Authentication and Access Control in Wimax

Authentication and Access Control in Wimax

Access control is the security mechanism to ensure that only valid users are allowed access to the network.

In the most general terms, an access control system has three elements: (1) an entity that desires to get access: the supplicant, (2) an entity that controls the access gate: the authenticator, and (3) an entity that decides whether the supplicant should be admitted: the authentication server. Figure shows a typical access control architecture used by service providers. Access control systems were first developed for use with dial-up modems and were then adapted for broadband services. The basic protocols developed for dial-up services were PPP (point-to-point protocol) and remote dial-in user service (RADIUS) .

PPP is used between the supplicant and the authenticator, which in most cases is the edge router or network access server (NAS),and RADIUS is used between the authenticator and the authentication server. PPP originally supported only two types of authentication schemes: PAP (password authentication protocol) and CHAP (challenge handshake authentication protocol), both of which are not robust enough to be used in wireless systems. More secure authentication schemes can be supported by PPP using EAP (extensible authentication protocol) .

Extensible Authentication Protocol

EAP, a flexible framework created by the IETF (RFC 3748), allows arbitrary and complicated authentication protocols to be exchanged between the supplicant and the authentication server. EAP is a simple encapsulation that can run over not only PPP but also any link, including the WiMAX link. Figure illustrates the EAP framework. EAP includes a set of negotiating messages that are exchanged between the client and the authentication server. The protocol defines a set of request and response messages, where the authenticator sends requests to the authentication server; based on the responses, access to the client may be granted or denied. The protocol assigns type codes to various authentication methods and delegates the task of proving user or device identity to an auxiliary protocol, an EAP method, which defines the rules for authenticating a user or a device.

A number of EAP methods have already been defined to support authentication, using a variety of credentials, such as passwords, certificates, tokens, and smart cards. For example, protected EAP (PEAP) defines a password based EAP method, EAP-transport-layer security (EAP-TLS) defines a certificate-based EAP method, and EAP-SIM (subscriber identity module) defines a SIM card–based EAP method. EAP-TLS provides strong mutual authentication, since it relies on certificates on both the network and the subscriber terminal.

In WiMAX systems, EAP runs from the MS to the BS over the PKMv2 (Privacy Key Management) security protocol defined in the IEEE 802.16e-2005 air-interface. If the authenticator is not in the BS, the BS relays the authentication protocol to the authenticator in the access service network (ASN). From the authenticator to the authentication server, EAP is carried over RADIUS.

Authentication

WiMAX uses mutual authentication between the mobile station (MS) and the network. It typically uses the Extensible Authentication Protocol (EAP) over the Authentication, Authorization, and Accounting (AAA) framework. The process ensures that both the MS and network verify each other’s identities before service access.

Access Control

After successful authentication, access control is enforced through authorization keys and service flows. The base station grants access to network resources based on subscriber profiles and policy rules. This includes bandwidth allocation, quality of service (QoS), and service-level permissions.

Security Associations (SA)

WiMAX establishes Security Associations using encryption keys for data protection. Each SA defines the cryptographic methods and keys used between the MS and base station, ensuring secure communication.

Logical Channel Types of LTE

Logical channels are in a one-to-one fashion associated with radio bearers. Logical channel types are used to distinguish the type of information transmitted within the attached radio bearer. The two major groups of logical channel types are therefore control channels for signaling and traffic channels for IP user data. Currently the following logical channel types are defined for EUTRAN signaling:

BCCH (Broadcast Control Channel): The BCCH is used to transmit system
information regarding access and non-access stratum. It allows the UE to retrieve cell and network configuration parameters (e.g. PLMN code, cell identity, cell reselection parameters, etc.) required for normal operation within EUTRAN.

PCCH (Paging Control Channel): The PCCH is used to transmit the paging
messages from RRC. Hence it is a downlink point-to-multipoint channel a UE is
using when it is in LTE_IDLE mode.

CCCH (Common Control Channel): The CCCH is an uplink (NOTE: DL is under investigation.) RRC signaling channel used by UEs to do the initial access
signaling when it is in RRC_IDLE state and wants to enter RRC_CONNECTED
state. The UE will send only one message (RRC CONNECTION REQUEST) and
the rest of the communication takes place on DCCH.

DCCH (Dedicated Control Channel): The DCCH is a bidirectional RRC signaling channel used for point-to-point (dedicated) RRC and NAS signaling procedures. It is the main signaling channel to be used by RRC_CONNECTED UEs.

MCCH (Multicast Control Channel): The MCCH is associated with MBMS. It allows the eNB to inform UEs that want to listen to broadcast or multicast service traffic about availability of such services and about the associated MBMS radio bearer (point-to-multipoint) radio bearers.

On the traffic channel side we have currently only two types defined:

DTCH (Dedicated Traffic Channel): The DTCH is used for user radio bearers carrying IP traffic. The eNB connects DTCHs with their associated S1-U tunnel to the SAE GW. DTCH can be bidirectional, uplink only or downlink only. DTCH are of course point-to-point.

MTCH (Multicast Traffic Channel): The MTCH is a point-to-multipoint traffic channel for MBMS. It carries IP traffic for broadcast or multicast services driven by the MBMS feature.

In LTE, there are two main types of logical channels: Control Channels and Traffic Channels. Control channels are used for signaling and control information, while traffic channels handle user data transmission. Examples include the Broadcast Control Channel (BCCH) for control and the Dedicated Traffic Channel (DTCH) for user data.

T-Mobile USA Ordered to Pay Compensation to Former Employee

SEATTLE—T-Mobile USA Inc. and its parent company, Deutsche Telecom A.G., have been ordered by the U.S. Department of Labor to pay $345,972 to a worker allegedly fired for being a whistle-blower. Bellevue, Wash.-based T-Mobile said it plans to appeal.

The Department of Labor’s order resulted from an investigation into alleged violations of the whistleblower protection provisions of the Sarbanes-Oxley Act of 2002. The investigation substantiated the affected employee’s complaint, which alleged termination for raising concerns about the possibility of millions of dollars in fraudulent roaming charges being levied on hundreds of international corporate customers.

T-Mobile says it plans to appeal the award and says the preliminary conclusion is incorrect and was not based on the evidence.

In addition to requiring T-Mobile to immediately reinstate the whistleblower, OSHA’s order requires the company to pay $244,479 in back wages and interest, $65,000 in compensatory damages and $36,493 in attorney’s fees. The company also must provide a neutral employment reference, post a notice about the Sarbanes-Oxley Act’s whistleblower provisions and train employees on these provisions.

The actual allegations raised by the unnamed employee would have to be investigated by the Securities and Exchange Commission and could not be acted on by the Department of Labor.

How to Layer 2 Functions and Data Flow in LTE

How to Layer 2 Functions and Data Flow in LTE

For layer 2 let us first take a look into the uplink.

Data transmission is handled through the protocol stack according to the following flow:

1. Data is generated by either signaling control protocols (RRC, NAS) or by some application on the UE’s IP stack. An associated chunk of bits is sent to layer 2 within the appropriate radio bearer.

2. The first protocol that handles the data frame is PDCP. For IP datagrams it will compress the IP (or IP/TCP, IP/UDP, IP/UDP/RTP) header according RFC 3095 (ROHC). Note that this is not applicable to signaling radio bearers. The second step within PDCP is encryption of the data packet.

3. Next comes RLC. For all radio bearers the associated RLC instance has to
perform segmentation or concatenation or padding to generate bit frames (RLC
PDU) that will fit into the transport channels. If the RLC entity of a radio bearer
works in acknowledged mode (AM), then the data is sent through the ARQ
function, which will buffer the packet in a retransmission buffer until the frame has been positively acknowledged. If the RLC entity is not in acknowledged mode, this step is obviously skipped.

4. RLC PDUs from all logical channels arrive then at the MAC protocol. Here the UE’s uplink scheduler has to decide, which logical channel will be served and multiplexed onto a transport channel. It is possible to combine several data units from different logical channels in one transport block, a multiplexer handles this.

5. The lower part of the MAC entity is the HARQ (Hybrid Automatic Retransmission on reQuest) entity. Note that only certain transport channel types (UL-SCH) can have this unit. Here the assembled transport block from the multiplexer will be stored in one of the HARQ’s buffers and simultaneously sent to the physical layer. If the eNB receives the transport block correctly, it will send an ACK indication via a special physical channel. This would delete the transport channel from the buffer. If no indication or a NACK indication is received, the HARQ entity will retransmit the transport block. Each retransmission can be done with different encoding in the physical layer. Therefore MAC will tell the physical layer, whether a transport block is new or is the nth retransmission.

6. The physical layer takes the transport block and encodes it for transmission on air.

In LTE Layer 2, the functions and data flow are handled by three key protocols:

  1. PDCP (Packet Data Convergence Protocol):
    • Functions:
      • Header compression
      • Encryption and integrity protection
      • Handover management
    • Data Flow:
      • Passes compressed and encrypted data to RLC.
  2. RLC (Radio Link Control):
    • Functions:
      • Segmentation and reassembly of packets
      • Error correction (ARQ)
      • In-order delivery of data
    • Data Flow:
      • Sends data to MAC, with retransmission support.
  3. MAC (Medium Access Control):
    • Functions:
      • Scheduling and multiplexing of data streams
      • Hybrid ARQ (HARQ) support
      • Mapping data to physical channels
    • Data Flow:
      • Passes data to the physical layer (PHY) for transmission.

Each layer ensures efficient data transfer, reliability, and error correction across the radio interface.

Different Tasks and States of RRC Protocol in LTE-EUTRAN

Different Tasks and States of RRC Protocol in LTE-EUTRAN

The RRC protocol for EUTRAN is responsible for the basic configuration of the radio protocol stack. But one should note, that some radio management functions (scheduling, physical resource assignment for physical channels) are handled by layer 1 and layer 2 autonomously. MAC and layer 1 signaling has usually delays that are within 10 ms, whereas RRC signaling usually takes something around 100 ms and more to complete an operation.

The RRC functional list is of course quite long.

System Information Broadcasting: The NAS and access stratum configuration of the network and the cell must be available to any UE camping on a cell. This information is coded as RRC message.

Paging: To locate an LTE_IDLE UE within a tracking area the RRC protocol
defines a paging signaling message and the associated UE behavior.

RRC Connection Management: The UE can have two major radio states:
RRC_CONNECTED or RRC_IDLE. To switch between the states an RRC connection establishment and release procedure is defined. With the state
RRC_CONNECTED the existence of signaling radio bearers and UE identifiers (CRNTI) is associated.

EUTRAN Security: Access layer security in EUTRAN consists of ciphering
(PDCP) and integrity protection for RRC messages.

Management of Point-to-Point Radio Bearers: Point-to-point radio bearers are signaling and user data radio bearers for SAE bearers. RRC is used to create, modify and delete such radio bearers including the associated lower layer configuration (logical channels, RLC mode, transport channels, multiplexing, …).

Mobility Functions: When a UE is in state LTE_ACTIVE, the mobility control is at the eNB. This includes handover from one EUTRAN cell to another or also inter system changes. To assist handover decisions in the eNB RRC defines procedures for measurement control and reporting. In LTE_IDLE mode the UE performs automatic cell re-selection, RRC takes control over this process within the UE.

MBMS (Multimedia Broadcast Multicast Service): RRC is used to inform UEs about available MBMS services in a cell and is also used to track UEs that registered for a certain multicast service. This allows the eNB to manage MBMS radio bearers which are usually point-to-multipoint.

QoS Control: The RRC protocol will be QoS aware, allowing implementation of radio bearers with different QoS within the UE.

Transfer of NAS Messages: NAS messages are sent and received through the EUTRAN protocol stack. RRC provides carrier services for such messages.
RRC will use one or two radio bearers exclusively used for signaling (Signaling
Radio Bearers). One will be for high, the other for low priority. The PDCP entities of these signaling radio bearers will be used for ciphering, but not for header compression.

The RRC protocol in EUTRAN defines two state for a UE: RRC_IDLE and RRC_CONNECTED. In the first state, the UE is not attached to a eNB and does free cell re-selection. In the second state the UE is connected to a eNB and the eNB handles all mobility related aspects of the UE via handovers. There is of course a close relationship between LTE-states and RRC states.

The RRC (Radio Resource Control) protocol in LTE-EUTRAN has three main states and associated tasks:

1. RRC_IDLE

  • Tasks:
    • User equipment (UE) is not actively communicating.
    • UE performs cell selection/reselection.
    • Initiates paging and maintains a listening mode for incoming calls.

2. RRC_CONNECTED

  • Tasks:
    • UE is actively communicating with the eNB.
    • Handles resource allocation, mobility, and handover procedures.
    • Manages RLC, MAC, and PHY layer configurations for active data transfer.

3. RRC_CONNECTING

  • Tasks:
    • Transitioning from RRC_IDLE to RRC_CONNECTED.
    • Establishing the connection and negotiating parameters (e.g., encryption, bearer setup).

These states manage the UE’s connection to the network, ensuring efficient resource use and mobility management.

Radio Protocol Architecture in LTE

Radio Protocol Architecture in LTE

The EUTRAN radio protocol model specifies the protocols terminated between UE and eNB. The protocol stack follows the standard guidelines for radio protocol architectures (ITU-R M1035) and is thus quite similar to the WCDMA protocol stack of UMTS.

The protocol stack defines three layers: the physical layer (layer 1), data link and access layer (layer 2) and layer 3 hosting the access stratum and non-access stratum control protocols as well as the application level software (e.g. IP stack).

Physical layer: The physical layer forms the complete layer 1 of the protocol stack and provides the basic bit transmission functionality over air. In LTE the physical layer is driven by OFDMA in the downlink and SC-FDMA in the uplink. FDD and TDD mode can be combined (depends on UE capabilities) in the same physical layer. The physical layer uses physical channels to transmit data over the radio path. Physical channels are dynamically mapped to the available resources (physical resource blocks and antenna ports). To higher layers the physical layer offers its data transmission functionality via transport channels. Like in UMTS a transport channel is a block oriented transmission service with certain characteristics regarding bit rates, delay, collision risk and reliability. Note that in contrast to 3G WCDMA or even 2G GSM there are no dedicated transport or physical channels anymore, as all resource mapping is dynamically driven by the scheduler.

MAC (Medium Access Control): MAC is the lowest layer 2 protocol and its main function is to drive the transport channels. From higher layers MAC is fed with logical channels which are in one-to-one correspondence with radio bearers. Each logical channel is given a priority and MAC has to multiplex logical channel data onto transport channels. In the receiving direction obviously demultiplexing of logical channels from transport channels must take place. Further functions of MAC will be collision handling and explicit UE identification. An important function for the performance is the HARQ functionality which is official part of MAC and available for some transport channel types.

RLC (Radio Link Control): Each radio bearer possesses one RLC instance
working in either of the three modes: UM (Unacknowledged), AM (Acknowledged) or TM (Transparent). Which mode is chosen depends on the purpose of the radio bearer. RLC can thus enhance the radio bearer with ARQ (Automatic Retransmission on reQuest) using sequence numbered data frames and status reports to trigger retransmission. Note that it shall be possible to trigger retransmissions also via the HARQ entity in MAC. The second functionality of RLC is the segmentation and reassembly that divides higher layer data or concatenates higher layer data into data chunks suitable for transport over transport channels which allow a certain set of transport block sizes.

PDCP (Packet Data Convergence Protocol): Each radio bearer also uses one PDCP instance. PDCP is responsible for header compression (ROHC RObust
Header Compression; RFC 3095) and ciphering/deciphering. Obviously header
compression makes sense for IP datagram’s, but not for signaling. Thus the PDCP entities for signaling radio bearers will usually do ciphering/deciphering only.

RRC (Radio Resource Control): RRC is the access stratum specific control
protocol for EUTRAN. It will provide the required messages for channel management, measurement control and reporting, etc.

NAS Protocols: The NAS protocol is running between UE and MME and thus
must be transparently transferred via EUTRAN. It sits on top of RRC, which
provides the required carrier messages for NAS transfer.

LTE Radio Protocol Architecture has three main layers:

  1. PDCP (Packet Data Convergence Protocol):
    • Header compression
    • Security (encryption, integrity)
    • Handover support
  2. RLC (Radio Link Control):
    • Segmentation/reassembly
    • Error correction (ARQ)
    • In-order delivery
  3. MAC (Medium Access Control):
    • Scheduling
    • Multiplexing
    • HARQ (Hybrid ARQ)

Below MAC is PHY (Physical Layer):

  • Modulation
  • Coding
  • Transmission/reception over air

These layers manage data flow, reliability, and resource use.

What is SC-FDMA and how it works in LTE?

What is SC-FDMA and how it works in LTE?

One of the major drawbacks of an OFDMA system is, that the transformation of a complex symbol mapped sequence (e.g. BPSK, QPSK, etc.) onto a small set of subcarriers produces time sequences that have high PAPR (Peak-to-Average Power Ratio). PAPR is the ratio between the maximum power and the averaged power This results in requirements for expensive transmission amplifiers and furthermore lead to high power consumption. Both effects are -particularly on terminal side unwanted.

It is thus a major design goal to limit this effect for the UL direction. In order to reduce the PAPR a variant of OFDMA is used. It is called SC-FDMA (Single Carrier Frequency Division Multiple Access). SC-FDMA works according to the following mechanism, described for the associated transmitter structure. SC-FDMA is the method of choice for EUTRAN in the uplink direction.

The data is mapped to complex symbols like in case of normal OFDM/OFDMA. But this time we interpret the resulting vector not as frequency domain signal, but as a “de-spread” or concentrated time signal. Thus before we can go to the mapping to subcarriers, we have to transform the sequence into a frequency domain signal. Thus a discrete Fourier transform is applied to the data vector. It gives us a vector of data symbol for each subcarrier to be used by the transmitter.

The next step is to map each transmitter symbol to one of the subcarriers of the system depending on which subcarrier was assigned to this transmitter. Obviously some subcarriers will remain free (0), that are the subcarriers for other transmitters. With this we go to the IFFT and do the normal OFDM processing.

SC-FDMA (Single Carrier Frequency Division Multiple Access) is a modulation and multiple access scheme used in the uplink of LTE (Long-Term Evolution) networks. It combines the advantages of single-carrier transmission and frequency-domain equalization, making it energy-efficient and suitable for mobile devices.

How SC-FDMA Works:

  1. Data Mapping: Input data is mapped to symbols using modulation schemes such as QPSK, 16-QAM, or 64-QAM.
  2. DFT Spreading: A Discrete Fourier Transform (DFT) is applied to convert the time-domain symbols into the frequency domain, spreading the signal across multiple subcarriers.
  3. Subcarrier Mapping: The frequency-domain data is mapped onto a subset of orthogonal subcarriers.
  4. OFDM Modulation: An Inverse Fast Fourier Transform (IFFT) converts the frequency-domain data back to the time domain, creating an OFDM-like signal structure.
  5. Transmission: The signal is transmitted over the channel with a cyclic prefix to combat inter-symbol interference (ISI).

On the receiver side, the process is reversed to recover the original data.

SC-FDMA provides low Peak-to-Average Power Ratio (PAPR), reducing the power requirements for mobile devices, making it efficient for uplink communication in LTE.

How Many Different Methods to Combine OFDMA for handle Multiuser System?

How Many Different Methods to Combine OFDMA for handle Multiuser System?

Threre are four Different Methods to Combine OFDMA for handle Multiuser System.

Plain OFDM: Normal LTE OFDM has no built-in multiple-access mechanism. This is suitable for broadcast systems like DVB-T/H which transmit only broadcast and multicast signals and do not really need an uplink feedback channel (although such systems exist too).

OFDMA method

Packet Statistical Multiplexing: It is of course possible to combine a plain OFDM with some LTE layer 2 protocol that takes over all addressing issues. In this case all LTE receivers must listen to the same signal, decode it completely and then decide in higher layers whether to go on with it or to discard the packet. A typical example for such an approach is 802.11a/g/n, where the MAC layer on top of the physical layer (which is OFDM capable) puts LTE MAC addresses in all frames to indicate source and destination. A problem of such systems is power saving to increase standby and operation time. Normally all receivers have to listen to all packets and decode them. Power saving mode in such a system is difficult and usually not very efficient.

Time Division Multiple Access via OFDM: The simplest model to implement multiple access handling is by putting a time multiplexing on top of LTE OFDM. In other words all except some system specific subcarriers go to user 1 in the first symbol period, then come user 2, user 3 and so on. After some time we repeat this multiplexing scheme. The disadvantage of this simple mechanism is, that every user gets the same amount of capacity (subcarriers) and it is thus rather difficult to implement flexible high and low bit rate services. Furthermore it is nearly impossible to handle highly variable traffic (e.g. web traffic) efficiently without too much higher layer signaling and the resulting delay and signaling overhead. The 802.11 WirelessMAN-OFDM specification form selected time division multiplexing on the LTE uplink direction as method.

Orthogonal Frequency Division Multiple Access OFDMA: The term LTE OFDMA is a registered trademark by Runcom Ltd. and was introduced with 802.16 (WiMAX) Wireless MAN-OFDMA for the downlink. The basic ideas is, to assign subcarriers to users and not time. This has the advantage that a single user can easily use multiple subcarriers to increase the bit rate. With this approach it is quite easy to handle high and low bit rate users simultaneously in a single system. But still it is difficult to run highly variable traffic efficiently. The solution to this problem is to assign to a single users so called resource blocks or scheduling blocks.

Such block is simply a set of some subcarriers over some time – efficiently it is a combination of TDMA with plain OFDMA. The blocks can be equal sized or not and a single user can use one or more blocks. 802.16d uses such a mechanism with variable block sizes. The first OFDM symbols in each frame are used to indicate which user gets which blocks with which size. LTE EUTRAN will use a similar system, but with fixed block sizes and the assignment mechanism is not specified yet (2007-08).

There are four main methods to combine OFDMA for handling multiuser systems:

  1. Frequency Division Multiple Access (FDMA): Users are assigned different subcarriers.
  2. Time Division Multiple Access (TDMA): Users are assigned different time slots.
  3. Code Division Multiple Access (CDMA) with OFDMA: Users are distinguished using spreading codes.
  4. Spatial Division Multiple Access (SDMA): Users are separated in space using multiple antennas (MIMO).

These can be used individually or in combination for better resource allocation.