1. Cellular Networks and Mobile Computing COMS 6998-7, Spring 2014 Instructor: Li Erran Li (lierranli@cs.columbia.edu) http://www.cs.columbia.edu/~lierranli/coms 6998-7Spring2014/ 3/7/2014: Introduction to Cellular Networks 1

2. Review of Previous Lecture What are the different approaches of virtualization? 2 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

3. Review of Previous Lecture What are the different approaches of virtualization? – Bear-metal hypervisor, hosted hypervisor, container (Linux LXC, Samsung Knox) 3 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

4. OS Kernel OS Kernel OS Kernel OS Kernel OS Kernel OS Kernel Hypervisor / VMM Hardware Bare-Metal Hypervisor poor device support / sharing Courtesy: Jason Nieh et al. 4 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

5. OS Host OS Kernel OS Hypervisor / VMM Hosted Hypervisor kernel module kernel module Hardware poor device performance poor device performance emulated devices emulated devices Courtesy: Jason Nieh et al. 5 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

6. Review of Previous Lecture (Cont’d) What approach does Cell use? What are the key design choices for Cell’s extremely low overhead? 6 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

7. Review of Previous Lecture (Cont’d) Device namespace – It is designed to be used by individual device drivers or kernel subsystems to tag data structures and to register callback functions. Callback functions are called when a device namespace changes state. – Each VP uses a unique device namespace for device interaction. Cells leverages its foreground-background VP usage model to register callback functions that are called when the VP changes between foreground and background state. 7 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

8. Linux Kernel Linux Kernel Power WiFi Cell Radio Framebuffer GPU RTC / Alarms SensorsInputAndroid... Audio/Video Device Namespaces safely, correctly multiplex access to devices device namespaces VP 3 VP 2 VP 1 Courtesy: Jason Nieh et al. 8 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

9. Review of Previous Lecture (Cont’d) How to run iOS applications on Android OS? 9 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

10. Cider Architecture Interaction between app and OS is defined by kernel app binary interface (ABI) – ABI includes: binary loader, async signal delivery, and syscall Mach-O binary loader built into Linux kernel – Kernel tags current thread with iOS persona Persona is an execution mode (exec foreign or domestic code) assigned to each thread Translation layer for async signal (illegal instruction, segmentation fault) delivery Multiple syscall interface – Wrapper mapping arguments from XNU structures to Linux ones 10 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

11. Duct Tape Mach IPC missing in Linux Duct tape to the rescue – Direct compilation of unmodified foreign kernel source code into domestic kernel – Direct translates foreign Kernel API such as sync, memory allocation, processing control into domestic kernel API Duct tape has three steps: – Create three distinct coding zones: foreign, domestic, duct tape No cross access between foreign and domestic Cross access between foreign (domestic) and duct tape – Identify foreign symbols conflicting with domestic code – Remap conflicting symbols to unique domestic ones Duct tape advantages: easy to maintain and reusable 11 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

12. Duct Tape (Cont’d) Cider uses duct tape to add three subsystems – pthread: differ from Linux, use kernel-level support for mutexes, semaphores and condition variables – Mach IPC: direct compilation; rewrite recursive queuing structures – Apple’s I/O Kit device driver framework Source code at: http://www.opensource.apple.com/source/xnu/xnu- 2050.18.24/iokit/ 12 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

13. Diplomatic Functions Mobile apps often use closed proprietary hardware and software stacks – OpenGL ES libraries directly communicate with GPU through proprietary software and hardware interfaces using device-specific ioctls (Android) or opaque IPC messages (iOS) How to direct access to proprietary hardware? Diplomatic function temporarily switches the persona of a calling thread to exec domestic functions from within foreign app 13 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

14. Review of Previous Lecture (Cont’d) What are the most expensive flash memory operations? – Random read – Random write – Sequential write – Sequential read 14 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

15. Random versus Sequential Disparity Performance for random I/O significantly worse than seq; inherent with flash storage Mobile flash storage classified into speed classes based on sequential throughput  Random write performance is orders of magnitude worse Vendor (16GB) Speed Class Cost US $ Seq Write Rand Write Transcend2264.21.18 RiData2277.90.02 Sandisk4235.50.70 Kingston4254.90.01 Wintec62515.00.01 A-Data63010.80.01 Patriot102910.50.01 PNY102915.30.01 Consumer-grade SD performance Performance MB/s For several popular apps, substantial fraction of I/O is random writes (including web browsing!) Courtesy: Nitin Agrawal et al. 15 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

16. Syllabus Mobile App Development (lecture 1,2,3) – Mobile operating systems: iOS and Android – Development environments: Xcode, Eclipse with Android SDK – Programming: Objective-C and android programming System Support for Mobile App Optimization (lecture 4,5) – Mobile device power models, energy profiling and ebug debugging – Core OS topics: virtualization, storage and OS support for power and context management Interaction with Cellular Networks (lecture 6,7,8) – Basics of 3G/LTE cellular networks – Mobile application cellular radio resource usage profiling – Measurement-based cellular network and traffic characterization Interaction with the Cloud (lecture 9,10) – Mobile cloud computing platform services: push notification, iCloud and Google Cloud Messaging – Mobile cloud computing architecture and programming models Mobile Platform Security and Privacy (lecture 11,12,13) – Mobile platform security: malware detection and characterization, attacks and defenses – Mobile data and location privacy: attacks, monitoring tools and defenses 16 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

17. Outline Goal of this lecture: understand the basics of current networks and future directions Current Cellular Networks – Introduction – Radio Aspects – Architecture – Power Management – Security – QoS What Is Next? A Clean-Slate Design: Software-Defined Cellular Networks Conclusion and Future Work 17 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

18. Cellular Networks Impact our Lives More Mobile Connection More Mobile Information Sharing More Mobile Users 1010100100001011001 0101010101001010100 1010101010101011010 1010010101010101010 0101010101001010101 More Infrastructure Deployment 18 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

19. Global Convergence LTE is the major technology for future mobile broadband – Convergence of 3GPP and 3GPP2 technology tracks – Convergence of FDD and TDD into a single technology track GSMWCDMAHSPA TD-SCDMAHSPA/TDD LTE FDD and TDD IS-95cdma2000EV-DO D-AMPS PDC WiMAX ? 3GPP 3GPP2 IEEE 19 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

20. 3GPP introduction 3 rd Generation Partnership Program – Established in 1998 to define UMTS – Today also works on LTE and access-independent IMS – Still maintains GSM 3GPP standardizes systems – Architecture, protocols Works in releases – All specifications are consistent within a release 20 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

21. 3GPP TS 23.401 V11.2.0 Stage 1 Requirements “It shall be possible to...” “It shall support…” 3GPP way of working E.g., 22-series specs Stage 2 Architecture Nodes, functions Reference points Procedures (no errors) Stage 3 Protocols Message formats Error cases E.g., 23-series specs E.g., 29-series specs Specification numbering example: Spec. number TS=Technical Specification (normative) TR=Technical Report (info only) Release Consistent set of specs per release New release every 1-2 years Updated after a meeting Courtesy: Zoltán Turányi 21 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

22. 3GPP specification groups 2G 3G/LTE System Protocols Cellular Networks and Mobile Computing (COMS 6998-10) 22 3/7/14

23. Starting points on 3GPP specifications http://www.3gpp.org/specification-numbering – Pointers to the series of specifications – Architecture documents in 23-series23-series Main architecture references – 23.002 – Overall architecture reference 23.002 – 23.401 – Evolved Packet Core with LTE access, GTP- based core 23.401 – 23.060 – 2G/3G access, and integration to Evolved Packet Core 23.060 – 23.402 – Non-3GPP access, and PMIP-based core 23.402 Courtesy: Zoltán Turányi 23 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

24. Example A base station with 3 sectors (3 cells) Courtesy: Zoltán Turányi

25. Large distances – Terminals do not see each other – Tight control of power and timing needed – Highly variable radio channel – quick adaptation needed Many users in a cell – A UMTS cell can carry roughly 100 voice calls on 5 MHz – Resource sharing must be fine grained – but also flexible Quality of Service with resource management – Voice – low delay, glitch-free handovers – Internet traffic – more, more, more Battery consumption critical – Low energy states, wake-up procedures – Parsimonious signaling Key challenges Courtesy: Zoltán Turányi

26. Radio basics 26 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

27. LTE air interface The key improvement in LTE radio is the use of OFDM Orthogonal Frequency Division Multiplexing – 2D frame: frequency and time – Narrowband channels: equal fading in a channel Allows simpler signal processing implementations – Sub-carriers remain orthogonal under multipath propagation One resource element One resource block 12 subcarriers during one slot (180 kHz × 0.5 ms) One OFDM symbol One slot 12 subcarriers time frequency Frame (10 ms) Subframe (1 ms)Slot (0.5 ms) Time domain structure 27 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

28. Orthogonal Frequency Division Multiple Access (OFDM)  Closely spaced sub-carriers without guard band  Each sub-carrier undergoes (narrow band) flat fading - Simplified receiver processing  Frequency or multi-user diversity through coding or scheduling across sub-carriers  Dynamic power allocation across sub- carriers allows for interference mitigation across cells  Orthogonal multiple access Frequency Narrow Band (~10 Khz) Wide Band (~ Mhz) T large compared to channel delay spread Sub-carriers remain orthogonal under multipath propagation T 1 Courtesy: Harish Vishwanath LTE air interface: Downlink 28 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

29. LTE air interface: Uplink User 1 User 2 User 3  Efficient use of spectrum by multiple users  Sub-carriers transmitted by different users are orthogonal at the receiver - No intra-cell interference  CDMA uplink is non-orthogonal since synchronization requirement is ~ 1/W and so difficult to achieve  Users are carrier synchronized to the base  Differential delay between users’ signals at the base need to be small compared to symbol duration W Courtesy: Harish Vishwanath 29 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

30. LTE air interface: Multiplexing  Each color represents a user  Each user is assigned a frequency-time tile which consists of pilot sub-carriers and data sub-carriers  Block hopping of each user’s tile for frequency diversity Time Frequency Typical pilot ratio: 4.8 % (1/21) for LTE for 1 Tx antenna and 9.5% for 2 Tx antennas Courtesy: Harish Vishwanath Pilot sub-carriers 30 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

31. Assign each Resource Block to one of the terminals – LTE – channel-dependent scheduling in time and frequency domain – HSPA – scheduling in time-domain only Time Frequency User #1 scheduled User #2 scheduled 1 ms 180 kHz Time-frequency fading, user #1 Time-frequency fading, user #2 LTE Scheduling Courtesy: Zoltán Turányi 31 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

32. Architecture 32 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

33. CS CN 3G Radio Access Network PS Core Network Why separate RAN and CN? – Two CNs with same RAN – Multiple RANs with same CN – Modularization – Independent scaling, deployment and vendor selection Why two GSNs? – Roaming: traffic usually taken home – Independent scaling, deployment and vendor selection – User can connect to multiple PDNs UMTS Architecture RNC GGSN Gn/Gp NodeB Iub L1 HSPA scheduling Real-time radio control Radio Resource Management Soft handover UP Ciphering Header Compression First-hop router GW towards external PDNs VPN support over Gi IP address management Policy Control Gi GPRS – Generic Packet Radio Service GGSN – Gateway GPRS Support Node SGSN – Serving GPRS Support Node RNC – Radio Network Controller PDN – Packet Data Network CN – Core Network PS – Packet Switched CS – Circuit Switched MSC – Mobile Switching Center HSS – Home Subscriber Server MSC SGSN IuPS IuCS Manage CN procedures HSS connection (authenticator) Idle mode state Lawful Intercept Bearer management

34. CS CN 3G Radio Access Network PS Core Network RNC GGSN Gn/Gp NodeB Iub L1 HSPA scheduling Real-time radio control Radio Resource Management Soft handover UP Ciphering Header Compression First-hop router GW towards external PDNs VPN support over Gi IP address management Policy Control Gi MSC SGSN IuPS IuCS Manage CN procedures HSS connection (authenticator) Idle mode state Lawful Intercept Bearer management Drivers for change Vendor lock-in due to proprietary Iub features Too many specialized data plane nodes Overhead of separate CS core when bulk of traffic is PS Complex, real- time RAN Courtesy: Zoltán Turányi

35. From 3G to EPC/LTE architecture 3G Radio Access Network PS Core Network LTE Radio Access Network eNodeB eNodeB – Evolved Node B RNC functions moved down to base station Evolved Packet Core (EPC) SGi PDN GW SGW S1-UP Only two data plane nodes in the typical case. user plane Packet Data Network GW Serving GW PS only MME S11 Mobility Management Entity Data plane/control plane split for better scalability. control plane S1-CP CS MSC IuCS RNC GGSN Gn/Gp NodeB Iub Gi SGSN IuPS Courtesy: Zoltán Turányi 35

36. Why separate SGW and PDN GW? LTE Radio Access Network eNodeB eNodeB – Evolved Node B Evolved Packet Core (EPC) SGi SGW Serving GW MME Mobility Management Entity S1-CP PDN GW S1-UP Packet Data Network GW S11 S5/S8 SGW and PDN GW separate in some special cases: Roaming: PDN GW in home network, SGW in visited network Mobility to another region in a large network Corporate connectivity Courtesy: Zoltán Turányi 36

37. Interworking with 3G SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS MSC RNC IuCS NodeB Iub SGSN IuPS UE MSC – Mobile Switching Center Gn Courtesy: Zoltán Turányi 37 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

38. Interworking with non-3GPP accesses SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS MSC RNC IuCS NodeB Iub SGSN IuPS Non-3GPP Access (cdma2000, WiMax, WiFi) S2 UE PMIP – Proxy Mobile IP Gn Courtesy: Zoltán Turányi 38 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

39. Debate of 2006: GTP vs. PMIP SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS MSC RNC IuCS NodeB Iub SGSN IuPS Non-3GPP Access (cdma2000, WiMax, WiFi) S2 PMIP GTP GTP? PMIP? GTP PMIP UE Gn Conclusion: Specify both Courtesy: Zoltán Turányi 39 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

40. EPC + LTE: 23.401 EPC + 2G/3G: 23.060 SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS MSC RNC IuCS NodeB Iub SGSN IuPS GTP UE GTP Gn Courtesy: Zoltán Turányi 40 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

41. EPC + non-3GPP: 23.402 SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS GTP UE PMIP EPC – Evolved Packet Core Non-3GPP Access (cdma2000, WiMax, WiFi) S2 PMIP Courtesy: Zoltán Turányi 41 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

42. Access Procedure Cell Search – Base station broadcasts synchronization signals and cell system information (similar to WiFi) – UE obtains physical layer information UE acquires frequency and synchronizes to a cell Determine the start of the downlink frame Determine the cell identity Random access to establish a radio link Base station UE 2 UE 1 42 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

43. ClientBase stationCore network Step 1: random access request (pick one of 64 preambles) Step 2: random access response Step 3: transmission of mobile ID Step 4: contention resolution msg Only if UE is not known in Base station Random Access Adjust uplink timing If ID in msg matches UE ID, succeed. If collision, ID will not match! 43 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

44. Base station Random Access (Cont’d) UE 2 UE 1 Why not carrier sensing like WiFi? Base station coverage is much larger than WiFi AP – UEs most likely cannot hear each other How come base station can hear UEs’ transmissions? – Base station receivers are much more sensitive and expensive 44 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

45. Modes of operation 45 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

46. Used during communication Signaling connection exists between network and UE Both CN and RAN keeps state about the UE UE location is tracked on a cell granularity – Needed to deliver the data Network controlled mobility Connected mode SGWMME Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14 46

47. Procedure 1.UE measures nearby cells 2.UE sends measurement reports to network 3.Network decides on and controls handover 4.Handover is prepared by network 5.Handover executes Network controlled mobility SGWMME 1. 2. 4. 3. 5 5 5 5 Reason: To allow the network to tune handovers 1.Select proper target cell 2.Network has additional information for handover decision 3.Collect and analyze data for cell planning and troubleshooting 4.Penalize ping-ponging UEs 5.Penalize microcells for fast UEs 6.Cell breathing Courtesy: Zoltán Turányi 47

48. Used when the UE is not communicating UE location is tracked on a Tracking Area (TA) granularity – eNodeBs advertise their TA – UE periodically listens to advertisements (every few seconds) – UE sends Tracking Area Update (TAU) to MME, when TA changes – TAU also sent periodically (e.g., once every 2 hours) No eNodeB state is kept for UE When traffic arrives to the UE, the UE is paged Idle Mode 48

49. UE periodically checks if data is available for it – Wakes up, (re)selects cell, reads broadcast and the paging channel – Exact timing is pseudo-random per UE PAGING › If packet arrives to SGW… –…it buffers the packet –…and notifies MME. –MME sends a Paging Request to all eNodeBs in the TA of the UE –eNodeBs page the UE on its paging slot locally –UE responds with a Service Request… –…eNodeB state is built up… –…and UE is moved to connected state. SGW PDN GW MME UE Courtesy: Zoltán Turányi 49

50. Idle mode is a great power-saving feature – A system-wide feature – Also saves a lot of RAN resources Balancing of TA size is needed – Too large: many paging messages – Too small: many TAU messages from UE – Lot of optimizations: per-UE TA, overlapping TA, etc. Connected  Idle transitions are costly – Usually a timeout is used to go to idle Not a good fit for chatty packet traffic Easy to attack: an IP address range scan wakes up everyone – Key application design goal: reduce chattyness The Phone OS also has responsibility – However, can be very effective when combined with DRX Idle mode issues Cellular Networks and Mobile Computing (COMS 6998-10) 50

51. LTE RRC State Machine UE runs radio resource control (RRC) state machine Two states: IDLE, CONNECTED Discontinuous reception (DRX): monitor one subframe per DRX cylce; receiver sleeps in other subframes Courtesy:Morley Mao 51 3/7/14

52. UMTS RRC State Machine State promotions have promotion delay State demotions incur tail times Tail Time Delay: 1.5s Delay: 2s ChannelRadio Power IDLENot allocated Almost zero CELL_FACHShared, Low Speed Low CELL_DCHDedicated, High Speed High Courtesy: Feng Qian 52 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

53. IDLE: procedures based on reception rather than transmission – Reception of System Information messages – Reception of paging messages with a DRX cycle (may trigger RRC connection establishment) – Location and routing area updates (requires RRC connection establishment) CONNECTED: need to continuously receive, and sent whenever there is data Why Power Consumptions of RRC States so different? 53 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

54. Security 54 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

55. Subscriber Identity Module – Usually embedded in a physical SIM card Initially specified in 1990 for GSM (freeze date of TS 11.11) Carries subscriber credentials – IMSI: International Mobile Subscriber Identity – 14-15 digits MCC: Mobile Country Code – 3 digits MNC: Mobile Network Code – 2 or 3 digits Rest of the digits identify the subscriber – Keying material (essentially symmetric keys) In the network HSS stores subscriber data – Including keying and phone number (MSISDN) Enables roaming and phone replacement – Key features in GSM The SIM card MSISDN – Mobile Subscriber ISDN Number 55

56. KEY hierarchy AuC – Authentication Centre AKA – Authentication and Key Agreement CK: Encryption, IK: integrity Protection ASME: Access Security Management Entity NH – Next Hop SGW PDN GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS UE AuC AKA procedure USIM Courtesy: Zoltán Turányi 56

57. Authentication at initial attach 57

58. MME pre-calculates NH keys – From K ASME and NCC – NCC: NH Chaining Counter 3: Source eNodeB sends {NH, NCC} to target eNodeB Target eNB uses NH for K eNB UE also calculates new K eNB 12: MME sends next {NH, NCC} to target eNB handover

59. QoS architecture 59 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14 59

60. A bearer is a L2 packet transmission channel – …to a specific external Packet Data Network, – …using a specific IP address/prefix, – …carrying a specific set of IP flows (maybe all) – …providing a specific QoS. In 2G/3G also known as “PDP Context” Bearer setup is explicitly signaled – In LTE one bearer is always set up at attachment Bearers SGW PDN-GW S5 eNodeB S1-CP MME S1-U S11 SGi HSS UE See more in: 23.107 QoS concept and architecture Courtesy: Zoltán Turányi 60 Cellular Networks and Mobile Computing (COMS 6998-10)

61. Service Data Flow Bearers default bearer Service Data Flow dedicated bearer Service Data Flow PDN connection APN traffic Terminal traffic IP microflows A set of IP microflows A set of IP microflows with the same QoS Traffic with the same IP address or IPv6 prefix Traffic to the same external network All traffic of a UE Dedicated bearer: bearer with special QoS Default bearer: rest of traffic with default QoS SGW PDN GW eNodeB MME SGi UE PDN GW SGi PDN 1PDN 2 APN1 PDN – Packet Data Network APN – Access Point Name APN2 External networks Two default bearers to different APNs Courtesy: Zoltán Turányi 61

62. Terminal apps do not use QoS – Original IP socket API has minimal QoS features No widespread QoS mechanism in fixed networks Usually IP app developers do not care about network QoS – A number of QoS API failures Conceptual difficulties – QoS must be authorized and charged QoS can only be effectively decided in the face of its price – Complex QoS descriptors Determining QoS parameters is challenging – E.g., 10 -3 or 10 -4 bit error rate? – Yet not flexible enough to cater for e.g., VBR video Why then no QoS today? (Apart from voice) 62

63. QCI: QoS Class Indicator – Scalar value encompassing all packet treatment aspects – 9 mandatory, operators can define new MBR: Max bitrate GBR: Guaranteed bitrate – If nonzero, admission control is performed ARP: Allocation and Retention Priority – priority (scalar): Governs priority at establishment and handover – pre-emption capability (flag): can this bearer pre-empt another? – pre-emption vulnerability (flag): can another bearer pre-empt this one? AMBR: Aggregated Maximum bitrate – Both a per-terminal and per-APN value #1: Simple parameters Source: 23.401, 23.203 GPRS Enhancements for E-UTRAN Policy and Charging Control Architecture 63

64. Allow a network application request QoS – Terminal app can remain QoS un-aware – Network can fully control QoS provided & payment charged First specified in Release 7 for 3G – Not all terminals support it Mandatory mode in LTE #2: Network initiated bearers App LTE App LTE + EPC UENetwork 1. Session setup 2. Request QoS 3. Bearer setup No QoS API Courtesy: Zoltán Turányi 64

65. Policy and Charging SGW PDN GW S5 eNodeB S1-MME MME S1-U S11 SGi PCRF Gx Rx UE Flow descriptor (5-tuple) QoS descriptor Charging rules Gating (on/off) Flow descriptor (5-tuple) Bandwidth Application (voice/video/etc.) App Policy and Charging Rules Function – Decides on QoS and Charging – Controls gating – Service Policy Based on Request Subscription data – Makes no resource decisions Courtesy: Zoltán Turányi 65

66. What Is Next? Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14 66

67. LTE Evolution LTE-A – meeting and exceeding IMT-Advanced requirements – Carrier aggregation – Enhanced multi-antenna support – Relaying – Enhancements for heterogeneous deployments LTE LTE-A LTE-B LTE-C Rel-8 Rel-9 Rel-10 Rel-11 Rel-12 Rel-13 Rel-14 67 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

68. LTE Evolution LTE-B – Work starting fall 2012 Topics (speculative) – Device-to-device communication – Enhancements for machine-to-machine communication – Green networking: reduce energy use – And more… LTE LTE-A LTE-B LTE-C Rel-8 Rel-9 Rel-10 Rel-11 Rel-12 Rel-13 Rel-14 68 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

69. Outline Goal of this lecture: understand the basics of current networks and future directions Current Cellular Networks What Is Next? A Clean-Slate Design: Software-Defined Cellular Networks – Radio Access Networks – Core Networks – Wide Access Networks Conclusion and Future Work 69 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

70. A Clean-Slate Design: Software-Defined Radio Access Networks 70 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

71. Carrier’s Dilemma 71 Exponential Traffic Growth Limited Capacity Gain Poor wireless connectivity if left unaddressed

72. LTE Radio Access Networks accesscore Packet Data Network Gateway Serving Gateway Internet Serving Gateway Base Station (BS) User Equipment (UE) 72 Goal: high capacity wide-area wireless network – Dense deployment of small cells

73. Dense and Chaotic Deployments Dense: high SNR per user leads to higher capacity o Small cells, femto cells, repeaters, etc 73

74. Problems Current LTE distributed control plane is ill-suited o Hard to manage inter-cell interference o Hard to optimize for variable load of cells Dense deployment is costly o Need to share cost among operators o Maintain direct control of radio resources o Lacking in current 3gpp RAN sharing standards 74

75. SoftRAN: Big Base Station Abstraction 75 time frequency time frequency time frequency radio element time controller Radio Element 1 Radio Element 2Radio Element 3 Big Base Station

76. Radio Resource Allocation 76 frequency radio element time Flows3D Resource Grid

77. SoftRAN: SDN Approach to RAN BS1 BS2 BS3 BS4 BS5 PHY & MAC Control Algo Coordination : X2 Interface 77 PHY & MAC Control Algo PHY & MAC Control Algo PHY & MAC Control Algo PHY & MAC Control Algo

78. SoftRAN: SDN Approach to RAN RE1 RE2 RE3 RE4 RE5 Network OS Control AlgoOperator Inputs PHY & MAC 78 RadioVisor PHY & MAC Radio Element (RE)

79. SoftRAN Architecture Summary 79 RADIO ELEMENTS CONTROLLER Radio Element API Controller API Interference Map Flow Records Bytes Rate Queue Size Network Operator Inputs QoS Constraints RAN Information Base Radio Resource Management Algorithm POWER FLOW Time Frequency Radio Element 3D Resource Grid Periodic Updates

80. SoftRAN Architecture: Updates Radio element -> controller (updates) – Flow information (downlink and uplink) – Channel states (observed by clients) Network operator -> controller (inputs) – QoS requirements – Flow preferences 80

81. SoftRAN Architecture: Controller Design RAN information base (RIB) – Update and maintain global network view Interference map Flow records Radio resource management – Given global network view: maximize global utility – Determine RRM at each radio element 81

82. SoftRAN Architecture: Radio Element API Controller -> radio element – Handovers to be performed – RF configuration per resource block Power allocation and flow allocation – Relevant information about neighboring radio elements Transmit Power being used 82

83. Refactoring Control Plane 83 Controller responsibilities: -Decisions influencing global network state Load balancing Interference management Radio element responsibilities: -Decisions based on frequently varying local network state Flow allocation based on channel states

84. SoftRAN Advantages 84 Logically centralized control plane: – Global view on interference and load Easier coordination of radio resource management Efficient use of wireless resources – Plug-and-play control algorithms Simplified network management – Smoother handovers Better user-experience

85. SoftRAN: Evolving the RAN Switching off radio elements based on load – Energy savings Dynamically splitting the network into Big-BSs – Handover radio elements between Big-BSs 85

86. Implementation: Modifications SoftRAN is incrementally deployable with current infrastructure – No modification needed on client-side – API definitions at base station Femto API : Standardized interface between scheduler and L1 (http://www.smallcellforum.org/resources- technical-papers)http://www.smallcellforum.org/resources- technical-papers Minimal modifications to FemtoAPI required 86

87. RadioVisor Design Slice manager o Slice configuration, creation, modification, deletion and multi-slice operations Traffic to slice mapping at RadioVisor and radio elements 3D resource grid allocation and isolation o Considers traffic demand, interference graph and policy 87 RadioVisor Slice Manager 3D Resource Grid Allocation & Isolation Traffic to Slice Mapping

88. Slice Manager Slice definition o Predicates on operator, device, subscriber, app attributes o A slice can be all M2M traffic of operator 1 Slice configuration at data plane and control plane o PHY and scheduler: narrow band PHY for M2M slice o Interference management algorithm Slice algebra to support flexible slice operations o Slice merge, split, (un)nest, duplicate 88

89. Resource Grid Allocation and Isolation Slices present resource demands every time window Max min fair allocation Example o Red slice entitles 2/3 and demands 2/3 RE1 only o Blue slice entitles 1/3 and demand 1/3 RE2 and 1 RE3 Radio Element 1 Radio Element 2 Radio Element 3 Interference Edge Time Radio Element Frequency 89

90. Conclusion Dense deployment calls for central control of radio resources Deployment costs motivate RAN Sharing We present the design of RadioVisor o Enables direct control of per slice radio resources o Configures per slice PHY and MAC, and interference management algorithm o Supports flexible slice definitions and operations

91. A Clean-Slate Design: Software-Defined Cellular Core Networks 91 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

92. Cellular Core Network Architecture accesscore Packet Data Network Gateway Serving Gateway Internet Serving Gateway Base Station (BS) User Equipment (UE) 92

93. 93 Interne t Controller Simple hardware SoftCell Overview + SoftCell software

94. SoftCell Design Goal Fine-grained service policy for diverse app needs  Video transcoder, content filtering, firewall  M2M services: fleet tracking, low latency medical device updates 94 with diverse needs!

95. Characteristics of Cellular Core Networks 1. “North south” traffic pattern 2. Asymmetric edge 3. Traffic initiated from low-bandwidth access edge 95 Access Edge Internet Gateway Edge ~1K Users ~10K flows ~1 – 10 Gbps ~1 million Users ~10 million flows ~400 Gbps – 2 Tbps

96. Challenge: Scalability Packet classification: decide which service policy to be applied to a flow  How to classify millions of flows per second? Traffic steering: generate switch rules to implement policy paths, e.g. traversing a sequence of middleboxes  How to implement million of paths? Limited switch flow tables: ~1K – 4K TCAM, ~16K – 64K L2/Ethernet Network dynamics: setup policy paths for new users and new flow?  How to hand million of control plane events per second? 96

97. SoftCell: Design-in-the-Large 1. Scalable system design  Classifying flows at access edge  Offloading controller tasks to switch local agent 2. Intelligent algorithms  Enforcing policy consistency under mobility  Multi-dimension aggregation to reduce switch rule entries ~1K Users ~10K flows ~1 – 10 Gbps Gateway Edge ~1 million Users ~10 million flows ~up to 2 Tbps Access Edge Controller LA 97

98. Multi-Dimensional Aggregation Use multi-dimensional tags rather than flat tags Exploit locality in network topology and traffic pattern Selectively match on one or multiple dimensions  Supported by the multiple tables in today’s switch chipset Policy TagBS IDUser ID 98 Aggregate flows going to the same Users. Aggregate flows going to the same (group of) base stations Aggregate flows that share a common policy (even across Users and BSs)

99. Conclusion and Future Work SoftCell uses commodity switches and middelboxes to build flexible and cost-effective cellular core networks SoftCell cleanly separates fine-grained service policies from traffic management policies SoftCell achieves scalability with 99 Data Plane Control Plane Asymmetric Edge Design Multi-dimensional Aggregation Hierarchical Controller Design Deploy SoftCell in real test bed Exploit multi-stage tables in modern switches – Reduce m×n rules to m+n rules

100. A Clean-Slate Design: Software-Defined WAN 100 Cellular Networks and Mobile Computing (COMS 6998-10) 3/7/14

101. Current Mobile WANs Organized into rigid and very large regions Minimal interactions among regions Centralized policy enforcement at PGWs Two Regions 101

102. Mobile WANs Problems Suboptimal routing in large carriers –Lack of sufficiently close PGW is a major cause of path inflation Lack of support for seamless inter-region mobility –Users crossing regions experience service interruption Scalability and reliability –The sheer amount of traffic and centralized policy enforcement Ill-suited to adapt to the rise of new applications –E.g., machine-to-machine –All users’ outgoing traffic traverses a PGW to the Internet, even for reaching a user served by a close base station in a neighbor region 102

103. SoftMoW Motivation Question: How to make the packet core scalable, simple, and flexible for tens of thousands of base stations and millions of mobile users? Mobile networks should have fully connected core topology, small logical regions, and more egress points Operators should leverage SDN to manage the whole network with a logically-centralized controller: –Directs traffic through efficient network paths that might cross region boundaries –Handles high amount of intra-region signaling load from mobile users –Supports seamless inter-region mobility and optimizes its performance –Performs network-wide application-based such as region optimization 103

104. SoftMoW Solution Hierarchically builds up a network-wide control plane –Lies in the family of recursive SDN designs (e.g. XBAR, ONS’13) In each level, abstracts both control and data planes and exposes a set of “dynamically-defined” logical components to the control plane of the level above. –Virtual Base stations (VBS), Gigantic Switches (GS), and Virtual Middleboxes (VMB) 104 Core Net GS Latency Matrix Radio Net VBS Union of Coverage Policy VMB Sum of capacities

105. New Dynamic Feature: In each level, the control logic can modify its logical components for optimization purposes –E.g., merge/spilt and move operations 105 SoftMoW Solution Move and Split Merge/Split

106. First Level-SoftMoW Architecture Replace inflexible and expensive hardware devices (i.e., PGW, SGW) with SDN switches Perform distributed policy enforcement using middle-box instances Partition the network into independent and dynamic logical regions A child controller manages the data plane of each regions Bootstrapping phase: based on location and processing capabilities of child controllers Bootstrapping phase: based on location and processing capabilities of child controllers 106

107. Second Level-SoftMoW Architecture A parent runs a global link discovery protocol –Inter-region links are not detected by BDDP and LLDP A parent participates in the inter-domain routing protocol A parent builds virtual middlebox chains and egress- point policies, and dictates to GSs 107

108. Hierarchical Traffic Engineering Latency (P1,E2)=300 Latency (P1,E4)=100 Web Voice GS Rules 108 A parent pushes a global label into each traffic group Child controllers perform label swapping o Ingress point: pop the global label and push some local labels for intra-region paths o Egress point: pop the local labels and push back the global label Push W Pop W Push W Push W2 Push W1 Pop W2 Pop W Pop W1

109. Time-of-day Handover Optimization Handover graph 109 Q: How can an operator reduce inter-region handovers in peak hours? Abstraction update GS Rule: Move Border VBS 1 coordination

110. Conclusion SoftMoW: Brings both simplicity and scalability to the control plane of very large cellular networks – decouples control and data planes at multiple levels ( focused only on two levels here) Makes the deployment and design of network- wide applications feasible – E.g., seamless inter-region mobility, time-of-day handover optimization, region optimization, and traffic engineering 110

111. Summary Mobile computing depends on cellular networks Cellular network performance still far from meeting demands of mobile computing Cellular network architecture is evolving to meet demands of mobile computing – SDN and NFV AT&T’s domain 2.0 3/7/14Cellular Networks and Mobile Computing (COMS 6998-10) 111