067 Ent Small Cell Net Arch Final Net Approved

7/25/2019 067 Ent Small Cell Net Arch Final Net Approved

1/57

www.scf.io/ www.smallcellforum.org

DOCUMENT

E-SCN network architectures

January 2016

067.06.02

SMALL CELL FORUM

RELEASE 6.0

Solving the HetNet puzzle

17:25

RURAL&REMOTE

URBAN

ENTERPRISE

VIRTUALIZATION

HOME

scf.io


2/57

SMALL CELL FORUM

RELEASE 6.0 scf.io

If you would like more information about Small Cell Forum or wouldlike to be included on our mailing list, please contact:

[email protected]

PostSmall Cell Forum, PO Box 23, GL11 5WA UK

Member [email protected]

Small Cell Forum accelerates small cell adoption to drive the wide-scale adoption of small cells and accelerate the delivery of integratedHetNets.

We are not a standards organization but partner with organizations that informand determine standards development. We are a carrier-led organization. Thismeans our operator members establish requirements that drive the activitiesand outputs of our technical groups.

We have driven the standardization of key elements of small cell technologyincluding Iuh, FAPI/SCAPI, SON, the small cell services API, TR-069 evolutionand the enhancement of the X2 interface.

Today our members are driving solutions that include small cell/Wi-Fiintegration, SON evolution, virtualization of the small cell layer, driving massadoption via multi-operator neutral host, ensuring a common approach toservice APIs to drive commercialisation and the integration of small cells into5G standards evolution.

The Small Cell Forum Release Program has now established business casesand market drivers for all the main use cases, clarifying market needs andaddressing barriers to deployment for residential, enterprise and urban small

cells. The theme of Release 6 is Enterprise, with particular emphasis on realworld and vertical market deployments, and the role of neutral host solutionsto drive the mass adoption of small cells in business environments.

Small Cell Forum Release website can be found here: www.scf.io


3/57

Report title: Enterprise small cell network architecturesIssue date: 13 January 2016

Version: 067.06.02

Scope

This document focuses on the architecture for supporting 3G and LTE small cells within

an enterprise environment. Particular focus is placed on enabling scalable solutionsfrom a mobility and deployment perspective, but also enabling differentiatedpropositions via access to local services, including enterprise Intranet and voiceservices.


4/57


Version: 067.06.02

Executive summary

This whitepaper addresses various aspects of enterprise small cell networks (E-SCN).

It starts by proposing a framework for E-SCN architectures, by identifying variousparts of such a network and their component functional entities. Specifically, the E-SCN consists of a number of small cells, an optional enterprise-small cell concentrator(E-SCC) and an optional enterprise-gateway (E-SCG). The E-SCC essentiallyaggregates the multiple small cells to mobile core network (MCN) interfaces and

provides a single interface to the MCN. Such aggregation reduces the signaling to theMCN and also can facilitate hierarchical mobility management, whereby the mobilitywithin the enterprise small cells can be hidden from the MCN.

As the name suggests, the E-SCG serves as a gateway to the various enterprise ITnetwork components, the principal ones being the IP-PBX and Intranet. Such

connectivity enables UEs connected to the small cells to access enterprise unifiedcommunication services as well as enterprise databases and servers.

After discussing the various elements of the E-SCN in detail, the paper proposes areference architecture as a basis for further developments within the industry.


5/57


Version: 067.06.02

Contents

1. Introduction .....................................................................1

1.1 Enterprise requirements ....................................................... 1

2. Framework for enterprise architectures ...........................2

2.1 Virtualization & E-SCN architecture ........................................ 4

2.2 ETSI-ISG MEC & E-SCN architecture ...................................... 5

3. Enterprise small cell concentrator ....................................7

3.1 Multi-small cell environment ................................................. 7

3.1.1 Virtualization and the multiple small cell enterpriseenvironment ....................................................................... 8

3.2 Enterprise small cell concentration architecture ....................... 9

3.2.1 3G small cell concentrator .................................................. 10

3.2.2 LTE small cell concentrator ................................................. 11

3.2.3 Virtualization and the small cell concentrator ........................ 11

3.3 Enterprise small cell concentrator functionalities .................... 12

3.3.1 IPSec aggregation ............................................................. 12

3.3.2 Iuh back-to-back agent ...................................................... 13

3.3.3 S1 back-to-back agent ....................................................... 13

3.3.4 X2 aggregation ................................................................. 13

3.3.5 Media relay ....................................................................... 143.3.6 GTP proxy ........................................................................ 14

3.3.7 Single configuration, performance and fault managementpoint ................................................................................ 14

3.3.8 Anchor point for UE sessions ............................................... 14

3.3.9 Discovery of ESCC ............................................................. 14

3.3.10 ESCC configuration ............................................................ 15

3.3.11 ESCG configuration ............................................................ 15

3.3.12 WAN admission control....................................................... 16

4. Enterprise small cell mobility architectures .................... 17

4.1 Requirements ................................................................... 17

4.1.1 Enhanced mobility handling ................................................ 17

4.2 3G small cell mobility architecture ....................................... 18

4.2.1 3G small cell to 3G small cell .............................................. 18

4.2.2 Macro-to-small cell ............................................................ 22

4.2.3 Small cell-to-macro ........................................................... 23

4.3 LTE small cell mobility architecture ...................................... 24

4.3.1 LTE small cell-to-LTE small cell ............................................ 24


6/57


Version: 067.06.02

4.3.2 Macro-to-LTE small cell ...................................................... 27

4.3.3 LTE small cell-to-macro ...................................................... 27

4.4 Discovery of enterprise small calls ....................................... 27

4.4.1 3G small cell discovery ....................................................... 274.4.2 LTE small cell discovery ...................................................... 28

5. E-SCN gateway function: Intranet/Internet-access ....... 29

5.1 Intranet access architectures .............................................. 29

5.2 Internet access architectures .............................................. 31

5.2.1 Breakout at core network ................................................... 31

5.2.2 Breakout at local network ................................................... 32

5.2.3 Local IP access and MEC traffic offload ................................. 34

5.3 Legal interception aspects .................................................. 34

5.3.1 Regulatory requirement...................................................... 34

5.3.2 LI architectural considerations............................................. 36

6. E-SCN gateway function: voice/unified-communicationintegration ..................................................................... 38

6.1 3GPP baseline IP-PBX integration ........................................ 38

6.2 Optimized VINE integration ................................................. 40

6.3 Pre-VINE IP-PBX integration ............................................... 41

6.4 Pre-VINE MO and enterprise MT calls ................................... 44

6.5 Pre-VINE service coherency ................................................ 466.6 Pre-VINE small-to-macro cell mobility .................................. 46

6.7 ETSI-MEC and unified-communication integration .................. 47

7. Reference on-premise E-SCN architecture ...................... 48

8. Summary ........................................................................ 49

References ................................................................................ 50

Figures

Figure 2-1 Enterprise small cell framework ........................................................ 2

Figure 2-2 Enterprise small cell network architecture options ............................... 3

Figure 2-3 Evolution to virtualized ESCN with on-Premise NFVI ............................ 4

Figure 2-4 Evolution to virtualized ESCN with off-premise NFVI ............................ 4

Figure 2-5 Mobile edge platform based breakout to an enterprise network [5] ....... 5

Figure 2-6 Evolution of enterprise small cell network architecture toaccommodate MEC .......................................................................... 6

Figure 3-1 Enterprise small cell concentrator ..................................................... 9

Figure 3-2 3G enterprise small cell concentrator architecture .............................. 10

Figure 3-3 LTE enterprise small cell concentrator architecture ............................. 11

Figure 3-4 VNFFG applied to the virtualization of the ESCC ................................. 12

Figure 4-1 E-SCC based hierarchical mobility .................................................... 17


7/57


Version: 067.06.02

Figure 4-2 Small cell-to-small cell hard handover using Iurh interface, source 3GPP 25.467 ................................................................................. 19

Figure 4-3 Iurh based soft handover initiation, source 3GPP 25.467 ................. 20

Figure 4-4 PSC disambiguation via system information reporting by R9 UEs,

3GPP 25.367 ................................................................................. 22Figure 4-5 ESCC based inter-LTE small cell mobility hiding ................................. 26

Figure 4-6 Macro-to-LTE small cell mobility (CSG and hybrid case), source 3GPP 36.300 ................................................................................. 27

Figure 4-7 Iurh establishment using configuration transfer request/response, 3GPP 25.467 ................................................................................. 28

Figure 5-1 HeNB LIPA architecture with collocated gateway 3GPP 23.829 ......... 29

Figure 5-2 HeNB mobility concept 3GPP 23.859 ............................................. 30

Figure 5-3 HeNB mobility under a L-GW 3GPP 23.859 Solution 1, section5.2.1.1 ......................................................................................... 31

Figure 5-4 3GPP 3G above RAN 'SIPTO@PS' solution (c) 3GPP 23.829 [] .............. 32

Figure 5-5 5 SIPTO@LN architecture for collocated HNB (c) 3GPP 23.859 ............. 33

Figure 5-6 SIPTO@LN architecture for 3G with separate L-GW and 3G core .......... 33

Figure 5-7 SIPTO@LN architecture for LTE and EPC with separate L-GW+SGW(source 23.859) ............................................................................. 34

Figure 5-8 Lawful interception requirements ..................................................... 35

Figure 5-9 Existing UMTS LI configuration ........................................................ 36

Figure 6-1 Small cell integration into VINE infrastructure ................................... 38

Figure 6-2 Hosted approach to VINE based small cell integration ......................... 39

Figure 6-3 Contrasting VINE media flows for small cell and IP-PBX ...................... 39

Figure 6-4 L-GW optimized VINE access ........................................................... 40

Figure 6-5 L-GW optimized mobile-to-desk calling ............................................. 41

Figure 6-6 Premise based pre-VINE SIP integration for legacy handsets ............... 42

Figure 6-7 Hosted based pre-VINE SIP integration for legacy handsets ................ 42

Figure 6-8 SIP register interworking for enterprise users location updating on thesmall cell network .......................................................................... 44

Figure 6-9 Mobile originated call handling by ESCC/G ........................................ 45

Figure 6-10 IP-PBX mobile terminated call handling by ESCC/G ............................ 46

Figure 7-1 Enterprise on-premise reference architecture .................................... 48


8/57


Version: 067.06.02 1

1. Introduction

1.1 Enterprise requirements

Small cells can bring significant benefits to the enterprise, its employees and visitors,in terms of improved coverage, enhanced capacity and innovative new services.

Compared with the deployment of small cells within a residential environment, theintroduction of small cells within the enterprise environment brings new requirements[1], including:

scalable idle and connected mode mobility; voice services integration including optimized handling of local media;

local IP access and selective IP traffic offload;

supporting open and hybrid in addition to closed subscriber group modes;and

management visibility.

These new requirements then drive the definition of new capabilities within the

enterprise small cell network architecture. Historically, many of these scenarios werenot considered by traditional standards developing organizations (SDOs). This resultedin many different alternatives for realizing such capabilities in terms of newfunctionalities within the conventional small cell network architecture.

This document defines those options available to service providers looking to deployenterprise small cell networks that support enhanced requirements listed in [1].

Importantly, since the first release of this document, ETSI ISG Mobile Edge Computing(MEC) has started to define approaches whereby operators can integrate their radionetwork edge with innovative applications and services to serve the enterprise, see

http://www.etsi.org/technologies-clusters/technologies/mobile-edge-computing.
http://www.etsi.org/technologies-clusters/technologies/mobile-edge-computinghttp://www.etsi.org/technologies-clusters/technologies/mobile-edge-computinghttp://www.etsi.org/technologies-clusters/technologies/mobile-edge-computing


9/57


Version: 067.06.02 2

2. Framework for enterprise architectures

Figure 2-1 Enterprise small cell framework

Figure 2-1 shown above is a framework for enterprise small cell networks (E-SCN),

which highlights the essential parts or domains of an end-to-end system containing anE-SCN and introduces the essential functionalities of an E-SCN. The framework is notmeant to be a detailed architecture in itself, but an aid to their development of thefunctional description of the various logical nodes.

Essentially, the enterprise small cell network consists of a number of small cell access

points (APs), which provide 3G and/or LTE connectivity. The E-SCN also contains twonew optional functionalities, namely E-SCN concentrator (termed as ESCC) and E-SCNgateway (ESCG), which are briefly described later in this section and in greater detail

later in this document.

The E-SCN provides cellular communication services to enterprise users and possibly

to guest users. The E-SCN interworks with, and may leverage, the existingcomponents of the enterprise communication infrastructure as well as enterprisecommunication services.

Accordingly, the E-SCN may be connected to the enterprise IP-PBX functionality (local

or hosted), which enables integration of the small cell network with existing enterprisevoice and unified communication services. In addition, the E-SCN may also providedirect connectivity to the enterprise Intranet, which typically contains e-mail servers,file servers and databases.

The E-SCN is connected via a backhaul network to the mobile core network usingstandardized approaches. Shown are two key components, namely the securitygateway for protecting the mobile core network and the small cell gateway. Themobile core network provides access to service networks such as the public Internetand operators service networks.

Note, [2] provides more detail of the backhaul system for supporting enterprisesmall cell deployments.

Access to the public Internet may also be provided more efficiently by offloading themobile core network. For example, it may be provided locally via the backhaul networkor at the small cell gateway, as shown.


10/57


Version: 067.06.02 3

Enterprise small cell concentrator:The ESCC is a point of aggregation for theenterprise small cell network that assists in scaling small cell deployments. The ESCCincludes functionality that is able to mask idle and connected mode mobility within theenterprise small cell network from the mobile core network.

Enterprise small cell gateway:The ESCG is the point of integration between theESCN and the enterprise services network. From classical 3GPP architecture, the ESCGincludes local gateway functionality to enable local IP access by suitable authorizedenterprise users. In addition to IP access, the ESCG delivers key functionality that

enables integration into the enterprise IP-PBX/UC environment and networkmanagement systems.

The ESCG and ESCC functions may both exist in isolation, be combined together or beco-located with existing functionalities, as illustrated inFigure 2-2.Option 1 shows theclassical 3GPP architecture comprising of small cell and small cell gateway, Option 2shows a converged ESCG and ESCC functionality bringing a new tier in the mobilityhierarchy, and Option 3 shows a decomposed ESCG and ESCC providing independent

concentrator and enterprise integration functionality. Finally, Option 4 shows avariation to Option 3, where the individual small cells are not connected directly to theESCG but only to ESCC.

Note that the dotted line indicates the demarcation between the operator core networkand the enterprise premises. The optional security gateway (SeGW) is not shown.

Figure 2-2 Enterprise small cell network architecture options

Note: The terminology used above and in the rest of this document is deliberatelydistinct from the 3GPP definition of home based solutions, e.g., HNB, HeNB, HNB-GW, HeNB-GW and HMS. According to the architectures defined in this document, thecapabilities of a small cell are generally compliant with the definition standardized by

3GPP. However, the enterprise integration use cases may require enhancedcapabilities compared with standard HNB and/or HeNB functionalities. Furthermore,whilst the definition of enterprise small cell concentrator/gateway functionality isbroadly aligned with 3GPP defined interfaces and standardized architectures, therequirements defined in [1]have driven the definition of enhanced capabilities foraddressing enterprise integration. Finally, it is envisioned that the small cell gatewaydelivers the standardized functions that have been defined by 3GPP for HNB-GW andHeNB-GW.


11/57


Version: 067.06.02 4

2.1 Virtualization & E-SCN architecture

The principles and advantages of virtualization of mobile network functions have been

thoroughly addressed by ETSI-ISG-NFV. SCF has studied and documented in SCF-154[3] how these may be applied to the ESCC and ESGW in general. Furthermore, theconcepts of VNF Forwarding Graphs can be applied to the realization of virtualized

ESCC and ESGW, when they are broken down into component functional blocks. Thesevirtualized functions can then be deployed on a network function virtualizationinfrastructure (NFVI).

Moreover, the adoption of virtualization also enables flexibility in terms of location ofthe NFVI. One approach enables the on-premise ESCC/ESCG functions that may have

conventionally being delivered on a dedicated appliance to be replaced with an on-premise NFVI POP, as illustrated inFigure 2-3.Alternatively, the evolution to NFV canalso enable the delivery of conventional ESCC/ESCG functionality on an off-premiseNFVI, e.g., delivered on a service providers cloud data centre, as illustrated in Figure2-4,

Figure 2-3 Evolution to virtualized ESCN with on-Premise NFVI

Figure 2-4 Evolution to virtualized ESCN with off-premise NFVI


12/57


Version: 067.06.02 5

2.2 ETSI-ISG MEC & E-SCN architecture

The previous section has highlighted a range of requirements that have led to the

definition of new on-premise functionality for addressing enterprise requirements,delivering a set of capabilities in close proximity to the users of the enterprise smallcell network, coupled with the increasing virtualization of mobile network functions. In

many regards, this combination of access to local edge services that leverage anincreasingly virtualized set of network functions can be seen as a precursor to thedefinition of mobile edge computing, or MEC. MEC provides IT and cloud-computingcapabilities within the RAN in close proximity to the mobile subscriber [4].

The MEC platform provides a hosting infrastructure for MEC applications. The platform

provides specific service to the applications that are hosted on the MEC infrastructure.Specifically called out in [4]is traffic offload functionality, i.e., functionality analogousto local IP access capabilities supported by the ESCG. Further, MEC TechnicalRequirements [5] describes a set of MEC use cases that include unified enterprise

communications, allowing enterprise users devices to be used for enterprise

communications.

Given the strong alignment between certain MEC use-cases and those that haveresulted in the definition of ESCC and ESCG functionalities, it is useful to compare

these two architectures.Figure 2-5 illustrates the MEC architecture for integrating intothe enterprise domain. Note, the exact function hosting the MEC platform is notdescribed further. Indeed [4]describes the three different deployment scenariosplanned to be supported in the first release of MEC as:

MEC server located at the LTE macro base station site

MEC server located at the multi-technology (3G/LTE) cell aggregation site,and

MEC server located at the radio network controller (RNC) site

Figure 2-5 Mobile edge platform based breakout to an enterprise network [5]

Taking on board the above MEC descriptions, it is evident that the multi-technology(3G/LTE) cell aggregation site corresponds to the enterprise small cell concentrator.In such a scenario, the functionality associated with the enterprise small cell gatewaycan be realized as either a dedicated function, or be delivered using the MEC platformas a set of MEC applications for traffic offload and enterprise unified communicationservice, as shown inFigure 2-6.


13/57


Version: 067.06.02 6

Figure 2-6 Evolution of enterprise small cell network architecture to accommodate MEC


14/57


Version: 067.06.02 7

3. Enterprise small cell concentrator

3.1 Multi-small cell environment

Compared with existing residential small cells and traditional macro cells, thedeployment of small cells within an enterprise will be characterized by the deployment

of multiple small cells that can offer contiguous small cell coverage within theenterprise environment. As connected mode users move within the enterpriseenvironment, their sessions will be handed over between neighbouring enterprisesmall cells. The flattened architectures specified by 3GPP for supporting 3G and LTE

small cells will then expose such connected mode mobility to upper layerfunctionalities, for example the small cell gateway, core network and evolved packetcore elements.

As the number of users and density of enterprise small cells increase, so will thenumber of mobility events exposed to these upper layer functions. Example data using

the enterprise reference scenarios [6] indicates that mobility events need to scale,accommodating different use cases, including:

0.1 mobility events/user/minute for mostly static users; 1.0 mobility events/user/minute for steady flow public access; and 4.8 mobility events/user/minute for tidal flow use cases.

Consequently, the opportunity for enterprise small cell deployments to generate largemobility rates should to be accommodated by the enterprise small cell architecture.

In those scenarios where it is determined that an enterprise small cell deployment willgenerate significantly large mobility rates, operators may be motivated to re-introducean aggregation/concentration function within the small cell architecture in order to

provide hierarchical mobility which will allow to better scale the frequent celltransitions and meet coverage, capacity, and KPI requirements of the mobile operator.

The term aggregation in the context of enterprise small cells refers to the principle ofeffectively combining the backhaul signaling of multiple ESCs, usually physicallylocated within a particular premises, into a single signaling stream before that streamis offered up over IP backhaul to the small cell gateway of a mobile network operator(MNO).

The end-effect may be likened to that of a regular NAT IP router in that theconfiguration and what happens on the private side of the NAT is largely hidden fromthe public side. The enterprise small cell concentrator (E-SCC) performs the small-

cell aggregation function, however there is rather more complexity involved than themanipulation of IP addresses, as with NAT, because the Iuh and/or S1 protocolsignaling streams themselves must also be manipulated in order to merge them. Thismanipulation is defined to be performed by a back-to-back small cell agent.

The driver behind aggregating multiple Iuh and/or S1 streams into a single one facing

an operator is to achieve a small-cell coverage multiplier effect, as far as the hostMNO is concerned. That is, for the resources used on the core small cell gateway for asingle Iuh/S1 connection (and so normally the coverage of a single small cell) the

operator and enterprise can benefit from the overall coverage of many small cellsinstead, maybe 5, 10, or even 100 cells on a site.

The term coverage-multiplier is used, as opposed to capacity-multiplier, because

very many more small cells can effectively be hosted by a central small cell gateway


15/57


Version: 067.06.02 8

than would otherwise be possible. However, the throughput (number of activecalls/transactions etc.) would not necessarily be any different as signaling transactionsmay still be required to be handled by the same core small cell gateway. If

aggregation is coupled with voice and data offload, then there is the double benefit ofhaving both coverage & capacity multipliers.

This Iuh/S1 aggregation may then allow an operator to roll-out cells with lower per APoperational expense, as the incremental upgrades necessary to the real core iseffectively less for each additional small cell. For a given total small-cell network

coverage, the necessary core network capital expense and CPU loading (in the smallcell gateway, including the SeGW) is less than it would have been if every cell wereindividually backhauled.

The introduction of Iurh in 3GPP Release 10 has permitted the hierarchical mobility tobe realized using standardized small cell/small cell gateway functionality, enablinghandover between adjacent small cells that does not burden the serving MSC orSGSN, as described in Chapter 3. In an enterprise environment, such handover events

could be common and thus the additional processing overhead on the small cellgateway may be significant, such that the Iurh processing can be beneficiallydistributed towards the E-SCC.

The term hierarchical mobility in the context of enterprise small cells then refers tothe principle of effectively hiding small cell connected-mode and idle-mode celltransitions from the centralized components in the core of the mobile networkoperator.

Importantly, in comparison with 3G, the conventional LTE architecture does not allowmobility to be hidden from the core network. Hence, one of the key capabilities of theESCC in an LTE small cell environment is to provide such functionality, to hide LTEinter-small cell connected and idle mode mobility from the MNOs core EPCcomponents.

Finally, prior to the introduction of enterprise small cell systems supporting Iurh, theESCC can deliver the back-to-back small cell agent functionality that enables

hierarchical mobility to be realized with pre-Release 10 enterprise small cells.

So far the E-SCC and E-SCG have been described as being actually on the enterprisepremise, i.e. realized as enhanced CPE capabilities. However, the aggregation and

mobility offload function could reside in alternative locations, e.g., certain functionsmay be co-located with the small cell gateway and/or delivered by a separate cloud-based offering and/or managed/operated by a 3rdparty service provider, e.g., offeringa shared E-SCN using techniques described in [7]. The principles described still largely

apply, certainly with regard to the benefits to the operator since the aggregation andmobility offload still happens off the operator premises.

3.1.1 Virtualization and the multiple small cell enterprise environment

The requirements that have led to the definition of the enterprise small cellconcentrator for aggregating small cells and providing hierarchical mobility have beenhighlighted as capabilities enabled by the application of network function virtualizationto the small cell, as described in [8]. SCF106 calls out several new capabilities

associated with virtualizing the small cell layer which are applicable to the ESCC,including:


16/57


Version: 067.06.02 9

Enabling the definition of one single virtual cell that is supporting multiplephysical remote small cells, i.e., the coverage multiplier described above

Supporting scalable hierarchical mobility whereby inter-remote small cell

mobility is hidden from the upper layer elements, i.e., the same hierarchicalmobility described above

Facilitating policy enforcement to be applied at an aggregate level so thatimproved admission control capabilities can be delivered, i.e., being able toeffectively manage enterprise WAN bandwidth, as described in [9]

The above bullets highlight the strong alignment between the ESCC and the virtualnetwork function (VNF) component of the virtualized enterprise small cell. Hence, itmay be anticipated that the adoption of virtualization within the small cell layer willsee the ESCC functionality collapse into the small cell VNF.

3.2 Enterprise small cell concentration architecture

In order to mask on-premise mobility events from the service provide network, the

enterprise small cell architecture can be augmented with an enterprise small cellconcentrator (ESCC). The ESCC element in the enterprise small-cell network enablesaggregation of various functional capabilities, as described in section 2.3 andsection 2.4.

As illustrated inFigure 3-1,the E-SCC function connects over the enterprise LAN tomultiple small cells, with an Iuh/S1 interface to each cell. It also connects using asingle Iuh/S1 link to the macro small cell gateway.

Figure 3-1 Enterprise small cell concentrator

To provide a level of abstraction between core network and the small cells, theconcept of a virtual access point (VAP) is introduced. This VAP is not any particularphysical small-cell itself but it is a logical software object within the E-SCC andrepresents a virtualized 3G or LTE small cell to the small cell gateway in the operator

core. The VAP behaves, to the small cell gateway, like any other real/physical smallcell and it is intentional that the small cell gateway should not know or see anydifference between physical and virtualized small cells connected to it in this way.


17/57


Version: 067.06.02 10

The advantage of this concept is that the virtual AP is a managed representation of acollective group of real small cell access points. The virtual AP may be configured likea normal small cell would be, and is the point of aggregation described in the previous

section. The actual identities used by the VAP need not be representative of thoseused by the underlying real small cells, but the VAP identities (e.g., location, routing,

service and/or tracking areas, etc.) will be those declared to the core small cellgateway on behalf of all the real small cells.

A virtual AP also has its own state, in the sense of active, blocked, offline etc., even

though it has no physical radio associated with it itself. Thus the VAP may be appearfully active and transmitting (providing service) to the core small cell gateway,regardless of the state of the underlying physical small cells and whether they areswitched on, plugged in etc. In reality, a suggested policy could be that the virtual AP

declares itself as in-service to the core small cell gateway if any one of the underlyingphysical small cells is in-service, and declares itself as offline only when all underlyingphysical small cells are simultaneously out of service. Thus the macro small cellgateway is not exposed to unnecessary management and boot-up signaling of multiple

small cells as they are inevitably unplugged and rebooted.

3.2.1 3G small cell concentrator

The existence of the enterprise small cell concentrator should preferably betransparent to the individual enterprise small cells, meaning that conventional smallcell interfaces are used, unchanged between the enterprise small cell and the ESCC.Using the example of a 3G small cell based enterprise small cell deployment, the

enterprise small cell concentrator will provide Iuh-back-to-back agent functionality,including aggregating the many IPSec tunnels to individual enterprise small cells into asingle IPSec tunnel towards the service provider network, as illustrated inFigure 3-2.

Figure 3-2 3G enterprise small cell concentrator architecture

Note: Small cell aggregation can also enable an implementation of hierarchicalmobility that relies on the more traditional 3GPP functionality split betweenNodeBs and RNC using a 3GPP based Iub interface. A description of alternative,non Iuh based 3G small cell implementations, is provided in [10].


18/57


Version: 067.06.02 11

3.2.2 LTE small cell concentrator

The flattened LTE system architecture conventionally requires the macro MME to beincluded in the procedures for supporting inter-LTE small cell mobility. Furthermore,the protection of NAS signalling between the UE and the MME restricts the ability ofthe LTE concentrator compared with its 3G equivalent. From an identity perspective,the NAS protection limits the LTE small cell or small cell concentrator from

autonomously sending NAS messages in order to recover the UEs permanent identity(IMSI). Furthermore, NAS protection limits the ability of any functionality below theevolved packet core to mask premises based mobility events because the successive

next hop (NH) parameter supplied by the MME to the LTE small cell is derived from alocal master key, KASME, that is shared (by separate calculation) between the MME andthe UE and is not available to the LTE small cell ([11] Section 7.2.8.4). Thus, althoughan S1 proxy will be able to see the NH parameter used in, or replenished after, a

handover, it will not be able to calculate the subsequent NH parameter value itself andso some signalling toward the MME is required to keep the collection of NH parametersets updated. However, an alternative architecture, in which the S1 proxy is replaced

by a back-to-back small cell agent supporting the LTE small cells, is described inChapter 4. This approach is illustrated inFigure 3-3 and is able to present inter-smallcell handovers as intra-ENB type handovers without requiring EPC interactions.

Figure 3-3 LTE enterprise small cell concentrator architecture

3.2.3

Virtualization and the small cell concentrator

The previous sections have highlighted how packets in the ESCC traverse threefunctional blocks, corresponding to the security gateway terminating the access IPSec,the back-to-back small cell agent and finally the security gateway for protecting WANtraffic between enterprise and Service Provider networks.

As described in [3], network function virtualization can be applied to the ESCC. InETSI NFV terminology, an end-to-end service that is comprised of various chainedfunctions is referred to as a virtual network function forwarding graph (VNF-FG) [5].

The capability delivered using VNF-FG is analogous to connecting existing physicalappliances via cables, providing the logical connectivity between the VNFs. Figure 3-4illustrates the use of VNF-FGs to support the chaining of functionality within the ESCC.


19/57


Version: 067.06.02 12

Figure 3-4 VNFFG applied to the virtualization of the ESCC

3.3 Enterprise small cell concentrator functionalities

The following sections describe the rationale for including different functionalitieswithin the enterprise small cell concentrator.

3.3.1

IPSec aggregation

Function:ESCC aggregates IPSec tunnels from individual enterprise small cell into asingle IPSec tunnel between the ESCC and the service provider networks

In the residential small-cell architecture, each small-cell establishes a direct and

secure IPSec tunnel for Iuh transport to the security gateway (SeGW) within theoperators core network. However, to facilitate the introduction of the enterprisearchitecture with a CPE based (or possibly hosted) E-SCC element, each enterprisesmall cell must create such a tunnel to the E-SCC itself instead. The E-SCC itself thenwould establish a single IPSec tunnel to the original operator SeGW.

Thus, arguably over the enterprise LAN and the backhaul to the operator, the small-cell signaling and traffic is secure. However, ultimately it has to be acknowledged thatthe same signaling and traffic is in the clear whilst it is being processed within the E-SCC hardware. In any final implementation of an E-SCC product it is very important

that all processing is done in secure environment, essentially allowing multiple IPSectunnels to terminate at its edge but prohibiting unauthorized access. It must, ofcourse, be just as secure as a small-cell itself.

The burden of this requirement will heavily dictate how and on what hardwareprospective vendors of E-SCC functionality will offer their products to operators.

There are some interesting options available, for example running the E-SCCfunctionality on additional processing capacity on one of the secure small cellsthemselves.

Where local voice and data offload is offered, the E-SCG may be co-located with the E-SCC (as described in section 2). In such a case, the security environment describedabove would need certain IP restrictions lifted to allow access to the enterprise LAN.This must be carefully managed, to avoid any undesirable bridging between enterpriseand operator IP networks. The E-SCG would have to contain a comprehensive

firewall. Note that such security concerns may be one motivation to decouple E-SCCand E-SCG functionalities into separate elements, as described in section 2.

The certificate credentials for the Iuh tunnels must be download from the small cellmanagement system and kept by the E-SCC for use in what is essentially its ownembedded SeGW.


20/57


Version: 067.06.02 13

When an enterprise small-cell powers-up it will always connect to the operator smallcell management system first of all, regardless of any enterprise architecture, at apreconfigured address/fully qualified domain name (FQDN). The TLS session

established and used for this process is independent of a subsequent IPSec tunnel thatmay be established for the purposes of Iuh signaling and traffic and is not transited

though any E-SCC equipment.

Benefits: Can simplify enterprise firewall configuration as only a single IPsec tunnelneeds to be supported for a complete deployment. Can simplify enterprise LAN

configuration as the endpoint of IPSec tunnels originated from the enterprise smallcells is located in the enterprise DMZ.

Can improve the scalability of the solution by reducing the number of IPSecconnections required to be supported by the centralized small cell gateway.

Enhances indirect small-cell to small-cell connectivity; for those systems that makeuse of indirect connectivity between small cells e.g., for Iurh and X2 signalled via

the small cell gateway, the local termination of IPSec enables optimized routing ofindirect flows.

3.3.2 Iuh back-to-back agent

Function: ESCC terminates Iuh HNBAP connection form the enterprise small cell and

proxies the connection towards the service provider small cell gateway. The completeenterprise small cell deployment will be presented as a single super cell to the serviceprovider small cell gateway.

Benefits: Improved scalability by hiding any power cycling of the enterprise small cells

Improved scalability of TNL address discovery between enterprise small cells.

Enterprise small cell network can be expanded with the addition of small cells withoutimpacting the service providers network.

The ESCC can provide a centralized provisioning point for access control lists for theentire small cell network

3.3.3 S1 back-to-back agent

Function:ESCC terminates S1 connection from the enterprise small cell and proxiesthe connection towards a single S1 interface from the ESCC to the service provider

EPC or (optionally) LTE small cell gateway. The complete enterprise deployment will

be presented as a single LTE small cell to the service provider EPC or (optionally) LTEsmall cell gateway.

Benefits: Enables hierarchical mobility where X2-handover between LTE small cells isfully masked from the core network.

Reduced S1-handover latency by avoiding WAN attributed delays

3.3.4 X2 aggregation

Function:Aggregates X2 interfaces from individual small cells, and presents a singleX2 for the entire E-SCN to each macro eNB. Routability to the macro layer needs to beensured.


21/57


Version: 067.06.02 14

Benefit:Reduces the complexity of managing large numbers of X2 links in large scaledeployments

Note: The Definition of X2 gateway functionality is being considered as part of 3GPPRelease 12 and will be considered for inclusion in a future Small Cell Forum release.

3.3.5 Media relay

Function:ESCC relays the CS media plane for UEs connected to the enterprise smallcells. The relay may need to manipulate RTP timestamps, sequence numbers andsynchronization source identifiers in order to mask any connected mode mobility fromupper layer functionalities.

Benefit: Hides inter 3G small cell mobility for users of circuit switched (CS) servicesfrom MNO core network elements, e.g., small cell gateway and/or media gateway(MGW).

3.3.6

GTP proxy

Function: ESCC proxies the GTP user plane for UEs connected to the enterprise smallcells. The proxy function presents a stable GTP tunnel endpoint for UEs as they movebetween enterprise small cells.

Benefit: Improved scalability by hiding any connected mode mobility events for usersof packet switched (PS) services from upper layer functionalities.

3.3.7

Single configuration, performance and fault management point

Function:The enterprise small cells may be optionally configured to reportmanagement data to the ESCC, including performance metrics, system faults as wellas recovering their configuration from the ESCC.

Benefit: The ESCC can provide an aggregated view of performance across the entireenterprise small cell network. The aggregated view of the network at the ESCC mayfacilitate integration into the enterprise management domain.

The ESCC can provide an aggregated view of faults across the entire enterprise smallcell network.

The ESCC can provide a single configuration point for configuration throughout theenterprise.

3.3.8

Anchor point for UE sessions

Function:Provides a stable anchor point for UE

Benefit:Enables integration with enterprise small cell gateway capability

3.3.9 Discovery of ESCC

Function:Enable enterprise small cells to automatically connect to the E-SCC.

Ideally, each small-cell deployed in an enterprise environment should not behave anydifferent to small cells in a residential or other environment. Each small cell must bemanaged by an operator, for regulatory location and spectrum reasons if nothing else,regardless of who physically owns the cell hardware. As many small cells may well be


22/57


Version: 067.06.02 15

owned by the operator (as opposed purchased by the enterprise), they must bemanaged in an inventory and logistics sense too.

In an enterprise environment, as in a residential one, once the small-cell hasestablished itself on the local LAN it will then contact the operators small cell

management system to download further configuration and profile information. Thesmall cell management system will normally be accessed over the Internet at apreconfigured URL which the small cell resolves using a public DNS. A TLS session iscreated and configuration pulled/pushed down using TR-069 once the small-cells basic

hardware identity and physical location (by GPS, macro network scan or apparent IPaddress) is verified.

Thus, regardless of the introduction of the E-SCC concept for Iuh/S1 signaling inenterprises, small cells will still check access the operator small cell managementsystem first.

However, for operation in an enterprise environment some of the data passed down

from the management system to each small cell may be different to normal, and couldinclude:

The URL or IP address of the E-SCC instead of the small cell gateway in themacro core network. (The URL could be a local URL resolved by a privateDNS server on the LAN.)

3.3.10 ESCC configuration

Function:Enable ESC to be automatically configured by a small cell managementsystem.

The E-SCC itself is also configured by connecting to the HMS and downloading data byTR-069 [12] by means of the fact that the virtualized AP described in the previous

section behaves as an small cell, has an effective small cell identity and so connectsover TLS and TR069 in the same way as a real cell.

Configuration information that a virtual AP would need from the small cellmanagement system and are extensions to existing TR069 management objectsinclude:

The URL and credentials to connect to the operator SeGW and small cell

gateway for Iuh/S1. The identities and IPSec tunnel credentials of each underlying small cell that

is to connect to the E-SCC (see section 4 for more details of Iurh/X2 inter-AP

signaling). The single cell identity (LAI etc) that the virtual AP should present to the core

small cell gateway within Iuh and/or S1-AP.

3.3.11

ESCG configuration

Function:Enable ESCG to be automatically configured by an enterprise small cellmanagement system.

The E-SCG itself needs enterprise specific configuration. The E-SCG may be configuredby a remote small cell management system or be configured using a localmanagement interface. SCF-068 [13] describes further detail of options for local

management integration within an enterprise environment.


23/57


Version: 067.06.02 16

3.3.12 WAN admission control

Function:Enable ESCC to perform admission control on session establishmentrequests in order to protect the WAN bandwidth resources, especially in deploymentswhere WAN bandwidth is shared between ESCN traffic and normal enterprise traffic.

The ESCC may be configured with a resource limit, e.g., by defining an enhanced TR-069 management object.

Benefit:This B2B small cell agent function can use this limit to admit or deny sessionestablishment requests in order ensure that valuable WAN resources are sharedeffectively between different users.


24/57


Version: 067.06.02 17

4. Enterprise small cell mobility architectures

4.1 Requirements

The Small Cell Forum requirements for enterprise small cells [1] include uniquerequirements as they relate to the support for mobility within the enterprise. In

particular, as well as established capabilities for supporting mobility between theenterprise small cell network and the macro networks, the requirements introduce thenew concept of a small cell group and the necessity for supporting CS and PS sessioncontinuity as the user hands over between small cells that are members of the group.

In addition, in order to enhance the scalability of the enterprise small cell system,

intra-group handoffs should beneficially be hidden from the service provider corenetwork (CN and/or EPS) hierarchical mobility in order to scale to support frequentidle and connected mode handovers by users moving within the enterpriseenvironment.

4.1.1

Enhanced mobility handling

Function: Inter small-cell mobility signalling handled through ESCC

A further advantage of this anchoring of user-plane traffic is that the E-SCC is theanchor point for local mobility events. For example, a user may move between localenterprise cells but the operator core network will not see any change in the userplane stream. It will remain appearing as if coming from the virtualized AP within theE-SCC, as shown inFigure 4-1.

Figure 4-1 E-SCC based hierarchical mobility

Benefits: Improved scalability by hiding any connected mode mobility events fromupper layer functionalities.

Minimize signalling latency by avoiding WAN attributed delays for non-Iurh/X2signalling exchanges.


25/57


Version: 067.06.02 18

4.2 3G small cell mobility architecture

4.2.1 3G small cell to 3G small cell

Connected mode mobility3GPP Release 10 has been enhanced to support optimized connected mode small cellmobility management which includes the definition of the Iurh reference point as alogical interface between co-located 3G small cells [14]. Prior to release 10, inter-small cell handovers were supported using standardized SRNS relocation capability.The new 3GPP Release 10 functionality includes the definition of Iurh for signallingbetween neighbouring 3G small cells in order to optimize the handover procedure andto mask such transitions from the core network [15].

The Iurh interface is used to support a small cell specific variant of the Iur interfacethat conventionally has been defined to be used between RNCs to facilitate handoverbetween RNCs, and which maintains a common RNSAP protocol This small cell specificinterface can be used as a direct connection between small cells for more efficient

localized handover or used indirectly between two small cells whereby the Iurh trafficis signalled via the small cell gateway.

The specification of the Iurh reference point is included in 3GPP TS 25.467 [8], which

describes the procedures for establishing an Iurh connection, Iurh disconnection andexample exchanges for supporting handover procedures. The user plane of the Iurhcan be used to transport the same Iu user plane data for dedicated channel streamsand Iur used data for common channels in a similar fashion to the deployment of Iur

between RNCs. Compared with legacy Iur, Iurh defines a user plane based on IPtransport making use of RTP for time critical circuit switched traffic and GTP-U/UDP forpacket based traffic. The control plane of the Iurh transports the same radio network

subsystem application part (RNSAP) signalling as is used over the Iur interface. The

RNSAP signalling is transparently transported using RNSAP user adaptation (RNA)signalling [16] that additionally is defined to support activation and de-activation ofIurh connections together with error handling procedures.

TheFigure 4-2 below illustrates the operation of 3G small cell-to-small cell connected

mode mobility using the enhanced SRNS relocation procedure that implements a hardhandover between neighbouring 3G small cells using the Iurh control planeexchanges. The figure shows that the CN can be kept unaware of any intra-small cellgateway connected mode mobility events by having the small cells share user andcontrol-data frame sequence numbers over the Iurh signalling connection and thesmall cell gateway provide RTP proxy functionality.


26/57


Version: 067.06.02 19

Source HNB Target

HNB

5. RRC RBReconfiguration

10. RNA Disconnect: RNSAPEnhanced Relocation Signalling

Transfer (L3 information.)

6. RRC RB Reconfiguration Complete

7. HNBAP Relocation Complete

1. RNA Connect:RNSAP EnhancedRelocation Request (UE Id, RANAPRelocation Information Request)

3. RNA Direct Transfer: RNSAP EnhancedRelocation Response

4. RNA Direct Transfer: RNSAPRelocation Commit

Detect UE sync

2a. HNBAP TNL Update Request(Accepted RAB List)

2b. HNBAP TNL Update Response

9. HNBAP UE De-Registration

HNB-GW CN

8a.RAB Release Request (Unaccepted RABs)

8b. RAB Assignment Procedure to release unaccepted RABs

UE

Figure 4-2 Small cell-to-small cell hard handover using Iurh interface, source 3GPP 25.467

In addition to being able to support small cell-to-small cell hard handover mobilitybased on SRNS relocation that is hidden from the CN that leverages Iurh signalling

exchanges, the Iurh interface also supports user-plane transport that can be used torealize soft handover operation. Because Iurh supports RNSAP, the same procedures

for adding and removing links to/from the active set can be used to manage the softhandover operation.Figure 4-3 illustrates how Iurh can be used to initiate the additionof a link to the active set, with the example showing the serving small cell (labelled

SHNB in the 3GPP figure) communicating with a drift small cell (labelled DHNB in the3GPP figure) with the Iu-UP being anchored at the serving small cell.


27/57


Version: 067.06.02 20

Figure 4-3 Iurh based soft handover initiation, source 3GPP 25.467

User plane handling

The voice RTP stream for each call on an enterprise small cell must transit the E-SCC.This is to ensure a single point of anchoring for hierarchical mobility, presenting astable interface to the 3G small cell gateway in the service provider core network asthe users transition between enterprise small cells. During a local connected mode

mobility event (i.e., intra-enterprise inter-small cell handover), the backhauled RTPstream (as far as the core 3G small cell gateway is concerned) is not affected.

The E-SCC function must track and perform a mapping function between RTP packetson the operator (aggregated side) and the local small-cell side. As the E-SCC is being

inserted transparently (to the core network) into the user plane it must differentiateand disseminate packets to/from each physical 3G small cell on the aggregated sideby UDP port and manipulate the RANAP RAB assignment request/outcome messageswithin Iuh to achieve that. For example, each small-cell must be told to stream RTPpackets to the IP address of the local E-SCC, overriding the IP address of the coreMGW that would otherwise have been passed down in RANAP from the core. RTPpacket multiplexing, if supported by the macro small cell gateway and MGW, must

also be supported by the E-SCC.

Voice packets are transferred on the user plane within IuUP packets, themselves

encapsulated within standard VoIP RTP packets. Before the first voice packets aretransferred there is an obligatory IuUP INIT sequence, within the first RTP packets,that negotiates RFCI numbers and frame types between small-cell and remote mediagateway. There are two options here.

The first option is that the E-SCC itself responds to the IuUP INITs from thesmall cells itself and creates its own normalized IuUP INIT dialogue with themacro core network. Note that for any voice offload that may occur (e.g., asdescribed in Section 6), the E-SCC would have to process the IuUP INIT

sequence itself.

UE SHNB

1. RRC Measurement Report

Decision to setup new RL

2. RNA CONNECT (UE context id,

RNSAP Radio Link Setup Request)

3. RNA Direct Transfer (UE context id,

RNSAP Radio Link Setup Response)

5. RRC Active Set Update

6. RRC Active Set Update Complete

DHNB

Start Rx

4. RNA Direct Transfer (UE context id,

RNSAP Radio Link Restore Indication)

Start Tx


28/57


Version: 067.06.02 21

The second option allows the E-SCC to proxy the IuUP INITs between small-cell and the macro MGW. This would allow a more flexible end-to-endapproach when dealing with bearer types (such as AMR subcodecs or CSD

calls) and avoids some of the manipulation of RANAP RAB Assignments the E-SCC would have to do to normalize/abstract the subframe types.

Packet data is conveyed as tunneled GTP-U (un-ciphered) from small cells. However,similar to voice streaming, the nature of the aggregation/concentration functionmeans that GTP tunnels cannot simply be transferred transparently across the E-SCC

towards the macro network SGSN, partly because as each small-cell actsindependently of each other then it is entirely possible that 2 small cells may allocatethe same local GTP tunnel-Id (TEId), which would cause confusion on the macronetwork side.

Thus the E-SCC must perform tunnel id mapping and translation procedures betweenGTP tunnels on the small-cell side and the operator side to avoid such conflicts, notunlike what NAT routers do but to IP headers. As GTP tunnel IDs are manipulated in

real-time, so the E-SCC must also monitor and accordingly manipulate the RANAPRABAssignment messages sent between the core 3G small cell gateway and smallcells.

As with voice streaming and RTP packets, note that all small cells send the GTPpackets to the local IP address of the E-SCC, not to the MNO SGSN as is the case inthe residential small-cell architecture for example. This requires manipulation of thetransport elements in RABAssignment message from the MNO core.

Connected user load balancingOther than being able to support small cell-to-small cell handovers for supporting usermobility, another driver for handing over users is to be able to effective balance loadwithin the enterprise small cell network. Unfortunately, the standardized Iurh interface

and RNSAP messaging do not support the standardized procedures for transferringload information between 3G small cells. Supporting dynamic load balancing betweenenterprise small cells will consequently require the use of vendor proprietaryextensions to the inter-small cell Iurh interface, although the actual messages willtypically already defined in the RNSAP protocol stack implementation.

Note, that as enterprise deployments are primarily driven by the need forcoverage rather than for capacity [17], then load balancing is not likely to beneeded in many cases.

Idle mode mobilityAs described above, the introduction of Iurh in 3GPP Release 10 has enabled

connected mode small cell-to-small cell mobility to be masked from the core network.Whereas legacy residential HNB deployments have used unique location/routing areacodes to enable visibility of UE idle mode transitions between neighbouring HNBs, in

the enterprise deployment, it is equally important to be able to mask such idle modeevents from the core network. In order to avoid signalling the core network due to idlemode mobility, it is recommended that the multi-small cell enterprise deploymentshould use a common location area codes (LAC) and routing area code (RAC) acrossthe deployment.

Note: From a small cell management system perspective, the TR-196v2 datamodel is adequately specified to enable the configuration of a common LAC/RACby the inclusion of only a single item in the LACRAC list.


29/57


Version: 067.06.02 22

4.2.2 Macro-to-small cell

The scalability requirements of conventional residential HNB deployments havemotivated deployments that look to re-use primary scrambling codes (PSCs) on thesame frequency within an individual serving RNC and even within a single macrosector. This re-use of PSCs has a direct impact on the ability of the system to supportmacro-to-small cell handovers. 3GPP refers to the condition as PSC confusion wherein

the serving macro RNC would normally trigger a handover procedure but is unable todetermine the correct target cell for handover based solely on the PSC and UARFCNincluded in the UE measurement report. Consequently, PSC confusion means that

realizing macro-to-small cell mobility using conventional SRNS relocation capabilitycannot always be supported in dense deployment scenarios.

3GPP has addressed such limitations by defining enhanced capability in Release 9whereby a suitable UE can be commanded by its serving RNC to perform acquisition ofthe system information broadcast (SIB) from neighbouring cells and to subsequently

report the cell identity of the target small cell to the SRNC.Figure 4-4 illustrates the

required enhancements to the macro RNC and UE for supporting PSC disambiguation[15].

UE SRNC

8. Handover processing [6]

2. MEASUREMENT REPORT [CSG Proximity Indication]

3. MEASUREMENT CONTROL [ CSG Inter-frequency cell info]

4. MEASUREMENT REPORT

[measured PSCs]

7. MEASUREMENT REPORT

[Cell Identity, CSG Member Indication]

1. MEASUREMENT CONTROL [(Measurement

Type = CSG Proximity detection)]

5. MEASUREMENT CONTROL [(report criteria = Periodical

reporting criteria), (Amount of reporting = 1), (Inter-frequency

SI Acquisition)],

6. UE reads System

Information of the target HNB

Figure 4-4 PSC disambiguation via system information reporting by R9 UEs, 3GPP 25.367


30/57


Version: 067.06.02 23

Because the 3GPP 3G small cell disambiguation procedure requires enhancements toboth macro RNC and UEs, service providers may require macro-to-small cellhandovers to be supported in advance of the availability and support of Release 9 SIB

decoding UEs. Such scenarios require the use of unique (PSC, UARFCN) value pairs forthose small cells that are valid handover targets from the macro network. These

unique values need to be configured in both the small cell management system as wellas the macro RNC.

Note: The current TR-196v2 management object enables configuration of suchunambiguous PSC values by the small cell management system.

3GPP has also enabled techniques to facilitate the disambiguation of legacy (nonCSG,-SIB reporting) small cells for macro-small cell hand in by allowing the small cellgateway to build up a profile of timing offsets between neighbour cells that enablesaccurate small cell identification/PSC disambiguation. As long as some existingoptional functionality is enabled in the macro network the small cell gateway maydisambiguate a target small cell for hand in. These techniques were introducing into

informative text during 3GPP Release 11.

4.2.3

Small cell-to-macro

Conventional residential HNBs already support the ability to handover from the HNBtowards the macro network. The same capability is re-used in enterprise deployments,enabling CS and PS sessions to continue as the user moves out of the enterpriseenvironment and into macro coverage.

However, when compared with the single handover use case identified in residentialdeployments, the service provider deploying an enterprise small cell network may bemotivated to offer differentiated operations for different types of handovers. Forexample, the service provider may like to prioritize small cell-to-small cell handoversin advance of small cell-to-macro handovers, keeping the connected mode UE on theenterprise small cell network. Similarly, a small cell-to-macro handover to a macro cellthat supports reciprocal macro-to-small cell handover may be preferred in advance of

the handover to a macro cell that does not support macro-to-small cell handover, forexample to enable the user to be optimally handed back to the enterprise small cellnetwork as RF conditions change.

Note: The standardized TR-196v2 data model does not enable differentmeasurement thresholds to be provided to the enterprise small cell and sovendor proprietary extension to the data model will likely be required to supportsuch enhanced capabilities.

Note: 3GPP Release 11 introduced the option of having an Iur interface betweena small cell gateway and a macro RNC. This enhanced handover from small cellto macro (soft or hard) is available with reduced core network signalling as long

as Iurh is routed via the small cell gateway. Whilst the protocol signalling exists,in the case of case of soft handover there will be practical deployment issuessuch as having a small enough latency between two cells in soft handover for theUE to be able to receive both radio paths.


31/57


Version: 067.06.02 24

4.3 LTE small cell mobility architecture

4.3.1 LTE small cell-to-LTE small cell

The LTE security architecture assumes that inter-eNB handovers will necessarilyrequire involvement of the MME in order to deliver new keying material to the neweNB. This obviously impacts the mobility hiding capabilities that are required to besupported by the deployment of LTE small cells in the enterprise [1], e.g., ascompared with the 3G standard that specifies how mobility hiding can be achieved asdescribed above.

In order to support such mobility hiding capability, enhanced ESCC functionality is

defined that is able to ensure correct operation of access stratum securityfunctionality. In particular, such functionality is required to enable the inter-LTE smallcell mobility events to be treated by the UE as an intra-eNB mobility events. The LTEsecurity architecture [18] defines the use of horizontal and vertical key derivationcapabilities, where the former is assumed to be used for intra-eNB operations and

does not involve MME interactions and the latter is assumed to be used for inter-eNBoperations which then assumes the MME is involved in re-keying operations.

The ESCC in co-operation with the LTE small cell co-operate in order to be able to

perform horizontal key derivation. In particular, horizontal key derivation enables anew eNB to generate new keying material based on previously used keying materialused by an old eNB together with PCI and E-ARFCN-DL channel configuration of thenew eNB. The indication of whether key derivation uses horizontal or vertical

techniques (and hence whether the MME is involved) is derived from theNextHopChainingCount (NCC) parameter. The conventional operation for inter-eNBhandovers is to increment the NCC value compared to intra-eNB handovers where the

NCC value used in the reconfiguration request is unchanged from the previously used

NCC value.

Figure 4-4 illustrates the operation of inter-LTE small cell mobility hiding. Steps 1through 20 show a typical attach of UE to the E-UTRAN. In particular, at step 12 theMME calculates the Kenb used for keying in the access stratum and delivers this to the

LTE small cell in the S1AP Initial context setup request message. The enhanced ESCCfunctionality is used to cache this information for use in subsequent key chaining.

Following normal UE movement, a handover is triggered as a result of measurementreports received in step 22. Whereas conventionally, the eNB/LTE small cell wouldtrigger a vertical handover to a neighbouring eNB/LTE small cell, new functionality is

defined to ensure that the value of NCC is kept unchanged across the handover tothen ensure horizontal re-keying and the new key (Kenb*) will be derived from the oldkey (Kenb). Steps 23 thought 28 then show the operation of the inter-LTE small cellmobility event. Importantly, the NCC in the RRC reconfiguration request is unchanged

from the value used with the source LTE small cell, indicating to the UE that horizontalre-keying should be used.

Steps 29 and 30 show the S1 path switch that is used to switch the downlink databath between the ESCC and the new LTE small cell. This path switch is not proxied

towards the MME since, from the MME perspective, the UE tunnel endpoint remainsanchored at the ESCC and is hence unchanged after the inter-LTE small cell mobilityevent.

Importantly, the S1 path switch request acknowledge message at step 30 will

normally be used by the MME to deliver new NH keying material to the ENB. Instead,


32/57


Version: 067.06.02 25

enhanced ESCC functionality is defined to simply re-use the stored Kenb (and anyreceived NCC, e.g., received during a previous ENB-to-LTE small cell mobility event) inthe S1 path switch acknowledge message security context.

Note, there were lengthy discussions on this topic in 3GPP RAN3 during Release 10

definition and the solution described in this section has previously been presented to3GPP RAN3 groups1but not adopted. Importantly, concerns around autonomouslyhandling the path switch (at the HeNB-GW) raised at that time meant that the solutionwas not included in Release 10 specification. The concerns raised included:

1.

Charging implications as the MME is unaware of the HeNB change;

2. LIPA deactivation without notifying the MME; and3. Horizontal key derivation impacts ability to support forward security.

The enterprise use case and E-SCC proposition effectively address concerns 1 and 2,i.e., the L-GW is now co-located with the E-CSS and it is unlikely that the operatorwould need to differentiate charging and rating between different enterprise small

cells connected to the E-SCC.

Operators are therefore encouraged to consider the criticality of forward security in asingle enterprise deployment versus the possible benefits of hierarchical mobilitybefore adopting E-SCC hierarchical mobility capability for LTE small cells.

1See http://3gpp.org/ftp/tsg_ran/WG3_Iu/TSGR3_70/Docs/R3-103425.zip


33/57


Version: 067.06.02 26

Figure 4-5 ESCC based inter-LTE small cell mobility hiding


34/57


Version: 067.06.02 27

4.3.2 Macro-to-LTE small cell

The macro eNB will be configured to trigger the measurement reporting by the UE ofneighbouring LTE small cells. The PSC confusion described for the 3G macro-to-smallcell has been addressed in LTE by having the eNB request the UE to decode systeminformation from the neighbouring cell and to report back the global cell identity, asillustrated inFigure 4-6 [19].

UE MMESource

eNB

HeNB

GW*Target

HeNB

1.Reconfiguration

(ReportProximityConfig)

2.ProximityIndication

3.Reconfiguration

(MeasurementConfig)

4.MeasurementReport

(PCI)

5.Reconfiguration

(SIRequest)

6.BCCH(CGI,TAI,CSGID)

7.MeasurementReport

(CGI,TAI,CSGID,Member

Indication) 8.HORequired

(AccessMode*,CSGID*)

10.HORequest

(CSGID*,MembershipStatus*)

9.Accesscontrolbasedon

reportedCSGID

11.HORequest

(CSGID*,MembershipStatus*)

12.ValidateCSGID

13.HORequestAck

14.HORequestAck

15.HOCommand

16.HOCommand

Figure 4-6 Macro-to-LTE small cell mobility (CSG and hybrid case), source 3GPP 36.300

Note: The scalability requirements of LTE small cell deployments may require thephysical layer cell ID (PCI) to be re-used between LTE small cells. In such cases, themacro eNB may erroneously infer that a previous PCI-to-ECGI mapping is valid for analternative neighbouring cell and hence confusion may still need to be resolved. One

approach for resolving such issues is to require that the macro eNB request ECGIsystem information measurement reporting for each handover procedure. However,such measurements are both resource intensive from a UE perspective and furtherelongate the handover procedure and hence may lead to increased handover failurerates.

4.3.3

LTE small cell-to-macro

Conventional eNB-to-eNB handover support is reused to enable mobility from the HNBtowards the macro network.

4.4 Discovery of enterprise small calls

4.4.1 3G small cell discovery

Before establishment of Iurh communications, the enterprise 3G small cells need to beable to discover each other. The Iuh interface has been enhanced to enable the 3G


35/57


Version: 067.06.02 28

small cell to register not only its cell identity that was supported in earlier releases,but also its transport address with its small cell gateway (or enterprise small cellconcentrator). When the 3G small cell registers with the small cell gateway, the small

cell provides is the transport layer IP address that other small cells can use toestablish Iurh signalling connections towards the registering small cell.

The enterprise small cells will then discover each other, e.g., using establishednetwork listen behaviour. Being able to identify a neighbour as being a small cell andhence a candidate for establishing Iurh connectivity can for example be based on

comparing the CSG-ID broadcast by the detected neighbour and comparing that withthe CSG-ID being broadcast by the detecting 3G small cell.

A detecting small cell can request the transport layer IP address of the detected smallcell by sending a HNBAP configuration transfer request to the small cell gateway. Thisrequest includes the cell identity of the detected small cell recovered by network listenprocedure. The configuration transfer response then includes the transport layer IPaddress that the detecting small cell can use to establish direct Iurh connectivity with

the detected small cell.Figure 4-7 illustrates Iurh establishment using theconfiguration transfer/request exchange.

The small cell gateway can provide the transport later IP address that it received from

the detected small cell when this small cell registered with the small cell gateway tothen enable direct Iurh connectivity between the enterprise small cells. In this casethe small cell gateway is not involved in the Iurh signalling. Alternatively, the smallcell gateway can return its own transport IP address in response to the configurationtransfer request from a small cell. In such situation, the gateway serves as an Iurh-proxy, but the operation of such a proxy is transparent to the attached small cells.

HNB1 HNB-GW

4. HNB Configuration Transfer Request

(request HNB2's Iurh signalling TNL Address)

5. HNB Configuration Transfer Response

(reply HNB2's Iurh signalling TNL Address)

HNB2

2. HNB Registration Procedure

0. HNB1already operating and registered at the

HNB-GW

1. HNB2switches to operational

mode, scans its environment.

3. HNB1Identifies HNB2

as a neighbor

6. The HNB1sets up an Iurh connection dependent on the Iurh connectivity option configured.

Figure 4-7 Iurh establishment using configuration transfer request/response, 3GPP25.467

4.4.2 LTE small cell discovery

Before establishment of X2 communications, the enterprise small cells need to be ableto discover each other. The S1-MME interface [20] enables the LTE small cell todiscover the IP Transport address for X2 signalling establishment.


36/57


Version: 067.06.02 29

5. E-SCN gateway function: Intranet/Internet-access

During 3GPP Release 10 the concepts of local IP access (LIPA) and selective IP traffic

offload (SIPTO) were studied in TR 23.829 [21], leading to the implementation of a

LIPA function for both LTE and 3G that involved a new node - a local gateway (L-GW) that supports a limited set of the functions of a GGSN for 3G or of a P-GW in thecase of LTE. The purpose of the LIPA service is to allow a UE to request a specificoffload to an APN that can be accessed via this L-GW towards IP addresses that arenot public e.g. Intranet or home network. 3GPP did not have time to standardize anysolutions for mobility underneath the local gateway during Release 10.

In parallel, SIPTO work was investigated but Rel-10 was only able to standardizeSIPTO above the RAN for 3G (SIPTO@PS). SIPTO above the RAN is not really neededfor LTE because the network architecture is already flat.

Subsequently, 3GPP Release 12 is currently addressing both SIPTO at the LocalNetwork, and LIPA mobility for multiple cells under the same L-GW [22].

It should be noted that LIPA is formally a service that can be requested by the device,whilst SIPTO is an optimisation that the device does not request and is chosen by theoperator.

5.1 Intranet access architectures

The underlying principle adopted for LIPA access is that a UE will request a LIPAservice from the core network by requesting a connection to a particular L-GW, asillustrated inFigure 5-1.This is achieved by using a particular LIPA-APN.

Figure 5-1 HeNB LIPA architecture with collocated gateway 3GPP 23.829

In normal (non-LIPA) usage the core network element (SGSN, MME) would checkaccess permissions with the HSS and then carry out a DNS lookup to determine the

most appropriate packet gateway to allocate the connection to, supplying this addressto the RAN once the connection to the gateway has been set up. By contrast, in theLIPA case a small cell presents the core network element with an additional transportaddress for the Local gateway that it has access to at the same time that the access is

requested. If the HSS allows permission, the local gateway will be requested to createthe appropriate context, and the small cell informed that the bearer has beenoffloaded by the existence of a correlation indicator in the radio bearer set upinstruction. The small cell then creates a direct (possibly internal) connection to thelocal gateway.

In the case that the RAN detects that the UE is moving out of the coverage of the L-GW (e.g. handing out to macro), then the L-GW will tear down the connection as it isin the position to detect this. If data arrives at the local gateway when the UE is in idle


37/57


Version: 067.06.02 30

mode, then the first packet is sent towards the core network in order to trigger pagingof the UE.

In the context of this enterprise small cell architectures, the local gateway will beembedded into the E-SCG.

During 3GPP Release 11 and Release 12, work has been done to extend the LIPAfunctionality to allow mobility under a local gateway as indicated inFigure 5-2 below,

and an architectural solution has been selected for which protocol changes arecurrently being implemented.

Figure 5-2 HeNB mobility concept 3GPP 23.859

There will be a new interface, Sxx between the local gateway and the small cell thatwill carry the user plane, and possibly some control plane data. This is illustrated in

Figure 5-3 below for an LTE deployment. Precise details will become available in the3GPP specifications, including TSs 36.300 [19], 23.401 and 36.413 [20]for LTE, and23.060, 25.467 [14]and 25.413 for 3G.


38/57


Version: 067.06.02 31

Figure 5-3 HeNB mobility under a L-GW 3GPP 23.859 Solution 1, section 5.2.1.1

5.2 Internet access architectures

The desire to offload the core network, possibly making use of an enterprises owninternet access and thereby reducing transport costs, is clear. 3GPP has defined threearchitectures to allow selective offloading of IP traffic (SIPTO). There are twopotential locations where this can take place: at the local network/RAN level, denoted

SIPTO@LN, and between the RAN and the core network (denoted SIPTO@PS).SIPTO@PS is not needed in LTE because the network architecture is already flat

enough above the RAN, whilst in 3GPP Release 10, SIPTO@PS was defined for 3G.SIPTO@LN is in the process of being defined in 3GPP Release 12.

5.2.1 Breakout at core network

This section addresses options for accessing public Internet via SIPTO@PS (aka SIPTOabove RAN) techniques.

The SIPTO@PS architecture is applicable to 3G only and was defined in 3GPP Release

10. In this architecture a traffic offload function (TOF) is situated just above the RANon the Iu-PS link from an RNC or HNB-GW to the SGSN. The existence of a TOF issignaled to the SGSN by the existence of an optional transport layer address in a

similar way to LIPA, and offload indicated by a correlation ID to indicate to the TOFwhich radio bearer is to be offloaded. The TOF also has the option to use techniquessuch as DPI to decide which bearers that it wishes to offload.

The SIPTO@PS architecture has the advantage that it automatically allows mobility ofthe UE underneath the RNC or HNB-GW.


39/57


Version: 067.06.02 32

Figure 5-4 3GPP 3G above RAN 'SIPTO@PS' solution (c) 3GPP 23.829 [21]

5.2.2 Breakout at local network

This section addresses options for accessing public Internet via SIPTO@LN techniques.

3GPP has defined two architectures in Release 12 for carrying out SIPTO at the localnetwork. These are:

1. SIPTO @ LN for a

067 Ent Small Cell Net Arch Final Net Approved

Documents

Transcript of 067 Ent Small Cell Net Arch Final Net Approved