NEC Femtocell Solution Femto Specific Features

Ref: NEE0858555 Date: 5th Jan. 2011

Copyright
Copyright 2011 by NEC Europe. All Rights Reserved. This material is protected by the copyright laws of the United Kingdom and other countries. It may not be reproduced, distributed, or altered in any fashion by any entity, except in accordance with applicable agreements, contracts or licensing, without the express written consent of NEC Europe.

Revision History
Date
28/08/2008 16/07/2009

Issue
1.00 2.00

Author
NEC NEC First Release Update

Amendment Details

2 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

1.
1.1

TABLE OF CONTENTS
Glossary.................................................................................................................................... 4

2.

FEMTO SPECIFIC FEATURES ............................................................................ 7

2.1 Auto Configuration .................................................................................................................... 7 2.1.1 Fast Sniff Mode ........................................................................................................................ 8 2.1.2 Power Management ................................................................................................................. 9 2.1.3 Neighbour Cell List Configuration ............................................................................................. 9 2.1.4 FAP & UE Registration Procedure ......................................................................................... 10 2.1.4.1 Femtocell Registration Procedure ........................................................................................ 10 2.1.4.2 Femtocell Discovery Procedure ............................................................................................ 11 2.1.4.3 UE Registration Procedure ................................................................................................... 12 2.2 Service Access Control by FAP ............................................................................................. 14

2.3 Air Synchronisation ................................................................................................................. 16 2.3.1 2G/3G Macro Cell Offset ........................................................................................................ 16 2.3.2 IP Timing Server ...................................................................................................................... 17 2.4 2.4.1 2.4.2 2.4.3 2.5 2.6 2.7 Home Coverage Indication ..................................................................................................... 18 Equivalent PLMN Methodology .............................................................................................. 18 MM Information ....................................................................................................................... 19 Home Zone Tone .................................................................................................................... 19 Emergency Call ...................................................................................................................... 19 FAP Location Change Detection ............................................................................................ 21 Differentiated Billing ................................................................................................................ 22

2.8 Data Offload ........................................................................................................................... 24 2.8.1 Local data Offload (Offload from FAP) ................................................................................... 24 2.8.2 Offload from SeGW (Network Data Offload) .......................................................................... 25

3 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

1.1 Glossary
Definition Second Generation Third Generation Authentication, Authorisation, Accounting Access Point-Management and Provisioning System Active Server Page Billing Rate Indicator Base Transceiver Station Call Detail Report Connectivity Session Location Function Common Pilot Channel Downlink Monitor Mode Digital Subscriber Line Digital Subscriber Line Access Multiplexer Femto Access Point Home Public Mobile Network Identity IP Network Controller International Mobile Subscriber Identity Internet Service Provider Location Area Location Area Code Local Area Network Location Area Identifier Media Access Control Mobile Country Code Mobility Management Mobile Network Code 4 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

Abbreviation 2G 3G AAA AP-MS ASP BRI BTS CDR CLF CPICH DLMM DSL DSLAM FAP HPLMN ID INC IMSI ISP LA LAC LAN LAI MAC MCC MM MNC

5 Jan. 2011

th

Mobile Network Operator Mobile Switching Centre Mobile Station International Subscriber Directory Numbers Network Time Protocol Part Per Billion Part Per Million Personal Computer Public Land Mobile Network Public Safety Answering Point Quality of Service Radio Access Bearer Radio Access Network Gateway Radio Frequency Radio Resource Management Received Signal Code Power Receive Signal Strength Indicator Routing Area Identifier Service Area Service Access Control Service Area Identitier Security Gateway Subscriber Identity Module SubChannel Number System Information Block Short Message Service Telecommunication and Internet converged Services and Protocols for Advanced Networking Universal Equipments UMTS Absolute Radio Frequency Channel Number

MNO MSC MS ISDN NTP Ppb Ppm PC PLMN PSAP QoS RAB RAN GW RF RRM RSCP RSSI RAI SA SAC SAI SeGW SIM SCN SIB SMS TiSPAN

UEs UARFCN

5 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

Unlicensed Mobile Access Universal Mobile Telecommunications System UMTS Terrestrial Radio Access Network Universal Subscriber Identity Module Extensible Markup Language

UMA UMTS UTRAN USIM XML

6 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

2. FEMTO SPECIFIC FEATURES 2.1 Auto Configuration

Femto Access Point (FAP) is a zero touch, full plug and play, self-configuring system. When FAP is switched on for the first time, it will perform four stages of radio auto configuration. Stage 1 : Download of Access Point-Management System (AP-MS) Parameters During the initial start up, the defined "rule set" by AP-MS will be downloaded to FAP. The "rule set" are permitted Radio Frequency (RF) carrier/scrambling codes, absolute maximum downlink transmitter power, absolute maximum Uplink transmitter power and the threshold (minimum signal and noise ratio). Stage 2 : Initial Downlink Monitor Mode (DLMM) At power on the FAP initiates the DLMM. This is a physical layer function and one of its tasks is to calculate the Common Pilot Channel (CPICH) Received Signal Code Power (RSCP) values of all surrounding FAPs and macro layer node Bs for all carrier frequencies supplied by the AP-MS for this purpose. It also measures the Receive Signal Strength Indicator (RSSI) for all the available carriers. The carrier exhibiting the lowest interference is typically selected. The FAP chooses the carrier frequency in the following order of preference. Attempt to select a clear (unused) carrier if available. If not, then attempt to select a carrier only used by FAPs. If not available, then select the carrier with lowest Macro RSCP power. If not available, then raise an alarm which is viewable in the management system. In the event that no CPICH signals are detected on any carrier, the carrier with the lowest RSSI is selected. Once the carrier has been selected, the FAP follows the following logic to choose a scrambling code from the list of allowed FAP scrambling codes the FAP selects a scrambling code unused by other FAPs. If all scrambling codes are already in use, the code with the lowest CPICH RSCP value is selected. If more than one scrambling code is available the FAP randomizes the selection to minimize the probability of two collocated FAPs selecting the same code. If CPICH RSCP of all allowed codes exceeds a certain threshold, then the FAP raises an alarm which is viewable through the AP-MS. The alarm threshold is configurable through the AP-MS. Approximately six scrambling codes are considered to be sufficient even for dense deployments when taking into consideration the natural diversity caused by multiple Universal Mobile Telecommunications System (UMTS) frequencies, UMTS operators and market penetration Stage 3 : Downlink and Uplink Power Adaptation During the auto configuration phase, the carrier/scrambling code will be selected and the downlink (FAP) and uplink (UE) transmitter power are adjusted to minimise interference. Downlink Power Adaptation - Tend to start with a higher downlink transmit power and adapt downwards. - UE measurements of the FAP CPICH Ec/Io, FAP CPICH RSCP and macro layer CPICH Ec/Io are carried out for all calls (data and voice).

7 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

- FAP path loss, FAP/macro layer CPICH signal quality histograms from measurement reports are created. - The downlink power adaptation algorithm attempts to maintain a FAP CPICH Ec/Io dominance for 90% for all CPICH measurements. - Adaptation requires approximately 10 minutes of calls to reach optimal power. - System Information Block (SIB) refresh if power is adapted. Uplink Power Adaptation - Tend to start with a lower uplink transmit power and adapt upwards. - From FAP UE to macro layer path loss measurements create histogram. - Maximum uplink transmit power is set using the same approach as the initial uplink power setting but using lowest 1% path loss sample. Stage 4 : Ongoing fast sniff mode measurements and rate adaptation algorithms Fast Sniff Mode - Carried out once every 100 seconds by stealing single downlink frame from any UMTS carrier, could be different carrier every 100 seconds. - Validate initial carrier and code selection decisions (i.e. detect deployment of new collocated FAPs, relocation of FAP). Result in error messages or FAP initiates full DLMM. - Use macro layer NodeB to train FAP to +/-0.1ppm accuracy. Rate Adaptation Algorithm - FAP uplink and downlink data rates are continuously adapted as a function of uplink or downlink interference. Rate adaptation carried out on a per FAP UE basis. - Rate adaptation is required to respond quickly to changes in local changes in interference (i.e. near/far effect as either macro layer UE or FAP UE approaches the FAP). - Interference is monitored through the physical layer uplink reports or downlink power allocation.

2.1.1 Fast Sniff Mode

The FAP will re-configure itself in regular intervals in order to continuously monitor the RF environment. If required, FAP will tune uplink and downlink transmit power to suit surrounding environment. It will also initiate reconfiguration if quality parameters fall below threshold levels. The 3G fast sniff mode is one of the important processes used for RF management between FAP and its surrounding macro layer. 3G fast sniff mode is run during normal operation when the FAP is not supporting any calls. This mode will be carried out at regular intervals (configurable by the AP-MS) during the operation of the FAP. The FAP determines when to carry out the fast sniff mode and will ensure that there is a no service interruption. In this mode approximately one downlink frame is stolen from the uplink every 100 seconds when the attached UEs are in idle mode. From the frame of data, RF measurements such as CPICH RSCP and CPICH Ec/Ior for particular neighbour cells are calculated to determine whether there have been changes in the local environment (i.e. new scrambling codes detected). The sniff mode is also used to calculate the frequency offsets from surrounding macro nodeBs from any operators network in order to correct for frequency drift in the FAPs local frequency reference.

8 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

The 2G fast sniff mode is needed when there is no 3G macro coverage. FAP needs to ensure that the user have coverage when they roves out/ handout to the macro network. 2G sniff mode is a process for FAP to sense the 2G macrocell environment.

2.1.2 Power Management

Power management is used to minimize the interference to the macro Layer and surrounding FAPs, it is important to manage the maximum uplink and downlink power settings as part of the power control Radio Resource Management (RRM) algorithms. Since radio planning of individual FAPs is not possible the FAP contains a downlink listen mode (DLMM/fast sniff mode) which measures the interference levels of surrounding node Bs and FAPs. Using listen mode the FAP selects the carrier and scrambling code of lowest interference and then sets the initial maximum uplink and downlink transmit power levels. During the first calls the FAP UE measurements of the active and neighbour cells are used to adapt the maximum uplink and downlink transmit power levels.

2.1.3 Neighbour Cell List Configuration

The FAP uses the DLMM/fast sniff mode to measure the macrocells signal strength and decode its broadcast system information. 3G Neighbour Macro Cells Creation When FAP is initialised it will scan the UMTS Terrestrial Radio Access Network (UTRAN) carriers belonging to the operator (this information is provided by AP-MS). The FAP detects the surrounding Third Generation (3G) neighbour cells and use this information to build an intra-frequency and inter-frequency neighbour cell list. The FAP will decode each of these detected cells Broadcas t Information to obtain its 28-bit Cell Identity, along with Location Area Identifier (LAI) and Routing Area Identifier (RAI). The cell identity helps uniquely identifying a cell in a Public Land Mobile Network (PLMN), which is needed during handover to identify a target cell. The FAP also decodes the necessary Broadcast Information (e.g. SIB 11) of strongest macro cell to obtain its Neighbour Cell List, this helps to derive other neighbour cells. The FAP measures the signal strength of these derived cells and tries to decode the Broadcast Information to obtain their cell identities. The FAP collates the detected and derived Neighbour cells into a list in following manner. Distribute the cells into two streams: Intra and Inter Frequency Neighbour Cells lists. In each list, sort the cells starting with Higher Signal Strength detected by Scanning the Carrier and Scrambling Codes and for which FAP has decoded the corresponding Cell Identities. Append additional Neighbour Cells as obtained from Broadcast Information (i.e. from macro cell Neighbour Cell List of strongest Macro Cell) for which Cell Identities are decoded successfully. Now append additional Neighbour Cells as obtained from Broadcast Information (i.e. from macro cell Neighbour Cell List of strongest macro cell) for which Cell Identities could not be decoded. The Neighbour Cell List size is limited to 10 for intra frequency and inter frequency respectively hence only first 10 strongest cells added in the list and rest are discarded. 2G Neighbour Macro Cells Creation The list of 2G neighbour cells are collated by following ways: Obtain the 2G Neighbour Cell list as broadcast by 3G macro cell (i.e. derived from 3G macro cell Neighbour Cell List). 9 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

 Decode the Broadcast information of these 2G cells to obtain their Cell Global Identities. Sort the Cells based on their measured signal strength. In the situation when 3G macro cell is either unavailable or does not 2G Cells in the Neighbour Cell List. FAP uses 2G sniff mode functionality to scan the 2G frequencies and include those cells belonging to operator (based on PLMN ID) in the Neighbour Cell list. Similar to above, FAP decodes the Broadcast Information of these detected Cells to obtain Cell Global Identities. These cells too are sorted based on their signal strengths. Inclusion of Neighbour Femtocells/FAPs FAP does not populate the neighbour femtocells in Neighbour Cell List. This functionality is incorporated in SME feature in Release 2.

2.1.4 FAP & UE Registration Procedure

When the FAP initializes, the FAP creates a Secure Association (IPsec tunnel) with the Security Gateway, contacts the AP-MS to download any new parameters, software, access lists etc, scans the air interface. And then the FAP attempts to register with the INC. UE also needs to be registered in the INC. The INC maintains a context for each Femtocell and each UE registered with the system.

2.1.4.1 Femtocell Registration Procedure

NEC femtocell system utilizes the standard 3GPP GAN Registration procedure to register each FAP with the Default HNB GW. The FAP Registration Procedure is described below.

Figure 1: FAP Registration procedure The FAP performs a Public DNS query (via the generic IP access network interface) to resolve the Default/Serving SeGW FQDN to an IP address. The DNS Server returns a response including the IP Address of the Default/Serving SeGW. The FAP establishes a secure tunnel (IPsec tunnel) to the Default/Serving SeGW. The FAP performs a private DNS query (via the secure tunnel) to resolve the 10 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

FQDN of the Default/Serving INC to an IP address. The DNS Server returns a response containing the IP address of the Default/Serving INC. The FAP then sets up a TCP connection to the INC and attempts to register on the INC by transmitting the GA-RC REGISTER REQUEST. The message contains (e.g.): Registration Type: Indicates that the registering device is a FAP. This is indicated using the GAN Classmark IE. Cell Info: Neighbouring UTRAN/GERAN cell ID retrieved as a result of system scan for neighbour information. The physical MAC address of the FAP: AP-ID. FAP Identity: IMSI.

If the INC has been configured for Service Access Control (SAC) over S1 interface, the INC will via an external business logic system authorize the FAP using the information provided in the REGISTER REQUEST. (See 2.3.2) If the INC accepts the registration attempt it responds with a GA-RC REGISTER ACCEPT. The message contains: GAN Femtocell specific system information (e.g.): Location-area identification comprising the mobile country code, mobile network code, and location area code (i.e. the Super Location Area code) corresponding to the Location Area into which the FAP is placed in the Core Network GAN Femtocell Capability Information indicated via the use of GAN Control Channel IE.

In this case the TCP connection and the secure IPsec tunnel are not released and are maintained as long as the FAP is registered to this INC. Alternatively, the INC may reject the request. In this case, it responds with a GA-RC REGISTER REJECT indicating the reject cause. The TCP connection and the secure IPsec tunnel are released and the AP is not attached to the network. Alternatively, if the INC wishes to redirect the FAP to (another) Serving INC, it responds with a GA-RC REGISTER REDIRECT providing the FQDN or IP address of the target Serving INC and the associated SeGW. In this case the TCP connection is released and the secure IPsec tunnel is optionally released depending on if the network indicates that the same IPsec tunnel can be reused for the next registration. The Registration procedure is performed at the following times: Each time the FAP is switched on or rebooted Each time the FAP must reconnect to the network after having suffered an outage in the IP path between the FAP and the HNB GW

The act of FAP registration creates a context for the FAP at the INC containing the IP address of the FAP, its identity (e.g. the IMSI or other identity field) and the CN-facing identifiers that have been allocated to the FAP for the duration of its session. These latter include the Super Location Area Identifier and the Service Area Code. Generally, all UEs attaching to the network through this FAP will inherit the same set of CN identifiers in their registration contexts.

2.1.4.2 Femtocell Discovery Procedure

The FAP initiates the discovery procedure when it does not have a valid default RAN Gateway information. In this case, the FAP must communicate with the Provisioning RAN Gateway for its default RAN Gateway assignment. This situation normally occurs when the FAP attempts to access the femtocell access network for the first time.

11 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

Figure 2: Discovery procedure The FAP has a provisioned Provisioning SeGW FQDN and performs a Public DNS query (via the generic IP access network interface) to resolve the Provisioning SeGW FQDN to an IP address. Then DNS Server returns a response including the IP Address of the Provisioning SeGW and the FAP proceed the establishment of a secure tunnel (IPsec tunnel) with the Provisioning SeGW. Then the FAP tries to access INC in femtocell access network. Since the FAP also has a provisioned Provisioning INC FQDN, the FAP performs a private DNS query (via the secure tunnel) to resolve the FQDN to an IP address. The DNS Server returns a response including the IP Address of the Provisioning INC. Then the FAP sets up a TCP connection to a well-defined port on the Provisioning INC. It then queries the Provisioning INC for the Default INC, using GA-RC DISCOVERY REQUEST. The message contains Cell Info (If the FAP detects macro network coverage, then it provides the detected macro UTRAN/GERAN cell ID and the UTRAN/GERAN LAI. If the FAP does not detect macro network coverage it provides the last LAI where the FAP successfully registered), IMSI and the physical MAC address of the FAP The Provisioning INC returns the GA-RC DISCOVERY ACCEPT message, using the information provided by the FAP (e.g. the macro cell ID), to provide the FQDN of the Default INC and its associated Default SeGW. This is done so the FAP is directed to a "local" Default INC in the HPLMN to optimize network performance. The DISCOVERY ACCEPT message also indicates whether the INC and SeGW address provided shall or shall not be stored by the FAP. If the Provisioning INC cannot accept the GA-RC DISCOVERY REQUEST message, it returns a GA-RC DISCOVERY REJECT message indicating the reject cause. Then the secure IPSEC tunnel established between the FAP and the Provisioning SeGW is released.

2.1.4.3 UE Registration Procedure

Once the FAP has registered in INC, the FAP begins transmitting on the air interface. When a UE attempts to camp on the FAP, the FAP traps the Location Update message from the UE, performs a local white-list IMSI check (if closed user groups are in use), sends a proxy GAN Registration Request on behalf of the UE to the INC and accepts or rejects the UE based on the GAN Registration response When the INC receives a UE Registration Request, INC optionally sends the UE registration information to an external logic server for network based access control (e.g. is this UE allowed to access this Femtocell?) Network-based Access Controls

12 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

potentially provide greater flexibility in the service model than a pure Femtocell based Access Control. Additionally, the security of the femtocell system is enhanced Sets certain parameters and identifiers for the UE context (e.g. Super LAC, Super SAC etc.) These parameters may be modified per UE class, e.g. for differential billing purposes where an owner may be billed at a different rate to a visitor Returns a Registration Accept or Reject to the Femtocell (note there is no redirection case for the UE)

When the INC has successfully registered the UE, the FAP forwards the original UE Location Update message to the CN and CN authenticates the UE. If authenticated, the CN initiates a Security Mode procedure to send ciphering information to the FAP for the UE session.

Figure 3: UE Registration

13 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

2.2 Service Access Control by FAP

The NEC femtocell access network implements different service access control mechanisms for FAP and UE. Two service access control methodologies can be implemented in NEC femtocell solution. The FAP together with the database enables femtocell-based Service Access Control (SAC) for UEs. The SAC at FAP provides: Authorization services for UE (Owner and Guest) registration with the femtocell network Registration parameters for Guest UE registration duration Configurable Emergency services for all UE The Authorized_UE_List is maintained on the femtocell and femtocell database updated via TR-069.

The FAP supports open/semi-open/closed access modes. Open Access Mode In the open access mode, the FAP does not maintain a local list of authorised UEs. All requests from UEs attach to the FAP are referred to the RAN GW. The FAP will accept or reject UEs according to the response received from the RAN GW. The access control is performed by IP Network Controller (INC). Semi-open access mode: This mode combines both previous modes by maintaining a local list of authorised UE and also by referring requests to attach from any unknown UEs to the core network before accepting/rejecting the UE. This mode permits preferential treatment for registered UEs above the open access UEs. Closed Access Model In the closed access mode, the FAP is configured by the AP-MS with the list of allowed UE or locally registered user list. This list consists of International Mobile Subscriber Identities (IMSIs) and always includes the IMSI of the femtocell subscribers (i.e. the account holder). The successfully screened UEs will then proceed with access control procedures with INC and core network. The closed access mode will allow up to 50 UEs in the FAP access list, however, the list size is operator configurable at AP-MS and maximum value of 10 or 20 is more typical.

The FAP access rejection of unauthorised UE mechanism is necessary because the mechanism can reduce UE battery being drained can reduce signalling load on FAP can maintain UE reachability on macro layer The FAP access control and rejection of unauthorised UE takes place when the UE performs the initial location updating request towards the FAP. This relies upon the UE always triggering a location updating procedure when the UE first camps on the FAP.

14 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

UE

ZAP FAP

RRC connection establishment MM: LOC UPDATING REQ (old LAI, old TMSI) GMM: ROUTING AREA UPDATE REQ (old RAI, old P-TMSI)

MM: IDENTIFICATION REQUEST (ID type = IMSI) MM: IDENTIFICATION RESPONSE (IMSI_UE)

ZAP determines UE is not authorised for access

ZAP PLMN ID = macro NW PLMN ID?

Yes MM: LOCATION UPDATING REJECT (Reject cause = 15 No Suitable Cells In Location Area)

No

MM: LOCATION UPDATING REJECT (Reject cause = 13 Roaming not allowed in this location area)

Figure 4 : Unauthorised UE rejection and barring When the UE decides to camp on the FAP it will detect the change of location area and perform a Location Update procedure. At this time the FAP will locally trigger the Mobility Management (MM) Identification procedure to determine the UEs IMSI. If the IMSI is not authorised according to local policy (the FAP contains a list of authorised users/IMSIs provisioned though the AP-MS) the FAP will locally generate a Location Update Reject message with Cause value = 15 No Suitable Cells In Location Area (if PLMN ID of AP= macro HPLMN PLMN ID) or Cause value = 13 Roaming not allowed in this location area (if PLMN ID of AP<> macro HPLMN PLMN ID). The UE will then return to the macro network. If the UE is locally authorised then the FAP will proceed to register the UE with the INC. At this stage the INC will contact the AAA server for authorisation. If the authorisation fails then the INC will reject the registration which will trigger the FAP to locally generate a Location Update Reject message with Cause value = 15 No Suitable Cells In Location Area (if PLMN ID of AP= macro HPLMN PLMN ID) or Cause value = 13 Roaming not allowed in this location area (if PLMN ID of AP<> macro HPLMN PLMN ID). The UE will then return to the macro network. The UE will thus place the FAP location area in the forbidden location areas for roaming" list and will not attempt to camp on the FAP for as long as the location area is part of the list. Since these lists are only erased when the UE is switched off or when the SIM/USIM is removed, and periodically (with period in the range 12 to 24 hours) - this guarantees that an un-authorised UE does no repeatedly attempt to camp on the FAP because as long as the FAPs location area is in that list the UE will not consider the FAP as a suitable candidate for cell selection/reselection. If the FAP is operating in open access mode then FAP will attempt to register the UE to the INC. The INC requests authorisation querying the AAA server with the IMSI of the FAP and the IMSI of the UE. (see 2.1.4.3)

15 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

2.3 Air Synchronisation

Air synchronisation is built on two distinct oscillators: one TCXO and one VCXO as shown in Figure 1. Calibration function is controlled either through the macro layer listen mode/sniff mode measurements (once every 100 seconds) or through IP Timing network time protocol (NTPv4). In normal conditions, the accuracy of the air synchronisation is +/- 0.1 ppm.
0.1ppm

TCXO
26MHz

Calibration Function

Frequency Synthesizer

VCXO

19.2MHz

Aging Correction Inputs

Listen Mode

IP Timing

Figure 1 : TCXO and VCXO in AP

2.3.1 2G/3G Macro Cell Offset

There are two limitations to the fast sniff mode. The FAP must be in the coverage of the macro network, a 3G cell or a 2G cell. The conditions of coverage are less strict than the usual UE camping coverage, as the FAP only requests timing information. The node B/BTS must be configured to deliver at a minimum a frequency accuracy of +/- 50ppb. In the fast sniff mode, the FAP can tune to any of the available downlink frequencies and extract the frequency offset from the surrounding nodeBs and from a local embedded temperature controlled crystal oscillator. This frequency offset is then used in a frequency synthesizer function to train the FAP voltage controlled crystal oscillator. The unique implementation of fast sniff mode enables the FAP to listen to multiple source types (3G macro, 2G macro) and multiplex their inputs through an internal algorithm in order to (re)condition its frequency synthesizer every 100 sec. A similar process is performed in IP Timing Mode where the FAP extracts the compared frequency from a network IP Timing Server. The 3G macro cell offset feature is available in Release 1.0 whilst the 2G macro cell offset is planned for Release 2.0.

16 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

2.3.2 IP Timing Server

The FAP, when there is no sufficient macro coverage, retrieves its synchronisation information from the IP core network. This method, called IP Timing uses the same crystal oscillator calibration function, or synthesiser, as the one used under macro coverage. The frequency acquisition model is based on Request/Retrieve Model: Available in Release 1.0 Subscription Model (Push Model): Available in Release 4.0

Macro network

e etriev est/R u q e l R Mode

Public NTPv4 Stratum 1 Server

Subscri pti

on Mod e

Proprietary NTPv4 Server

Figure 2 : FAP IP Timing Models

Request/Retrieve model retrieved from a IP Timing server. This IP timing function, based on a simplified version of the NTPv4 protocol with substantially reduced packet rates, makes use of two jitter nonsensitive digital calibration functions, one for initialization based on a highly efficient fast timing algorithm, focusing on fast convergence of the frequency to the required accuracy and one for oscillator aging control, focusing on backhaul bandwidth savings. The Subscription model, mono-directional, using a lightweight NTPv4 protocol, presents the advantage of not using any upstream bandwidth which is crucial for asynchronous networks, such as Digital Subscriber Line (xDSL), using guaranteed rate for critical data (synchronization and voice). The solution should ideally be using end-to-end Quality of Service (QoS) and assign the highest priority to the IP timing packets. As the IP Timing synchronization is highly core IP network dependent, this IP network in most cases not being controlled by the Mobile Network Operator (MNO), it required a more IP network independent mechanism than the ones usually used. The IP timing function makes use of two jitter non-sensitive digital calibration functions. The mechanism is latency dependent, as long as it remains in an order of magnitude, compared to the average perceived latency, less than 1ms. The algorithm can cope with a major change of latency, more than 1ms, as the associated standard deviation will be too large and will result in the sample being discarded. For latency modifications of less than 1ms, it will affect convergence of the synchronisation function as the standard deviation will consider the samples as having more or less jitter. The mechanism can also make use of multiple IP Timing servers to get a much more accurate accuracy, by determining the IP Timing servers with the smallest standard deviation.

17 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

In order to control the convergence of IP Timing algorithms and load on the DSL backbone, parameters are available on both master and/or slave depending on the model implemented: Number of packets per burst Interval between intra-burst packets Inter-burst interval Nevertheless, any configuration change will affect the algorithm behaviour, this one will need to converge again to synchronization. It can take about 10 minutes. However, the real synchronisation will run in a holdover mode and wont affect any service as long as bandwidth is available.

2.4 Home Coverage Indication

Home zone indication is an important feature in the femtocell solution. The main benefit of home zone indication is to allow end users to be aware of their serving network. By knowing which network their handset/UE is camped on (i.e. the 3G macro cell or 3G femtocell) the end users will be able to make an informed choice in their service usage. The various methods to enable home coverage indication are listed as below. All these methods are controlled by the FAP and is transparent to the core network.

2.4.1 Equivalent PLMN Methodology

The Equivalent PLMN methodology is implemented by identifying an alternative PLMN ID to femtocell network. In this method, a unique Mobile Network Code (MNC) is assigned for the femtocell network identification. As shown in the Figure 3, the MNC for femtocell identification is +01.
Lookup table In USIM/UE PLMN ID LAC LAI broadcast by serving cell
PLMN ID UE display in femtocell

Operator Network Assignment Femtocell or MCC +MNC (+02) Macro cell or Operator Macro Network
UE display in macro cell

Home Zone

MCC + MNC(+01)

Figure 3 : Alternative PLMN Identifier to display femtocell coverage The Equivalent PLMN benefits are: It uses existing procedures and principles. It requires no UE modification. It provides real-time indication whenever UEs transition between femto and macro network in idle mode. It works with both Subscriber Identity Module (SIM) and Universal Subscriber Identity Modules (USIMs).

18 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

2.4.2 MM Information
The second methodology to achieve home zone indication is by usage of MM-INFORMATION message. MM INFORMATION can be signalled by the network at anytime during radio resource connection. This MM methodology can be achieved by: Configuring the serving network to trigger an MM-INFORMATION procedure towards the UE immediately after the UE performs a successful location update procedure. The MM-INFORMATION message contains an appropriate network name field to distinguish whether the UE is served by the femto network or the macro network. The UE uses this text to overwrite the network name field on its display (as this takes preference over the name derived from the registered PLMN). The MM-information methodology benefits are : It provides real-time and persistent indication. It allows a customised network name text to be configured on a per femtocell access point basis this could be meaningful and representative of the customer, and offered as a value added service.

2.4.3 Home Zone Tone

Home zone tone is another way to indicate to the user that the UE is camped on the FAP. This method is applicable to both connected and idle mode. It is especially useful when the user is not looking at the UEs display. Home zone tone can be implemented by the FAP inserting a tone into the audio path in the following two circumstances. Circuit Switched Service Handover (Connected Mode Transition) The FAP can be configured to inject a tone into the speech path when it is carrying out a hand over request between the FAP and macro (i..e hand in or hand out). This is used to inform the user that they are entering (hand in) or leaving (hand out) femtocell coverage.

Call Setup (Idle to Connected Mode)

When the user makes a call in the femtocell, the FAP will play a short audio file (e.g. with short tone sequence) during the call set up to indicate that the user is attached to the FAP. The audio file can be defined by the operator and configured in the AP-MS. Packet Switched Service Home Zone Packet Switched Session Notification The home zone Packet Switched session can be notified when the FAP sends a Short Message Service (SMS) Class 0 message to the UE to show that the UE is using the FAP for the PS session.

2.5 Emergency Call

FAP supports emergency call and its routing can be achieved by assigning a SAC to FAP. Figure 4 illustrates the emergency call routing mechanism. The SAC is assigned for FAP at the INC registration. INC passes the FAP SAC to Mobile Switching Centre (MSC) on each call setup message including emergency calls. If the emergency call is initiated, MSC will reroute call to correct Public Safety Answering Point (PSAP) based on called number and SAC (e.g. PSAP center A is assigned for femtocell SAC 900). 19 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

Country Code (CC): 123 Network Code (NC): 321 Location Area (LA): 353 Femto Service Area (SAC):

Femtocell SAI

Called Digits: 112 SAC

900

Center
A

300 to 350 900 400 to 450 901

Femto SAC 900 UMTS SAC: 323

IP IP Access Access

INC

3 2

PSAP A

Femto SAC 901 UMTS SAC: 405

RNC

MSC
PSAP B

Figure 4 : Emergency Call routing based on femtocell SAC Figure 5 is an illustration of how the emergency area is mapped with service area and Figure 6 shows the super LA/RA/SA mapping table. The femtocell reports the strongest macro cell information to the INC during registration.

RNC
(RNC 5)

Emergency Area 1

RNC
(RNC 1)

RNC
(RNC 3)

Emergency Area 3

MSC

MSC

RGW
(RNC 2)

RGW
(RNC 4)

Internet

Emergency Area 2

Up

Up

Emergency Area 4

Super SAs Defined on RGW (RNC 2) # 1 2 Macro Location of FAP Emergency Area 1 Emergency Area 2 Super SAC 900 901 # 1 2

Super SAs Defined on RGW (RNC 4) Macro Location of FAP Emergency Area 3 Emergency Area 4 Super SAC 902 903

Figure 5 : Service Area Mapping Illustration

Source Femtocell Reported Macro LAC/Cell Id LAC Range 1000..1999 2000..2999 3000..3999 4000..4999 Cell Id Range 1.. 65535 1.. 65535 1.. 65535 1.. 65535 RGW Super LAC/RAC/SAC Super LAC 10000 10000 10000 10000 Super RAC 100 100 100 100 Super SAC 900 901 902 903

MCC XXX XXX XXX XXX

MNC YY YY YY YY

20 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

Figure 6 : Super LA/RA/SA Mapping table When FAP is outside macro coverage or cannot see a macro signal, the FAP Registration Request is passed to external business logic. The business logic finds the physical address of the FAP by: Querying the DSL network for address info if available, or Looking up the registered address of the FAP subscriber, The physical address is compared to the closest NodeB/BTS location (operator must supply this database). The LAC/Cell Id of the NodeB/BTS is returned to the INC. The INC uses this new LAC/Cell ID information to map the FAP into the correct SA. This method can also be used for out-of-coverage subscribers through use of dummy macro cell entries. Below is an illustration of service area mapping in no macro coverage. The sequence can be explained in the following:
CLF Server / DSL Line ID DB IP Address a.a.a.a b.b.b.b Physical Address Line Address #1 Line Address #2 AP Database

DSL Line Id Database

External Business Logic

AP/Sub Database

AP Address 1 2 AP Address #1 AP Address #2 NodeB/BTS Location DB

3 NodeB/ BTS Database

AP Address 1 2 AP Address #1 AP Address #2

LAC / Cell Id LAC / Cell Id #1 LAC / Cell Id #2

4 AP #1 1
S1 Request S1 Accept with LAC/Cell Id

INC
Internet

Iu-CS

MSC/ SGSN

Figure 7 : Service Area Mapping in No Macro Coverage 1. The Registration Request is forwarded to external business logic. 2. The logic discovers the physical address of the FAP from the DSL or subscriber databases (whichever is available). 3. The logic compares location to the closest NodeB/Base Transceiver Station (BTS) and retrieves the appropriate LAC/Cell ID. 4. The LAC / Cell ID is returned to the INC which maps it to the correct SAC as per the mapping table Note: the NodeB/BTS location database may have dummy entries to properly map out-of-coverage subscribers The FAP can be configured to redirect any emergency calls from attached users to the 2G/3G macro network. If the FAP is able to identify that it has macro cell neighbours then it will rediect the call and it does not have coverage then the FAP will support the emergency call.

2.6 FAP Location Change Detection

NEC femtocell solution employs various mechanisms to detect the geographical relocation of FAP. In the event when relocation is detected the solution offers the options to operator, such as blocking the service

21 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

totally, receiving an alarm or alternatively blocking the service and at the same time sending an alarm to AP-MS. These options are configurable from AP-MS.

Method 1: Detection using Macro cell signal This mehod is to use the UMTS/GSM neighbor cell information read from collocated macro cells to determine whether it has been moved since last power up. This is method is supported in Release 1.0. Every time the FAP is initialised it scans the macro network frequencies. The FAP continually monitors the macro network frequencies and if the list of detected cells changes considerably, the alarm will be raised to the AP-MS. There are three possible outputs from the analysis of the detected cells changes: 1. No Location Change if less than N% of the macro neighbour cells on the AP allowed frequencies have changed 2. More than N% of the macro neighbour cells on the AP allowed frequencies have changed: Location Changed alarm is raised 3. More than N% of the macro neighbour cells on the AP allowed frequencies have changed AND the PLMN of at least one the UMTS macro neighbour cells has changed: Location Changed AND Invalid Country alarm are raised Method 2: Detection Using MAC Address The first time when a standalone FAP initialises, the MAC address of the DSL modem/router it is attached to will be recorded in the FAP subscriber database and sent to the RAN GW when the FAP attempts to register with the network. If, on a subsequent registration attempt, this MAC address is different to the initial address recorded, then the FAP can detect that it has potentially been relocated to a different residence. This is method is supported in Release 1.0. Method 3: Detection using IP Address During the tunnel authentication process, the public IP address of the FAP is presented to the Authentication, Authorisation, Accounting (AAA) server. This IP address may be checked to establish the identity of the provider using standard Internet tools and recorded in the FAP subscription database. Again, on subsequent attempts to authenticate, the AAA may check that the ISP from where the FAP is now located matches that which was first recorded for the FAP (the IMSI of the FAP is also provided in the authentication request to the AAA server). If Operator does not wish to use, for example, a who is lookup each time a FAP registers, then an alternate approach is to store the public IP address of the first authentication attempt as before, and then on each subsequent attempt to compare the new public IP address to the old one using a mask. Generally, most ISPs will reserve a certain block of IP address for certain areas in the national network and, even if the public IP address of a particular subscriber changes, it is likely to be within that same block of reserved addresses and comparing using, say a 20 bit mask will enable a comparison to be made. This is method is supported in Release 2.0.

2.7 Differentiated Billing

There are two requirements for differential billing support. Identify which calls are made from a femtocell system. (Supported in Release 1.0) Identify which calls are made from a different class of user on a single femtocell. (Supported in Release 2.0)

22 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

When the FAP registers with the RAN GW, it is allocated to a Super LAC and Super SAC for the duration of its session. The Super LAC value, is by definition unique to the femtocell network and therefore this value may be used to determine that a call was placed from the femtocell network. The femtocell system appears to the Core Network as a standard 3G Radio Network Subsystem. Circuit Switched and Packet Switched sessions will be recorded with the SAI of the originating UTRAN location in the CDR. This SAI is unique to the femtocell service (as indicated using the SuperLAI value) and can therefore be used to differentiate tariff as the call was established from within femtocell coverage rather than macro UTRAN coverage. Hence the differentiated billing can be achieved by allocating distinct and different LAC ranges to FAP as illustrated in Figure 8. FAP is assigned with a LAC at INC registration. INC then passes SAI which it comprises of Super LAC and SAC to MSC on each call setup message. Based on the Super LAC, the Core Network can identify the origin of call from femtocell environment and hence can charge the femtocell users accordingly.

Country Code (CC): 123 Network Code (NC): 321 Femtocell Location Area (LAC): Service Area (SAC): 900

Femtocell SAI

353

Femto LAC 353

IP IP Access Access
UMTS LAC: 323

INC

SAI (LAC) helps to differentiate the billing SAI (353 + 900)

2 3

Femto LAC 353

RNC
UMTS LAC: 405

MSC

Figure 8 : Differentiated Billing based on Femtocell LAC The NEC femtocell solution will also support differential tariff feature where different tariffs are applied for different classes of user. The INC component of the RAN GW is pre-programmed to modify the Super LAC for any UE camped on a FAP to one of up to eight different values for its session. The actual value used for each UE session is determined by a parameter returned from the RADIUS interface to the INC during the registration process: the Billing Rate Indicator (BRI). The BRI is a numeric value (1 8) representing one of the eight potential Super LACs that the UE may be associated with during its session with the RAN GW. During the registration of the UE with the RAN GW, the external logic that performs the access control and session parameter setting is programmed to determine the status (or class) of the UE with respect to the FAP to which it is attempting to camp on, and then to return the associated BRI value to the INC. The INC uses this value as an index into the Super LAC table to identify which value to use for the Super LAC in the initial RANAP message to the Core Network. Figure 9 illustrates the billing mechanism used to differentiate the calls and users in the femtocell system.

23 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

UE 1: Owner
UE Context at RGW

UE 2: Guest
UE 1 2 3 4 5 6 Status Owner Registered Guest Registered Guest Visitor Owner Registered Guest

BRI 1 2 2 3 1 2

UE 3: Guest

Super Super Super LAC RAC SAC 1001 100 901 1002 100 901 1002 100 901 1003 100 901 1001 100 901 1002 100 901

UE 4: Visitor UE 5: Owner
Internet

RGW
Iu-CS

MSC/ SGSN

Here: Registered Owner UE class returns BRI = 1 Registered Guest UE class returns BRI = 2 Visitor UE class returns BRI = 3 The returned BRI value enables the INC to map Owner to Super LAC = 1001, Guest to Super LAC = 1002 and Visitor to Super LAC = 1003

UE 6: Guest

Figure 9 : Differentiation of different class of users

2.8 Data Offload

Data off-load has a number of advantages for the network operator. These are: Reduce cost of supporting high-speed and high volume data applications. Improved performance by routing data directly to the customers ISP rather than the operators network reduces delays and has increased bandwidth. Access to home applications.

2.8.1 Local data Offload (Offload from FAP)

The FAP can be configured to direct data requests from the UE directly to the LAN, and then to the users ISP and the internet. This allows the user to directly access services on their LAN and the FAP supports a firewall to prevent unauthorised external systems accessing the FAP and the UE. The below diagram illustrates the local data offload from FAP. This feature is supported in Release 1.0.

Figure 104 : Local data offload 24 NEC confidential

Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th

Advantages of the local data off load are: Low cost. No impact on the network and so there is no cost to the operator. High capacity. The data is accessed locally and so the user will have access to higher data rates and less delays than if it were passed through the operators Core Network. Local access. The user can access services and devices on their Local Area Network (LAN), for example a media server (i.e. a Personal Computer (PC) which stores the digital contents) with their photo albums or MP3 files. Peer to peer communications. Using local off-load the FAP is able to create data connections between peer FAPs on the same LAN or potentially across the Internet. This will then enable value added services such as instant messaging without having to go through the operators Core Network. Disadvantages of the local data off load are: No control. The operator is unable to control or monitor the content or services the user is able to access. The operator is unable to support lawful intercept of the data the user is accessing, and is unable to bill for the data volumes for the user. No handover support. If a UE hands over between the FAP and the macro network then the UE will have to re-establish the session at the application layer. In the case where the user is accessing the local services then handover would not be required.

2.8.2 Offload from SeGW (Network Data Offload)

FAP can route the UE data to the Security Gateway (SeGW)/ Packet Data Gateway (PDG) which can then direct the data to the operators service and/or the Internet. The advantages for network data offload are: Operator Monitoring. The operator is able to monitor the services the user is accessing via the SeGW/PDG. This means that they can support potentially bill for the services. Operator Control. The operator is able to control the services the user is able to access. For example restricting access to the Internet or operator content. Access to Operator services. The data from the UE is directed via the secure tunnel to within the operators internal network and so can directly access the operator services and content. This feature will be supported in Release 3.0.

25 NEC confidential
Copyright 2011 by NEC Europe. All Rights Reserved.

5 Jan. 2011

th