CDMA2000 Mobile Wireless Network Architecture

CDMA2000 builds on the inherent advantages of CDMA technologies and introduces

other enhancements, such as Orthogonal Frequency Division Multiplexing (OFDM

and OFDMA), advanced control and signaling mechanisms, improved interference

management techniques, end-to-end Quality of Service (QoS), and new antenna

techniques such as Multiple Inputs Multiple Outputs (MIMO) and Space Division

Multiple Access (SDMA) to increase data throughput rates and quality of service,

while significantly improving network capacity and reducing delivery cost. WCDMA

and CDMA2000 have the same characteristics (roaming support, same data rates,

wide band, etc). The main difference between the WCDMA and CDMA2000 is that

the WCDMA uses only one wide band, while CDMA2000, apart from the wide band

uses several narrow bands (low data rate channels).

CDMA2000 network Architecture diagram

CDMA2000 is a hybrid 2.5G / 3G technology of mobile telecommunications that uses

code division multiple access to send digital radio, voice, data, and signaling data

between mobile phones and cell sites. CDMA2000 is standardized by the 3rd

Generation Partnership Project 2 (3GPP2).

Figure - CDMA2000 Network Architecture in detail

THE CDMA2000 NETWORK COMPRISES OF THREE MAJOR PARTS

• Mobile station (MS)

• The Core Network (CN)

• The radio access network (RAN)

THE MOBILE STATION (MS): This is the device which terminates the radio path on the

user side of the network and enables subscribers to access network services over

the Um interface. In CDMA2000, there is no need to replace the CDMA MS in order

to function in the network; but in order to receive the full services of the CDMA2000

the MS should be replaced.

THE RADIO ACCESS NETWORK (RAN): In a CDMA2000 access network, two Radio

Access Network technologies are supported; 1xRTT and EV-DO (Evolution-Data

Optimized or Evolution-Data only). CDMA2000 is considered a 2.5G (or 2.75G)

technology when the 1xRTT access network is used and a 3G technology when

the EV-DO access network is used.

• CDMA2000 1xRTT: The core CDMA2000 wireless air interface standard is

also known as 1x, 1xRTT, and IS-2000. The designation "1x", meaning "1

times Radio Transmission Technology", indicates the same RF bandwidth as

IS-95 (CDMA-One): a duplex pair of 1.25 MHz radio channels. 1xRTT almost

doubles the capacity of IS-95 by adding 64 more traffic channels to the

forward link, orthogonal to the original set of 64. Although capable of higher

data rates, most deployments are limited to a peak of 144 Kbit/s. IS-2000

also made changes to the data link layer for the greater use of data services,

including medium and link access control protocols and QoS (Quality of

Service).

• CDMA2000 EV-DO: CDMA2000 EV-DO is a broadband access radio

technology standardized by 3rd Generation Partnership Project 2 (3GPP2),

provides access to mobile devices with air interface speeds of up to 2.4 Mbit/s

with Rev. 0 and up to 3.1 Mbit/s with Rev. A. The industry is working newer

generations of EV-DO such as Rev. B and Rev. C, etc.

Characteristics of CDMA2000 Access Network

• The CDMA2000 access network may perform mobility management functions

for registering; authorizing, authenticating and paging IP based terminals,

independent of circuit based terminals.

• The access network may perform handoffs within an access network and

between access networks of the same technology and may support handoffs

between access networks of differing technologies.

The key components of the cdma2000 access network are:

• Base Transceiver System (BTS)

• Packet Control Function (PCF)

• Base Station Controller (BSC)

Base Station Controller (BSC): an entity that provides control and management

for one or more BTSs. Apart from routing the Time division multiplexing (TDM) traffic

to the circuit switched platform, the BSC routes the packet to and from the PDSN.

Packet Control Function (PCF): an entity that provides interface function

between the access network and the packet switched core network. It is located in

the radio access network and manages the relay of packets between the BS and the

PDSN. The PCF is generally part of the BSC.

• In order to provide the feel of “always connected”, if there are packets from the

Internet to a certain MS that currently doesn’t have radio resources allocated,

the packet is held on the PCF until the user is allocated a channel. The PDSN

does not hold the packets but the PCF. The PCF may be HW and/or SW.

• The CDMA2000 may introduce firewalls to protect the network and application

servers to support packet services.

• The PDSNs, AAA and the connection to the RAN (BSCs) are via a private IP

network for security and for providing different QoS levels.

Mobile IP (not an entity)- supports moving between two different PDSNs without

needing to reconnect. It is the PDSN’s responsibility to either update the IP of the

user when they move to another PDSN area (it is implying the packet sessions need

to turn down and restart), or to implement the Mobile IP mechanism for a

transparent move. In the Mobile IP mechanism the FA and HA are required. Simple IP

(not an entity) –does not support mobility between different PDSNs. The PDSN is the

owner of the User IP (DHCP). If in the middle of a page loading the MS moves

between two different PDSNs, the MS will have to reconnect

Base Transceiver System (BTS): an entity that provides transmission capabilities

across the Um reference point. The BTS consists of radio devices, antenna and

equipment and its responsibilities include:

a) Assigning the Fundamental channel (FCHs) - the number of physical resources

available.

b) The FCH forward power (the power already allocated and available).

c) The Walsh codes required and those available.

d) SDU function: The SDU function (Selection/Distribution Unit function) includes the

following functions:

• Traffic Handler: This function exchanges traffic bits with the associated

vocoder or CDMA RLP function, and is directly connected to the A5 interface.

• Signaling Layer 2: This function performs the layer 2 functionality of the air

interface signaling protocol and is responsible for the reliable delivery of layer

3 signaling messages between the base station and the mobile station.

• Multiplex Sub-layer: This function multiplexes and demultiplexes user traffic

and signaling traffic for the air interface.

• Power Control: This function administrates the forward and reverse link

power control in a CDMA system. This function and the channel element

provide the power control function for the CDMA operation. As part of this

function, it generates or utilizes relevant power control information that is

exchanged over the air interface or with the channel element.

• Frame Selection/Distribution: This function is responsible for selecting the

“best” incoming air interface reverse link frame from the channel elements

involved in the soft handoff. It also distributes forward air interface frames to

all channel elements involved in a call.

• Backhaul Frame Handler: This function demultiplexes the control

information and the air interface reverse frame from the frame received over

the backhaul network. It also multiplexes the control information and the air

interface frames in the forward direction.

THE CORE NETWORK (CN): This is further decomposed in two parts, one interfacing

to external networks such as the Public Switched Telephone Network (PSTN)

which is called the Circuit switched domain (that based on voice) and the other

interfacing to the IP based network such as Internet, which is called the Packet

switched domains (that is based on data).

Figure-CDMA2000 Packet Core Network (PCN) Architecture

A. The Circuit Switch Core Network(CS-CN)

In any mobile services network, the most important circuit switched core network

elements are the Mobile Switching Center / Visitor Location Register (MSC / VLR) and

the Home Location Register (HLR). All the other network elements, required for

other supplementary or value added services are called as Adjunct Network

elements (like SMSC, SCP, VMS, OTAF etc.)

The circuit-switching network interfaces with the radio/access network via the

mobile switching center (MSC), which provides the typical wire-line interface to the

PSTN.

The MSC-VLR and HLR (All the circuit switched Core networks) need software

upgrades in order to support the authentication and authorization of the packet

data network. Note that, it is still the CS-CN (Circuit Switched Core Network) which

authenticates and authorizes the wireless access of the user during packet session

initiation. The MSC-VLR and HLR are updated with the Packet data user profile

information. The information is then downloaded from the HLR to the VLR of the

associated network switch during the successful registration process.

T he HLR : It is responsible to keep track of the current location of a Mobile Station.

The HLR is a database used for storage and management of subscriptions. The HLR is

considered the most important database, as it stores permanent data about subscribers,

including a subscriber's service profile, location information, and activity status. When an

individual buys a subscription from one of the mobile services switching center (MSC) - The

MSC performs the telephony switching functions of the system. It controls calls to and from

other telephone and data systems. It also performs such functions as toll ticketing, network

interfacing, common channel signaling, and others.

MSC :

VLR: The VLR is always integrated with the MSC, and it is a database that contains temporary

information about subscribers that are needed by the MSC in order to service visiting

subscribers.. When a mobile station roams into a new MSC area, the VLR connected to that MSC

will request data about the mobile station from the HLR. Later, if the mobile station makes a

call, the VLR will have the information needed for call setup without having to interrogate the

HLR each time.

It’s the combined responsibility of the MS (Mobile Station) and the MSC that, they

should keep the HLR updated about the MS’s current location. This is done by virtue

of “Registration” process.

The Registration Process

Registration is the process of a mobile associating itself with a particular cell in a

particular network. There are nine types of registration.

1. Power on: when a mobile is turned on

2. Power off: just before a mobile is turned off

3. Timer-based: after a certain timer expires

4. Distance-based: if the mobile moves to a further cell

5. Zone-based: if a mobile moves in or out of a zone

6. Ordered: base station requests the registration

7. Parameter change: if the mobile’s parameters change

8. Implicit: base station infers the mobiles position

9. Traffic channel: for registration in active mode

Of these the first five are autonomous type of registration. They are called so,

because the base station informs the mobile station at power on, to register if any

of the events happen.

a. Mobile Station moves from MSC/VLR–2 to MSC/VLR–1. The Mobile Station

requests for “Location Update” to the network. The MSC/VLR-1 sends IS-41

message called Registration Notification (or REGNOT in short) to the HLR with

different parameters included in it. Most important parameter being the MIN.

MIN is used as the primary key by the HLR to find the subscriber’s record in

it’s database.

b. HLR compares the received MSCID / PC_SSN parameter against the value of

these parameters stored in it’s dynamic database. As the HLR finds that the

MS (identified by the MIN) was registered at MSC/VLR-2, earlier, it sends a

message called as Registration Cancellation (REGCANC) to the MSC/VLR-2.

c. The MSC/VLR-2 deletes the record of this MIN from it’s database and sends

the response to REGCANC to the HLR. The HLR stores the new MSCID /

PC_SSN parameter in it’s dynamic data.

d. On receipt of ‘regcanc’ from MSC/VLR-2, the HLR sends the ‘regnot’ response

to the MSC/VLR-1 with the subscriber’s profile included in it. The profile

includes the MDN of the subscriber, Call Origination / Termination capabilities,

SMS origination/termination capabilities, Data Services capabilities, other

supplementary service like Call Waiting, Call Conferencing, Call Forward etc.

For further details about Registration Process visit

Authentication center (AUC): A unit called the AUC provides authentication and

encryption parameters that verify the user's identity and ensure the confidentiality

of each call. The AUC protects network operators from different types of fraud found

in today's cellular world.

Authentication is the process by which information is exchanged between a mobile

station and base station for the purpose of confirming the identity of the mobile

station. A successful outcome of the authentication process occurs only when it can

be demonstrated that the mobile station and base station possess identical sets of

shared secret data. This is done so as to prevent what is called Phone Cloning.

The standards use the CAVE (Cellular Authentication Voice Privacy Encryption)

Algorithm and CMEA (Cellular Message Encryption Algorithm) for the maintaining

security.

Uses of the CAVE and CMEA Algorithm

i. CAVE is also used to generate a set of crypto-variables for the Cellular Message

Encryption Algorithm (CMEA) message encryption process.

ii.CAVE is used in the generation of 520 bits for the duplex voice privacy masks.

iii.CAVE is used in the generation of a subscriber's "shared secret data" from his

unique A-key. Also used in verifying the manual entry of the A-key.

iv.CMEA is used in encrypting certain type specific fields.

Encryption: In an effort to enhance the authentication process and to protect

sensitive information (example PIN’s sent as DTMF tones), certain fields which carry

these sensitive information in Traffic Channel messages are encrypted.

E quipment identity register (EIR): The EIR is a database that contains

information about the identity of mobile equipment that prevents calls from stolen,

unauthorized, or defective mobile stations.

Note: The AUC and EIR can implemented as stand-alone nodes or as a combined

AUC/EIR node

B. The Packet Switch core network (PS-CN)

This is a network architecture based on third-generation cdma2000 mobile/cellular

networks, being promoted by TIA as the packet-data standard.

Packet data calls allow users to exchange data between the MS and an IP data

network. For all calls supporting packet data services, a Packet Data Serving Node

(PDSN) exists that interfaces between the transmission of the data in the fixed

network and the transmission of the data over the air interface. The

PDSN interfaces to the BS through a Packet Control Function (PCF), which may or

may not be co-located with the BS.

CDMA2000 Packet data network Architecture

There are three packet data service states:

Active/Connected, Dormant, and Null/Inactive

• In the Active/Connected State, a physical traffic channel exists between the MS

and the BS, and either side may send data.

• In the Dormant State, no physical traffic channel exists between the MS and

the BS, but the PPP link between the MS and the PDSN is maintained.

• In the Null/Inactive State, there is no traffic channel between the MS and the

BS and no PPP link between the MS and the PDSN.

Figure 3-1: Packet data service transitions

The mobile may cross Packet Zone boundaries while in the Dormant State. This is

referred to as Dormant Handoff. The Dormant handoff procedures allow the A10

connections between the PCF and PDSN to be moved (or established) for the mobile

when it enters a new packet zone. The mobile may re-enter Active state (e.g., if the

user has data to send) at any time. This transition is referred to as Re-Activation

from Dormant, and is not related to Dormant Handoff (i.e., Re-Activation from

Dormant is not related to a mobility event). Packet data is typically transmitted over

the air on dedicated traffic channels. Mechanisms also exist for transmitting data

over the common channels. Short Data Burst (SDB) is a part of the 3G Packet Data

feature that enables small amounts of data to be transmitted over the common

channels. Common Channel Packet Data is a mode of 3G Packet Data where all data

is transmitted using Short Data Bursts. A1 and A8 connections are maintained

during the Active / Connected State and released during transition to Dormant or

Null/Inactive State. The A10 connection is maintained during the Active/Connected

and the Dormant State.

PCN is a collection of logical and physical entities that provide;

• IP-centric packet-data-based registration,

• roaming, and

• Forwarding services for mobile nodes.

NEW ENTITIES IN CDMA2000-1X COMPARED TO CDMA (IS-95)

PDSN:

• Establishes, maintains and terminates Point-to-Point protocol (PPP) session with

the MS.

• Establishes, maintains and terminates the logical link to the Radio network

across the radio-packet (R-P) interface.

• Initiates Authentication, Authorization and Accounting (AAA) for the MS to the

packet data network (Internet) via the AAA Server.

• Receives service parameters for the MS from the AAA.

• Routes packet data between the RAN and the Internet (like NAS in the Internet).

• Collects usage data that is related to the AAA Server.

• Supports both Simple and Mobile IP.

• For Mobile IP the FA (foreign agent) should be implemented on the PDSN (also a

HA (home agent) is needed).

• One BSC can interconnect to a few PDSNs for load balancing.

AAA : The AAA server, also called the RADIUS server, authenticates only the user

Internet access and not a user wireless access (same entity used in the Internet).

RADIUS – Remote Access Dial-In User Service communicates with the PDSN via IP.

Authentication associated with PPP and Mobile IP connection.

HA : One of the tasks of the HA is to track the location of the Mobile IP subscriber as

it moves from one packet zone to another. In tracking the Mobile, the HA ensures

that the packets are forwarded to the mobile itself.

An HA is a router on the Mobile node’s home network. It uses a tunneling

mechanism to forward Internet traffic so that the device’s IP address does not have

to be changed each time it connects from a different location. The HA works in

conjunction with the FA, which is the router on the visited network. The HA identifies

the IPv4 address of the PDSN that terminates the A10 connection.

FA : Works in conjunction with the HA in order to perform internet traffic forwarding

to a device connecting to the Internet from any location other than its home

network. The HA tunnels datagram packets intended for the mobile node to either

the IP address for the FA, or to an IP address acquired through DHCP. The FA de-

tunnels the packets and delivers them to the mobile node. In general, Mobile IPv6

(MIPv6) minimizes the use of FA.

NEW ENTITIES AND FEATURES FOR CDMA 1X-EV-DO

Access Network – This is the network equipment providing data connectivity

between a packet switched data network (typically the Internet) and the access

terminals. An access network is equivalent to a base station in CDMA2000 systems.

Access Terminal (AT ) : This is a device that provides data connectivity to a user.

An access terminal may be connected to a computing device such as a laptop or it

may be a self-contained data device such as a personal digital assistant. An access

terminal is equivalent to a mobile station in CDMA2000 systems.

Access Network (AN): This is the network equipment that provides data

connectivity between a packet switched data network (typically the Internet) and

the access terminals. An access network is equivalent to a base station in

GSM/CDMA2000-1xRTT.

AN AAA: An entity that performs terminal authentication and authorization

functions for the Access Network.

Connection: A connection is a particular state of the air-link in which the access

terminal is assigned a Forward Traffic Channel, a Reverse Traffic Channel and

associated Medium Access Control (MAC) Channels. During a single HRPD session

the access terminal and the access network can open and can close a connection

multiple times.

Hybrid MS/ AT : This device is capable of operating on both CDMA2000 and HRPD

access networks.

Service Stream: The HRPD stream is used when exchanging data between the

access terminal and the PDSN.

HRPD session : An HRPD (High Rate Packet Data (1xEV-DO)) session refers to a

shared state between the access terminal and the Access network. This shared

state stores the protocols and protocol configurations that were negotiated and are

used for communications between the access terminal and the access network.

Other than to open a session, an access terminal cannot communicate with an

access network without having an open session. Note, that it is possible that the

A10/A11 connection is not established even though the HRPD session is established.

PCF: The PCF enhancement for EV-DO logically contains the SC/MM function and is

capable of HRPD specific operation. The original PCF function and procedure may

also be optimized or enhanced using information obtained from these additional

functions.

Packet Data Session: This is an instance of the use of packet data service by a

mobile user. A packet data session begins when the user invokes a packet data

service. A packet data session ends when the user or the network terminates the

packet data service. During a particular packet data session, the user may change

locations but the same IP address is maintained.

SC/MM function: SC/MM (Session Control and Mobility Management) is logically

located in the PCF and includes the following functions:

• Storage of HRPD session related information: This function keeps HRPD session

related information (e.g., Keep Alive timer, MNID, mapping between MNID and UATI,

etc.) for dormant ATs.

• Assignment of UATI (Unicast AT identifier): This function assigns a new UATI to an

AT.

• Terminal Authentication: This function performs the terminal authentication

procedure. This function judges whether an AT (access terminal) should be

authenticated or not when the AT is accessing the HRPD RAN. The SC/MM performs

PPP procedures for terminal authentication.

• Mobility Management: This function manages the location of an AT. The location

information of the AT is obtained via distance-based registration. This function may

perform a paging procedure based on the information.

Terminal Authentication: A procedure in which the AT is authenticated by the AN-

AAA

Note

Multimedia Domain (MMD), a new all IP network defined by the 3GPP2, is the latest

architecture of the CDMA2000 core network, which is intended to provide

multimedia services based on the IP technologies.

For a UMTS based 3G mobile/cellular wireless network, the basic Core Network

architecture is based on GSM network with GPRS. All equipment has to be modified

for UMTS operation and services. The UTRAN provides the air interface access

method for User Equipment. Base Station is referred as Node-B and control

equipment for Node-B's is called Radio Network Controller (RNC).

Some of the circuit switched elements in the UMTS core network are Mobile services

Switching Centre (MSC), Visitor location register (VLR) and Gateway MSC. Packet

switched elements are Serving GPRS Support Node (SGSN) and Gateway GPRS

Support Node (GGSN). Some network elements, like EIR, HLR, VLR and AUC are

shared by both domains.

The architecture of the UMTS Core Network may change when new services and

features are introduced. Number Portability Database (NPDB) will be used to enable

user to change the network while keeping their old phone number. Gateway

Location Register (GLR) may be used to optimize the subscriber handling between

network boundaries. MSC, VLR and SGSN can merge to become a UMTS MSC.

CDMA2000 Network Interfaces and Protocol Stack

CDMA2000, also known as IMT-CDMA Multi-Carrier or IS-2000 is the main 2.5 and 3G

technology for CDMA based 2G networks (cdmaOne). The CDMA2000 technologies

and protocols are defined by the Third Generation Partnership Project 2 (3GPP2).

CDMA2000 provides enhanced services to cdmaOne subscribers, as well as forward

and backward capabilities in terminals.

Figure-CDMA2000 Interfaces and Protocol stacks

The main communication interfaces and protocols in the CDMA2000

network are listed below:

Reference Points A, Ater, Aquinter, and Aquater

• The A reference point is implemented by A1, A2, A5.

• The Ater reference point is implemented by A3 and A7.

• The Aquinter reference point is implemented by A8 and A9.

• The Aquater reference point is implemented by A10 and A11.

Interfaces Description – CDMA2000 –1xRTT

A1: The A1 interface carries signaling information between the Call Control and

Mobility Management functions of the MSC and the call control component of the BS

(BSC).

A2: The A2 interface carries 64/56 kbps PCM information or 64 kbps Unrestricted

Digital Information (UDI, for ISDN) between the Switch component of the MSC and

the Selection/Distribution Unit (SDU) function of the BS.

A3: The A3 interface carries coded user information (voice/data) and signaling

information between the source BS SDU function and the channel element

component (BTS) of the target BS. This is a logical description of the endpoints of

the A3 interface. The A3 interface is composed of two parts: signaling and user

traffic. The signaling information is carried across a separate logical channel from

the user traffic channel, and controls the allocation and use of channels for

transporting user traffic.

A5: The A5 interface carries a full duplex stream of bytes between the MSC and the

SDU function of the BSC.

A7: The A7 interface carries signaling information between a source BS and a target

BS.

A8: The A8 interface carries user traffic between the BS and the PCF.

A9: The A9 interface carries signaling information between the BS and the PCF.

A10: The A10 interface carries user traffic between the PCF and the PDSN.

A11: The A11 interface carries signaling information between the PCF and the

PDSN.

Interfaces Description – CDMA2000–1x–EV-DO

A8: The A8 interface carries user traffic between the Access Network (AN) and the

Packet Control Function (PCF).

A9: The A9 interface carries signaling information between the AN and the PCF.

A10: The A10 interface carries user traffic between the PCF and the PDSN.

A11: The A11 interface carries signaling information between the PCF and the

PDSN.

A12: The A12 interface carries signaling information related to terminal

authentication between the SC/MM function in the PCF and the AN AAA

(Authentication, Authorization and Accounting entity for 1x-EV-DO).

A13: The A13 interface carries signaling information between the SC/MM function in

the source PCF and the SC/MM function in the target PCF.

A14: The A14 interface carries signaling information between the SC/MM function in

the PCF and the AN.

A15: The A15 interface carries signaling information between ANs when inter-

ANpaging is used. Ax The Ax interface carries user traffic between

the SC/MM function in the PCF and the AN.

Mobility Management

The responsibility for keeping the MS connected while moving on the network

(between different MSCs, etc.) is divided into two different cases: While in active

session, the RAN is responsible for the Handoff (in general for the Low data rate

channel we will always have SHO (Soft hand off), and as much as the data increases

in the SCH the SHO for SCH will decrease (the SHO for SCH is limited). While the

mobile moves between BTSs but not in a session, and than between BSCs and MSCs

and PDSNs (while idle) it is the mobile’s responsibility to update the network that it

has moved by registering to a new MSC or PDSN.

It is important that the MS updates the system in the CS in order for the system to

be able to route the circuit voice calls to the mobile. In idle mode the MS runs the

mobility management procedure, and in active the MS assists the RAN.

• The A8/A9 interfaces supports mobility between BSCs under the same PCF.

• The A10/A11 interfaces supports mobility between PCFs under the same PDSN.

• Mobile IP supports mobility between PDSN/FA under the same Home Agent.

• Hard handoff and soft handoff procedures realize the mobility between BTSs.

Packet Data Micro-Mobility and Macro-Mobility Concepts - CDMA2000 1x

The figure below provides a conceptual view of levels of packet data mobility.

Figure 3-2: Levels of packet data mobility

• The A8/A9 interfaces support mobility between BSCs under the same PCFs.

• The A10/A11 interfaces support mobility between PCFs under the same PDSN.

• Mobile IP supports mobility between PDSN/FA under the same Home Agent.

• Hard handoff and soft handoff procedures realize the mobility between BTSs.

HRPD Micro-Mobility and Macro-Mobility Concepts - CDMA2000 1x-EV-DO

The figure below provides a conceptual view of levels of HRPD packet data mobility.

Figure 3-3: HRPD Packet data mobility

• The A8/A9/A14 interfaces support mobility between ANs under the same PCF.

• The A10/A11/A13 interfaces support mobility between PCFs under the same

PDSN.

• Mobile IP supports mobility between PDSNs under the same Home Agent.