1. UMTS Technical Note
By NetTest
ABSTRACT
UMTS (Universal Mobile Telecommunication System) or 3G represents a major leap
forward with expectations of faster communication and the capability of combining voice
and data in new ways, to facilitate multi-media and end-to-end broadband services. At
the same time, UMTS represents a major challenge to vendors and mobile operators
because of the technical complexity and the immense costs involved in the
infrastructure.
The UMTS Technical Note is the latest in the NetTest series of technical notes. Our aim
in publishing the technical notes is to provide our customers with clear and accurate
information on the most relevant technologies. At the same, this technical note is
intended to serve as quick reference guide for the many complex issues surrounding
UMTS.
Apart from serving as a quick reference guide and important tool in the day-to-day work,
the UMTS technical note also forms part of the material used in the NetTest training
programs.
Chapter 1 through 3 dives into the UMTS technology and describes in details the
structure, the network interfaces and protocols, as well as the network functionality, and
the signaling procedures.
Chapter 4 and 5 cover two key aspects in UMTS: security and Quality of Service.
Chapter 6 briefly outlines NetTest’s offerings within UMTS network monitoring and
optimization to aid our customers face the increasing challenges in a highly competitive
market place, allowing mobile operators troubleshoot and optimize network and service
performance.
Technical Note

2. TABLE OF CONTENTS
1. UMTS Network Overview................................................................................................................... 5
1.1 Introduction .......................................................................................................................................... 5
1.2 Standardization .................................................................................................................................... 7
1.3 The UMTS Releases............................................................................................................................ 7
1.4 The Services on a UMTS Network ...................................................................................................... 8
1.5 The Network Components of a UMTS Network................................................................................. 10
2. UMTS Network Interfaces and Protocols ...................................................................................... 20
2.1 Overview ............................................................................................................................................ 20
2.2 General UTRAN Interface Protocols Architecture ............................................................................. 20
2.3 The UTRAN Interfaces....................................................................................................................... 24
2.4 Core Network (CN) Protocols ............................................................................................................ 33
3. UMTS Network Functionality .......................................................................................................... 37
3.1 User Equipment (UE) and Network States ........................................................................................ 37
3.2 Elementary Procedures ..................................................................................................................... 41
3.3 Mobility Management......................................................................................................................... 48
3.4 Radio Resource Management (RRM) ............................................................................................... 53
3.5 CS Service Example: Mobile Terminating (MT) Voice Call................................................................ 59
3.6 PS Service Example: MT Data Connection (Interactive) ................................................................... 60
4. UMTS Security and Ciphering ........................................................................................................ 61
4.1 Security .............................................................................................................................................. 61
4.2 Ciphering............................................................................................................................................ 62
5. Mobile Quality of Service (QoS) ..................................................................................................... 65
5.1 Introduction ........................................................................................................................................ 65
5.2 What is Quality of Service (QoS)? ..................................................................................................... 65
5.3 Mechanisms for Delivering QoS ........................................................................................................ 66
6. UMTS Testing ................................................................................................................................... 70
6.1 Hot Spot Expert Analysis Tools .......................................................................................................... 71
6.2 End-to-End Network Monitoring......................................................................................................... 73
7. Terms and Abbreviations ................................................................................................................ 75
8. Websites ........................................................................................................................................... 81
9. References........................................................................................................................................ 82
UMTS Technical Note Page 2 of 83

3. TABLE OF FIGURES
Figure 1.1 The evolution of mobile telephony............................................................................................... 5
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks. ...................... 6
Figure 1.3 The 3GPP organizations. ............................................................................................................ 7
Figure 1.4 GSM/GPRS/UMTS network architecture. ................................................................................. 10
Figure 1.5 GERAN architecture...................................................................................................................11
Figure 1.6 UTRAN architecture. ................................................................................................................. 12
Figure 1.7 Serving RNC. ............................................................................................................................ 13
Figure 1.9 UMTS network architecture....................................................................................................... 14
Figure 1.10 Core network elements - CS domain. ..................................................................................... 15
Figure 1.11 The signaling gateway function. .............................................................................................. 16
Figure 1.12 Core network elements - PS domain. ..................................................................................... 16
Figure 1.13 The HSS is a superset of the HLR. ......................................................................................... 17
Figure 1.14 The IP Multimedia Subsystem................................................................................................. 18
Figure 2.1 Simplified UMTS structure showing three significant parts....................................................... 20
Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN..................................... 21
Figure 2.3 Control plane UE to PS Core Network (3G-SGSN). ................................................................. 22
Figure 2.4 Control plane UE to CS Core Network (MSC). ......................................................................... 22
Figure 2.5 Circuit and Packet Switched Mobility Management. ................................................................. 23
Figure 2.6 User plane UE to PS Core Network. ......................................................................................... 24
Figure 2.7 User plane UE to CS Core Network.......................................................................................... 24
Figure 2.8 General structure of the UTRAN interfaces. ............................................................................. 25
Figure 2.9 The Iu interface connects the UTRAN to the CN. ..................................................................... 25
Figure 2.10 The Iu-CS control plane protocol stack. .................................................................................. 26
Figure 2.11 The Iu-PS protocol stack. ........................................................................................................ 28
Figure 2.12 The Iub protocol stack. ............................................................................................................ 29
Figure 2.13 The Iur protocol stack.............................................................................................................. 30
Figure 2.14 Radio interface protocol architecture (service access points marked by circles). .................. 31
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR................................ 33
Figure 2.16 MAP services as defined in 3G TS 29.002. ............................................................................ 34
Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces. ............................................... 35
Figure 2.18 Control plane SGSN-MSC/VLR. ............................................................................................. 35
Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces. ................................................... 36
Figure 3.1 UE and CN MM states............................................................................................................... 37
Figure 3.2 UE and CN PMM states. ........................................................................................................... 38
Figure 3.3 RRC states. ............................................................................................................................... 39
Figure 3.4 UE state overview...................................................................................................................... 40
Figure 3.5 PDP states................................................................................................................................. 40
Figure 3.6 CS Paging Procedure in Iu mode.............................................................................................. 41
UMTS Technical Note Page 3 of 83

4. Figure 3.7 CS signaling connection establishment. ................................................................................... 42
Figure 3.8 Signaling connection Release................................................................................................... 43
Figure 3.9 Authentication and security procedure. ..................................................................................... 43
Figure 3.10 CS Service Request and RAB Allocation. ............................................................................... 44
Figure 3.11 PS Service Request and RAB Allocation. ............................................................................... 44
Figure 3.12 PS Service and RAB Release................................................................................................. 45
Figure 3.13 CS Service and Iu Release. .................................................................................................... 45
Figure 3.14 CS RAB Allocation................................................................................................................... 46
Figure 3.15 PS RAB Allocation................................................................................................................... 47
Figure 3.16 RAB Release procedure.......................................................................................................... 47
Figure 3.17 Combined GPRS/IMSI Attach procedure with LU................................................................... 49
Figure 3.18 UE initiated combined GPRS/IMSI Detach procedure............................................................ 50
Figure 3.19 LA containing RAs and cells within URA................................................................................. 50
Figure 3.20 UMTS LA/RAU procedure....................................................................................................... 52
Figure 3.21 URA Update. ........................................................................................................................... 53
Figure 3.22 Cell update. ............................................................................................................................. 53
Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs.54
Figure 3.24 Soft handover. ......................................................................................................................... 54
Figure 3.25 Before and after hard handover/SRNS relocation and RAU................................................... 55
Figure 3.26 Hard handover and SRNS relocation...................................................................................... 56
Figure 3.27 UMTS to GSM Handover......................................................................................................... 56
Figure 3.28 UMTS to GPRS cell relocation................................................................................................ 57
Figure 3.29 CS service: MT voice call. ....................................................................................................... 59
Figure 3.30 PS service: MT data connection (interactive).......................................................................... 60
Figure 4.1 Overview of the security architecture in Rel-4........................................................................... 61
Figure 4.2 Security between networks. ...................................................................................................... 63
Figure 5.1 QoS segments........................................................................................................................... 65
Figure 5.2 UMTS QoS architecture. ........................................................................................................... 67
Figure 5.3 QoS attributes and their usage. ................................................................................................ 67
Figure 5.4 Using traffic classes to achieve required QoS. ......................................................................... 68
Figure 5.5 UMTS QoS classes. .................................................................................................................. 69
Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics............... 70
Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools................................................ 71
Figure 6.3 The InterQuest is a powerful tool with the ability to capture large amounts of data from multiple
links in both access and core network. ................................................................................... 71
Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most
complete surveillance solution available today. MasterQuest UMTS builds on this platform. 73
Figure 6.7 MasterQuest performs network-wide correlation and monitors end-to-end service delivery
performance ............................................................................................................................ 73
UMTS Technical Note Page 4 of 83

5. 1. UMTS Network Overview
1.1 Introduction
Communication has always been essential to mankind. When two people meet, they only need their voice to
communicate, but as the distance increases the need for tools arises. When Alexander Graham Bell invented the
telephone in 1876, a significant step was taken to enable two people to talk together, however far apart they may be
– that is, as long as they are near a telephone set! For more than a century wire line telephony has been the solution
for voice communication over distance for most people. Radio based communication systems not depending on a
wire for network access were developed for special purposes (e.g. military, police, naval and closed car radio nets),
and eventually systems emerged allowing people to communicate via telephones with radio rather than wire line
access. They were primarily intended for people driving in cars and were known as mobile telephony systems.
During the early 1980s, the first generation (1G) of mobile telephone systems based on analog technology was
experiencing rapid growth in many European countries. Each country developed its own system, each incompatible
with the others in terms of equipment and operation. This led to a wish and a need for a common European mobile
communication system with high capacity and pan-European coverage. The latter implied that the same mobile
telephones could be used in all European countries and that incoming calls would automatically be routed to the
mobile phone independent of location (automatic roaming). In addition it was expected that one single European
market with common standards would lead to cheaper user equipment and vendor-independent network elements.
Finally, the use of modern digital technology would result in smaller hand-held devices coupled with improved
functionality and quality.
In 1982 the CEPT (Conference of European Posts and Telegraphs) formed a study group called the Groupe Spécial
Mobile (GSM) to study and develop a pan-European public land mobile system – the second generation of cellular
telephony (2G). The name of the study group - GSM - was also used for the mobile system. In 1989, GSM
responsibility was transferred from CEPT to the ETSI (European Telecommunication Standards Institute).
Originally GSM was only intended for the ETSI member countries. However, many other countries have also
implemented GSM – e.g. Eastern Europe, the Middle East, Asia, Africa, the Pacific Basin and North America (with
a derivative of GSM called PCS1900). The name GSM – now meaning the Global System for Mobile
communication – is thus very appropriate.
Figure 1.1 The evolution of mobile telephony.
GSM has been around for a decade and has turned into an overwhelming success, being very widely deployed in
most parts of the world. The system is well suited for voice communication and is also extensively used for Short
Message Service (SMS) information transfer. Circuit switched data services were also covered by the GSM
specification, as the integrated wireless access to voice and data services was one of the goals for the system.
However, the offered access speed (max. 9600 baud) has limited the use of the GSM system for data applications.
ETSI have defined several solutions to improve the data access of the mobile network often referred to as 2.5G. This
is to indicate that they represent a step forward compared to GSM, but these systems are still quite tightly connected
to GSM: HSCSD (High Speed Circuit Switched Data), GPRS (General Packet Radio System) and EDGE (Enhanced
Data rates for Global/GSM Evolution).
HSCSD is the simplest enhancement of the GSM system for data: Like GSM it is based on circuit switched
connections, but a better utilization of the available bandwidth and allocation of more than one time slot per
connection allows higher data rates – theoretically up to 57.6 kbps. However, the circuit switched nature of HSCSD
makes it inefficient for data traffic, as this is packet oriented.
UMTS Technical Note Page 5 of 83

6. GPRS is designed as a packet data service with a theoretical maximum data rate of approx. 170 kbps. GPRS co-
exists with the GSM network, reusing the basic structure of the access network. GPRS is an extension of GSM
networks with data services carried on the existing radio infrastructure, while the core network is enhanced by a
packet overlay with new components and interfaces. GPRS supports combined voice and data services and enables
multimedia services.
EDGE is an enhancement of the GSM/GPRS system using a new air interface modulation technique that allows the
bit rate on the air interface to be increased considerably. EDGE will increase the theoretical maximum data rate to
384 kbps.
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks.
The UMTS (Universal Mobile Telecommunication System) – third generation cellular telephony (3G) – is expected
to do more than merely provide better and faster mobile communication. UMTS will also enable combination of
voice and data services in a new way, for example facilitating multimedia and end-to-end broadband services. In
summary, UMTS will mean the following for operators and their customers:
UMTS for customers:
• Worldwide wireless access using a single handset
• A wide range of multimedia services with appropriate quality levels
• The third generation mobile standard enables mobile users to harness the full power of the Internet through efficient
high-speed radio transmission, optimized for multimedia communications
• UMTS will make the dream of anywhere, anytime communications a reality
UMTS for the operator:
• Unification of the diverse wireless access systems we see today into a flexible radio infrastructure
• Evolution from earlier "legacy" systems, ensuring global economies of scale and supply while allowing:
- Plenty of scope for product and service differentiation
- Choice of radio access methods and core networks in order to flexibly implement and evolve their systems based on
the regulatory, market or business requirements for each region or country
For operators there is a huge difference in the investment required to provide a 2.5G (GPRS) compared to a 3G
system. 2.5G requires relatively small investments for the necessary modifications of the radio access network and
add-on equipment (a packet switched core network) on top of existing GSM networks, while UMTS requires a very
large investment, as most of the network must be created from the ground up. EDGE will also require huge
investments, as a new radio access network will be needed.
UMTS Technical Note Page 6 of 83

7. For existing GSM operators, 2.5G technologies will be attractive as they can be implemented based on the operation
licenses operators already have, while UMTS requires new (and in several countries expensive) licenses. For users
GPRS will be a major step forward with new services, while UMTS is mainly an extension of these services. Thus
the success of GPRS and the services it offers will be an important indicator of which services will drive the success
of coming 3G UMTS networks.
1.2 Standardization
One of the driving forces behind UMTS is the desire to create a truly universal system. This is why the
standardization work has been moved from ETSI to a new organization: “Third Generation Partnership Project”
(3GPP) with the participation of a number of regional and national standardization organizations. Market
considerations are handled by an additional partnership – the “Market Representation Partners” (MRP).
Figure 1.3 The 3GPP organizations.
The 3GPP creates a common standard based on the inputs from the participating organizations. The Operator
Harmonization Group (OHG) has been set up to find necessary compromises in the event that the 3GPP is unable to
reach agreement. In addition to these bodies, the Third Generation Partnership Project Number 2 (3GPP-2) ensures
that North American IS-95 radio technology based systems are taken into account.
Even though it is based on existing GSM/GPRS networks, UMTS adds several new components and interfaces to
the core network. The radio access network is also entirely new, based on a new technology, Wideband Code
Division Multiple Access (WCDMA) with better usage of the spectrum than today’s GSM, resulting in support for
higher data rates, more capacity and subsequently, more subscribers. Eventually UMTS will cause a complete
rearrangement of the GSM/GPRS/UMTS core network, as all-IP technology will emerge.
1.3 The UMTS Releases
In the standardization of UMTS within the 3GPP, UMTS has been defined in a set of phases – or releases. So far
three releases have been defined: UMTS Release 1999 (R99 – sometimes also referred to as Release 3/Rel-3),
UMTS Release 4 (Rel-4) and UMTS Release 5 (Rel-5). The network architectures figure in section 1.5 indicates
how the releases affect the network. The UMTS releases are the three main deliverables of approved specifications
from 3GPP.
The major headlines for each release are:
R99
• Defines the UMTS Universal Terrestrial Radio Access Network (UTRAN)
• The Radio Network Subsystem (RNS) is added to the existing GSM/GPRS network
• The Core Network (CN) is the existing GSM/GPRS network with some enhancements
Rel-4
• Rel-4 introduces Media Gateway (MGW), the Mobile Switching Center (MSC) server and the Signaling Gateway (SGW).
This allows user data and signaling to be logically separated in the MSC
• UTRAN enhancements that include support of even higher data rates, in local areas up to 2 Mbps
UMTS Technical Note Page 7 of 83

8. Rel-5
• IP Multimedia (IM) Subsystem (IMS) is added
• The Home Location Register (HLR) is replaced by/extended to a Home Subscriber Server (HSS)
• UTRAN improvements to enable efficient IP-based multimedia services in UMTS
• Introduction of IubFlex (allows Radio Network Controllers (RNCs) to connect to more than one set of Node Bs)
• Enhancements of Location Services (LCS)
• all-IP network will eventually become a reality
• Rel-5 will be based on IPv6
The above releases are in the "Frozen" state, which means that revisions are allowed if a correction is needed (i.e.
new features are no longer added). A release 6 is planned and more releases are likely to follow: They may cover
areas like IMS enhancements, Wireless LAN Integration (WLANI), Internet convergence (regarding protocols and
services), Multimedia Broadcast/Multicast Service (MBMS) and evolution to the network within the Packet
Switched (PS) domain only.
This note will for the most part be based on Rel-4. Other releases will however be mentioned in some cases to
highlight major differences to Rel-4.
1.4 The Services on a UMTS Network
As the UMTS network evolves, more and more services will be supported. With UMTS Rel-5 the mobile network
will support services like those known from the Internet today, e.g. video streaming, Voice over IP (VoIP), video
conferencing and interactive services. The circuit switched part of the network will change and be put on top of a
packet-oriented technology (most likely IP), to support higher data rates and to increase flexibility in the network.
The packet switched part of the network will not change much, but a new packet domain will be added: the IP
Multimedia Subsystem (IMS).
1.4.1 General Services
The basic services provided by UMTS are similar to those known from GSM and ISDN (Integrated Services Digital
Network). Using the ITU-T definitions, telecommunication services can be divided into bearer services,
teleservices, and supplementary services. The most basic teleservice supported by UMTS is voice telephony. As
with all other communications, speech is digitally encoded and transmitted through the network as a digital stream.
A variety of data services are offered implemented as packet switched data communication. The Short Message
Service (SMS), introduced together with GSM will also be available. Supplementary services are provided on top of
teleservices e.g.:
• Call Forwarding/Barring/Waiting/Hold
• Three Party Service
• Advice of Charge
• Caller identification
• Closed user groups
1.4.2 Quality of Service
One of the enhancements of 2.5G and 3G networks is the improved support of data communication. To facilitate
this, both GPRS and UMTS have introduced the concept of Quality of Service (QoS) as an integrated part of the
system. Having an effective QoS mechanism in place enables mobile operators to cost-effectively deliver high-
value, differentiated, IP-based applications and services. QoS is discussed in detail in chapter 5.
1.4.3 UMTS Service Capabilities
The way UMTS is defined separates as far as possible the part of the network that makes actual connections from
the part that maintains services. This facilitates more openness and potential in the market and allows a concept of
separate providers of contents, service and carriers. Some of these services are listed below.
UMTS Technical Note Page 8 of 83

9. 1.4.3.1 Location Based Services
The geographic position of the User Equipment (UE) can be given by measuring radio signals. There are many
different possible applications for positioning information. The positioning functions may be used internally by the
UTRAN for radio system performance optimization, by value-added network services, by the UE itself or through
the network, and by "third party" services. Typical commercial services are:
• Traffic information
• Fleet management
• “Follow me”
• “Nearest service”
• Emergency services
UMTS network planners can also use this information.
Location based services can also be implemented in GSM/GPRS networks where they are based on the signaling
between the network and the Mobile Station (MS – the GSM/GPRS equivalent of the UE).
1.4.3.2 WAP Service
WAP (Wireless Application Protocol) is Internet access optimized for mobile telephony. It will allow the mobile
user to gain access to Internet information and services anywhere anytime, for example e-mail, flight schedules etc.
The WAP service capability provides the user with a web-browser that uses a Wireless Markup Language (WML)
instead of the HyperText Markup Language (HTML) normally used on the Internet. WML is designed for use with
mobile terminals. Gateways in the system will take care of the conversion between the WAP format and the normal
Internet format.
1.4.3.3 Multimedia Messaging Service (MMS)
The Multimedia Messaging Service (MMS) is used for delivering multimedia messages to a UE, from either another
UE, a fixed point on the Internet or a Value Added Service (VAS) provider. Value-added services could be news,
weather broadcasts, stock exchange information etc. Multimedia messages can contain all types of media in addition
to text, e.g. speech, video, audio and still images.
1.4.3.4 CAMEL
The Customized Applications for Mobile networks Enhanced Logic (CAMEL) is a common platform for a number
of services for customers. It provides the UMTS network with Intelligent Network (IN) features like:
• Prepaid
• Call screening
• Supervision
CAMEL allows the necessary information to be exchanged between networks (IN features are normally network
specific). Traditional IN solutions create circuit switched services. CAMEL will do this and also interact with packet
switched connections.
1.4.4 Virtual Home Environment (VHE)
The VHE is a service concept within UMTS that enables the user to have the same personalized interface to the
network regardless of the network accessed. It requires that networks transfer information on user profiles, charging,
services and number portability, which considering the complexity of the networks is not a trivial task. Where the
VHE requires network-network communication, the CAMEL will be used.
UMTS Technical Note Page 9 of 83

10. 1.5 The Network Components of a UMTS Network
Figure 1.4 GSM/GPRS/UMTS network architecture.
The figure above shows some of the subsystems in GSM/GPRS/UMTS networks, as they will evolve with the
UMTS releases. On the access network side there is the Base Station Subsystem (the GERAN) for GSM/GPRS and
the RNS (the UTRAN) for UMTS. The CN is based on the GSM/GPRS core network, but as indicated, UMTS Rel-
4 and Rel-5 will modify some subsystems and components and add others. This allows existing GSM/GPRS
network operators to benefit from the improved cost-efficiency of UMTS while protecting their 2G investments and
reducing the risks of implementation. There are also other entities in the network such as the location services
entities, which are used for location calculation.
The GSM/GPRS/UMTS network interfaces with other Public Land Mobile Networks (PLMNs) including pre Rel-4
networks, the PSTN and other IP-based multimedia networks.
1.5.1 Access Network Elements
Two types of access network are defined for GSM/GPRS/UMTS network; the BSS used for GSM, GPRS and
EDGE access (the GERAN), and the RNS (the UTRAN) used for WCDMA access.
UMTS Technical Note Page 10 of 83

11. 1.5.2 The GSM/EDGE Radio Access Network (GERAN) Architecture
The GERAN is the access network defined for GSM, GPRS and EDGE. The GERAN is connected to the GSM
Phase 2+ CN either via two legacy interfaces (the A-interface and the Gb interface), or through the Iu interfaces.
The interface between the GERAN and the PS domain of the CN (the Iu-PS or the legacy Gb interface) is used for
packet switched data, and the interface between the GERAN and the Circuit Switched (CS) domain of the CN (Iu–
CS or the legacy A interface) is used for circuit switched voice or data.
Figure 1.5 GERAN architecture.
1.5.2.1 Base Station Subsystem (BSS)
The BSS or the GERAN is the system of base station equipment (transceivers, controllers, etc.), which is
responsible for communicating with mobile stations in a certain area. The BSS is connected to the MSC through a
single A or Iu-CS interface. Similarly, in PLMNs supporting GPRS, the BSS is connected to the Serving GPRS
Support Node (SGSN) through a single Gb or Iu-PS interface.
The radio equipment of a BSS may support one or more cells. A BSS may consist of one or more base stations.
Where an Abis-interface is implemented, the BSS consists of one Base Station Controller (BSC) and one or more
Base Transceiver Station (BTS). The BTS and the BSC communicate across the Abis interface.
1.5.2.2 Base Transceiver Station (BTS)
The BTS contains the radio transmitters and receivers (transceivers – TRX) covering a certain geographical area of
the GSM network (a base station area consisting of one or more radio cells). The BTS handles the radio link
protocols with the MS.
1.5.2.3 Base Station Controller (BSC)
The BSC controls a group of BTSs regarding radio channel setup, power control, frequency hopping, and handovers
- the transfer of a call in progress from one radio channel to another, typically as a result of an MS moving from one
base station area to another. The BSC is the connection between the mobile station and the MSC.
UMTS Technical Note Page 11 of 83

12. 1.5.2.4 GSM Mobile Station (MS)
The GSM MS consists of the mobile equipment (the terminal) and the Subscriber Identity Module (SIM) card. The
SIM provides personal mobility, providing user access to subscribed services irrespective of a specific terminal. The
International Mobile Equipment Identity (IMEI) uniquely identifies the mobile equipment. The SIM card contains
the International Mobile Subscriber Identity (IMSI) used to identify the subscriber to the system, a secret key for
authentication, and other information. The IMEI and the IMSI are independent, thereby allowing personal mobility.
The MS communicates with the GSM network via the radio interface (Um Interface).
In relation to UMTS the MS must operate in one of the following two modes:
• A mode based on A/Gb interfaces between BSS and CN e.g. for:
- pre-Release 4 terminals
- Rel-4 terminals when connected to a BSS with no Iu interface towards the CN
• A mode based on Iu-CS and Iu-PS between BSS and CN for:
- Rel-4 terminals when connected to a BSS with Iu interfaces towards the CN
1.5.3 Universal Terrestrial Radio Access Network (UTRAN) Architecture
UMTS R99 saw the introduction of a new radio access network, the UTRAN. The UTRAN is based on WCDMA
technology, introduced in order to achieve a better bandwidth efficiency compared to the techniques used in
GSM/GPRS. The UTRAN is connected via the Iu to the GSM Phase 2+ CN; the interface between UTRAN and the
PS domain of the CN (Iu–PS) is used for packet switched data, and the interface between UTRAN and the CS
domain of the CN (Iu–CS) is used for circuit switched data. There is actually a third domain, the BroadCast (BC)
domain, which can used to broadcast a short message to a given geographical area (“service area”, being one or
more cells). The interface to the BC domain is called Iu-BC. It is not shown in the figure in section 1.5.2 and will
not be described further here.
1.5.3.1 Radio Network Subsystem (RNS)
The UTRAN consists of one or more RNSs connected to the CN via the Iu interfaces. Each RNS consists of a RNC
and one or more Node Bs. The Node Bs are connected to the RNCs via the Iub interface. The Node Bs provide radio
access (i.e. antennas) to the network. The RNCs of each RNS can be interconnected via the Iur interface
Figure 1.6 UTRAN architecture.
UMTS Technical Note Page 12 of 83

13. 1.5.3.2 The Radio Network Controller (RNC)
Each RNC has responsibility for and control over the radio resources of a set of cells. The RNC is equivalent to a
GSM/GPRS BSC but is more self-controlled. A RNC may have different roles in the UTRAN network:
• Controlling RNC
- Each RNC is responsible for the resources of its set of cells and the Node Bs in its RNS. In this role the RNC is called
the Controlling RNC (CRNC)
• Serving RNC
- For each connected UE the RNCs may have an additional role: A Serving RNC (SRNC) providing radio resources to
the connected UE. The SRNC terminates the Iu towards the CN
Figure 1.7 Serving RNC.
• Drift RNC
- In order to minimize the effect of handovers, RNCs may have a third role: A Drift RNC (DRNC). A DRNC provides
(“lends”) resources to a SRNC for a specific UE. The DRNC will normally also act as a SRNC (or DRNC) for other UEs
Figure 1.8 Drift RNC.
UMTS Technical Note Page 13 of 83

14. 1.5.3.3 The Node B
The Node B handles the transmission and reception of signals in one or more cells, similar to GSM BTS. The Node
B is also responsible for the inner loop power control. Please refer to section 3.5 for more information on power
control.
1.5.3.4 User Equipment (UE)
The UE is equivalent to the GSM MS, i.e. it is the terminal through which the users access the network. The UE
consists of the mobile equipment (the terminal) and a Universal Service Identity Module (USIM). The mobile
equipment is uniquely identified by the IMEI. In order to allow future enhancements, the terminal equipment should
have an Application Programming Interface (API). The USIM provides personal mobility, providing the user with
access to subscribed services. Unlike the GSM SIM card, the USIM card may hold a number of profiles. Each
profile will have a specific purpose. It can be used to adjust the available services to the capabilities of the terminal
into which the USIM card is installed. Both the user and the network can adjust the profiles.
1.5.4 Core Network Elements
Figure 1.9 UMTS network architecture.
The CN is logically divided into a CS domain and a PS domain. In addition, a set of databases (“Registers”) is used
for storage of information needed by the system. The different entities in the domains are described below.
UMTS Technical Note Page 14 of 83

15. 1.5.5 Core Network Elements – Circuit Switched (CS) Domain
Figure 1.10 Core network elements - CS domain.
1.5.5.1 Mobile Switching Center/Gateway Mobile Switching Center (MSC/GMSC)
The central component of the CS domain in the CN is the MSC. The MSC is an exchange, which performs all the
switching and signaling functions for MSs located in a geographical area designated as the MSC area. The main
difference between an MSC and an exchange in a fixed network is that the MSC has to take into account the impact
of the allocation of radio resources and the mobile nature of the subscribers, which means it performs procedures
such as:
• Procedures required for the location registration
• Procedures required for handover
The MSC/GMSC constitutes the interface between the radio system and the fixed networks. The MSC performs all
necessary functions in order to handle the circuit switched services to and from the mobile stations. The MSC is
responsible for call control (setup, routing, control and termination of the calls), management of inter-MSC
handover and supplementary services, and for collecting charging/accounting information. The MSC is connected to
the location and equipment registers and to other MSCs in the same network.
The GMSC acts as the gateway to other mobile networks and the public-switched networks (telephone network,
ISDN and data networks).
In order to obtain radio coverage of a given geographical area, a number of base stations are normally required; i.e.
each MSC would thus have to interface several base stations. In addition several MSCs may be required to cover a
country.
1.5.5.2 Media Gateway/Mobile Switching Center (MGW/MSC) Server
To enable bearer-independent (and thus enabling all-IP based networks) CS network architecture in Rel-4, the MSC
is split into an MGW for transport of user data and an MSC server for signaling. The MSC server mainly comprises
the Call Control (CC) and mobility control parts of an MSC. The split into MGW and MSC server also results in a
more independent environment for service creation. The new CAMEL features benefit from this concept when the
service control gets independent from the switching fabric.
UMTS Technical Note Page 15 of 83

16. MGW is the PSTN/PLMN transport termination point and interfaces UTRAN with the CN over Iu. The MGW may
terminate bearer channels from a circuit switched network and media streams from a packet network (e.g. RTP
(Real-time Transport Protocol) streams in an IP network).
1.5.5.3 Signaling Gateway (SGW)
A SGW converts signaling (both ways) at transport level between the SS7 based transport of signaling used in pre-
Rel 4 networks, and the IP based transport of signaling possibly used in post-R99 networks (i.e. between Sigtran
SCTP/IP and SS7 MTP). The SGW does not interpret the application layer (e.g. MAP, CAP, BICC, ISUP) messages
but may have to interpret the underlying SCCP (Signaling Connection Control Part) or SCTP (Stream Control
Transmission Protocol) layer to ensure the correct routing of the signaling. The SGW will be necessary to obtain an
all-IP UMTS network.
The signaling gateway function may be implemented as a stand-alone entity or inside another entity.
Figure 1.11 The signaling gateway function.
1.5.6 Core Network (CN) Elements – Packet Switched (PS) Domain
Figure 1.12 Core network elements - PS domain.
UMTS Technical Note Page 16 of 83

17. 1.5.6.1 Serving GPRS Support Node (SGSN)
The SGSN acts as a packet switch and router in the PS domain of the CN. The SGSN controls the access of the MS
to the network and routes packets to the right BSC/RNC. It performs Mobility Management (MM) functions similar
to the MSC in the CS domain of the CN such as location registration, Routing Area Updates (RAUs) and paging.
The SGSN also handles security functions such as authentication and ciphering (between the MS/UE and the
SGSN).
1.5.6.2 Gateway GPRS Support Node (GGSN)
The GGSN acts as a packet router in the PS domain of the CN and is the gateway between the mobile IP packet
routing of the GPRS/UMTS network and the fixed IP routing of the Internet. It transfers packets between the IP
multimedia networks and the appropriate SGSN, which currently serves the MS/UE. If the MS changes the SGSN
during ready mode, the GGSN is used as a data packet buffer. The GGSN stores subscriber data for active MSs/UEs
and performs security functions such as firewall and screening.
1.5.7 Core Network (CN) Elements – Registers
1.5.7.1 Home Location Register (HLR)
The HLR is an independent core network element up to and including Rel-4. In Rel-5 the HLR is replaced by the
HSS (Home Subscriber Server – see next section), which is a superset of the HLR. The HLR contains all the
administrative information of each subscriber registered in the particular network, information on permitted
services, and the current location of the mobile. The location of the mobile is typically in the form of the signaling
address of the Visitor Location Register (VLR) associated with the MS. There is logically one HLR per network,
although it may be implemented as a distributed database.
The HLR provides functionality like:
• Support to PS domain entities such as the SGSN and GGSN, through the Gr and Gc interfaces. It is needed to enable
subscriber access to the PS domain services
• Support to CS domain entities such as the MSC/MSC server and GMSC/GMSC server, through the C and D interfaces. It
is needed to enable subscriber access to the CS domain services and to support roaming to legacy GSM/UMTS CS
domain networks
1.5.7.2 Home Subscriber Server (HSS)
Figure 1.13 The HSS is a superset of the HLR.
In UMTS Rel-5 the HSS replaces the HLR. The HSS is a superset of the HLR and contains all the functionality of
the HLR plus additional functionality to support the IM functionality of the IMS (please refer to section 1.5.8).
The HSS is an entity common to the PS and CS domains. The HSS is the master database for a given user and
contains the subscription related information to support the network components handling calls/sessions, for
example support to the call control servers in order to complete routing/roaming procedures by solving
authentication, authorization, naming/addressing resolution and location dependencies.
A UMTS Network may contain one or several HSSs, depending on the number of mobile subscribers, the capacity
of the equipment, and the organization of the network.
UMTS Technical Note Page 17 of 83

18. The HSS consists of the following functionalities:
• IM functionality to provide support to control functions of the IMS such as the Call State Control Function (CSCF). It is
needed to enable subscriber access to the IM CN subsystem services
• The subset of the HLR functionality required by the PS domain
• The subset of the HLR functionality required by the CS domain, if it is desired to enable subscriber access to the CS
domain or to support roaming to legacy GSM/UMTS CS domain networks
The HSS contains the following user-related information:
• User identification, numbering and addressing information
• User security information
- Network access control information for authentication and authorization
• User location information at inter-system level
- The HSS supports the user registration, and stores inter-system location information, etc.
• User profile information (i.e. parameter settings for specific purposes)
1.5.7.3 Visitor Location Register (VLR)
The VLR contains selected administrative information from the HLR, necessary for call control and provision of the
subscribed services, for each mobile currently located in a Location Area (LA) controlled by the VLR. Each time an
MS performs roaming in a new LA, the VLR covering that LA informs the HLR about the new location of the
subscriber. The HLR subsequently informs the VLR about the services to which the subscriber has access. The VLR
also controls the assignment of TMSI.
The HLR and the VLR, together with the MSC, provide the call routing and roaming capabilities of the network. In
most implementations the VLR is integrated with the MSC, and with UMTS Rel-4 it will be a part of the MSC
server.
1.5.7.4 Authentication Center (AuC)
The AuC is a protected database that contains the individual subscriber-identification keys (also contained in SIM),
and provides the subscriber data to HLR and VLR (via HLR) used for authentication and encryption of calls.
1.5.7.5 Equipment Identity Register (EIR)
The EIR is a database that contains a list of all valid mobile equipment on the network, and in which each MS is
identified by its IMEI. An IMEI is marked as invalid if the mobile has been reported stolen or is not type approved.
1.5.8 IP Multimedia Subsystem (IMS)
Figure 1.14 The IP Multimedia Subsystem.
UMTS Technical Note Page 18 of 83

19. The IMS is the major difference between UMTS Rel-4 and Rel-5. The IMS comprises all CN elements for provision
of multimedia services. IM services are based on a session control capability defined by the Internet Engineering
Task Force (IETF). IM services, along with multimedia bearers, utilize the PS domain - possibly including an
equivalent set of services to the relevant subset of CS Services.
The IMS enables PLMN operators to offer multimedia services to their subscribers based on and built upon Internet
applications, services and protocols. 3GPP has no intention of standardizing such services within the IMS. The
intention is that these services will be developed by PLMN operators and third party suppliers, including those in
the Internet space, using the mechanisms provided by the Internet and the IMS. The IMS should enable the
convergence of, and access to, voice, video, messaging, data and web-based technologies for the wireless user, and
combine the growth of the Internet with the growth in mobile communications.
The specific functional elements of the IMS are described below.
• The CSCF which can have three roles:
- Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IMS. The Policy Control Function (PCF) is a
logical entity of the P-CSCF
- Interrogating-CSCF (I-CSCF) is the contact point within an operator’s network for all IMS connections destined to a
user of that particular network operator
- Serving-CSCF (S-CSCF) performs the session control services for the UE
• The Media Gateway Control Function (MGCF) performs protocol conversion between ISUP (ISDN User Part) and the IMS
call control protocols (e.g. ISUP/SIP (Session Initiation Protocol) conversion)
• The Multi Resource Function (MRF) performs multiparty call and multimedia conferencing functions
• The IP Multimedia Media Gateway (IM-MGW) terminates bearer channels from a switched circuit network and media
streams from a packet network. The IM-MGW may support media conversion, bearer control and payload processing
(e.g. codec, echo canceller, conference bridge)
UMTS Technical Note Page 19 of 83

20. 2. UMTS Network Interfaces and Protocols
2.1 Overview
The figure below gives a simplified view of the UMTS architecture. It splits UMTS in 3 significant parts: The UE,
the access network (UTRAN) and the CN.
Figure 2.1 Simplified UMTS structure showing three significant parts.
The information that flows through the UTRAN is logically split into two parts:
• The access stratum - being information required for the interaction between the UE and the UTRAN
• The Non Access Stratum (NAS) - being information transferred between the CN and the UE across the UTRAN
The reason for this split is a desire to make the information transfer between CN and UE independent of the radio
handling in the UTRAN.
2.2 General UTRAN Interface Protocols Architecture
The UTRAN interface protocols consists of 3 parallel protocol stacks:
• The control plane which amongst other things conducts the signaling that enables the transport of user data
• The user plane is where the user data are actually transported
• The Transport Network Control Plane (TNCP)
- The transport channels in the user plane are dynamic. The TNCP makes it possible to establish and remove transport
channels on a given UTRAN interface
UMTS Technical Note Page 20 of 83

21. Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN.
2.2.1 Control Plane
The control plane is used for signaling between the UE and the network. The control plane includes an (upper layer)
application protocol (RANAP/RNSAP/NBAP) and a (lower layer) signaling bearer for transporting the application
protocol messages.
The application protocol is used for things like setting up bearers (i.e. Radio Access Bearer (RAB) or radio link) in
the radio network layer, controlling different transmission resources and handover). In the three-plane structure the
bearer parameters in the application protocol are not directly tied to the user plane technology; they are general
bearer parameters. The control plane protocols include a mechanism for transparent transfer of NAS messages.
The lower layer – the signaling bearers - for application protocol, is a part of the transport network user plane. The
control actions required for setting up the signaling bearers are Operations & Maintenance (O&M) actions.
2.2.2 User Plane
The user plane includes the data streams and the data bearers for the data streams. The data streams are
characterized by one or more frame protocols specified for that interface. The user plane protocols implement the
radio access bearer service, i.e. carries the user data through the access stratum.
The lower layer – the data bearers - in the user plane is a part of the transport network user plane. The transport
network control plane directly controls the data bearers in transport network user plane during real-time operation.
2.2.3 Transport Network Control Plane (TNCP)
Many of the bearers in the UTRAN network are dynamically created as required (in the form of an ATM virtual
circuit), and closed afterwards. The TNCP handles this.
The TNCP does not have a radio network layer. It includes the ALCAP protocols needed to set up the transport
bearers (data bearer) for the user plane and the signaling bearer for the ALCAP protocols. The TNCP allows the
application protocol in the radio network control plane to be independent of the data bearer technology in the user
plane.
When the TNCP is used, a control plane application protocol signaling transaction triggers the ALCAP protocol to
set up of the data bearer. The ALCAP protocol is specific for the user plane technology used. ALCAP is however
not used for all types of data bearers. If there is no ALCAP signaling transaction, the TNCP is not needed at all. This
is the case when pre-configured data bearers are used.
UMTS Technical Note Page 21 of 83

22. The signaling bearer for ALCAP is always set up by O&M actions and it may or may not be of the same type as the
signaling bearer for the application protocol.
2.2.4 End-to-End View of UTRAN Protocols
Figure 2.3 Control plane UE to PS Core Network (3G-SGSN).
Figure 2.4 Control plane UE to CS Core Network (MSC).
UMTS Technical Note Page 22 of 83

23. At the top of the control plane, NAS control messages are carried. These messages are used for GPRS Mobility
Management/Session Management and Mobility Management/Call Control (GMM/SM, respective MM/CC):
GMM/SM and MM/CC are described in 3GPP TS 24.008. Figure 2.5 summarizes the MM/GMM/SM/CC
functionality:
Circuit Switched Packet Switched
Mobility Management (MM) GPRS Mobility Management (GMM)
Registration • Attach and Detach
• IMSI detach indication • P-TMSI reallocation
• Location updating • Authentication and ciphering
Security • Identity request/ response
• Authentication • Routing area update
• Identity • GMM Status/ Information
• TMSI reallocation • Service Request/Accept/Reject
Connection management
• CM service
• Abort
Miscellaneous
• MM information/status
Circuit-mode connections Call Control (CC) GPRS Session Management (SM)
Call establishment • Activate Packet Data Protocol (PDP) context
• Alerting • Activate Secondary PDP Context
• Call proceeding/confirmed • Request PDP context activation
• Connect/ connect acknowledge • Modify PDP context request
• Progress • Deactivate PDP context
• Setup • SM Status
Call information phase
• Modify
• User information
• Call clearing
• Disconnect
• Release/ release complete
Supplementary service control
• Facility
• Hold
• Retrieve
Miscellaneous
• Congestion control
• Notify
• DTMF handling
• Status
Figure 2.5 Circuit and Packet Switched Mobility Management.
SMS supports the mobile-originated and mobile-terminated Short Message Service (SMS) as described in 3GPP TS
23.040. Information on the access stratum protocol layers is given in the description of protocols for the specific
interfaces.
UMTS Technical Note Page 23 of 83

24. Figure 2.6 User plane UE to PS Core Network.
Figure 2.7 User plane UE to CS Core Network.
2.3 The UTRAN Interfaces
For the UTRAN, four interfaces are defined: two internal (Iur and Iub) and two external (Iu and Uu). Each interface
carries both user data and signaling. This document focuses on the control plane protocols (signaling).
UMTS Technical Note Page 24 of 83

25. 2.3.1 General UTRAN Interface Protocols Architecture
The protocols on each of the UTRAN interfaces have a general structure as shown below.
Figure 2.8 General structure of the UTRAN interfaces.
Each protocol stack is divided into an upper layer (the radio network layer) and a lower layer (the transport network
layer). The upper layers are used for applications and information that go beyond a particular interface, while the
lower layer ensures and conducts the transport of information on a particular interface.
2.3.2 Iu Interface
The Iu interface connects the UTRAN to the CN. The Iu interface is split up in three functional types of interfaces.
The Iu interface towards the CS domain is called Iu-CS. The Iu interface towards the PS domain is called Iu-PS.
The last core network domain is the BC domain and the interface towards that is the Iu-BC. The Iu-BC is not
covered by this document. The UTRAN is responsible for all radio-related aspects including mobility of a UE in
connected mode on cell level.
Figure 2.9 The Iu interface connects the UTRAN to the CN.
UMTS Technical Note Page 25 of 83

26. The CN is responsible for the end user service related aspects, including keeping track of the UE in idle mode on
location/routing area level.
The Iu interface supports a common set of RAB services that are offered by UTRAN to the CN nodes, regardless of
their type.
2.3.3 Iu-CS Protocol Stack
Figure 2.10 The Iu-CS control plane protocol stack.
The Iu-CS control plane protocol stack consists of a signaling bearer layer, the transport network layer, and an
application protocol on the radio network layer.
The broadband Signaling System No. 7 is used as signaling bearer for the Radio Access Network Application
Protocol (RANAP). This means that SCCP is used by RANAP. Both connectionless and connection oriented
procedures are used. Message Transfer Part 3b (MTP3b) is used by SCCP. SSCF-NNI and SSCOP and AAL5 are
interface protocols between ATM and SS7 protocols.
2.3.3.1 The Radio Access Network Application Protocol (RANAP) Layer
The RANAP encapsulates and carries higher-layer signaling, handles signaling between the 3G-SGSN and UTRAN,
and manages the GTP connections on the Iu interface.
UMTS Technical Note Page 26 of 83

27. RANAP provides UTRAN specific control/signaling including:
• The overall management of the RAB such as setup, release and maintenance
• Transport of NAS information between UE and CN, like MM and broadcast information
• Paging requests to the UE
• UE location information
• Error handling
• Overload handling
• Iu connection management
The RANAP is specified in 3G TS 25.413.
2.3.3.2 The Signaling Bearer Layer
The signaling bearer layer consists of several protocol layers:
• The SCCP provides connectionless and connection oriented services for the higher layer. Connections are made on a
mobile-by-mobile basis. SCCP is defined in ITU-T Recommendation Q.716
• MTP3b provides functions like message routing, signaling link management, load sharing, changeover and changeback
between links. MTP3b is defined in ITU-T Recommendation Q.2210
• Service Specific Co-ordination Function (SSCF-NNI). SSCF maps the requirements of the layer above to the
requirements of SSCOP. SSCF-NNI is defined in ITU-T Recommendation Q.2140
• Service Specific Connection Oriented Protocol (SSCOP) provides mechanisms for the establishment and release of
connections and the reliable exchange of information between signaling entities. SSCOP is defined in ITU-T
Recommendation Q.2110
• ATM Adaptation Layer (AAL5) adapts the upper layer protocol to the requirements of the lower ATM cells. AAL5 is
defined in ITU-T Recommendation I.363.5
Together the SSCF, the SSCOP and the AAL5 are also known as the Signaling ATM Adaptation Layer – Network
Node Interface (SAAL-NNI).
The signaling bearer layers below RANAP are defined in 3G TS 25.412.
2.3.4 Iu-PS Protocol Stack
The Iu-PS protocol stack is slightly different from the Iu-CS protocol stack. The operator has two stacks to choose
from for signaling: The operator can use the same stack as for Iu-CS, or the alternative IP over ATM based stack,
using M3UA (a special MTP3 adaptation protocol for use over IP), the SCTP and IP.
UMTS Technical Note Page 27 of 83

28. Figure 2.11 The Iu-PS protocol stack.
The figures in section 2.2.4 show the relation between the Iu-PS protocol stacks and the protocol stacks on other
UMTS interfaces.
2.3.4.1 The GPRS Tunneling Protocol for the User Plane (GTP-U)
This protocol tunnels user data between UTRAN and the 3G-SGSN, and between the GPRS Support Nodes (GSNs)
in the backbone network. GTP must encapsulate all PDP Protocol Data Units (PDUs). GTP is specified in 3G TS
29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer mentioned in section
2.4.2. However, different messages defined in the recommendation are used for the control plane (GTP-C) and the
user plane (GTP-U) applications.
2.3.4.2 The User Datagram Protocol/Internet Protocol (UDP/IP)
UDP/IP are the backbone network protocols used for routing user data and control signaling.
2.3.5 Iub Interface
The Iub interface is used by the CRNCs (or DRNCs) to request the setting up, adding or deleting of radio links in
the Node Bs. It is also used by the DRNC to perform radio resource admission control and hardware resource
control.
UMTS Technical Note Page 28 of 83

29. 2.3.6 Iub Protocol Stack
Figure 2.12 The Iub protocol stack.
The signaling bearer used by Node B Application Part (NBAP) comprises of SSCF-UNI on top of SCCOP and
AAL5. Together the three signaling bearer layers are called the Signaling ATM Adaptation Layer (SAAL). The
figures in section 2.2.4 show the relation between the Iub protocol stacks and the protocol stacks on other UMTS
interfaces.
2.3.6.1 The Node B Application Part (NBAP) Protocol Layer
The NBAP protocol, specified in 3G TS 25.433, is used on the Iub interface. Here it provides UTRAN specific
control/signaling e.g.:
• Handling and control of the measurements, performed by the UE
• Management of radio links and of common channel and resources
• Synchronization
• Error handling
2.3.6.2 User Plane Radio Network Layer Protocols
The user plane radio network layer on the Iub interface consists of a number of protocols. The structure reflects the
way the information is organized on the air interface, i.e. the data streams that are carried across the Uu interface.
These protocols are listed on the following page.
UMTS Technical Note Page 29 of 83

30. Detailed information on these channels is, however, outside the scope of this document:
• Common Packet CHannel Framing Protocol (CPCH FP)
• Uplink Shared CHannel Framing Protocol (USCH FP)
• Downlink Shared CHannel Framing Protocol (DSCH FP)
• Paging CHannel Framing Protocol (PCH FP)
• Forward Access CHannel Framing Protocol (FACH FP)
• Random Access CHannel Framing Protocol (RACH FP)
• Dedicated Transport CHannel Framing Protocol (DCH FP)
2.3.7 Iur Interface
The Iur interface is used by the SRNCs to request the setting up, adding or deleting of radio links in the DRNCs. It
also supports handover and synchronization. In order to minimize the equivalent of the inter-BSC handovers known
from GSM/GPRS, the Iur is used to enable inter-RNC soft handover. This is again to hide radio network functions
from the CN and in particular to avoid ping-pong effects, for example, UEs frequently changing back and forth
between two cells, on the CN.
2.3.8 Iur Protocol Stack
Figure 2.13 The Iur protocol stack.
The transport network layer part of the control plane protocols for the Iur are the same as those for Iu-PS. Again the
operator has a choice between two stacks. The radio network layer in the Iur protocol stack consists of the Radio
Network Subsystem Application Part (RNSAP) protocol.
UMTS Technical Note Page 30 of 83

31. 2.3.8.1 The Radio Network Subsystem Application Part (RNSAP) Protocol Layer
The RNSAP protocol is used on the Iur interface, where it provides UTRAN specific control/signaling e.g.:
• Relocation of SRNC
• Transport of NAS information between the UE and the CN, like MM and broadcast information
• Paging requests to the UE
• Management of transport channel resources (radio and physical links)
• Soft handovers
The RNSAP is specified in 3G TS 25.423.
2.3.9 Uu Interface
Figure 2.14 Radio interface protocol architecture (service access points marked by circles).
The Uu interface is the air interface between the UE and the UMTS network. The figures in section 2.2.4 show the
relation between the Iub protocol stacks and the protocol stacks on other UMTS interfaces.
UMTS Technical Note Page 31 of 83

32. 2.3.9.1 The Radio Resource Control (RRC) Protocol Layer
The RRC protocol, specified in 3G TS 25.331, is used between the UTRAN (the RNC) and the UE. It provides
functionality including:
• Broadcast of information
• Management of:
- RRC connection between the UE and UTRAN (establishment, release, maintenance)
- Radio Bearers (establishment, release, reconfiguration)
- RRC connection radio resources (assignment, release, reconfiguration)
• Mobility functions for the RRC connection
• Control of requested QoS
• Handling of UE measurement reports
• Outer loop power control (please refer to section 3.4.3.2)
• Control of ciphering
• Paging
• RRC message integrity protection
• Timing advance (Timing Division Duplex (TDD) mode)
2.3.9.2 The Packet Data Convergence Protocol (PDCP) Layer
The PDCP specified in 3G TS 25.323 is used in the user plane between the UTRAN (the RNC) and the UE. It
provides functionality including:
• Compression and decompression of header in IP data streams (e.g. TCP/IP and RTP/UDP/IP headers for IPv4 and IPv6)
• Transfer of user data between PDCP service users
2.3.9.3 The Radio Link Control (RLC) Protocol Layer
The RLC protocol is used for RLC connections between the UTRAN (the RNC) and the UE. There is one RLC
connection for each Radio Bearer (RB). The RLC protocol provides functionality including:
• Segmentation and reassembly of long upper layer PDUs
• Concatenation of short upper layer PDUs
• Transfer of user data including error correction and flow control
• In-sequence delivery of upper layer PDUs
• Sequence number checking
• Detection and recovery of protocol errors
• Ciphering
The RLC protocol is specified in 3G TS 25.322.
2.3.9.4 The Medium Access Control (MAC) Protocol Layer
The MAC protocol is just above the physical layer. It is used between the UTRAN (the RNC) and the UE. It
provides functionality including:
• Mapping between logical channels and transport channels
• Selection of appropriate transport format for each transport channel depending on instantaneous source rate
• Handling of priority between data flows of one UE and between UEs
• Multiplexing/demultiplexing of upper layer PDUs to and from the actual physical layer transport channels
The MAC protocol is specified in 3G TS 25.321.
UMTS Technical Note Page 32 of 83

33. 2.4 Core Network (CN) Protocols
This section discusses protocol stacks for all relevant interfaces in the CN, both the CS domain and the PS domain.
Again the focus will be on the control plan protocols (signaling).
2.4.1 The Mobile Application Part (MAP) Protocol
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR.
The MAP protocol (or a fraction of it) is used on a number of interfaces in the CN. TCAP, SCCP, MTP3, and MTP2
are transport protocol layers defined in Signaling System No. 7. The same protocols are used to support MAP in CS
PLMNs.
Figure 2.16 on the following page shows the services and functionality supported by the MAP protocol.
UMTS Technical Note Page 33 of 83

34. Services and Functionality Supported by the MAP Protocol
Mobility Supplementary Services Related
• Location management services • Register/erase/activate/deactivate/interrogate/invoke
• Paging and search supplementary services
• Access management services • Password services
• Handover services • Unstructured supplementary services support
• Authentication management services • Register/erase CC entry service
• Security management services
Short Message Service Management
• International mobile equipment identities • Send-routing-info-for-SMS service
management services
• Forward SMS
• Subscriber management services
• Report SM delivery status service
• Identity management
• Ready for SM service
• Fault recovery services
• Alert service center service
• Subscriber information services
• Inform service center service
Call Handling • Send info for SMS service
• Send routing information service
Network-Requested PDP Context Activation
• Provide roaming number service
• Send routing info for GPRS service
• Resume call handling service
• Failure report service
• Group call service
• Note MS present for GPRS service
• Provide SIWFS number
• SIWFS signaling modify Location Service Management (LCS)
• Set reporting state service • Send routing info for LCS service
• Status report service • Provide subscriber location service
• Remote user free service • Subscriber location report service
• Immediate Service Termination (IST) services
Operation and Maintenance
• Subscriber tracing services
• Other operation and maintenance services
Figure 2.16 MAP services as defined in 3G TS 29.002.
2.4.1.1 Interfaces using the MAP Protocol
SGSN – HLR (the Gr interface):
• The MAP protocol supports signaling exchange with the HLR, as defined in 3G TS 29.002, with enhancements for GPRS,
see 3G TS 23.060
SGSN– EIR (the Gf interface):
• The MAP protocol supports signaling between the SGSN and the EIR, as described in sub clause "Identity Check
Procedures" 3G TS 23.060
SGSN - SMS-GMSC or SMS-IWMSC (the Gd interface):
• The MAP protocol supports signaling between the SGSN and SMS-GMSC or SMS-IWMSC, as described in sub clause
"Point-to-point Short Message Service" 3G TS 23.060
GGSN– HLR (the Gc interface):
This optional signaling path allows a GGSN to exchange signaling information with an HLR. There are two
alternative ways of implementing this signaling path:
• If an SS7 interface is installed in the GGSN, the MAP protocol can be used between the GGSN and an HLR
• If an SS7 interface is not installed in the GGSN, any GSN with an SS7 interface installed in the same PLMN as the GGSN,
can be used as a GTP-to-MAP protocol converter to allow signaling between the GGSN and an HLR
UMTS Technical Note Page 34 of 83

35. 2.4.2 GSN – GSN Control Plane
Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces.
• GTP-C
- This protocol tunnels signaling messages between SGSNs and GGSNs (Gn), and between SGSNs in the backbone
network (Gp). GTP-C is used for location management and MM and is specified in 3G TS 29.060
• UDP
- This protocol transfers signaling messages between GSNs
2.4.3 SGSN - MSC/VLR
Figure 2.18 Control plane SGSN-MSC/VLR.
UMTS Technical Note Page 35 of 83

36. • Base Station System Application Part+ (BSSAP+)
- A subset of BSSAP procedures supports signaling between the SGSN and MSC/VLR, as described in 3G TS 29.018.
The requirements for the lower layers are specified in 3G TS 29.016
2.4.4 GSN – GSN User Plane
Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces.
• GTP-U
- This protocol tunnels user data between SGSNs and GGSNs (Gn), and between SGSNs in the backbone network (Gp).
GTP is specified in 3G TS 29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer
mentioned in section 2.4.2. However, different messages defined in the recommendation are used for the control
plane (GTP-C) and the user plane (GTP-U) applications
• UDP
- This protocol transfers user data between GSNs
UMTS Technical Note Page 36 of 83

37. 3. UMTS Network Functionality
This chapter provides an overview of the basic control signaling and node interworking.
The UE, the UTRAN and the CN operate in a number of states. Each state is characterized by the activity level and
thereby the resource requirements. In UMTS the changing resource requirements are supported by dynamic
allocation of resources. This gives better utilization of resources, reduced interference and extended battery life for
mobiles. The states also define the CN behavior towards the UE, for example terminate or reject an incoming call if
the UE is turned off, idle or already active.
A set of elementary procedures controls the state changes and allocation of resources as required. Mobility
Management (MM) and Radio Resource Management (RRM) such as handovers enable the UE to move seamlessly
around in the network.
One of the characteristics of UMTS is that elementary procedures can be combined in different ways to implement a
complete service. The specifications also enable the same thing to be done in several ways.
In addition to describing the elementary procedures, MM and RRM, examples are used to explain the general
signaling procedures for a number of services. The detail level is selected to provide a functional overview.
3.1 User Equipment (UE) and Network States
When the UMTS UE is turned on, it will enter IDLE mode. It will start the cell search mechanism scanning the
UMTS band for a cell with broadcast information matching the list of allowed PLMNs. When a suitable cell is
found, the UE will camp on this cell and request initial access to the UTRAN to attach to the network and enter the
CONNECTED state. Once attached the UE will be known/registered to the network and can access the services
offered. This mode of operation is also known as Camping on UTRAN Cell.
Multimode UEs are able to operate on existing GSM/GPRS networks in addition to the UMTS network. When no
UMTS network is available, the UE may operate on a GSM/GPRS cell. This mode of operation is also known as
Camping on GSM/GPRS Cell.
The UE may also feature intersystem handovers and Location Updates (LUs).
The following state descriptions apply when the UE is camping on UTRAN cell.
3.1.1 Circuit Switched (CS) Mobility Management (MM) States
In CS mode the UE and CN operate in three states as shown below, similar to GSM behavior.
Figure 3.1 UE and CN MM states.
UMTS Technical Note Page 37 of 83

38. When the UE is turned on and performs an IMSI Attach it goes from MM-DETACHED to MM-CONNECTED and
then to MM-IDLE, when the IMSI Attach is successfully completed. In MM-IDLE state the UE is registered in the
CN by Location Area (LA) but not registered in the UTRAN.
When a call is started or when performing location updating the UE goes back to MM-CONNECTED until
completion of the call/transaction.
When the IMSI Detach is performed the state is changed to MM-DETACHED. In MM-CONNECTED state the UE
will be registered in the UTRAN by cell ID and in the CN by the Iu connection ID.
3.1.2 Packet Switched Mobility Management (PMM) States
In PS mode the UE and CN operate in three states as shown below.
Figure 3.2 UE and CN PMM states.
When the UE performs a GPRS Attach, it goes from PMM-DETACHED to PMM-CONNECTED, and then to
PMM-IDLE when the GPRS Attach is successfully completed and the signaling connection is released.
In PMM-IDLE state the UE is registered in CN by Routing Area (RA) but not registered in the UTRAN.
When a new service is requested or when performing Routing Area Updates (RAUs) it goes back to PMM-
CONNECTED until completion of the service/transaction. In PMM-CONNECTED state the UE will be registered
in the UTRAN by cell ID and in the CN by the Iu connection ID.
When the PS Detach is performed the state is changed to PMM-DETACHED.
UMTS Technical Note Page 38 of 83

39. 3.1.3 Radio Resource Control (RRC) Service States
Figure 3.3 RRC states.
Depending on the type of connection and the traveling speed, the UE may be in one of several different states. This
is handled by the RRC states, controlled by the RNC. In Idle mode the UE has no active connections. In Connected
mode the UE may be in one of four RRC states:
• The Cell_ FACH (Forward Access CHannel) state is used for communication over common channels with limited
bandwidth, e.g. IMSI Attach and LU
• The Cell_DCH (Dedicated CHannel) state is used for communication over allocated dedicated channels like voice
call and data transmission. In this state the UTRAN will perform handovers for CS QoS and Cell Update for PS
QoS
• The Cell_PCH (Paging CHannel) and URA_PCH states are used when there is no data to send. The UE will only
listen to the Paging Channel thus minimizing battery load. In the Cell PCH state the UE will perform Cell
Updates whereas in the URA_PCH state the UE performs the less frequent UTRAN Registration Area (URA)
Updates. (Refer to section 3.3.3 for descriptions of locations.) The advantage of the latter is increased power
savings and the sacrifice is that paging is required. E.g. URA_PCH is preferred to Cell_PCH when the UE is
moving at high speed to minimize frequency of location updating procedures
3.1.4 UE State Overview
Figure 3.4 summarizes the UE and RRC states. The location of the UE will be known by the network in varying
resolution. Depending on the actual state the UE will be registered in different databases and with different
accuracy. Based on the state and the type of active connection either the UE or the UTRAN will select which cell to
camp on. Refer to section 3.3.3 for descriptions of locations.
UMTS Technical Note Page 39 of 83