UNLICENSED MOBILE ACCESS: NEXT GENERATION

OF MOBILE NETWORK TECHNOLOGY

Deepak Menghani
B.Tech. (Hons.), Electronics and Communication Rajasthan Technical University, Kota deepak.menghani@hotmail.com

Abstract
This paper covers the discussion on a cutting edge technology in Telecommunications to deliver voice, messaging and multimedia content over a wireless IP Network, known as Unlicensed Mobile Access (UMA). UMA provides access to Global System for Mobile Telecommunication (GSM) and General Packet Radio Service (GPRS) mobile services using unlicensed spectrum technologies (such as Bluetooth, IEEE 802.11 standard WLAN technology, DSL, etc). By implementing UMA, service providers can allow their subscriber base to roam and perform handover operations between licensed cellular network and public and private unlicensed wireless networks using a dual-mode mobile terminal. GSM subscribers can experience all-the-time voice and data service even if service provider has no cellular network coverage in some area or at the time of Network Busy Hour. In addition, UMA provides a considerably higher throughput than GSM systems. Evolution of highly stable digital circuit switched network has taken place from the old incompatible analogue system. The next major trend in telecom network evolution will be based upon packet switched network implemented using UMA. The technical measurements of UMA performance provided evidence that the solution really works. The handovers between UMA and GSM are similar to typical inter-BSC handovers in the GSM system. Therefore, UMA is at its best in extending the cellular network operators current network coverage in indoor locations in current market trends where subscribers expectation is very high.

2. UMA TECHNOLOGY
2.1 UMA: BRIEF HISTORY & OVERVIEW
Currently, the definitions of standards allowing transparent handover between different radio technologies (vertical handover) are an area of intense activity. A number of standards in this domain have been approved and are under investigation, for example, the IEEE 802.21 standard is especially true for 802.11 and cellular technologies, aiming to exploit the rapid deployment of broadband and the use of wireless LAN (WLANs) within homes, offices and hot-spots. UMA is a concrete example in providing a high bandwidth and low-cost wireless access network, which is further integrated into operators core network, enabling roaming and handover operations between itself and originally licensed mobile network. In this context, the UMAC (Unlicensed Mobile Access Consortium) was formed by leading companies within the wireless industry to promote UMA technology and to develop its specifications. The initial specification of UMA was published on 2nd September 2004, which details the use of the same device over a licensed radio spectrum connection (GSM) when users are outside the UMA coverage and using an unlicensed radio spectrum (Bluetooth or Wi-Fi) when being inside the UMA coverage. 3GPP defined UMA as a part of 3GPP release 6 (3GPP TS 43.318) under the name of Generic Access Network (GAN).

Keywords: UMA, GAN, GSM, WLAN, Bluetooth

1. INTRODUCTION
Unlicensed Mobile Access (UMA) aims to offer mobile, fixed and internet telephony on a single mobile terminal and provide seamless handover between these services using Wi-Fi or Bluetooth technology, etc. UMA uses IP tunneling to transmit any content a mobile subscriber can receive over the GSM or UMTS network i.e. existing voice, data and IMS services. UMA-enabled handset connects to any IP-based service and wraps the standard GSM content in an IP packet. The packet is then transmitted to UMA Network Controller (UNC) over local area network or internet. At the UNC, it is unwrapped and routed further towards mobile service providers Core Mobile Network. Essentially UMA offers high speed delivery of standard GSM/UMTS content to mobile service providers Core Mobile Network: a video streaming service could be from 1-4 frames per second over a cellular network and jump to 20 frames per second over UMAsupported W-Fi connections. It is expected to resolve the issues of modern mobile telephony such as limited signal strength indoors and limited bandwidth. It opens a wide range of opportunities both for the telecom consumers and operators. It allows subscribers to enjoy the benefits of better indoor coverage using private or public WLAN radio access. It serves to give operators the ability to fully leverage their cellular assets via alternative radio access methods where they are unable to provide cellular network due to low revenue generation or other cost- cutting factors or at the time of Network Busy Hour where call congestion may occur. It is a cost-effective way to expand cellular coverage for voice and data services to homes and enterprises where it might be too difficult or expensive to build cellular coverage indoors.

2.2 UMA ARCHITECTURE OVERVIEW

UMA technology allows subscribers to seamlessly roam between mobile and home wireless networks or Wi-Fi Hot spots. Subscribers perform handover operation between two networks and continue to receive mobile voice and data service in a consistent manner. A mobile user can take advantage of potentially faster data services through avoiding the bandwidth constraint in the GSM network. As illustrated in Figure 1, connection to the fixed unlicensed network occurs automatically when a mobile subscriber with a UMA enabled handset moves within its range. Upon connecting, the handset contacts the UMA Network Controller (UNC) over broadband IP access network to get authenticated for accessing GSM and GPRS services via unlicensed wireless network. After getting authorized, the subscribers new location information is stored in the core network element Home Location Register and from this point, all mobile voice and

Unlicensed Mobile Access- Research Paper Volume 2.1, January, 2013

data traffic is routed to the handset via the UMA network instead of licensed cellular network. The UNC presents itself to the mobile core network as a standard cellular Base Station Controller (also it is virtually created in NSS core network element Mobile Switching Center/Visitor Location Register). The mobile terminal communicates with UNC using standard GSM / UMTS existing protocols, thus when it moves from a GSM / UMTS network to 802.11 network, it appears to the core network as if it is simply on a different base station connected with core elements. Today all commercial GAN dual-mode handset deployments are based on a 2G connection and all GAN enabled devices are dual-mode 2G/Wi-Fi. The specification, though, defined support for multimode handset operation. Therefore, 3G/2G/WI-Fi handsets are supported in the standard. The first 3G/UMA devices were announced in the second half of 2008. A typical UMA/GAN handset has four modes of operations:GERAN-only: Uses only cellular networks GERAN-preferred: uses cellular networks if available, otherwise the 802.11 radio GAN-preferred: uses a 802.11 connection if an access point is in range, otherwise the cellular network GAN-only: uses only the 802.11 connection

Figure 1 - UMA Architecture 2.3 UMA SERVICES

UMA offers under mentioned services: Seamless mobility between licensed & unlicensed mobile access network for providing voice & data call continuity Mobile users are able to make use of existing as well as new data services in a seamless manner with considerably higher throughput Bandwidth-intensive mobile services such as internet gaming, audio & video streaming do not have to end when the end user goes home Multimedia Services over IMS such as push-to-talk (PTT), Voice-Over-IP (VOIP), etc are also available

In all cases, the handset scans for GSM cells when it first turns on to determine its location area. This allows carrier to route the call to the nearest UNC, set the correct rate plan and comply with existing roaming agreements. At the end of 2007, the GAN specification was enhanced to support 3G (Iu) interfaces from the UNC to the mobile core network (MSC/GSN). This native 3G interface can be used for dual-mode handset as well as 3G femtocell service delivery. The GAN release 8 documentation describes these new capabilities. The following functional block in the Mobile Station (MS) supports end-user access to telecommunication services: An MTu provides access via UTRAN An MTm provides access via GERAN An MTp provides access via UMA network

3. UMA IMPLEMENTATION
The UMA solution does not need much direct investment. The most critical block in UMA implementation is UMA Network Controller (UNC) which provides authentication and tunneling setup. In the UNC, operators can also specify other restrictions for the access, such as access point SSID or MAC specifications. Therefore, the cellular network operator (who also runs the UMA solution) can specify who can use UMA and how they can use it in connecting to the operators core network. The generic structure of UMA access system is illustrated in Figure-2.

2.4 BENEFITS OF UMA FOR SERVICE PROVIDERS

Following benefits a service provider can achieve by implementing UMA in its network: GSM radio network can be optimized by using alternative lower-cost and higher-bandwidth access network Direct investment can be minimized in cellular network expansion in the areas of low revenue generation or at the time of Network Busy Hour or at the time of festive season Delivering advanced reach as well as improved voice quality over IP network Bringing increased usage and allowing new services to be oered along with existing ones Greatly increasing the use of mobile voice and data services in locations where usage was discouraged due to cost or network coverage

2.5 MODES OF OPERATIONS IN UMA

The original Release 6 GAN specification supported a 2G (A/Gb) connection from the UNC into the mobile core network (MSC/GSN).

Figure 2 UMA Access to cellular network

Unlicensed Mobile Access- Research Paper Volume 2.1, January, 2013

4. UMA TECHNOLOGY SPECIFICATIONS

4.1 HOW UMA TECHNOLOGY WORKS?
UMA technology provides alternative access to GSM and GPRS core network services via IP-based broadband connections. In order to deliver a seamless user experience, the specifications define a new network element (the UMA Network Controller, UNC) and associated protocols that provide for the secure transport of GSM/GPRS signalling and user plane traffic over IP. The UNC interfaces into the core network via existing 3GPP specified A/Gb interfaces. 1. A mobile subscriber with a UMA enabled dual-mode handset moves within range of an unlicensed wireless network (It is assumed that handset is allowed to connect to UMA network). Upon connecting, handset contacts the UMA network controller (UNC) over the broadband IP access network for authentication and authorization to access GSM voice and data services via unlicensed wireless network. Upon successful authentication, the subscribers current location is updated in core network elements (Home Location Register). All the mobile voice and data traffic is routed to the handset via UMA network rather than cellular radio access network (RAN). ROAMING: When a UMA enabled subscriber moves outside the range of an unlicensed wireless network, the UNC and the handset facilitate roaming back to the licensed outdoor network. HANDOVER: If a subscriber is on active GSM Voice call or GPRS data session, when they come within the range (or out of the range) of an unlicensed wireless network, that voice call or data session can automatically handover between access networks with no discernible service interruption. Handovers are completely transparent to the subscriber.

authentication, encryption and data integrity for signaling, voice and data traffic A broadband IP network provides connectivity between the AP and the UNC. The IP transport connection extends all the way from the UNC to the MS, through an AP. A single interface, the Up interface, is defined between the UNC and the MS Co-existence with the GSM/GPRS Radio Access Network (GERAN) and interconnection with the GSM Core Network (CN) via the standardized interfaces defined for GERAN: A-interface for circuit switched services [TS 48.008] Gb-interface for packet switched services [TS 48.018]

2.

4.3 FUNCTIONAL ENTITIES

Mobile Station The MS must have dual mode capability to switch between licensed cellular network and public and private unlicensed network. It must support either Bluetooth or 802.11 WLAN standards. It must also support an IP interface to access points.

3.

4.

5.

4.2 UMA FUNCTIONAL ARCHITECTURE

The UMA network consists of one or more access points (APs) and one or more UMA Network Controller (UNC) interconnected through a broadband IP network. The basic elements as represented in Figure 3 are classified as: Mobile Station (MS) versus Mobile Terminal (MT) Access Point (AP) - The AP provides the radio link to the mobile station using unlicensed spectrum Access Points The Access Points provides radio link towards the mobile station using unlicensed spectrum. - It connects to the UNC through broadband IP network. The AP provides Bluetooth or 802.11 access point functionality. The AP doesnt provide any UMA-specific gateway functions, and any generic AP can be used to interconnect the MS to the UNC via the broadband IP network. The UMA cell is analogous to a GSM base station controller (BSC). For this reason, it is perceived as such by the cellular network and roaming between UMA and GSM is considered an inter-BSC handover. From the BSC perspective the UNC is just another BSC. In theory, if the UNC is in the BSC neighbors list, it is possible to perform a handover. However, the individual Wi-Fi cells are independent from the UMA system. Regardless of the similarities between the UNC and the BSC, the cell size does not directly correlate.

Figure 3 UMA Functional Architecture

UMA Network Controller (UNC) - The UNC appears to the core network as a GERAN Base Station Subsystem (BSS). It includes a Security Gateway (SGW) that terminates secure remote access tunnels from the MS, providing mutual

Unlicensed Mobile Access- Research Paper Volume 2.1, January, 2013

5. GSM-UMA MOBILITY
Handovers between the GSM and UMA systems are in most of the cases originated by the Mobile Station. Depending upon the operating mode, the MS will decide how often it will attempt to establish a connection and / or to start a handover. The handover triggers are likely to be based on received signal strength measurements. However, the standard also provides the means to originate the handover based on a request from the UNC. 3. Third, the MS will start the actual handover between systems. This procedure involves two main phases, one to setup a voice stream connection (messages 7 to 9), and another phase to transfer the voice stream from the GSM access to the UMA access. The actual voice break resulting from the handover will happen only in this second phase of the handover (messages 10 to 12). Fourth and last, the previous connection is released from the GSM system (messages 13 to 14)

5.1 GSM TO UMA HANDOVER

In case of GSM-to-UMA handover, the message flow is depicted in Figure 4.1. The initial state before the handover requires that the call is active in the GSM system. That is, voice goes through the BSC and then to the core network (CN). Afterwards, while the GSM call is ongoing, four main stages take place: 1. First, when the MS detects Wi-Fi, it will establish a link with the access point and attempt to establish a secure IPSec tunnel with the UNC. The establishment of the secure tunnel requires the mobile station to be authenticated by the UNC. This procedure is known as UMA registration Second, the mobile station initiates the handover by reporting a UMA neighbor cell as the highest signal level to the BSC. Assuming that the operators BSS is configured with the UMA cell as a neighbor, the source BSC decides to start the handover procedure based on the handover report. The handover procedure between the source BSC, core network and UNC follows the same signaling flow as the GSM inter-BSC handover. It is not explicitly visible to the source BSC that the target handover is the UMA access. Once the signaling required for the handover has taken place, a handover command message will be sent to the MS indicating that the handover can take place (messages 1 to 6)

5.2 UMA TO GSM HANDOVER

2.

In case of GSM-to-UMA handover, the message flow is depicted in Figure 4.2. The initial state before the handover requires that the call is active in the UMA system. That is, voice goes through the UNC and then to the core network. Whilst the UMA call is ongoing, three main stages take place: 1. First, when the Wi-Fi link is deteriorated up to a predefined threshold, the MS determines that the Wi-Fi link is no longer acceptable for UMA service. However, it is also possible to trigger the handover via an uplink quality indication message from the UNC. At this point, the MS sends a handover required message to the UNC specifying the signal levels of the neighboring GSM cells. Subsequently, the UNC selects one of the target cells and sends a handover request to the core network. The core network then handles the resource allocation procedures with the BSC for the GSM call. Once the resources have been allocated, the MS is notified that the handover is ready to take place (messages 2 to 7) 2. Second, the MS will start the actual handover between systems. This procedure involves two main phases, one to setup a voice stream connection (messages 8 to 11) and another to transfer the voice stream from the UMA access to the GSM access (messages 12 to 14). The actual voice break resulting from the handover will happen only in this second phase of the handover Third and last, the previous connection is released from the UMA system (messages 15 to 18)

3.

6. UMA INTEROPERABILITY
An open test specification is under development that can be used to facilitate interoperability testing between implementations. The test specification will be available through this web site. Companies planning to implement products based on the UMA specifications should seek bilateral compliancy testing agreements directly with other vendors. In principle, the UMA specifications ensure interoperability similar to any other industry specifications, but the specifications may include options and parameters that have to be agreed bilaterally with other vendors. The UMA participating companies do not guarantee interoperability and the specifications may be upgraded without notice.

7. DRAWBACKS IN COMMERCIAL
ROLLOUT OF UMA
Although UMA technology enabled operators to expand their coverage and introduce new mobile data services, such services will not be adopted if there is a threat to its availability or usage to end users. The introduction of UNC into the GSM / GPRS core also exposes the network to new security threats such as:

Figure 4.1 GSM-to-UMA Handover

Unlicensed Mobile Access- Research Paper Volume 2.1, January, 2013

Opening traditional GSM/GPRS RAN to public IP world increases the attacks against the network, especially man-in-the-middle attacks and denial-of-service (DoS) attacks, which could highly impact the services access Known security concerns also exist in WLAN, for example, eavesdropping Intrusion attacks that can lead to unauthorized access (of a nonlegitimate subscriber) as well as unauthorized installation (through a UMA subscriber or the Internet), thus damaging the whole communication Stealth attacks and voice spam

8. CONCLUSION AND OUTLOOK

With UMA, operators can extend high-quality mobile services to provide increased revenue opportunities. Many service providers view UMA as a critical rst step toward merging voice and multimedia services over an IMS architecture. Highlights of UMA technology are as follows: Seamless delivery of mobile voice and data services

This technology was launched several years ago, but has not spread into use widely because of regulatory issues. Also, in countries like India, where each PLMN is hogged by several operators, it becomes more difficult to go license-free. Moreover, private operators would need to do agreement with all other operators, which will add to complexities. Further, this might lead to wastage of enormous R&D investments which vendors have done.

over unlicensed wireless networks Provides the same mobile identity on Cellular RAN and unlicensed wireless networks Seamless transitions (roaming and handover) between Cellular RAN and unlicensed wireless networks Preserves investment in existing/future mobile core network infrastructure Independent of underlying unlicensed spectrum technology Transparent to existing, standard CPE devices (e.g. access points, routers and modems) Utilizes standard always on" broadband IP access networks (e.g. DSL, Cable, T1/E1, Broadband Wireless, FTTH, etc) No impact to operations of Cellular RAN (e.g. spectrum engineering, cell planning, etc)

9. REFERNCES
1. 2. 3. 4. 5. 6. 7. 8. 9. UMA Technology, http://www.umatechnology.org/overview Unlicensed Mobile Access (UMA) User Perspective (Stage 1), R1.0.0 (2004-09-01), Technical Specication http://www.umatechnology.org/specications/index.htm UMA Today, http://www.umatoday.com UMA SecurityBeyond technology, white paper, June 2006 Securing the UMA network, white paper, ReefPoint Systems, 2005 Unlicensed Mobile Access (UMA) Architecture (Stage 2), R1.0.4 (2005-5-2), Technical Specication http://www.umatechnology.org/specications/index.htm Unlicensed Mobile Access (UMA) Protocols (Stage 3), R1.0.4 (2005-5-2), Technical Specication. http://www.umatechnology.org/specications/index.htm.

Figure 4.2 UMA-to-GSM Handover