Chap06 ll cprot_03_kh

20
Chapter 6 LLC Protocol Contents: 6.1 Functional description of the LLC layer 1. Functions of the LLC layer 2. Functional model of the LLC layer 3. LLC layer structure 4. Structure of TLLI 5. Logical Link States 6.2 Frame formats 1. LLC frames 2. LLC Transmission Modes in GPRS 3. LLC header fields-Control Field 4. LLC Acknowledged mode operation 5. Exchange Identification Parameter Negotiation 6. LLC layer parameter default values 7. Some LLC parameters 8. LLC header example

description

 

Transcript of Chap06 ll cprot_03_kh

Page 1: Chap06 ll cprot_03_kh

Chapter 6

LLC ProtocolContents:6.1 Functional description of the LLC layer

1. Functions of the LLC layer2. Functional model of the LLC layer 3. LLC layer structure 4. Structure of TLLI 5. Logical Link States

6.2 Frame formats1. LLC frames 2. LLC Transmission Modes in GPRS 3. LLC header fields-Control Field 4. LLC Acknowledged mode operation 5. Exchange Identification Parameter Negotiation 6. LLC layer parameter default values7. Some LLC parameters8. LLC header example

Page 2: Chap06 ll cprot_03_kh

Chapter 6

LLC ProtocolContents:6.1 Functional description of the LLC layer

1. Functions of the LLC layer2. Functional model of the LLC layer 3. LLC layer structure 4. Structure of TLLI 5. Logical Link States 6. Ciphering algorithm interface

Page 3: Chap06 ll cprot_03_kh

Functions of the LLC layer

End-to-End data exchange between MS and SGSNEnd-to-End data exchange between MS and SGSN

Transmission, format and operational error detection and correction

Transmission, format and operational error detection and correction

Sequence controlSequence control

Notification of unrecoverable errorsNotification of unrecoverable errors

Flow controlFlow control

CipheringCiphering

LLCMAC

GSM RF

RLC

LLC

SNDCP

IP v 4/6

ApplicationTCP/UDP

MAC

GSM RF

RLC

NS

FR

L1

BSSGP

Relay

NS

FR

L1

BSSGP

LLC

SNDCP

L1

L2 L2

IP IP

UDP /TCP

UDP /TCP

GTP GTP

Relay

L1

L2

IP v 4/6

L1

ApplicationTCP/UDP

LLC layer functions provide the means for information transfer via peer-to-peer Logical link connections between an MS and SGSN pair.

LLC includes functions for:

• the provision of one or more logical link connections discriminated between by means of a DLCI (Data Link Connection Identifier). A logical link connection is identified by a DLCI consisting of two identifiers: a SAPI (Service Access Point Identifier) and a TLLI (Temporary Logical Link Identifier).

The SAPI is used to identify the service access point on the SGSN side and the MS side of the LLC interface. An SAPI is carried in the address field of each LLC frame.

The TLLI is used to identify a specific MS.

• sequence control, to maintain the sequential order of frames across a logical link connection;

• detection of transmission, format and operational errors on a logical link connection;

• recovery from detected transmission, format and operational errors; • notification of unrecoverable errors; • flow control• ciphering.

Page 4: Chap06 ll cprot_03_kh

Functional model of the LLC layer

Signalling Signalling and data transfer

LogicalLink

EntitySAPI=7

LogicalLink

EntitySAPI=8

SGSNMS

GPRS Mobility Management

LogicalLink

ManagementEntity

Multiplex Procedure

LL5 LL9LL3 LL11

SNDCP

LLGMM

SMS

LogicalLink

EntitySAPI=2

RLC/MAC

LogicalLink

EntitySAPI=11

LogicalLink

EntitySAPI=9

LogicalLink

EntitySAPI=5

LogicalLink

EntitySAPI=3

LogicalLink

EntitySAPI=1

GRR

LLGMM

RLC/MAC layer

LLC layer

Layer 3

LLC layer

BSSGP

BSSGP

BSSGP layer

TOM

TOM8 LLSMSTOM2

The default values for SAPIs 3, 5, 9, and 11 have been chosen to correspond with the four GPRS quality of service delay classes, see 3GPP TS 22.060 [3]. However, there is no fixed relationship between SAPI and delay class. The LLC layer parameters for any SAPI can be negotiated to support any QoS profile, see 3GPP TS 23.060.

Page 5: Chap06 ll cprot_03_kh

LLC layer structure

The logical link layer consists of multiple Logical Link Entities (LLEs), identified by Service Access Point Identifiers (SAPI) that control the information flow of individual connections.Functions provided by each LLE are: unacknowledged information transfer

acknowledged information transferflow control in ABM operationframe error detection.

The Logical Link Management Entity (LLME) manages the resources that have an impact on individual connections.Functions provided by the LLME are: parameter initialization

error processingconnection flow control invocation.

 Multiplex procedureOn frame transmission, the multiplex procedure generates and inserts the FCS (Frame Check Sequences), performs the frame ciphering function, and provides SAPI-based logical link control layer contention resolution between the various LLEs.On frame reception, the multiplex procedure performs the frame decipher function and checks the FCS. If the frame passes the FCS check, the multiplex procedure distributes the frame to the appropriate logical link entity based on the DLCI (Data Link Connection Identifier).

GPRS Mobility Management/Session Management (GMM/SM) uses the services of the LLC layer to transfer messages between the MS and the SGSN.It includes functions such as attach and authentication, and transport of session management messages for functions such as PDP context activation and deactivation.The Short Message Service (SMS) uses the services of the LLC layer to transfer short messages between the MS and the SGSN.Tunneling of Messages TOM is a generic protocol layer used for the exchange of TOM Protocol Envelopes between the MS and the SGSN.

Page 6: Chap06 ll cprot_03_kh

Structure of TLLI

Local TLLI

Foreign TLLI

Random TLLI

Auxiliary TLLI

at SGSN:At the SGSN it is only possible to build an auxiliary TLLI. An auxiliary TLLI is selected by the SGSN and is used by the SGSN and MS to unambiguously identify an Anonymous Access MM and PDP Context. (Pleaso note starting with Rel 99. Anonymous PDP context is not possible any more and auxiliary TLLi not found in GPRS netrworks anymore!!

The TLLI (Temporary Logical Link Identifier) is used to identify a specific MS. TLLI assignment is controlled by GMM. Please note that the TLLI is not part of the LLC header, it is carried by lower layer protocols (RLC/MAC or BSSGP) or in higher layer messages (attach request,...)A TLLI (32 bits) is built by the MS or by the SGSN either on the basis of the P-TMSI (local or foreign TLLI), or directly (random or auxiliary TLLI).

A local TLLI is derived from the P-TMSI allocated by the SGSN, and is valid only in the Routing Area (RA) associated with the P-TMSI.

0 1 1 1 1

Bit 0 - 26 Random Number

7 6 5 4 3 2 1 0

1 1

Bit 0 - 29 from P-TMSI

7 6 5 4 3 2 1 0

0 1 1 1 0

Bit 0 - 26 Auxiliary

7 6 5 4 3 2 1 0

1 0

Bit 0 - 29 from P-TMSI

7 6 5 4 3 2 1 0

3GPP 23.003

A foreign TLLI id also derived from the P-TMSI but the P-TMSI is allocated in another Routing Area

The random TLLI is selected randomly by the MS, and is used when the MS does not have al valid P-TMSI.

 

At MS:

Page 7: Chap06 ll cprot_03_kh

ABM State (Required for acknowledged

user data)

Logical Link States

TLLI Unassigned State (only GMM signaling)

TLLI Assigned/ADM State

(GMM/SM signaling)

GPRSattach

A logical link entity may be in one of three basic states:

TLLI Unassigned state: unacknowledged information transfer is possible in the MS-to-SGSN direction for SAPI=1 (GMM/SM)

TLLI Assigned / ADM (Asynchronous Disconnected Mode) state: in this state a TLLI has been assigned and unacknowledged information transfer is possible 

GPRS Mobility Management (GMM) controls TLLI assignment

ABM (Asynchronous Balanced Mode) state: this state is established by means of an ABM establishment procedure and both acknowledged and unacknowledged information transfer is possible.

ABM establishment procedure

Available SAPI: 3, 5, 9, 11

Available SAPI: 1, 2, 3, 5, 7, 8, 9, 11

Available SAPI: 1

Page 8: Chap06 ll cprot_03_kh

Ciphering algorithm interface

The ciphering algorithm has three input parameters:

- the ciphering key (Kc);- the frame-dependent input (Input); and- the transfer direction (Direction).

The ciphering algorithm has one output parameter:- Output.

The relationship between the input and output parameters and the ciphering algorithm is illustrated below:

CipheringAlgorithmKc

Input

Output

Direction

Unciphered FrameDeciphered FrameCiphered Frame

MS or SGSN SGSN or MS

CipheringAlgorithmKc

Input

Output

Direction

Input -32 bits (depends on LLC frame number)

Direction - 1 bit (0 for UL, 1 for DL) Kc - 64 bits, Cipher Key Unciphered -an LLC UI or I Frame Frame max 1523 octets Output -same length as LLC

Once ciphering is started not only user data but almost all Signalling is sent encrypted. This makes the analyses of messages on Gb impossible!

XOR XOR

Page 9: Chap06 ll cprot_03_kh

Chapter 6

LLC Protocol6.2 Frame formats

1. LLC frames 2. LLC Transmission Modes in GPRS 3. LLC header fields-Control Field 4. LLC Acknowledged mode operation 5. Exchange Identification Parameter Negotiation 6. LLC layer parameter default values7. Some LLC parameters8. LLC header example

Page 10: Chap06 ll cprot_03_kh

LLC frames

Control field

Information field

Frame Check Sequence (FCS) (3 octets)

8 7 6 5 3 2 14

SAPIPDC/R X X

An LLC frame consists of 4 fields:

Address field, which consists of one byte, containing several information elements (1 octet).

Protocol Discriminator bit (PD) indicates whether a frame is an LLC frame or belongs to a different protocol. LLC frames have the PD bit set to 0.Command/Response bit (C/R) identifies the frame as either a command or a response. Service Access Point Identifier (SAPI) identifies an LLE that should process an LLC frame and also a layer-3 entity that is to receive information carried by the LLC.

Control field, which identifies the type of frame uniquely. It has typically a length between 1 and 3 octets. The content of the Control field follows on the next pages (up to 36 octets).

Information field (if present), which carries signaling or user data of the layer 3 protocols GMM/SM, SNDCP or SMS (140 to 1520 octets).

Frame Check Sequence, which consists of a 24 bit Cyclic Redundancy Check (CRC) code. The CRC-24 is used to detect bit errors in the frame header and information fields. The FCS field contains the value of a CRC calculation that is performed over the entire contents of the header and information for protected service. The FCS field contains the value of a CRC calculation that is performed over the frame header and 5 bytes of the information filed only for unprotected service. The CRC calculation is done before ciphering at the transmitting side, and after deciphering at the receiving side.

Page 11: Chap06 ll cprot_03_kh

LLC Transmission Modes in GPRS

Reliability Class

GTP Mode LLC Frame ModeLLC Data

ProtectionRLC Block Mode

1 Acknowledged Acknowledged Protected Acknowledged

4 Unacknowledged Unacknowledged Protected Unacknowledged

5 Unacknowledged Unacknowledged Unprotected Unacknowledged

For real-time traffic, the QoS profile also requires appropriate settings for delay and throughput.

2 Unacknowledged Acknowledged Protected Acknowledged

3 Unacknowledged Unacknowledged Protected Acknowledged

Traffic Type

Non real-time traffic, error-sensitive application that cannot cope with data loss.

Real-time traffic, error-sensitive application that can cope with data loss.Real-time traffic, error non-sensitive application that can cope with data loss.

Non real-time traffic, error-sensitive application that can cope with infrequent data loss.Non real-time traffic, error-sensitive application that can cope with data loss, GMM/SM, and SMS.

usage of Rel 97/98 Reliability Classes QoS parameter 3GPP TS 03.60 (Rel 98)

Acknowledged Mode

Unacknowledged mode

In acknowledged mode, the receipt of LL‑PDUs are confirmed. The LLC layer retransmits LL‑PDUs if confirmation has not been received within a timeout period.

In unacknowledged mode, no confirmations are required. Signalling and SMS shall be transmitted in unacknowledged mode. It offers two options:

- transport of protected information. FCS is done over the complete LL PDU. An error will result in discarding the frame.

- Transport of unprotected information, the FCS is done only on header. LLC is disabled to detect errors in the LLC information field.

I-frame

S-frame

UI-frame

U-frame

If there is no data in the other direction one may find:

Mainly when LLC connnections are established or released:

Page 12: Chap06 ll cprot_03_kh

LLC header fields:-Control Field I

I-frame 0 X X X X X X X

S-frame 1 0 X X X X X X

UI-frame 1 1 0 X X X X X

U-frame 1 1 1 X X X X X

01234567

The Control Field with a length between 1 and 3 Byte identifies the type of the frame. With GPRS four different types are possible. To distinguish between the different types of frames the bits 6-8 from the first byte is used:

Information Frame (I-frames) is used to transmit informations (Layer 3) which must be acknowledged.

A Supervisory Frames (S-frames) is the acknowledgment for I-frames.

To transmit Unconfirmed Informations a UI-frame is used. These UI-frames are numbered but not acknowledged frame

The U (numbered) format shall be used to provide additional logical link control functions. This format contains no sequence number.

I-frame S-frameand contain an A (Acknowledgement Request) bit: A=1 Ack requested,A=0 no Ack requested

I-frame 0 A X X X X X X

S-frame 1 0 A X X X X X

01234567

Numbered I frames also carry supervisory information (S frame), and are for this reason also called I+S frames. A separate S frame is sent when there is no information field to be transferred.

I-frame I+S-frame=

Page 13: Chap06 ll cprot_03_kh

X X X X X X S1 S2

LLC header fields: Control Field II

Following bits indicate the type of messages:

ResponseCommandFormat

DM---

UA

---

XID

---

SABM

---

DISC

XID

FRMR

---Unnumbered

0 100

1 110

1 000

0 111

0 011

0 001

M1M2M4 M3

ResponseCommandFormat

RRRR

RNR

ACK

SACK

RNR

ACK

SACK

Information + Supervisory

S2S1

00

0

1

1

1

0

1

U-frame 1 1 1 X M4 M3 M2 M1I-frame

X X X X X X S1 S2

X X X X X X X X

01234567

S-frame 1 0 A X X X X X

0 A X X X X X X

Receive Ready (RR) command / responseAcknowledgement (ACK) command / responseSelective Acknowledgement (SACK) command / responseReceive not ready (RNR) command /response

Disconnect Mode (DM) responseDisconnect (DISC) commandUnnumbered Acknowledge (UA): responseSet asynchronous balanced mode (SABM) commandFrame reject (FRMR) responseExchange Identification (XID) command / response

Page 14: Chap06 ll cprot_03_kh

N(U)N(U) N(U)N(U)N(U)N(U) E PM

N(R)N(R)N(R)N(R)N(R)N(R) S1 S2

LLC header fields: Control Field III

I-frame

N(R)N(R)N(R)N(R)N(R)N(R) S1 S2

N(S) N(S) N(S) N(S) X N(R)N(R)N(R)

0 A X N(S) N(S)N(S) N(S) N(S)

S-frame 1 0 A X X N(R)N(R)N(R)

Send sequence number N(S) identifies the I-frame and is incremented by 1 with each successive I-frame.Receive sequence number N(R) denotes the expected send sequence number of the next in-sequence received I frame. At the time that a frame of the above types is designated for transmission, the value of N(R) is set to the value of the receive state variable V(R).

Unconfirmed sequence number N(U) N(U) is the confirmed sequence number of UI-frames.No verification of sequence numbers is performed for UI frames. Therefore, an UI frame may be lost without notification to the layer 3 entity if a logical link exception occurs during transmission of the frame. The U format is used to provide additional logical link control functions. This format contains no sequence number.

Poll/Final bit (P/F)All U frames contain the Poll/Final (P/F) bit. The P/F bit serves a function in both command frames and response frames. In command frames the P/F bit is referred to as the P bit. In response frames it is referred to as the F bit.

Acknowledged Mode

Unacknowledged mode

UI-frame 1 1 0 X X N(U)N(U)N(U)

U-frame 1 1 1 P/F M4 M3 M2 M1

Encryption mode bit (E) The E bit is used to indicate whether the information and FCS fields of the UI frame are encrypted (ciphered) to provide user data confidentiality. Protected Mode bit (PM) The PM bit is used to indicate whether the FCS field shall be calculated using both the frame header and information fields. The PM bit is set to 1 to indicate that the FCS covers the frame header and information fields. The PM bit is set to 0 to indicate that the FCS covers only the frame header field and the first 4 octets of the information field. This permits UI frames to transport "unprotected" information, such that errors beyond the first 4 octets of the information field do not result in the frame being discarded

LLC functions

Page 15: Chap06 ll cprot_03_kh

R(249)

R(250)

R(251)

R(252)

R(253)

R(254)

R(255)

X

R(9) R(10) R(11) R(12) R(13) R(14) R(17) R(16)

R(1) R(2) R(3) R(4) R(5) R(6) R(7) R(8)

R(249)

R(250)

R(251)

R(252)

R(253)

R(254)

R(255)

X

R(9) R(10) R(11) R(12) R(13) R(14) R(17)R(16)

R(1) R(2) R(3) R(4) R(5) R(6) R(7) R(8)

X X X K

LLC header fields: Control Field IV

In Asynchronous Balanced Mode, all I+S and S SACK frames contain R(n), the SACK bitmap. At the time that a SACK frame is designated for transmission, the value of each bit R(n) in the bitmap is set to 0 or 1 depending on whether I frame number N(R) + n has been received or not. R(n) = 1 indicates that the LLE transmitting the SACK frame has correctly received I frame number N(R) + n. R(n) = 0 indicates that the LLE transmitting the SACK frame has not correctly received I frame number N(R) + n.

N(R)N(R)N(R)N(R)N(R)N(R) S1 S2

I-frame

N(R)N(R)N(R)N(R)N(R)N(R) S1 S2

N(S) N(S) N(S) N(S) X N(R)N(R)N(R)

0 A X N(S) N(S)N(S) N(S) N(S) S-frame 1 0 A X X N(R)N(R)N(R)

Octet

1

2

:

34 (max)

3

4

36 (max)

5

6

Octet

1

2

3

4

K Bitmap length indicator

Page 16: Chap06 ll cprot_03_kh

LLC Acknowledged mode operation

MS SGSNSABM (SAPI)

UA

V(S) V(R) V(A) V(S) V(R) V(A)

0 0 0

0 0 0

I (RR, N(S)=0, N(R)=0)1 0 0 S(RR, N(R)=1)1 0 1

0 1 0

I (RR, A=0, N(S)=1, N(R)=0)I (RR, A=1, N(S)=2, N(R)=0)

2 0 13 0 1

0 2 0

0 3 0I(RR, N(S)=0, N(R)=3)1 3 0

I (RR, A=1, N(S)=4, N(R)=1)S (ACK, N(R)=3)

I (RR, A=1, N(S)=3, N(R)=1)S (RR, N(R)=5)

3 1 3

4 1 35 1 3 1 3 1

1 5 1

5 1 5

successfulABM establishment

V(S) is the Send State Variable. The transmitting LLE holds here the number of the next I-frame to be transmitted. As soon as the next I-frames was sent, its value is increased by one (mod 512). If a frame is retransmitted, its value is not increased.

V(A) represents the Acknowledged State Variable. V(A) denotes the last frame, which has not yet been confirmed, i.e. V(A) – 1 equals N(S) of the last acknowledged frame. V(S) may exceed V(A) by k. k can range between 1 and 255.

V(R) is the Received State Variable. It identifies the next in-sequence I-frame to be received at the LLE. It is incremented by one, if it received an error-free, in-sequence I-frame with N(S)=V(R).

Page 17: Chap06 ll cprot_03_kh

Exchange Identification Parameter Negotiation

VERSION: LLC version number

IOV-UI: ciphering Input offset value for UI frames, common for all SAPIs of a TLLI

IOV-I: ciphering Input offset value for I frames, for the SAPI under negotiation

T200: retransmission time-out N200: maximum number of retransmissions N201-U: maximum information field length for U and UI frames N201-I: maximum information field length for I frames mD: I frame buffer size in the downlink direction mU: I frame buffer size in the uplink direction kD: window size in the downlink direction kU: window size in the uplink direction

The negotiation procedure is one-step, e.g. one side starts the process by sending an XID command or a SABM command containing an Information field, offering a certain set of parameters from the applicable parameter repertoire the sending entity wants to negotiate, proposing values within the allowed range. In return, the other side sends an XID response or an UA frame with an information field, either confirming these parameter values by returning the requested values, or offering higher or lower ones in their place.

Both entities supports the negotiated values, however under certain conditions one or more parameters may need to be re-negotiated (e.g., in the case of a change in SGSN).

Without any prior XID exchange, default values apply.

SABM (T200 = 300, N200 = 4)

UA (T200 = 300, kD = 1)

Negotiation Procedure with XID

XID (P=1, N201-I=500, mD=250, L3-Par)

XID (F=1, N201-I=500, mD=250, L3-Par)

Negotiation Procedure during ABM procedure

Page 18: Chap06 ll cprot_03_kh

LLC layer parameter default values (3GPP 04.64)

LLCParameter

SAPI 1GMM

SAPI 2TOM 2

SAPI 3User Data 3

SAPI 5User Data 5

SAPI 7SMS

SAPI 8TOM 8

SAPI 9User Data 9

SAPI 11User

Data 11

Version 0

IOV‑UI 0

IOV‑I Note 2 Note 2 227 • SAPI 227 • SAPI Note 2 Note 2 227 • SAPI 227 • SAPI

T200 and T201 5 s 5 s 5 s 10 s 20 s 20 s 20 s 40 s

N200 3 3 3 3 3 3 3 3

N201‑U 400 270 500 500 270 270 500 500

N201‑I Note 2 Note 2 1 503 1 503 Note 2 Note 2 1 503 1 503

mD Note 2 Note 2 1 520 760 Note 2 Note 2 380 190

mU Note 2 Note 2 1 520 760 Note 2 Note 2 380 190

kD Note 2 Note 2 16 8 Note 2 Note 2 4 2

kU Note 2 Note 2 16 8 Note 2 Note 2 4 2

NOTE 1: Proper LLC operation requires that timer T200 be greater than the maximum time between transmission of command frames and the reception of their corresponding response or acknowledgement frames.NOTE 2: This parameter applies to ABM procedures. ABM operation is not allowed for GMM, SMS, and TOM that use only UI frames for information transfer.NOTE 3: The default values for SAPIs 3, 5, 9, and 11 have been chosen to correspond with the four GPRS quality of service delay classes, see 3GPP TS 02.60. However, there is no fixed relationship between SAPI and delay class. The LLC layer parameters for any SAPI can be negotiated to support any QoS profile, see 3GPP TS 03.60.NOTE 4: Proper LLC operation requires that the values for N201‑U and N201‑I are not greater than the maximum number of octets in an information field that can be transmitted or retransmitted over the Gb interface, see 3GPP TS 08.18. It is the responsibility of the SGSN to negotiate N201‑U and N201‑I to values compatible with the usage of the Gb interface.

Page 19: Chap06 ll cprot_03_kh

Some LLC parameters

Information field

The maximum length of the information field is defined by the N201 parameter N201-U for LLC UI and

N201-I for LLC I&S frames N201: min 140, max 1520 octets

Only for acknowledged mode

DataframeMS SGSN

T200

T200

No Ack !

No Ack !

No Ack !

1. retransmission

2. retransmission

N200 th. retransmission

T200 No Ack !release

Page 20: Chap06 ll cprot_03_kh

LLC header example

|GPRS IP, RFC 791 12.81 (IP_791) DTGR (= Datagram) |GPRS Logical Link Control, SMG#31, 04.64 V6.7.0 (TS 101 351) (LLC670) UI (= Unnumbered information) |

|Unnumbered information |

|0------- |Protocol Discriminator |LLC |

|-1------ |Command/Response |MS->SGSN: Resp | SGSN->MS: Cmd |

|--00---- |Spare |0 |

|----0011 |SAPI |QOS priority level 1 |

|110----- |Format indicator |UI-Frame |

|---00--- |Spare |0 |

|***b9*** |N(U) |415 |

|------0- |Encryption function bit |encryption |

|-------1 |Protect data bit |FCS for frame + data field |

|**B500** |DATA |35 10 80 37 38 39 30 31 32 33 34 35 |