CDMA2000 Packet Data Network Evolution Huawei Technologies Co., Ltd. grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner's name any Organizational Partner's standards publication even though it may include all or portions of this contribution; and at the Organizational Partner's sole discretion to permit others to reproduce in whole or in part such contribution or the resulting Organizational Partner's standards publication. Huawei Technologies Co., Ltd. is also willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions for purpose of practicing an Organizational Partner’s standard which incorporates this contribution. This document has been prepared by Huawei Technologies Co., Ltd. to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on Huawei Technologies Co., Ltd.. Huawei Technologies Co., Ltd.. specifically reserves the right to amend or modify the material contained herein and to any intellectual property of Huawei Technologies Co., Ltd.. other than provided in the copyright statement above. Zhong Xin: Wang Jie:

Huawei 2 Outline  Network Architecture  Mobility Management  Security  Service Based Bearer Control  Cross-technology Interworking  Appendix: Optional Network Architectures

Huawei 3 Network Architecture LMHA DHCP Server AGW RRM BTS AT Air Interface S2 U2 S3 LMHA: Local Mobility Home Agent AGW: Access Gateway RRM: Radio Resource Management Control Plane Interface User Data Plane Interface Air Interface AGW Pool HA Backbone IP Network WLAN WiMAX AAA 1x/HRPD S4

Huawei 4 Entity Functions (1) Access Gateway (AGW) Functions  First-Hop Router for the MS/AT  Mobility Management  Session Management  DHCP Relay/Server  Authentication Functions  Accounting Functions  RADIUS Client (for authentication and accounting)  TFT  Policy enforcement function (flow based…)  RLP (Optional)  Header Compression (mandatory if RLP is located in AGW, optional if RLP is located in BTS)  Security (Ciphering / Integrity Protection) (if RLP is located in AGW)

Huawei 5 Entity Functions (2) Local Mobility Home Agent (LMHA) Functions  Controlling/ Delegating IP address to the MS/AT  Mobility Management Radio Resource Management (RRM) Functions  Radio Resource Management (Admission Control, Load Control and so on)  Radio Session Management  Session Transfer  Radio Link Management:  Handoff control Base Transceiver System (BTS) Functions  Radio Signal Transceiver  Base Band Processing  Radio Resource Dynamic Scheduling  RLP (Optional)  Header Compression (optional if RLP is located in BTS)  Security (Ciphering / Integrity Protection) (if RLP is located in BTS)

Huawei 6 Key Concepts MIP is used to support handover between different access networks. AGWs in a specific area consist of a pool for load balancing and high reliability. Since RRM is only responsible for control plane processing, the path of control plane between AT and AGW remains three hops, while the user data plane is reduced to two hops. The location of RLP termination has two options: in AGW or BTS.

Huawei 7 Interfaces Interface between AGW and LMHA  Use IETF Standard Protocol (e.g. MIP) Interface between RRM and RRM (S4)  Control plane interface (3GPP2 specific)  Control plane interface for handoff Interface between RRM and AGW (S3):  Control plane interface (3GPP2 specific)  Flexible interface (multiple to multiple relationship) Interface between AGW and BTS (U2):  User data plane interface  Flexible interface (multiple to multiple relationship) Interface between RRM and BTS (S2):  Control plane interface (3GPP2 specific)  One to multiple relationship

Huawei 8 Local route optimization intra LMHA User traffic without optimization User traffic with optimization Plain data Tunneling data Note: if communication peers are under the same LMHA area, route optimization may be desirable for efficiency.

Huawei 9 Inter-AGW Dormant Handoff

Huawei 10 Inter-AGW Active Handoff

Huawei 11 Inter-LMHA Dormant Handoff (MIP)

Huawei 12 Inter-LMHA Active Handoff (MIP)

Huawei 13 Security Architecture Overview LMHA AGW (RLP) AGW (RLP) RRM BTS AT AGW Pool HA Backbone IP Network AAA Network access authentication and authorization U-plane ciphering and optional integrity protection. C-plane integrity protection and optionally ciphering. C-plane integrity protection and optionally ciphering between AT and RRM C-plane security associations between AGW and RRM

Huawei 14 Security Association in network Each AT has a SA with AGW  protect User plane traffic of AT  protect signaling between AT and AGW  AGW can assign encrypted temporary ID to AT for preventing AT tracking Each RRM has a SA with AGW  encrypt and integrity protect signaling between RRM and AGW  protect key( between AT and RRM ) transfer from AGW to RRM Each AT has a shared key with specific RRM  Against fake RRM attack  integrity and optional encrypt protect signaling between RRM and AT Note: If RLP is located in BTS, U-plane and C-plane protection is necessary between AT and BTS.

Huawei 15 Key Hierarchy  AT and AGW have the MSK (Master Session Key).  MSK is a result of authentication between AT and AAA-server (EAP-AKA etc.). AAA server transfers the MSK to AGW.  AGW derives RRM specific key (i.e. K AT_RRM ) form MSK, RRM identity is involved in derivation. AGW can send multiple RRM identity to AT to enable AT computing multiple K AT_RRM simultaneously.  AGW sends K AT_RRM to RRM using SA between them.  Session key is shared between AT and AGW, and is derived from MSK also. RRM a BTS AT AGW (RLP) MSK K AT_RRMa K AT_RRMb Session key RRM b K AT_RRMa MSK Note: If RLP is located on BTS, AGW can derive K AT_BTS for BTS, and sends to RRM, then RRM forwards it to BTS. [K AT_RRMa K AT_RRMb ] Session key

Huawei 16 SBBC Architecture (non roaming)  Different AGWs may connect different PCRFs  PCEF locates in AGW  Inter-AGW handoff may need PCEF relocation HPLMN LMHA AGW(PCEF) PCRF AF AF:Application Function AGW:Access Gateway LMHA: Local Mobility Home Agent PCEF:Policy and Charging Enforcement Function PCRF:Policy and Charging Rule Function H-PCRF:Home Policy and Charging Rule Function V-PCRF:Visited Policy and Charging Rule Function Data Ty Tx Signaling PCRF Ty

Huawei 17 SBBC Architecture (roaming) HPLMN VPLMN LMHA AGW(PCEF) H-PCRF V-PCRF AF Data Ty Tx Signaling When AF is in HPLMN  AF connects with H-PCRF  V-PCRF acts as a proxy or a relay agent between AGW and H-PCRF

Huawei 18 SBBC Architecture for roaming 2 HPLMN VPLMN LMHA AGW(PCEF) H-PCRF V-PCRF AF Data Ty Tx Signaling When AF is not in HPLMN Options 1  AF connects with H-PCRF  V-PCRF acts as a proxy or a relay agent between AGW and H-PCRF Option 2:  AF connects with V-PCRF directly  AF-related information needn’t to be passed between the visited PCRF and the home PCRF  V-PCRF gets home-related information from H-PCRF via Ty. Tx

Huawei 19 Cross-technology Inter-working Case 1: Interworking with other access network within the same LHMA, access network controlled by one operator Note: In case of AT only Supporting SIP,IWU should act as a proxy MIP. AT internet CDMA Home service network AAA HA Other access network (WLAN/WIMAX) IWU AGW LMHA CDMA Access network AT access Internet via WLAN/WIMAX CDMA based Access control and Authentication Access CDMA PS service network via WLAN/WIMAX Access CDMA PS service network via CDMA AN IWU: Inter-Working Unit It served as gateway for user to access CDMA PS service via WALN /WIMAX

Huawei 20 Cross-technology Inter-working Case 2: Interworking with other access network within the HA, access network controlled by same or different operator internet CDMA Home service network AAA HA LMHA AGW CDMA Access network Other access network (WLAN/WIMAX) AT IWU AT access Internet via WLAN/WIMAX CDMA based Access control and Authentication Access CDMA PS service network via WLAN/WIMAX Access CDMA PS service network via CDMA AN IWU: Inter-Working Unit It served as gateway for user to access CDMA PS service via WALN /WIMAX

Huawei 21 Inter-working unit (IWU) function  support access to cdma2000 packet Data service via the WLAN/WIMAX system.  act as proxy MIP function when AT only support SIP.  MIP is the Interface between IWU and HA(LMHA) Network selection  Terminal should provide the auto and manual network selection according to network capability 、 service characteristics and cost.  User shall may have the capability to prioritize the selection of access system.  Home Operator may have the capability to define preferred or forbidden WLAN/WIMAX access network  Network may direct user to the appropriate access technology according to service and current network capability in order to manage network loading. Service continuity while switching across different access network Requirement of Cross-technology Inter-working

Huawei 22 Appendix: Optional Network Architecture 1 DHCP Server AGW BTS (RRM) BTS (RRM) BTS (RRM) BTS (RRM) AT Air Interface U2 S2 LMHA: Local Mobility Home Agent AGW: Access Gateway RRM: Radio Resource Management Control Plane Interface User Data Plane Interface Air Interface AGW Pool RRM Combined with BTS as one entity LMHA Backbone IP Network HA AAA

Huawei 23 Appendix: Optional Network Architecture 2 DHCP Server AGW (RRM) AGW (RRM) BTS AT Air Interface U2 S2 LMHA: Local Mobility Home Agent AGW: Access Gateway RRM: Radio Resource Management Control Plane Interface User Data Plane Interface Air Interface RRM Combined with BTS as one entity LMHA Backbone IP Network HA AAA

Huawei 24 Considerations about Optional Architectures Optional Architecture 1  Faster session setup and activation/deactivation, faster intra-BTS handoff  More complex inter-BTS handoff Optional Architecture 2  Less 3GPP2 specific entities than other options  Difficult to support AGW pool because RRM is coupled with AGW  Hard to define S2 & U2 as an open interface