4G Network Fundamentals by Institut Mines-Télécom

What are the goals of the 4G Network Fundamentals course?
The goals of the 4G Network Fundamentals course include:

  • Describing 4G networks' functioning and architecture.
  • Explaining how telecommunications operators provide mobile users with a permanent IP address in a secure manner.
  • Analyzing the internal exchanges and protocols used in a 4G network: attachment, location updating, and handover.
  • Identifying the transport and control functions in a 4G network.
  • Diagnosing a network service problem.

How is the 4G Network Fundamentals course structured week-by-week?
The 4G Network Fundamentals course is structured week-by-week like this:

  • Week 2 - Security procedures and the initial attachment of a UE to the network.
  • Week 3 - The radio interface.
  • Week 4 - Tunnels between PGW, SGW, and eNodeB, and signaling messages between UE, eNodeB, and MME.
  • Week 5 - Managing sporadic data flows.
  • Week 6 - Mobility.

Questions based on quizzes

What is a cellular network made of?
A cellular network is made of a set of base stations deployed across a large territory and connected to a fixed network.

Why are cells small in a densely populated zone?
Cells are small in a densely populated zone to provide a high capacity in Mbit/s per km2
and to minimize transmit powers.

Why is a territory divided into cells?
A territory is divided into cells to increase the capacity of the network and make sure a terminal is always within range of an intersection.

What is the beacon channel and what is used for?
The beacon channel is transmitted by the base station and used by a terminal to get an indication of the level of coverage.

What does it mean when a terminal doesn't detect any beacon channel?
If a terminal doesn't detect any beacon channel, it means that there's no cellular network in the area.

What does SGW stand for?
SGW stands for Service GateWay.

What is an SGW?
An SGW is a gateway that serves a geographical area and that forwards data packets sent to or from terminals.

What a PGW?
A PGW is a gateway that allows the 4G network and the Internet to interconnect with each other.

What do all data packets sent to and from a terminal always go through in a 4G network?
In a 4G network, all data packets sent to and from a terminal always go through an SGW and a PGW.

What does HSS stand for in a 4G context?
In a 4G context, HSS stands for Home Subscriber Server.

Where are subscriber profiles permanently stored?
Subscriber profiles are permanently stored in the HSS.

Where are subscriber profiles transferred to when a terminal connects to a 4G network?
When a terminal connects to a 4G network, subscriber profiles are transferred to the MME.

What does the MME control and on what scale?
The MME controls a set of base stations on a regional or national scale.

Does an HSS exchange messages with a PGW in the EPC standard architecture and why?
No, an HSS doesn't exchange messages with a PGW in the EPC standard architecture because there is no interface defined between them.

Can an MME be connected to multiple SGWs?
Yes, an MME can be connected to multiple SGWs.

In 4G networks, what does the USIM card contain?
In 4G networks, the USIM card contains the International Mobile Subscriber Identity (IMSI).

The smaller a cell is in a mobile network ...
The smaller a cell is in a mobile network, the greater the capacity in Mbit/s/km2.

What does the coverage of a base station depend on?
The coverage of a base station depends on the environment.

What is used by terminals to deduce the coverage of a base station?
The coverage of a base station is deduced by terminals using the beacon channel sent by the base station.

What type of network is the 4G core network?
The 4G core network is an IP network.

What controls the access rights of a 4G subscriber's terminal from cell to cell?
The MME controls the access rights of a terminal from cell to cell using a copy of the subscriber's profile.

What components of the 4G network do the packets of a website travel through in order?
The packets of a website travel through these 4G network components in order:

  • eNodeB.
  • SGW.
  • PGW.

Are two base stations exchanging messages on the X2 interface necessarily connected directly to each other?
No, base stations exchanging messages on the X2 interface aren't necessarily directly connected.

When someone turns on their 4G terminal and connects to a 4G network, where is their subscriber profile retrieved?
When someone turns on their 4G terminal and connects to a 4G network, their subscriber profile is retrieved from the HSS and copied to the MME.

What does the HSS contain a list of?
The HSS contains a list of the network subscribers.

Why is the HSS queried by the MME?
The HSS is queried by the MME so the MME can have the subscriber profiles of the subscribers that it manages in its zone.

Visible elements of a mobile network and sub-networks

What is a terminal?
Terminal is another term for User Equipment (UE).

What must a terminal have to work on the network?
For a terminal to work on the network, it must have a SIM card.

What does SIM stand for?
SIM stands for Subscriber Identity Module.

What two things does a SIM card contain?
A SIM card contains the subscriber identity unique throughout the world and the subscription data.

Who provides SIM cards for terminals?
The operator provides SIM cards for terminals.

What is the SIM card also called in 3G / 4G networks?
In 3G / 4G networks, the SIM card is also called a Universal Subscriber Identity Module (USIM).

What do you sometimes see when you look at the tops of towers or buildings?
When you look at the tops of towers or buildings, you will sometimes see antennas.

What are antennas?
Antennas are radiating devices which transform high frequency alternating current into electromagnetic waves, or vice versa.

What building will you find close by to a tower or building with mobile network antennas?
The building you will find close by to a tower or building with 4G antennas is a technical cabinet.

What is inside technical cabinets connected to mobile network antennas?
Inside technical cabinets connected to mobile network antennas, there are radio transceivers which enable radio transmission from terminals to the network.

What is the technical term for the radio transceivers which enable radio transmission from terminals to the network?
The technical term for the radio transceivers which enable radio transmission from terminals to the network is base station.

What is a base station called in 4G networks?
In 4G networks, a base station is called an eNodeB.

What does the "e" in eNodeB mean?
The "e" in eNodeB means evolved to indicate that there's been an evolution compared with the previous generation.

What does the "Node" in eNodeB mean?
The "Node" in eNodeB indicates it belongs to a network.

What does the "B" in eNodeB mean?
The "B" in eNodeB means it is a base station.

What is a base station?
A base station is a set of transceivers in one place.

What is each base station equipped with?
Each base station is equipped with antennas.

How do terminals around the base station communicate with it?
Terminals around the base station communicate with it by radio transmission.

What are the two sub-networks of the 4G network?
The sub-networks of the mobile network are the access network and the core network.

What makes up the access network in 4G?
In 4G, the access network is made up of base stations / eNodeBs.

What makes up the core network in 4G?
In 4G, the core network is made up of an IP network deployed by the operator.

What is the access network also called in 4G?
In 4G, the access network is also called the Evolved Universal Terrestrial Radio Access Network (eUTRAN).

What is the core network also called in 4G?
In 4G, the core network is also called the Evolved Packet Core (EPC).

What are each of the base stations connected to in 4G?
In 4G, each of the base stations are connected to the core network.

What is the core network interconnected with and through what?
The core network is interconnected with the IP networks of other operators through one or several routers.

What can the base stations do since they're all connected to the Evolved Packet Core?
Since all of the base stations are connected to the Evolved Packet Core, they can communicate with each other.

Distribution of base stations

What is the transmission power of a 4G terminal typically?
The transmission power of a 4G terminal is typically 0.2 watts or 200 milliwatts.

Does the range that a terminal can transmit depend on location?
Yes, the range that a terminal can transmit depends on location. The range in the city is not the same as in the country.

What is the maximum range a terminal can transmit with 0.2 watts of power, generally?
Generally, the maximum range a terminal can transmit with 0.2 watts is several kilometers.

What is the operator's goal for deploying base stations?
The operator's goal for deploying base stations is so that a terminal is always less than a few kilometers away from one.

What signal does each base station regularly transmit?
Each base station regularly transmits a signal called the beacon channel.

What does the beacon channel signal to a terminal?
The beacon channel signals to a terminal that the base station exists and gives the characteristics of the network such as the identity of the operator.

Why is it important that the base station transmits the identity of the operator in the beacon channel?
It is important that the base station transmits the identity of the operator in the beacon channel so terminals communicate with their own operator and not a competitor.

How can a terminal determine if they're receiving a base station well?
A terminal can determine if they're receiving a base station well by measuring the strength of the beacon channel signal.

How is a territory divided up?
A territory is divided up into cells.

What is a cell?
A cell is an area served by a base station.

Should the division of cells and passing between them be perceptible to the user?
No, the division of cells and passing between them should be imperceptible to the user.

What user density does an urban zone have?
An urban zone has high user density.

What is the goal for deploying base stations in high user density areas?
The goal for deploying base stations in high user density areas is to provide sufficient capacity in terms of Mbit/s per km2.

Does the capacity of a cell in Mbits/s depend on the size of the cell?
No, the capacity of a cell in Mbit/s doesn't depend on the size of the cell.

What user density does a rural zone have?
A rural zone has low user density.

What is the goal for deploying base stations in low user density areas?
The goal for deploying base stations in low user density areas is to provide sufficient coverage so that a terminal is always within range of a base station.

Core network (EPC) and routing of data

What is the difficulty with sending packets from the Internet to mobile devices?
The difficulty with sending packets from the Internet to mobile devices is that the Internet itself cannot manage mobility. Each packet is intended for an address, and addresses are generally linked to a physical location.

How does a 4G network handle packets destined to mobile subscribers from outside the network?
A 4G network handles packets destined to mobile subscribers from outside the network by routing all packets through a single network gateway.

What is name of the network gateway that all packets are routed through, either to a mobile subscriber inside or to a server outside of the network?
The network gateway that all packets are routed through, either to a mobile subscriber inside or to a server outside of the network, is called the Packet Gateway (PGW).

What are the reasons for having multiple PGWs?
The reasons for having multiple PGWs include:

  • Having enough capacity to manage all of the packets.
  • Ensuring redundancy and reliability.

How are packets routed to a terminal from the PGW?
Packets are routed to a terminal from the PGW through the mobile operator's own IP network to the base station communicating with the terminal.

What component of an operator's IP network routes packets from the PGW to the base station?
The component of an operator's IP network which routes packets from the PGW to the base station is the Serving Gateway (SGW).

How large of an area does a Serving Gateway typically serve?
A Serving Gateway typically serves a geographic region.

If a terminal moves from one base station to another, how does the Serving Gateway know to route packets to the new base station?
If a terminal moves from one base station to another, the Serving Gateway knows to route packets to the new base station by regularly exchanging signaling messages.

Does the same process happen in reverse when a terminal is sending out packets to a server outside of the mobile network?
Yes, the same process happens in reverse when a terminal is sending out packets to a server outside of the mobile network.

How does the number of base stations, Service Gateways, and PGWs compare?
The number of base stations, Service Gateways, and PGWs compare as so:

  • There are thousands of base stations.
  • There are tens of Service Gateways which connect all base stations.
  • There are a few PGWs which connect all Service Gateways.

Control procedures

What is the database used for access control in a 4G network?
In a 4G network, the database used for access control is the Home Subscriber Server (HSS).

What is the only type of information that goes to and from the HSS?
The only type of information that goes to and from the HSS is signaling.

What is signaling?
Signaling is the set of messages exchanged to manage network access, track terminals when moving, and other functions.

What makes up the messages in signaling?
Control information useful to the operator is what makes up the messages in signaling.

What is the risk of using the HSS for every control request?
The risk of using the HSS for every control request is saturation from managing too many requests.

What is the database used for access control of a particular region in a 4G network?
In a 4G network, the database used for access control of a particular region is the Mobility Management Entity (MME).

What is the objective of the MME?
The objective of the MME is to control mobility of various terminals.

What does the MME store?
The MME stores profiles and security data.

What does the MME manage?
The MME manages the control of mechanisms related to network access, security, and mobility for terminals present in its zone.

What does the MME maintain an awareness of?
The MME maintains an awareness of the locations of terminals in its area.

How is the MME involved in a handover or handoff?
The MME is involved in a handover or handoff by possibly keeping a session active when a terminal moves and changes cells.

What is the name of the process for a terminal establishing a connection with an eNodeB?
The name of the process for a terminal establishing a connection with an eNodeB is attachment.

What does an eNodeB first do when a terminal attaches to it?
When a terminal attaches to an eNodeB, the eNodeB first sends a request to the MME to see if the subscriber is in the database.

What does the MME do if the subscriber is not found in the database?
If the subscriber is not found in the database, it sends a request to the HSS to obtain the subscriber's information and copies it for future use.

What are the two things the MME selects during the attachment process?
The two things the MME selects during the attachment process are the SGW and PGW which the terminal's Internet traffic will route through.

The MME is equivalent to ... memory for programmers.
The MME is equivalent to cache memory for programmers.

Architecture

What does all of the network equipment have from the IP family?
All of the network equipment has a protocol stack from the IP family.

What makes up the operator's IP network?
The operator's IP network is made up of a set of interconnected routers.

Can equipment communicate even if they aren't directly linked together?
Yes, equipment can communicate even if they aren't directly linked together.

How can equipment communicate even if they aren't directly linked together?
...

What is the database that registers terminals which have been stolen?
The database that registers terminals which have been stole is the Equipment Identity Register (EIR).

What does the Policy and Charging Rules Function (PCRF) manage in a 4G network?
In a 4G network, the PCRF manages quality of service.

Why are logical interfaces between the different nodes of the network defined?
Logical interfaces between the different nodes of the network are defined because different types of data are going to be exchanged between any two nodes, requiring the use of specialized communication protocols tailored to the type of data being exchanged.

What are the different logical interfaces used in a 4G network?
The different logical interfaces used in a 4G network are:

Interface Name Between Components Types of Data Being Exchanged
SGi PGW and external IP network
Gx PGW and PCRF Signaling messages
S5 SGW and PGW User data and a few signaling messages
S8 SGW and PGW of another network User data and a few signaling messages
S11 SGW and MME Signaling messages
S13 MME and EIR Signaling messages
S6a MME and HSS Signaling messages
S1-MME eNodeB and MME Signaling messages
S1-U eNodeB and SGW User data
X2 eNodeB and another eNodeB User data and signaling messages
Uu / Radio Terminal (UE) and eNodeB User data and signaling messages

2G, 3G, and 4G

What is the overview of the various generations of mobile networks in Europe?
The overview of the various generations of mobile networks in Europe is:

Generation Principle services Name of technology in Europe Type of access on radio interface Lifetime
1 Telephony R2000, NMT Analog FDMA 1980-1995
2 Telephony, SMS GSM TDMA 1995-
2.5 Telephony, SMS, IP access at 100 Kbit/s GPRS EDGE extension + Packet access new modulation 2000-
3 Telephony, SMS, IP access at 1 Mbit/s UMTS CDMA 2002-
3.9 Telephony, SMS, IP access at 10 Mbit/s Extension HSDPA CDMA + packet access new modulation 2008-
4 IP access at 100 Mbit/s with low latency LTE, LTE - advanced OFDMA 2010-

What was the innovation of GSM over the first generation?
The innovation of GSM over the first generation was that the network used digital transmission instead of analog.

What was the original meaning of GSM?
The original meaning of GSM was Groupe Spécial Mobile when it was in French.

What does GSM mean now?
GSM now means Global System for Mobile Communications.

What is GPRS?
GPRS is the Global Packet Radio Service, which was additional equipment and procedures added to GSM to allow mobile access to the Internet.

What is the principle of GPRS?
The principle of GPRS is to use packet access and new modulations on the radio channel to allow packet transmission.

What is EDGE?
EDGE stands for Enhanced Data Rate for the GSM Evolution and allowed higher throughput on GPRS.

What is UMTS?
UMTS is the Universal Mobile Telecommunication System.

...

What does an operator provide a new subscriber to their network?
An operator provides a new subscriber to their network a SIM card in some form.

What globally unique identifier is given to a SIM card?
The globally unique identifier given to a SIM card is the International Mobile Subscriber Identity (IMSI).

From the moment the terminal has an ... , it can work.
From the moment the terminal has an IP address, it can work.

What is the sequence of events during the attachment process?
The sequence of events during the attachment process is:

HSSPGWSGWMMEeNodeBTerminalHSSPGWSGWMMEeNodeBTerminalAttach Request (IMSI)IMSI, MME identifiersSubscriber profile (APN, connection parameters)APNAPNIP address, ...IP address, ...IP address

What are the potential security vulnerabilities and the security mechanisms which stop them?
The potential security vulnerabilities and the security mechanisms which stop them are:

  • Fraudulent use of the network - Authentication.
  • Listening to exchanges - Encryption.
  • Modifying messages - Integrity.
  • Tracking - Temporary identity.

What does a SIM card and the HSS share?
A SIM card and the HSS share a 128-bit key.