmanias Technical Document: Network Architecture for and Interworking Overview: Network Architecture Authentication & Security STA i/WPA2: E based Authentication & CCMP based Security i/WPA: E based Authentication & TK based Security 802.1x: E based Authentication & WEP based Security 802.1x: RADIUS* based Authentication * RADIUS is IETF RFC standards (RFC 3580, RFC 4675, RFC 4898, ) AAA WLAN/ Standard IEEE (WLAN): IEEE standards define MAC and PHY layer Wireless LAN (WLAN) term is used by IEEE Alliance (): Several vendors came together to form a global non-profit organization with the goal of driving adoption of high-speed wireless local area networking term is used by Alliance PHY & MAC n: 600Mbps / 2.4 & 5GHz g: 54Mbps / 2.4GHz b: 11Mbps / 2.4GHz a: 54Mbps / 5GHz WLAN(Wireless LAN) = The term is used in general as a synonym for WLAN Network Element (Entity) STA (Station) Hotspot Service in Korea : E based or Non Standard MAC/Web based Authentication KT SKT LG U+ SSID ollehwifi (secure) NESPOT, ollehwifi T wifi zone (secure) T wifi zone E-AKA Authentication MAC based authentication, Web (ID/PW) based authentication E-AKA MAC based authentication, Web (ID/PW) based authentication U+ zone (secure) MSCHv2 over PE (Very similar with E-TTLS) FREE U+ zone Open Access (1 hour free access after Ad. watch) Device which has chip & antenna (Access Point) It has IEEE Wireless LAN interface for use-facing and IEEE Ethernet interface for network-facing port It provides connection between STA and network AAA (Authentication, Authorization, Accounting) User authentication server Authentication & Security for Radio Interface E based authentication User data encryption and integrity protected based on AES(CCMP)/TK/WEP 8

9 Netmanias Technical Document: Network Architecture for and Interworking Overview: Handover (Vendor Specific Solution) Handover Controller (C, or Wireless LAN Controller(WLC)) will be required to support Inter- handover Major /C providers such as Aruba, Avaya, Meru support vendor specific protocol between and C (CW[RFC 5415, 5416] driven by Cisco, but other vendors still support their own methods Example: Handover Solution of the Meru Networks Inter- Handover Inter-C Handover IMS IMS AAA AAA Network Network Accounting for MS (1) Accounting for MS (1) C 1 C 2 C 1 in Tunnel C 2 Network Network WiFi 1 WiFi WiFi 1 WiFi 1 WiFi STA STA STA STA STA Traffic Flow: Before Inter- Handover Traffic Flow: After Inter- Handover STA can t recognize Inter- handover, which means that BSSID ( MAC) is not changed STA address (1) is not changed Accounting Data from C1 Handover Time: 3ms Traffic Flow: Before Inter-C Handover Traffic Flow: After Inter-C Handover STA address (1) is not changed in Tunnel between Cs Accounting Data from C2 Handover Time: 200ms ~ 2s ( HO standard) 9

10 Netmanias Technical Document: Network Architecture for and Interworking Comparison Standard 3GPP IEEE / Alliance Standard Entity User Authentication Security for User Data (E-UTRAN): EPC (SAE):,, MME, HSS, PCRF, SPR, OCS, OFCS EPS-AKA Encryption STA,, Controller(optional), AAA E based Authentication (Standard) E-AKA/SIM E-TLS E-TTLS, etc Web based Authentication (WBA) ID/PW MAC based Authentication (Non Standard) STA MAC E based Authentication Encryption/Integrity Protected Web/MAC based Authentication None QoS Support Supported Supported (WMM), but not guaranteed Handover (User Mobility) Support Supported Tunneling Protocol GTP Vendor Specific Supported, but vendor specific methods Controller required Packet Loss during handover Frequency Interference None Big issue (ISM band) Frequency Band KT: 1.8GHz SKT: 800MHz, 1.8GHz LG U+: 800MHz, 2.1GHz 2.4GHz/5GHz 10

11 Netmanias Technical Document: Network Architecture for and Interworking Tunneling Technology for Mobile Network Wired Access Network (FTTH, DSL, Ethernet, HFC, etc) S=YouTube D= /24 PC /24 PC 2 ge /24 PC 3 Switch Payload ge1 ge2 Router YouTube Network User Mobility in Wired Network If user moves to another location without changing address in wired access network, communication will be broken because routing network can not recognize user mobility Wireless/Mobile Access Network (3G,, WiMAX,, etc) a SmartPhone move c Tunnel header Payload S= Anchor D= Switch S=YouTube D= Tunnel 1 Tunnel 2 a /24 b /24 ge /24 c b Router Anchor Tunnel header Payload S= Anchor D= ge1 ge2 S=YouTube D= Mobile Network S=YouTube D= YouTube Network Payload c Payload S=YouTube D= User Mobility in Wireless/Mobile Network The key requirement of user mobility is User address should not be changed Anchor should be existed in wireless/mobile network for supporting user mobility (3G: GGSN, :, WiMAX: ASN-GW, : Controller) Downstream traffic delivered process 1. Anchor advertises user address prefix to routing network via OSPF, IS-IS or BGP 2. Anchor receives packet destined to user over the 3. Anchor encapsulates the user packet with Tunnel header and forwards the resulting outer packet to the Base Station(BS) 4. So, routing network between BS and Anchor has no chance to see user address, which means that routing network does not require to concern about user mobility Tunneling Protocol in Wireless/Mobile Network 3G/ (standardized by 3GPP) - ~ : GTP Tunnel (3GPP) - ~ : GTP Tunnel (3GPP) WiMAX (standardized by WiMAX Forum) - BS ~ ASN-GW: GRE Tunnel (RFC 1702) - ASN-GW ~ HA: in Tunnel (RFC 2003) (standardized by IEEE/ Alliance) - ~ Controller: Vendor Specific Tunnel 11

12 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (1) Network Reference Model Mobile Data Offloading EPS-AKA HSS Diameter MME GTP-C S1- E-UTRAN PCRF RRC Diameter GTP-U GTP Tunnel GTP-U GTP Tunnel EPC Sec Tunnel PMv6 (S2b) GRE Tunnel IKEv2 (SWu) epdg /C Diameter (SWx) Diameter (S6b) Diameter (SWm) DHCP DHCP 3GPP AAA Diameter (SWa) E-AKA Data offloading is the use of complementary network technologies for delivering data originally targeted for cellular networks. The main complementary network technologies used for the mobile data offloading are, Femtocell Let s use cheaper access instead of expensive cellular () network! Trust & Untrust Access Network Simply put, this is really an indicator on if the 3GPP operator trust the security of the non-3gpp access network If non-3gpp access network supports trust security level from the 3GPP core (EPC) viewpoint, it is interworked with S2a interface, otherwise S2b interface is used - Example of Trust network: WiMAX - Example of Untrust network: WLAN() in a public café HPLMN 3GPP Access S6a Serving Gateway S5 HSS Gxc S2a PDN Gateway S2b Gx epdg PCRF Gxb SWn SGi Rx SWm SWx Operator's Services (e.g. IMS, PSS etc.) S6b 3GPP AAA Server EPS Entity EPS Entity for Interworking Handover Entity Dual-Radio Traffic Path Non-3GPP Networks Trusted Non-3GPP Access Gxa SWu Untrusted Non-3GPP Access SWa STa 3GPP TS Figure : Non-Roaming Architecture within EPS using S5, S2a, S2b 12

13 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (2) Authentication and Security HSS delivers AVs to MME & 3GPP AAA HSS AVs RAND, AUTN, XRES MME MME authenticates by verifying if RES = XRES 3GPP AAA authenticates by verifying if RES = XRES 3GPP AAA AVs RAND, AUTN, XRES EPS-AKA AUTN, AUTN, RES epdg authenticates by verifying AUTH epdg E-AKA over IKEv2 AUTN, AUTN, RES 1 /C IKEv2 AUTH 2 User Authentication for access Authentication Protocol: EPS-AKA (USIM based) Mutual authentication between and MME 1 authenticates MME by verifying AUTN Handover authenticates 3GPP AAA by verifying AUTN User Authentication for epdg access Authentication Protocol: E-AKA ove IKEv2 (USIM based) It is very similar with EPS-AKA in network User Authentication Process 1. When requests to connect with epdg 2. 3GPP AAA obtains authentication vectors (RAND, AUTN, XRES) from the HSS 3. Mutual authentication between and 3GPP AAA - authenticates 3GPP AAA - 3GPP AAA authenticates 2 13

14 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (2) Authentication and Security (cont) Security for Radio Interface User data is encrypted between and chip(hw) of supports data encryption/decryption 1 Security for Radio Interface 3GPP assumes that security is not enabled (supported) 2 Security between and epdg User data is encrypted and integrity protected between and epdg Sec driver(sw) of supports data encryption/decryption and integrity protection (Performance issue?) 3 epdg Encryption Handover /C Encryption & Integrity Protected Sec ESP Packet between and epdg 20B Header 8B ESP Header 20B Header Application Encrypted Integrity Protected Variable Variable ESP ESP Trailer ICV 14

15 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (3) Allocation Which entity allocates address? allocates address in both case that attaches to and network User packet is routing with this address in the address is not changed even if access network is changed ( to, and to ) 1 3 Allocation by Allocation by For Connection via Network (PDN Address) = epdg DHCP 3 For Connection via Network (WLAN s Remote ) = Application TCP/ OS (Kernal) Sec Driver Protocol Stack Handover /C Application OS (Kernal) TCP/ Sec Driver Protocol Stack Allocation by DHCP For epdg Connection via Nework (WLAN s Local ) = Another address for accessing network or External DHCP server allocates Outer address in access network for Sec Tunneling between and epdg This outer address can be changed during handover. So, MOBIKE should be supported in and epdg So, Two addresses are required when accesses to network - WLAN s Local : Outer address which allocated by /DHCP server - WLAN s Remote : Inner address which allocated by P- GW 15 2

16 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (3) Allocation (cont) Example of address usage attach (PDN Address) = DRB GTP Tunnel GTP Tunnel Application Sec Payload Payload Payload DRB S=( ) D=google DRB Payload Payload GTP-U UDP S=( ) D=google UDP GTP-U S= D= Payload Payload GTP-U UDP S=( ) D=google UDP GTP-U S= D= Payload Payload S=( ) D=google Payload S=google D=( ) S= D= S=google D=( ) S= D= S=google D=( ) S=google D=( ) epdg connection (WLAN s Remote ) = (WLAN s Local ) = DHCP Access Network Sec Tunnel epdg GRE Tunnel Application Sec Payload Payload Sec Payload Payload Sec Payload GRE S=( ) D=google Sec Payload S=( ) D=ePDG S=( ) D=google GRE S=ePDG D= Payload Payload S=( ) D=google Payload S=ePDG D=( ) S=google D=( ) S= D=ePDG S=google D=( ) S=google D=( ) 16

17 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (4) Traffic Selector WLAN 3GPP Access User Traffic Path: epdg Traffic is passed through the 3GPP core, which means that it can support handover between and Use Case: Operator Service (example: KT olleh TV now). Operator can provide differentiated service (e.g., heterogeneous handover) to their subscriber 1 WLAN Direct Access User Traffic Path: Traffic is not passed through the 3GPP core, which means that it can not support handover between and Use Case: OTT service (example: YouTube) 2 epdg Traffic Selector TS (Traffic Selector) TSi = S, Protocol, SP TSr = D, Protocol, DP TSi + TSr = 5-tuple WLAN 3GPP Access Handover /C 1 2 WLAN Direct Access S = Source ( header) D = Destination ( header) SP = Source Port # (TCP/UDP header) DP = Destination Port # (TCP/UDP header) Traffic Selector can be used to distinguish between WLAN 3GPP Access and WLAN Direct Access gets Traffic Selector from the epdg during the IKEv2 procedure Traffic Selector consists of TSi and TSr: - TSi = Source Address(S) range, Protocol range, Source Port Number(SP) range - TSr = Destination Address(D) range, à Server Identification Protocol range (same as TSi, à TCP or UDP Destination Port Number(DP) range à Service Identification Tsi + TSr = 5-tuple Based on 5-tuple, (Sec driver) can determine whether application traffic ( flow) is served by WLAN 3GPP Access or WLAN Direct Access 17

18 Netmanias Technical Document: Network Architecture for and Interworking and Interworking: (4) Traffic Selector (cont) App D=YouTube Protocol=TCP DP=80 YouTube 2 ollehtv 5 D= (ollehTV) Protocol=6(TCP) DP=80(HTTP) Traffic Selector Source Destination ~ Protocol 6 (TCP) Source Port # 0 ~ Destination Port # 80 (HTTP) TCP/ Traffic Selector 1 no match match Sec Insert Sec header /C epdg Payload Sec 7 4 S=( ) D= S=( ) D=ePDG a b c 3 Payload d S=( ) D=YouTube WLAN s Local Address Allocated by /DHCP Server in Network Sec Tunnel Outer Source in case of WLAN 3GPP Access Source in case of WLAN Direct Access WLAN s Remote Address Allocated by Sec Tunnel Inner Source in case of WLAN 3GPP Access d Network a Payload Sec b Payload GRE c Payload S=( ) D= S=( ) D=ePDG S=( ) D= Payload S=( ) D=YouTube S=ePDG D= WLAN 3GPP Access WLAN Direct Access S=( ) D=

19 Netmanias Technical Document: Network Architecture for and Interworking Status of KT, SKT & LG U+ and Requirements KT, SKT: No plan LG U+: Deploy epdg from Insprit ( but do not service yet LG U+: The Purpose of epdg Deployment LG U+ Service Provides security when subscriber accesses LG U+ service via network At this moment, there s no interworking (no PMv6/GTE tunnel) between and epdg which means that it does not support handover between and epdg Software Requirement for / Interworking Sec(MOBIKE) driver (Kernel Layer) is required Handover Manager (Kernel Layer) is required: Handover decision by monitoring and signal strength Big Issue: Apple willing to support Sec and Handover Manager in iphone/ipad??? /C 19