Category Archives: Notes

IMTx: NET02x (4G Network Essentials) – Radio Interface – 3. Packet Allocation

EUTRAN, LTE, Mobile Networks, Notes, RF, , , , , , , , , , ,

These are my lecture notes from IMT’s NET02x (4G Network Essentials) course, I thought I’d post them here as they may be useful to someone. You can find my complete notes here.

Allocation Tables

To inform UEs of which resources are allocated to it, the eNB regularly publishes Allocation Tables with this information.

Resources are allocated dynamically, by the eNB to all the UEs it is serving.

Because the eNB manages all the resources, the eNB must inform the UEs which resources are allocated to which UEs.

This is broken into two functions:

  • A UE must be able to be informed it’s going to receive data (downlink) and be allocated the resources for it.
  • A UE must be able to request resources from the eNB to send data (uplink) and be allocated resources for it.

The eNB manages all resource allocation, for downlink and uplink, when they are needed. This is done through an allocation table published by the eNB every subframe (1ms).

There are two allocation tables – One for uplink, one for downlink.

Addressing on the Radio Interface – RNTI

As an allocation table needs to allocate resources to each UE it needs a way to address them.

GUTI, IMSI, TMSI etc, are all too long (allocation tables are published every subframe so need to be a small as possible).

Instead for addressing in the allocation tables as RNTI – Radio Network Temporary Identifier is issued by the eNB to each UE it is serving, the RNTI is issued by the eNB and only valid for that cell, if the user moves to another cell served by another eNB another RNTI is allocated by that eNB.

The RNTI is 16 bits long, meaning it can store 65,536 decimal values. (65,536 UEs)

Allocation on Downlink

Resource allocation for the downlink is managed by the eNB, which publishes allocation tables every subframe defining which resource blocks are allocated to which UE.

The resource blocks contains the RNTI of each UE to receive data and the resource blocks it’s data will be contained in.

Each UE listens for the allocation tables published in each subframe, and if the UE sees it’s own RNTI in the allocation table it listens on the resource blocks allocated to it.

In the example above we can see the allocation table in the dark blue colour, published every 1ms (aka every subframe).

In this example the UE that has been assigned RNTI 63 (represented in green) has got resource blocks 12 & 13 assigned to it, so will listen on 12 and 13 to get it’s downlink data.

Because UEs only listen for the allocation tables and the resource blocks assigned to them, it leads to power savings on the UE as they don’t all need to listen / decode to all resource blocks. Power savings on the UE translate to better battery efficiency.

The UE with RNTI 61 for example, does not get allocated any resource blocks in the downlink in the example allocation table, so it listens for the allocation table and then goes into standby mode until the next allocation table is published.

The allocation tables are contained in the Physical Downlink Control Channel (PDCCH) a channel used only by the eNB to broadcast resource allocation tables and control data.

The actual downlink data for each UE is contained in the Physical Downlink Shared Channel (PDSCH)

Allocation in the Uplink

Allocation in the uplink is similar to allocation in the downlink, however there are some important differences.

  • The UE must request the resources from the eNB and wait for them to be allocated in the next uplink resource block.
  • There is a 4ms delay between a resource block being allocated in an allocation table by the eNB for the uplink and it being used by the UE to send data. This gives the UE time to get the data ready to go into the resource block.

The UE requests a resource from the eNB (covered later) and the eNB publishes an allocation table in the next subframe, however this allocation table is to be used in 4 subframes time.

The UE then buffers this allocation table and uses it in 4 subframes time.

By having this delay in using the resource table / allocating resource tables in advance, it allows our UEs to prepare the message for transmission, encode it, modulate it, etc.

The image below shows the UE in red requesting a resource for uplink from the eNB, the eNB then publishes the allocation table for 4 subframes time, the UE waits for 4 subframes to pass and then the UE transmits using the resources allocated in the allocation table published 4ms prior.

For example in the image below the UE with the RTNI of 64, represented in light blue, has requested a resource to send data (uplink), the eNB publishes an uplink allocation table in the next subframe, and the UE has then 4 subframes to prepare the data for transmission before sending the data using the resources allocated in the allocation table sent to it 4 subframes prior.

Like in the Downlink, Uplink transmissions are managed by a Control Channel and data is contained within a Data Channel.

The Physical Uplink Control Channel (PUCCH) contains the control information and the resource tables for the uplink (to be used in 4 subsframes time), shown in gray.

The data being sent from the UEs is contained in Physical Uplink Shared Channels (PUSCH) allocated 4ms prior in a PUCCH.

When a UE has data to transmit it transmits on the PUCCH to request a resource block for the uplink data.

IMTx: NET02x (4G Network Essentials) – Radio Interface – 2. Resource Blocks & Sub-Frames

EUTRAN, LTE, Mobile Networks, Notes, RF, , , , , , ,

These are my lecture notes from IMT’s NET02x (4G Network Essentials) course, I thought I’d post them here as they may be useful to someone. You can find my complete notes here.

As spectrum is sparse and expensive, so it must be used wisely and shared across multiple users.

LTE shares spectrum in both frequency and time.

L

LTE can use bandwidths from 1.4Mhz to 20Mhz, based on the spectrum owned and needs of the area.

Spectrum is divided into sub-carriers, allowing each subcarrier to be allocated to a different user, and these subcarriers are re-allocated by the eNB based on the terminal’s needs.

Resource Element (RE)

A Resource Element is the time and frequency a single symbol can be transmitted on.

Resource Elements are allocated by the eNB to UEs and the UE transmits on it’s allocated resource element one symbol.

The size of the data in the symbol is defined by the MCS used.

One Resource Element is contained within 1 subcarrier of 15kHz lasting 66μ s.

Resource Blocks (RB)

Because resource elements are so small, they’re managed in Resource Blocks.

Each Resource Block lasts 0.5ms with 12 sub carriers on each, allowing for 84 Resource Elements in per Resource Block.

The number of Resource Blocks that can be used is determined by the spectrum available.

As we can calculate a Resource Block occupies 180kHz of bandwidth, how many Resource Blocks we can have is determined by how many will fit into our bandwidth.

A system using the minimum bandwidth of 1.4Mhz will have 6 RBs available (1.4Mhz divides into 6 complete 180kHz RBs), while one using the maximum of 20Mhz will have 100 RBs available.

Not all the REs in an RB can be used by terminals though, many of them are reserved for LTE control channels.

The purple and red blocks are reserved as control channels

Meaning only the white REs shown above can be filled with user traffic.

Sub-Frame

Every 1ms (or 2 Resource Blocks) LTE reallocates the RBs to the terminals that need to communicate.

This means Resource Blocks are allocated in pairs, called a subframe, lasting 1ms.

Subframe, RB, RE Hierarchy

Each subframe is 1ms long and made up of 2 0.5ms Resource Blocks.

Each Resource Block contains 84 Resource Elements, each of which contain one symbol of data.

Resource Allocation in Uplink

When a device needs to transmit data it is allocated one or more resource blocks.

If the number of resource blocks is not enough it can be allocated more in the next subframes.

The amount of data a device can transmit in each subframe is called a Transport Block and is made up of the number of RBs and the modulation (MCS) used.

Table of MCS vs Resource Block Pairs (Subframes) and resulting data throughput rate in bits

The sub frame containing contain data for various terminals is shown below in different colors.

Transmission Chain

Transport Blocks are filled with data based on the Transport Block size.

CRC is added to detect errors.

Data is encoded to help recover data containing errors. (Defined by MCS)

Data is modulated (Using modulation scheme defined by MCS)

Data is transmitted in the user-data part that has been allocated in one or more Resource Block Pairs.

IMTx: NET02x (4G Network Essentials) – Radio Interface – 1. Radio Transmission

EUTRAN, LTE, Mobile Networks, Notes, RF, , , ,

These are my lecture notes from IMT’s NET02x (4G Network Essentials) course, I thought I’d post them here as they may be useful to someone. You can find my complete notes here.

The E-UTRAN relies on Phase Shift Keying to modulate data.

The downlink uses orthogonal frequency division multiplex (OFDM) while the uplink uses SC-FDMA due to OFDM’s high peak-to-average-power ratio making it unstable for uplink due to power consumption requirements.

Binary Phase Shift Keying (BPSK)

The simplest modulation is Binary Phase Shift Keying, allowing the phase to be left unmodified to encode a 0, or offset by 180 degrees (aka π) to transmit a 1.

While each bit of data is being transmitted, the time it is being sent over the air is referred to as the symbol length.

2 phase states of BPSK in LTE
2 Phase States of BPSK

Quaternary Phase Shift Keying (QPSK)

QPSK adds to additional phase states, to allow us to send twice as much data in one symbol.

This is done by defining more than two states (phase unmodified, phase offset by pi), but rather 4 states:

DataPhase Offset
00π/2
115π/2
013π/2
107π/2

This means we can transmit double the number of bits in a single symbol, with QPSK we can now transmit 2 bits per symbol as per the table above.

This means the data rate of QPSK is twice that of BPSK.

4 phase states of QPSK in LTE
4 phase states of QPSK

BPSK vs QPSK

Thanks to interference, drift, Doppler shift etc, our modulated data probably isn’t going to be received at exactly the same offset that it was sent.

So because our phase shift isn’t going to land exactly on the red dot in the circle, but somewhere nearby.

The receiver will determine the phase of the signal based on it’s proximity to a known phase shift angle.

Because QPSK has more phase states than BPSK we get a higher data rate, but as the recieved data isn’t going to be exactly the phase offsets defined, the states may overlap and the receiver will not receive the correct information

BPSK vs QPSK in LTE UTRAN
BPSK vs QPSK

Channel conditions restrict the modulation techniques we can use. BPSK is slower but more reliable, while QPSK is faster but more error prone due to it’s lower tolerances.

Transmission Reliability

Error Correction is needed in LTE to make sure the message can be reconstructed correctly by the reciever.

To do this, in a simple form LTE adds redundant data.

For example sending 3 copies of the data increases the chance one will get through correctly, and provides the receiver with information to discriminate the right data.

(If only two copies were sent to increase the reliability, the receiver wouldn’t know which one was the correct one.)

Let’s take an example of sending the message “Hello World” and look at the 3 copies sent.

Copy 1: Helso Wdrld
Copy 2: H1llo Worlp
Copy 3: qello Uorld
Correct Data: Hello World

By looking at what’s common we can see that the first letter is H in the first to copies, but not in the third copy, so we can say with some surety that the first letter is H.

The second letter is e in copy 1 and copy 3, so we can again say the second letter is e.

This is a simplified example of coding the data with redundant data to aid in reconstruction.

The ratio of useful information / total transmitted is called the coding rate.

LTE coding rates can vary from 1/3 for extensive error correction, to close to 1 for almost no error correction.

Modulation Coding Scheme (MCS)

As channel conditions change continuously for each terminal/UE, LTE has to change the modulation technique and coding rate dynamically as channel conditions change for each terminal/UE.

The Modulation Coding Scheme is the combination of modulation and coding scheme used, and this changes/adapts in real time based on the signal conditions, independently for each terminal/UE.

There are 29 MCS combinations in LTE.

Wireshark trace showing a "401 Unauthorized" Response to an IMS REGISTER request, using the AKAv1-MD5 Algorithm

All About IMS Authentication (AKAv1-MD5) in VoLTE Networks

EPC, IMS / VoLTE, LTE, Mobile Networks, Notes, RFCs & Standards, SDM, Security, SIM Cards, Software, VoIP, , , , ,

I recently began integrating IMS Authentication functions into PyHSS, and thought I’d share my notes / research into the authentication used by IMS networks & served by a IMS capable HSS.

There’s very little useful info online on AKAv1-MD5 algorithm, but it’s actually fairly simple to understand.

RFC 2617 introduces two authentication methods for HTTP, one is Plain Text and is as it sounds – the password sent over the wire, the other is using Digest scheme authentication. This is the authentication used in standard SIP MD5 auth which I covered ages back in this post.

Authentication and Key Agreement (AKA) is a method for authentication and key distribution in a EUTRAN network. AKA is challenge-response based using symmetric cryptography. AKA runs on the ISIM function of a USIM card.

I’ve covered the AKA process in my post on USIM/HSS authentication.

The Nonce field is the Base64 encoded version of the RAND value and concatenated with the AUTN token from our AKA response. (Often called the Authentication Vectors).

That’s it!

It’s put in the SIP 401 response by the S-CSCF and sent to the UE. (Note, the Cyperhing Key & Integrity Keys are removed by the P-CSCF and used for IPsec SA establishment.

Wireshark trace showing a "401 Unauthorized" Response to an IMS REGISTER request, using the AKAv1-MD5 Algorithm
Click for Full Size version of this image