Control- Plane Protocol Interac.ons in Cellular Networks Guan- Hua Tu *1, Yuanjie Li *1, Chunyi Peng 2, Chi- Yu Li 1, Hongyi Wang 1, Songwu Lu 1 1: University of California, Los Angeles; 2: The Ohio State University * The first two authors contribute equally to this work.
Cellular Services are Ubiquitous 2 Large- scale wireless infrastructure Offer data and voice services to anyone, anywhere, any+me 6.8+ billion Source: hgp://www.4gamericas.org/
Cellular Network Architecture 3 (PS + CS) Circuit Switching (CS) Mobile Switching Center Base stations Gateways Packet Switching (PS) 4G (PS only) Mobility Management Entity (Control Node)
Control Plane in Cellular Network 4 Connec.vity Management () Mobility Management () Layered protocol stack Radio Resource Control () Circuit Switching (CS) Mobile Switching Center Gateways Packet Switching (PS) 4G Mobility Management Entity (Control Node)
Control Plane in Cellular Network 5 CS Domain PS Domain Layered protocol stack Domains separated for voice (CS) and data (PS) Radio Resource Control () Mobile Switching Center Gateways Circuit Switching (CS) Packet Switching (PS) 4G Mobility Management Entity (Control Node)
6 Control Plane in Cellular Network CS Domain PS Domain 4G PS Domain Layered protocol stack Domains separated for voice (CS) and data (PS) Hybrid /4G systems Radio Resource Control () 4G Mobile Switching Center Gateways Circuit Switching (CS) Packet Switching (PS) Mobility Management Entity (Control Node)
Complex Interactions 7 Protocols work together to offer vital /4G utlites Rich pagerns along three dimensions cross-domain cross-system CS Domain PS Domain PS Domain cross-layer Radio Resource Control 4G
8 Complex Interactions Problem: Each individual protocol may be well designed. Protocols work together to offer vital /4G utlites How about protocol interactons? Rich pagerns along three dimensions cross-domain cross-system CS Domain PS Domain PS Domain cross-layer Radio Resource Control 4G
Rich Protocol Interactions 9 Complex interactons in common scenarios Inevitable interplay between radio, mobility, data/voice Concurrent voice and data use /4G switch due to hybrid deployment, mobility, voice Two causes of problematc interactons Design defects Operation/Implementation slips MSC Gateways Circuit Switching (CS) Packet Switching (PS) 4G E
Rich Protocol Interactions 10 Complex interactons in common scenarios Inevitable interplay between radio, mobility, data/voice Concurrent voice and data use Diagnosis over one layer/domain/system is /4G switch due to hybrid deployment, mobility, voice Two causes of problematc interactons Design defects Operation/Implementation slips insufficient Single- type test fails to unveil both issues 4G MSC Closed Core Gateways Network Circuit Switching (CS) Packet Switching (PS) E
Our SoluTon: CNetVerifier 11 Cellular- specific model checking Extract full-stack cellular model from PP standards Create a variety of usage scenarios Define desirable user-perspective properties Discover counterexamples for possible design defects Protocol Stacks Usage Se[ngs Desirable ProperTes Model Checker Violated property Counterexamples
Our SoluTon: CNetVerifier 12 Cellular- specific model checking Phone- based experimental validaton Instrument end devices to collect traces for verification Discover operational slips in real networks Protocol Stacks Usage Se[ngs Black- box Desirable ProperTes Model Checker Violated property Counterexamples Scenario Setup Design Flaws Opera.onal slips
Finding Overview 13 I. Necessary cooperaton II. Independent operatons
Finding Overview 14 I. Necessary cooperaton II. Independent operatons cross-layer cross-domain cross-system
þ Improper coopera.on: Cross- System 15 Scenario: run data services during 4Gà à 4G CS PS 4G PS 1. Setup 4G connectvity to access internet 4G Conn. Context 4G 131.179.176.1
þ Improper coopera.on: Cross- System 16 Scenario: run data services during 4Gà à 4G CS PS 4G PS 1. 2. Setup 4Gà : 4G connectvity conn. context to access is internet converted to for seamless switch Conn. Context 131.179.176.1 4G
þ Improper coopera.on: Cross- System 17 Scenario: run data services during 4Gà à 4G CS PS 4G PS 1. 2. 3. Setup 4Gà : à 4G: 4G connectvity conn. context to access is is internet converted to back for to 4G seamless switch 4G Conn. Context 4G 131.179.176.1
18 þ Improper coopera.on: Cross- System How and why? ProblemaTc scenario: context is deleted before returning to 4G 1. conn. context is deleted. Conn. Context 131.179.176.1 4G Causes of dele.on (in PP) Low layer failures User disables data services No enough resources.
19 þ Improper coopera.on: Cross- System How and why? ProblemaTc scenario: context is deleted before returning to 4G 2. - >4G: No context 1. conn. context is deleted. transferred to 4G context Conn. Context 131.179.176.1 4G Out- of- Service
20 þ Improper coopera.on: Cross- System How and why? ProblemaTc scenario: context is deleted before returning to 4G 2. - >4G: No context 1. conn. context is deleted. transferred to 4G context PS conn Conn. context is not mandatory in (PS+CS), Context but mandatory in 4G (PS only) 131.179.176.1 Shared context for 4G and is not well protected in 4G Out- of- Service
þ Improper coopera.on: Cross- System 21 Real- world impact Occurs 3.1% in user study out-of-service for up to 25s Lessons: a design defect Different demands of packet switching in & 4G Desirable but not enforced: shared context should be consistently protected in 4G & Proposed remedies Avoid unnecessary PS context deactivation Immediately enable 4G PS context reactivation
þ þ Improper coopera.on: cross- domain+system 22 Scenario: 4G users make calls via CS Fallback CS PS 4G PS 1. To make a call, 4G user à 4G
þ þ Improper coopera.on: cross- domain+system 23 Scenario: 4G users make calls via CS Fallback CS PS 4G PS 1. 2. To When make the a call, ends, 4G user à 4G à 4G
24 þ þ Improper coopera.on: cross- domain+system How and Why? ProblemaTc Scenario: Call with background data 1. A call makes 4G à ; Data is migrated to, too 4G
25 þ þ Improper coopera.on: cross- domain+system How and Why? ProblemaTc Scenario: Call with background data 1. 2. When A call the makes call 4G ends, à No ; Data à 4G is migrated (data is stll to, on) too 4G User gets stuck in, losing 4G.
26 þ þ Improper coopera.on: cross- domain+system How and Why? Unexpected loop in state machine CS PS CONN- ED 4G PS CONN- ED IDLE IDLE Voice only User gets stuck in, losing 4G.
27 þ þ Improper coopera.on: cross- domain+system How and Why? Unexpected loop in state machine CS PS CONN- ED 4G PS CONN- ED Voice + Data (certain sezng) IDLE IDLE User gets stuck in, losing 4G.
28 þ þ Improper coopera.on: cross- domain+system How and Why? Unexpected loop in state machine CS PS CONN- ED 4G PS CONN- ED Voice + Data (certain sezng) state transiton is inconsistent with dual- IDLE domain, inter- system se[ngs IDLE User gets stuck in, losing 4G.
þ þ Improper coopera.on: cross- domain+system 29 Real- world impact 62.1% 4G users being stuck in afer the call Stuck in for 39.6s in average Lessons: a design defect CS and PS are indirectly coupled in Inconsistent state transition with all à 4G options Proposed remedies Revise the state transition for possible settings
þ 30 Improper coopera.on: Cross- Layer How and why? Problem Scenario: Signaling loss for registraton CS PS 4G PS Deregistered Registered Attach request Attach accept Attach complete Deregistered Deregistered Registered
þ 31 Improper coopera.on: Cross- Layer How and why? Problem Scenario: Signaling loss for registraton out- of- service right afer being agached CS PS 4G PS Deregistered Registered Deregistered Attach request Attach accept Attach complete Location update Deregistered Deregistered Registered Location update response (error)
þ 32 CS Problem Scenario: Signaling loss for registraton PS Improper coopera.on: Cross- Layer How and why? out- of- service right afer being agached 4G PS Deregistered Registered Attach request Attach accept Attach complete Deregistered Deregistered Upper- layer () assumes underlying reliable in- Registered sequence signal Location transfer, update but lower- layer () Deregistered cannot offer this guarantee Location update response (error)
þ Unnecessary Coupling: Cross- layer 33 Scenario: voice/data request with locaton update - CS - PS 4G- PS 1. LocaTon update is triggered by (e.g., user moves) Location Update MSC
þ Unnecessary Coupling: Cross- layer 34 Scenario: voice/data request with locaton update - CS - PS 4G- PS 1. 2. LocaTon Afer locaton update update, is triggered user can by send/receive (e.g., user voice moves) and data Location Update Dial out MSC
þ 35 ProblemaTc Scenario: voice/data request during the locaton update - CS - PS Unnecessary Coupling: Cross- layer How and why? 4G- PS 1. LocaTon is triggered by (e.g., 2. User dials out user moves) Location Update MSC Base stations Gateways
þ 36 ProblemaTc Scenario: voice/data request during the locaton update Dial out - CS - PS Unnecessary Coupling: Cross- layer How and why? 4G- PS 2. User dials out Location Update Updating the location MSC Outgoing call Gateways is delayed Base stations
þ 37 ProblemaTc Scenario: voice/data request during the Without locaton update user loca+on, the cellular network Dial out - CS - PS Unnecessary Coupling: Cross- layer How and why? 4G- PS 1. LocaTon is triggered by (e.g., 2. User dials out user moves) cannot route user voice/data. Location Update Updating the location MSC Outgoing call Gateways is delayed Base stations
þ 38 ProblemaTc Scenario: voice/data request during the Without locaton update user loca+on, the cellular network Dial out - CS - PS Unnecessary Coupling: Cross- layer How and why? 4G- PS 1. LocaTon is triggered by (e.g., 2. User dials out user moves) cannot route user voice/data. without user locaton Location Update Outgoing voice/data requests can be routed Updating the location MSC Unnecessary prioritzaton of locaton update over outgoing call/data Outgoing call Gateways is delayed Base stations
þ 39 Unnecessary Coupling: Cross- layer Real- world Impact up to 8.3s call delay and 4.1s data delay 7.6% of outgoing calls occur during locaton update Lessons: a design defect outgoing data/voice requests and location update are independent, but they are artificially correlated Proposed remedies Decouple location update and outgoing data/voice requests E.g., two parallel threads for different purposes
þ Unnecessary Coupling: Cross- domain 40 CS Scenario: dial a call during data service in PS 4G PS 2. Dials 1. Access a call internet at full rate Circuit Switching (CS) 10Mbps 10Mbps Packet Switching (PS)
þ Unnecessary Coupling: Cross- domain 41 CS Scenario: dial a call during data service in PS 4G PS 2. Dials 1. Access a call internet at full rate 12.2Kbps Circuit Switching (CS) 12.2Kbps 2.5Mbps 2.5Mbps Packet Switching (PS) Data service rate declines up to 74%
þ Unnecessary Coupling: Cross- domain 42 CS Scenario: dial a call during data service in PS 4G PS 2. Dials 1. Access a call internet at full rate 12.2Kbps 12.2Kbps Circuit Switching (CS) Voice: low rate, low loss (e.g., 16QAM) Data: high rate, loss tolerant (e.g., 64QAM) 2.5Mbps 2.5Mbps Packet Switching (PS) Voice and data have competng demands on the Data channel, service but they rate have declines to share the up radio to channel 74%
Unnecessary Coupling: Cross- system þ 43 Scenario: LocaTon update in and 4G CS PS 4G PS 1. Update 4G locaton, and notfy MSC 4G
Unnecessary Coupling: Cross- system þ 44 Scenario: LocaTon update in and 4G CS PS 4G PS 2. locaton update fails, so 4G deregisters the network MSC unavailable 4G Detach
Unnecessary Coupling: Cross- system þ 45 Scenario: LocaTon update in and 4G CS PS 4G PS 2. locaton update fails, so 4G deregisters the network MSC unavailable 4G Detach internal failures are exposed to 4G devices
Conclusion 46 Uncover problems in signaling protocol interactons in cellular networks Three Lessons The layering rule should be fully honored (optimistic assumptions, coupled actions) Inter-domain difference should be well recognized (coupling independent services) Hybrid systems are not properly coordinated (context sharing, fault isolation) More rigorous efforts are needed