Advanced Internet Technologies

Transcription

1 Advanced Internet Technologies Mobile Internet PD Dr. Dennis Pfisterer Institut für Telematik, Universität zu Lübeck

2 Contents Global System for Mobile Communications (GSM, GPRS, EDGE) Universal Mobile Telecommunications System (UMTS) User Mobility (Mobile IP) Security - 04 Cryptology #2

3 Global System for Mobile Communications Global System for Mobile Communications (GSM)

4 Global System for Mobile Communications Goal of GSM Replace analog telephony systems (e.g., A-/B-/C-networks in Germany) Create a mobile ISDN Digital mobile telephony system allowing Europe-wide user mobility Mobile data services Features Communication: mobile and wireless; support voice and data Mobility: international access, SIM enables use of different providers Worldwide connectivity (one number, network handles localization) High quality: audio quality and reliability for uninterrupted phone calls at high speeds (e.g., from cars, trains) Security: access control, authentication via chip-card and PIN 4

5 History and Evolution of GSM CEPT (European Conference of Postal and Telecommunications Administrations) creates Groupe Spécial Mobile with the task to create a pan-european mobile telephony standard Germany, Italy and France sign a treaty for the joint development of this new standard 17 network operators willing to deploy GSM sign a Memorandum of Understanding 1989 Groupe Spécial Mobile becomes a Technical Committee at ETSI Deutsche Bundespost and Mannesmann obtain a license for building one GSM network each (at this time called D-Netz ) Final specification of GSM 900 (including extension to use the MHz frequencies) GSM renamed to Global System for Mobile Communications Devices and network infrastructure manufactured in quantities European GSM 900 operators start operations (D1, D2 in Germany) 2000 GSM standardization moves to the 3GPP (3rd Generation Partnership Project) 5

6 Usage of GSM worldwide From European root to world-wide coverage 670 GSM-networks in about 200 countries 78% of all mobile telephony users Services include telephony, circuit- and packet-switched data communication, text messaging, and fax. Users CDMA GSM IDEN PDC TDMA 3GSM Total Users in Billion Year 6

7 GSM: Mobile Services GSM offers several types of connections: voice connections, data connections, short message service multi-service options (combination of basic services) Three service domains Bearer Services (Transmission of Data) Telematic Services (Telephony, Multi-numbering, Emergency Call, SMS, Fax, ) Supplementary Services (Caller-ID, automatic call-back conferencing, ) MS TE bearer services MT GSM-PLMN transit network source/ destination R, S (PSTN, ISDN) network (U, S, R) U m TE tele services TE = Terminal Equipment, MT = Mobile Termination, MS = Mobile Station, PLMN = Public Land Mobile Network 4c-7

8 Architecture of the GSM system GSM is a PLMN (Public Land Mobile Network) Several providers setup mobile networks following the GSM standard within each country Components MS (mobile station) BS (base station) MSC (mobile switching center) LR (location register) Subsystems RSS (radio subsystem): covers all radio aspects NSS (network and switching subsystem): call forwarding, handover, switching OSS (operation subsystem): management of the network 4c-8

9 GSM: cellular network Segmentation into cells Use of several carrier frequencies Not the same frequency in neighboring cells Cell sizes vary from some 100m up to 35km depending on user density, geography, transceiver power etc. Hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) Cell change: handover of the connection to a neighboring cell possible radio coverage of the cell cell idealized shape of the cell

10 GSM: Overview NSS with OSS OMC, EIR, AUC HLR GMSC (G)MSC: (Gateway) Mobile Switching Center BSC: Base Station Controller BTS: Base Transceiver Station HLR, VLR: Home/Visitor Location Register OMC: Operation and Maintenance Center EIR: Equipment Identity Register AUC: Authentication Center Fixed Network VLR MSC VLR MSC BSC BSC RSS BTS BTS BTS BTS BTS

11 System architecture: radio subsystem Radio subsystem Network and Switching Subsystem (NSS) Components MS (Mobile Station) MS MS U m BSS (Base Station Subsystem): BTS (Base Transceiver Station): sender and receiver BSC (Base Station Controller): controlling several transceivers BTS BTS A bis BSC MSC Interfaces U m Radio interface A bis Standardized, open interface with16 kbit/s user channels BTS BTS BSS BSC A MSC A Standardized, open interface with 64 kbit/s user channels

12 Network and switching subsystem (NSS) MSC Network Subsystem SS7 EIR HLR Fixed Partner Networks ISDN PSTN Components MSC (Mobile Services Switching Center) IWF (Interworking Functions) ISDN (Integrated Services Digital Network) PSTN (Public Switched Telephone Network) PSPDN (Packet Switched Public Data Net) CSPDN (Circuit Switched Public Data Net) MSC IWF VLR ISDN PSTN PSPDN CSPDN Databases HLR (Home Location Register) VLR (Visitor Location Register) EIR (Equipment Identity Register)

13 Radio subsystem The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers Components Base Station Subsystem (BSS) Base Transceiver Station (BTS) Radio components including sender, receiver, antenna - if directed antennas are used one BTS can cover several cells Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (U m ) onto terrestrial channels (A interface) Mobile Stations (MS)

14 GSM protocol layers for signaling U m A bis A MS BTS BSC MSC CM CM MM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s CM Call Management Supplementary Services (Conf Call, SMS, DTMF) MM Mobility Management Registration, Authentication, Identification, Location RR Radio Resource Management Channel control assignment, BTSM BTS Management Part of the resource management BSC has control LAPD m Link Access Procedure D-channel (mobile) Similar to ISDN networks SS7 Signaling System Nr. 7 Handles control data (MSC, BSC, VLR, AuC ) BSSAP BSS Application Part Remote control of BTS

15 Mobile Terminated Call 1) Call GSM subscriber 2) Forward call to GMSC calling station PSTN 1 2 HLR 3 6 GMSC VLR MSC BSS BSS BSS MS 3) Signal call setup to HLR 4) Request MSRN (Mobile Station Roaming Number) from VLR 5) (continuation) 6) Forward responsible MSC to GMSC 7) Forward call to MSC 8) Request MS status 9) (continuation) 10) Page MS 11) (continuation) 12) Answer of MS to BSS 13) Forward to MSC 14) Security Checks 15) (continuation) 16) Connection Setup 17) (continuation)

16 Mobile Originated Call 1) Connection request 2) (continuation) 3) Security check 4) (continuation) VLR 5) Check resources (free circuit) 6) (continuation) 7) (continuation) 8) (continuation) 9) Set up call 10) (continuation) PSTN 6 5 GMSC MSC 2 9 MS 1 10 BSS

17 4 types of handover 1. Intra-BTS (different segments / antennae) MS MS MS MS 2. Different BTS, same BSC 3. Different BSC, same MSC BTS BTS BTS BTS BSC BSC BSC 4. Different MSCs MSC MSC

18 Handover decision receive level BTS old receive level BTS old HO_MARGIN MS MS BTS old BTS new

19 Handover procedure MS measurement report BTS old measurement result BSC old MSC BSC new BTS new HO decision HO required HO request HO command HO command HO command HO access Link establishment clear command clear command clear complete clear complete resource allocation ch. activation HO request ack ch. activation ack HO complete HO complete

20 Data services in GSM I Data transmission standardized with only 9.6 kbit/s Advanced coding allows 14,4 kbit/s Not enough for Internet and multimedia applications HSCSD (High-Speed Circuit Switched Data) Mainly a software update Bundling of several time-slots to get higher AIURs (Air Interface User Rate) such as 57.6 kbit/s using 4 slots, 14.4 each Advantage: ready to use, constant quality, simple Disadvantage: channels blocked for voice transmission, charging based on time, not traffic volume

21 Data services in GSM II GPRS (General Packet Radio Service) Uses sending slots only if data packets are to be transmitted E.g., for 50 kbit/s 4 slots are allocated temporarily Standardization 1998, introduction 2001 Advantage: one step towards UMTS, more flexible Disadvantage: more investment needed (new hardware) Data transmission speed (in kbit/s): Coding scheme 1 slot 2 slots 3 slots 4 slots 5 slots 6 slots 7 slots 8 slots CS CS CS CS

22 GPRS architecture and interfaces GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN): Interworking unit: GPRS and PDN (Packet Data Network) SGSN (Serving GSN): Supports the MS, performs location, billing, security, GR (GPRS Register) user addresses SGSN G n MS BSS SGSN GGSN PDN U m G b G n G i VLR MSC EIR HLR/GR

23 GPRS protocol architecture MS U BSS m G SGSN b G GGSN n G i apps. IP/X.25 IP/X.25 SNDCP SNDCP GTP GTP LLC LLC UDP/TCP UDP/TCP RLC RLC BSSGP BSSGP IP IP MAC MAC FR/ATM FR/ATM L1/L2 L1/L2 radio radio SNDCP: Sub Network Dependent Convergence Protocol, LLC: Logical Link Control, RLC: Radio Link Control, BSSGP: Base Station System GPRS Protocol (between SGSN and BSS), FR: Frame Relay, GTP: GPRS Tunneling Protocol (GTP)

24 Enhanced Data Rates for GSM Evolution (EDGE) #24

25 Enhanced Data Rates for GSM Evolution (EDGE) Higher data-rates by using a new modulation technique Based on Gaussian minimum-shift keying (GMSK) Eight-phase-shift keying (8 PSK) modulation ~3 times faster compared to CS-3 Intermediate step towards UMTS Changes to hardware necessary for MS and BSS Costs for adding additional transceiver hardware Examples 4 slots => 4 x bit/s => 192kbit/s 8 slots => 8 x bit/s => 384kbit/s EDGE Evolution or Evolved EDGE Some (software changes) to allow higher data rates

26 Universal Mobile Telecommunications Universal Mobile Telecommunications System (UMTS)

27 UMTS and IMT-2000 Requirements for a 3G system min. 144 kbit/s rural (goal: 384 kbit/s) min. 384 kbit/s suburban (goal: 512 kbit/s) up to 2 Mbit/s urban Proposals for IMT-2000 (International Mobile Telecommunications) UWC-136 CDMA 2000 WP-CDMA UMTS (from ETSI) UMTS Chosen by the ITU, first release called release99 New radio network: UTRA (UMTS Terrestrial Radio Access) New backbone: UTRAN (UMTS Terrestrial Radio Access Network) UMTS and GSM/EDGE can share the same core network (CN)

28 UMTS architecture (Release 99) Major differences to GSM: new radio technology (W-CDMA) W-CDMA Wideband Code Division Multiple Access Also called UMTS-FDD, UTRA-FDD, or IMT-2000 CDMA Direct Spread Code Multiplex with FDD (Frequency Division Duplex) and TDD (Time Division Duplex) Issue: Cell Breathing Cell size depends on current load Additional traffic appears as noise to other users If the noise level is too high users drop out of cells

29 UMTS architecture (Release 99) UE (User Equipment) UTRAN (UTRA Network) Cell level mobility Radio Network Subsystem (RNS) Encapsulation of all radio specific tasks CN (Core Network) Inter-system handover Location management if there is no dedicated connection between UE and UTRAN U u I u UE UTRAN CN

30 GSN SGSN GGSN RNS RNC GPRS Support Nodes Service Gateway Radio Network Subsystem Radio Network Controller Core network: architecture BSS VLR BTS A bis I u BSC MSC GMSC PSTN Node BTS B I u CS AuC RNS Node B EIR HLR GR I ub Node B RNC SGSN G n GGSN G i Node B I u PS CN

31 PDH SDH SONET Plesiochronous Digital Hierarchy Synchronous Digital Hierarchy Synchronous optical networking Core network VLR RNS MSC GSM-CS backbone GMSC PSTN/ ISDN HLR RNS Layer 3: IP Layer 2: ATM Layer 1: PDH, SDH, SONET SGSN GGSN GPRS backbone (IP) SS 7 CN PDN (X.25), Internet (IP) UTRAN

32 Core network Core Network (CN) and Interface I u are separated into two logical domains Circuit Switched Domain (CSD) Circuit switched service incl. signaling Resource reservation at connection setup GSM components (MSC, GMSC, VLR) I u CS Packet Switched Domain (PSD) GPRS components (SGSN, GGSN) I u PS Release 99 uses GSM/GPRS network and adds a new radio access Helps to save a lot of money Much faster deployment Not as flexible as newer releases (5, 6)

33 RLC SAR AAL PDCP GTP Radio Link Control Segmentation and Reassembly ATM Adaption Layer Packet Data Convergence Protocol GPRS Tunneling Protocol UMTS protocol stacks (user plane) UE UTRAN I u CS 3G MSC U u apps. & protocols Circuit switched RLC MAC RLC MAC AAL2 SAR SAR AAL2 radio radio ATM ATM UE U u UTRAN I u PS 3G SGSN apps. & protocols G n 3G GGSN Packet switched IP, PPP, PDCP RLC IP tunnel PDCP GTP GTP GTP RLC UDP/IP UDP/IP UDP/IP IP, PPP, GTP UDP/IP MAC MAC AAL5 AAL5 L2 L2 radio radio ATM ATM L1 L1

34 Support for mobility: macro diversity Multicasting of data via several physical channels Enables soft handover Uplink Simultaneous reception of UE data at several Node Bs Reconstruction of data at Node B, SRNC or DRNC UE Node B Node B RNC CN Downlink Simultaneous transmission of data via different cells Different spreading codes in different cells

35 Support for mobility: handover From and to other systems (e.g., UMTS to GSM) This is a must as UMTS coverage was poor in the beginning RNS controlling the connection is called SRNS (Serving RNS) RNS offering additional resources (e.g., for soft handover) is called Drift RNS (DRNS) End-to-end connections between UE and CN only via Iu at the SRNS Change of SRNS requires change of Iu Initiated by the SRNS Controlled by the RNC and CN Node B SRNC CN UE I ub I ur I u Node B DRNC I ub

36 Example handover types in UMTS/GSM UE 1 Node B 1 RNC 1 I u 3G MSC 1 UE 2 Node B 2 I ub I ur UE 3 Node B 3 RNC 2 3G MSC 2 UE 4 BTS BSC 2G MSC 3 A bis A

37 UMTS Further Developments Release 4 (Changes in Network Infrastructure) Integration of ATM- and IP-based Core Network to an Everything-over-IP network Combination of MSC and SGSN => UMSC Release 5 (New Services and higher Data Rates) IP Multimedia Services (IMS) Higher Data rates => HSPA Release 6 (Interoperability with WLAN ) New IMS-Functionality, Speech Recognition, Further Optimization of Air Interface WLAN/UMTS-Handover Release 7 (Long Term Evolution, LTE) Flexible Channel Width, Spectrum Efficiency/Utilization, Lower Latency Data Rate up to 100 Mbps

38 User Mobility (Mobile IP)

39 Motivation Users are mobile and change their location frequently Different offices (different networks & address spaces) Changing access technology Applications should continue to work seamlessly while users roam networks Implies a static network address Why? Any other options? However Routing is based on IP addresses IP addresses are bound to physical locations Ethernet Frame Relay ATM (A)DSL Cable Modem WiFi GPRS EDGE UMTS 39

40 Motivation IP routing Based on IP address identifying the network CIDR network prefix, e.g., determines physical subnet Implications of user mobility Roaming requires obtaining topologically correct addresses I.e., an IP address of the new network s address space Alternatives Global update of routing tables Does not scale: high number of mobile hosts, frequent changes Long delays, high traffic for routing table updates, large routing tables, security challenges, administrative issues, etc. Publish new IP address via DNS Long delays due to distributed nature of DNS and caches Interrupts existing connections 40

41 Solution: Mobile IP (for IPv4) Requirement for user mobility without interrupting applications lead to the development of Mobile IP Standards RFC 2002 (IP Mobility Support, 1996) RFC 3220 (IP Mobility Support for IPv4, 2002) RFC 3344 (IP Mobility Support for IPv4, 2002) RFC 4721 (Mobile IPv4 Challenge/Response Extensions (Revised), 2007) 41

42 Mobile IPv4: Design Goals Transparency Mobile devices keep their home IP address Devices can roam to different networks seamlessly Communications continue after a change of network connectivity Compatibility No change to end systems (incl. applications) and routers required Support for the same Layer-2 protocols as IP Security Authentication of all registration messages Efficiency and Scalability Require only few additional messages between the end device and the home network (bandwidth efficiency for low-bandwidth wireless links) World-wide coverage and support for large numbers of mobile devices 42

43 Mobile IPv4: Jargon Mobile Node (MN) Mobile end system Roams between different networks without changing its IP address Home Agent (HA) System in the home network of the MN Often, but not necessarily, a router Tracks the location of the MN and forwards IP packets towards the MN Care-of Address (COA) Current address in the foreign network where IP packets are forwarded to (called tunnel endpoint, not necessarily the MN itself) Foreign Agent (FA) System in the (current) foreign network of the MN Forwards tunneled packets to the MN Correspondent Node (CN) Communication partner of the MN 43

44 Mobile IPv4: Scenario Foreign Network Mobile Node Foreign Agent Home Network The Internet Home Agent Correspondent Node 44

45 Mobile IPv4 Agent Advertisement How does a MN discover a FA? HA and FA periodically broadcast advertisement messages MN receives these messages and determines if this is the HA or FA MN learns a COA from the FA advertisement messages Registration (with limited validity) MN signals COA to the HA via the FA Actions must be authenticated Advertisement HA takes the IP address of the MN (proxy ARP) Packets to the MN are sent to the HA Independent of changes of the current COA or FA 45

46 Scenario Foreign Network 4.) FA dispatches packet to MN Mobile Node 3.) HA tunnels packet to FA Foreign Agent Home Network The Internet Home Agent 1. ) CN sends packet to home address of the MN 2. ) HA intercepts the packet (using proxy ARP) Correspondent Node 46

47 Scenario 5.) MN sends reply via FA Foreign Network Mobile Node 5.) FA routes packet to CN Foreign Agent Home Network The Internet Home Agent Correspondent Node 47

48 Issues with this scenario Each network a client roams to requires a FA Requires additional administrative effort, resources Consequence Only few networks are usable with MobileIP Solution: Co-located COA Client acts as FA More complex clients Positive: End-to-end argument: No intelligence in the network required 48

49 Issues with this scenario Triangle Routing : MN directly transmits to the CN Optimization: Requires fewer hops to the CN Problem Source IP does not match the network s prefix Firewalls and egress filters may prevent this (avoid IP spoofing) Solution Inform the CN about the MN s current address (security issues) Tunnel outgoing messages through the HA Reverse tunneling (RFC 3024 and 2344) 49

50 Open issues / problems Packet Filters / Firewalls Often not possible to use MobileIP with Firewalls If possible, only reverse tunneling is possible Need for FA Requirement for FA limits practical applicability Only possible if MN acts as its own FA Security Authentication with the FA problematic (typically owned by another organization) Key management and distribution problematic No widespread deployment of MobileIP has been observed 50