Testing General Packet Radio Service GPRS

Harshawardhan Lele

Todays Switching Network

Todays Mobile Network 2G

Todays Mobile Network 2G

DTAP L O 2 & RSL M M LAPD PCM30

DTAP BSSMAP SCCP MTP PCM30

MAP TCAP SCCP MTP PCM30 MAP ISUP TCAP SCCP MTP PCM30

Mobile Network
PSTN

AUC GMSC
H C

Gi

PSTN

GGSN
Gc Gn Gr Gp

PDN
other PLMN

HLR
D G VLR VLR

EIR
F
Gs Iu-CS Iu-CS Iu-PS Iu-PS RNS BSS Gb Gf

MSC
E A BSS RNS

MSC

SGSN

BSC
Abis

RNC
Iur Iub

RNC
Iub

BSC
Abis

BTS

BTS

Node B

Node B

Node B

Node B

BTS

BTS

System Overview

Existing GSM Network containing BSS (BTS; BSC); MSC; VLR; HLR; EIR circuit switched (CS) connected to SS#7 Network Additional Network containing BSS with PCU; SGSN; GGSN packet switched (PS) connected to Packet Data Networks (PDN) Shared Resources BSS (BTS) VLR; HLR; EIR

Test Areas
Physical Layer Testing CS Testing signalling protocols (e.g.: MTP; SCCP; TCAP; MAP) switched circuits user level PS Testing network layers user layers user level (applications) Interworking

GPRS Reference Model

SMS-GMSC SMS-IWMSC

SM-SC

E
Gd

C HLR

MSC/VLR
A TE R M T BSS Um SGSN Gn Gs Gb SGSN Gp GGSN Other PLMN Gn D

Gc Gr GGS N Gf Gi EIR
Signalling Interface Signalling and Data Transfer Interface

PD N

TE

Transmissions Plan (Data)

Appli catio IP n / X.25

M S

BSS

SGSN

GGSN

IP / X.25

IP / X.25

SNDCP LLC RLC MAC GSM RF LLC Relay RLC MAC GSM RF BSSGP Network Service L1bis Gb

SNDCP LLC BSSGP Network Service L1bis

GTP UDP [TCP] IP Frame Relay L1 Gn

GTP UDP [TCP] IP Frame Relay L1 Gi L1 L2

U m

Data Interfaces
Um RF; MAC; RLC; LLC; SNDCP; IP GPRS Abis proprietary protocol; MAC; RLC; LLC; SNDCP; IP Gb FR (/ ATM); NS; BSSGP; LLC; SNDCP; GMM, IP Gn (Gp) FR / Ethernet (/ ATM); IP; UDP (/ TCP); GTP; IP Gi FR / Ethernet (/ ATM); IP

Transmissions Plan (Signalling)

MS

BSS

SGSN

GMM/SM LLC RLC MAC GSM RF Um

GMM/SM LLC BSSGP Network Service L1bis Gb

LLC Relay
RLC RLC MAC MAC GSM RF BSSGP Network Service L1bis

Signalling Interfaces
Um ( / GPRS Abis) RF (/ proprietary); MAC; RLC; LLC; GMM/SM (SMS) Gb FR; NS; LLC; GMM/SM (SMS) Gr (SGSN / HLR), Gc (SGSN / EIR), Gf (GGSN / HLR) MTP; SCCP; TCAP; MAP Gs (SGSN / VLR) MTP; SCCP; BSSAP+ Gd (SGSN / SMS-IW/GMSC) MTP; SCCP; TCAP; MAP (SMS)

Physical Interfaces and Layer 2

E1 / T1 Frame Relay ( ITU / ANSI) channelized, unchannelized, fractional mode Ethernet 10BaseT, 100BaseTx Router to Frame Relay / E1 ATM (future use/UMTS) STM-1, STM-4, DS1,DS3, E1, E3 AAL5, AAL2

Interactions with other Services

SMS IMSI attached - via MSC GPRS attached - via SGSN both - via MSC or SGSN circuit switched services MS class-A/B/C mode limited RF resources - GPRS suspend / resume

Common Entities and Procedures

entities HLR (e.g. G/SGSN IP address; PDP contexts) VLR (e.g. currently serving SGSN IP address) EIR (standard IMEI) procedures combined IMSI and GPRS attach combined routeing area / location area update cell update

Monitoring
complex behaviour - view of all interfaces needed new statistics mean packet delay; Kbyte / s; mean packet size; Kbyte / user ... new call traces GPRS attach - data transmissions - GPRS detach PDP context activation - data transmission - PDP context
deavtivation

Billing Radius

Packet transfer
TCP timing problems Packet Generation / verification emulation of all lower layers up to IP on Abis, Gb, Gn, Gi timestamp, checksum, interfaces IP routing to standard interfaces generation and checking of user layers GPRS and PDN interworking

Performance Measurement
Erlang and BHCA not applicable Kbyte per second packets per second maximum and mean packet delay QOS

Monitoring

1/2

Signaling Point A

Signaling Point B

K1205
Protocol Tester is a passive monitor

Decodes protocol messages between two network elements

Checks for errors in protocol messages or procedures

Monitor all Interfaces simultaneously

BSS

SGSN

GGSN

PDN

K1205

Tektronix K1205 offers

Monitoring
Gb Interface Gn Interface Gi Interface Gd Interface Gr Interface Gs Interface Gc Interface Gf Interface GPRS Abis for Nortel, Siemens, Ericsson, Alacatel, Nokia, Motorola & Lucent

GPRS Applications on K12xx

GPRS Gb Analyser

GPRS Statistics
GPRS CDR Viewer GPRS Service Profiles GPRS MM/SM statistics GPRS Deciphering Application

GPRS Call Trace

GPRS Gb Analyzer

GPRS Gb Analyzer - What for?

Monitoring and analysis of actual subscriber

activities and crucial QoS parameters at the Gbinterface

Obtaining valuable information on GMM, SM

procedures, QoS parameters and service usage

Troubleshooting at the Gb-interface

(e.g. based on detected failed GMM, SM procedures)

GPRS Gb Analyzer - Features (1)

Displays important information for thousands of

GPRS sessions (e.g. IMSI, P-TMSI, current state, Attach type, ) Displays and stores statistical output in tabulated format Measures signaling performance Monitors and analyzes important QoS parameter (e.g. requested vs. negotiated vs. actual) Evaluates service usage and their duration Operates Online and Offline Is part of K12 basic SW

GPRS Gb Analyzer - Features (2)

GPRS Gb Statistics

K12xx GPRS Statistics

GPRS procedures

GPRS Applications on K12xx (3)

CDR Viewer

GPRS Applications on K12xx (4)

GPRS Service Profiles

GPRS Applications on K12xx (5)

Extension of GPRS MM/SM statistics

GPRS Applications on (5)

Extension of GPRS MM/SM statistics

Ciphering in GPRS networks ...

is intended as a secure transmission of data over the air interface is performed between SGSN and MS through the GPRS encryption algorithm (GEA/x). As of Release 98 only GEA/1 is available. is applied to signaling data and payload. is one task of protocol layer LLC (GSM 04.64) is mandatory for GPRS terminals

GPRS Ciphering - Methodology

Input Direction Input Direction

Kc

GEA/x
Output

Kc

GEA/x
Output

Unciphered Frame

Ciphered Frame

Deciphered Frame

MS or SGSN

SGSN or MS

GPRS Encryption Algorithm (GEA/x) has three input parameters:

Ciphering Key Kc Transfer direction Frame dependent input variable

Deciphering in GPRS networks

Kc

For I- and S- Frames F{ IOV and N(S)} For UI-Frame F{IOV and N(u)}

GEAx

Direction Bit (0/1)

Cipher Sequence

Encrypted Bits Data Flow

Head

FCS

Data Field

Head

K12 Gb deciphering solution

* Optional

Enciphering without deciphering capability (within a monitoring tool)

If deciphering is not supported by means of a

monitoring tool all enciphered signaling signallingand andpayload payload data are invisible up to the Gb interface
Consequently, important information informations are are denied denied to to

the technician or engineer attempting to observe the transmissions behavior under normal (enciphered) conditions.
Of course, enciphering could be disabled temporarily

during monitoring and analysis, but this seems to be no suitable way out !

K12 Gb Deciphering - What for?

The K12 Gb deciphering solution deciphers GPRS

transmissions at the Gb interface automatically, providing unhampered access to all messages above the protocol layer Logical Link Control (LLC).
It allows enciphering to remain on during

monitoring and analysis

K12 Gb Deciphering - So what?

Enciphering is allowed to remain on during

monitoring and analysis Subscribers receive the uninterrupted security and privacy they expect Troubleshooting, optimization, statistics can be performed in usual way Tektronix outstanding position for non-intrusive GPRS testing can be strengthened Gunnar Heine (Accepted expert in mobile network technologies):
even skeptic colleagues and customers who barely apply new features of the K1205 are nowadays persuaded of the value of the deciphering application and use it on a regular base

K12 Gb Deciphering - Features (1)

Three operation modes Full Automatic Mode
Automatic recognition up to 25000 subscribers (over the IMSI) and their corresponding Kc values Half Automatic Mode Automatic recognition of Kc values for up to 25000 manually entered IMSIs Manual Mode Processing up to 25000 manually-entered IMSI and Kc values

GEA1 and GEA2 support Real-time mode and post-capture mode Capability to delete inactive or detached subscribers

GPRS Deciphering - Solution on K1205 (2)

HLR

Encryption
Enciphered messages on Gb Gb

Gr

BSS/ PCU

SGSN

K1205

GPRS Deciphering - Solution on K1205 (3)

HLR

Encryption
Enciphered De ciphered messages on Gb Gb

Gr

BSS/ PCU

SGSN

Decipher

K1205