Topic #7: How is a SIM card used to help a phone attach to the network?
Disclaimer: This is mainly a core topic, and not my area of expertise. I am mostly confident in the information, but there may be some mistakes.
The main purpose of a SIM card is to identify and authenticate the user with the network. Among the many parameters on a SIM card, the following are especially important:
- Ki (secret key)
- IMSI (International Mobile Subscriber ID)
IMSI is a unique number similar to IMEI, but for the subscriber, not the phone. Only one IMSI is used on your SIM, and it doesn't change whether you are using 3G or LTE. From the network's point of view, this number identifies you with Public Mobile. On an Android phone, you can download an app like this to view your own IMSI (look for "SIM Subscriber ID"):
As you can see, the first 6 digits of your IMSI are always the same as the network ID (Fido being the notable exception).
Telus = 302220
Bell = 302610
Rogers = 302720
These numbers are known as PLMN, which are unique global network identifiers. A PLMN is further broken down into MCC (Mobile Country Code) and MNC (Mobile Network Code). Canada's MCC is 302. In North America, MNC is always 3 digits. For the rest of the world, MNC is 2 digits. The MNC identifies an operator in that country.
The very first time a SIM is used on a network, the IMSI is sent to eNodeB to identify the user. This information is not encrypted, so it is minimized to avoid eavesdropping. The IMSI includes the PLMN as mentioned above, as well as the subscriber ID. This way, the network knows exactly who is trying to attach, and which operator they claim to be from. Authentication is required to prove the user is legitimately from that operator (this is explained further below). Once the user is attached, the core network will remember the IMSI and assign a temporary IMSI (TMSI) to the user to be used for future attach requests. In subsequent attach requests, the phone will send its TMSI, and the network should remember this user. If there is ever a problem, the network can always ask for the IMSI again, but this is not common.
The secret key (Ki) is a very important number used for authentication. The exact same key is stored on the operator's core network, inside the HSS. During the LTE attach procedure, the MME will ask the HSS for a challenge question and expected response. It will forward the challenge question to the phone (via eNodeB), but will hold on to the expected response.
When eNodeB asks the phone to respond to the challenge, the SIM card uses its key to come up with the response. The response is passed on to MME (via eNodeB). The MME compares the response to the expected response, and if they match, the user is accepted. If not, user is rejected (though allowed to make emergency calls).
For an excellent overview of the authentication procedure, refer to this video:
As you can imagine, the key is a critical piece of this process, and it's not shared with anyone, not even the MME, which is the powerful "brains" of the LTE network.
In a roaming scenario, the visited MME will exchange information with the home HSS to complete authentication. This avoids sharing keys between operators.
The big exception with authentication is emergency calls. In fact, calling 911 doesn't even require the phone to have a SIM card. Even though the phone may show no signal bars, it will say "emergency calls only". The phone will be talking to the network in the background and is permitted to only make emergency calls. All other service requests are denied.
Please note that sometimes during activations, people will require a new SIM card to get their accounts set up correctly. This is not due to incorrect key or IMSI values, but maybe the wrong IMSI is linked to a user's account number internally at the operator's billing system. These provisioning steps are separate from what I have discussed here, and I am not familiar with those processes.
Topic #6: Basics of LTE roaming and why I don't need to change my APN
Disclaimer: This is mainly a core topic, and not my area of expertise. I am mostly confident in the information, but there may be some mistakes.
Previously I described the LTE network with the simple diagram shown below.
LTE roaming can be achieved in 2 ways:
- Home routed (traditional)
- Local breakout
Before any roaming takes place, the home operator and the visited operator must come to an agreement and connect to each other's core networks. If the user doesn't have a valid account at home, which allows roaming in the visited country, then the visited core network will reject the phone from attaching to the network.
With traditional roaming, the local SGW is used, but the home PGW is used. With local breakout, the local SGW and PGW are used.
Let's look at an example:
A Telus user travels to the US and roams on AT&T. Once the AT&T core network authenticates the user's SIM card (see next topic for more info), the user is allowed to attach to the network to receive service. All of this takes place in a matter of seconds, and you may notice this short delay when you first disable airplane mode upon landing, until you have service.
With traditional roaming, the user's data is routed from AT&T's SGW to Telus's PGW in Canada, and then to the internet from there. Since the PGW is in charge of APNs, there is no need for a new APN. This is an ok approach for nearby countries, but what if the Telus user goes to Australia and is roaming on Telstra? Having to connect from Telstra's SGW to Telus's PGW will introduce noticeable delays and the LTE experience of the customer could suffer. This is especially true if he/she is trying to browse local Australian websites, which means the data travels from the phone to the RAN to Telstra's SGW, to Telus PGW, to internet, where it is finally routed back to the local Aussie web server.
In this scenario, Telus might have preferred to implement local breakout. One thing I'm not sure about here is how the APN would be configured. I believe the PGW can assign an APN to the phone via the MME during the attach procedure.
As far as I know, Telus does not implement local breakout as it is more challenging to rely on the foreign operator to keep track of data usage and other things that are more easily handled by Telus's own PGW.
Topic #5: What does a cell site look like in real life?
A cell site (base station) is generally made up of a few essential parts:
- Transport router to connect to backhaul network (backhaul can be microwave, fiber, satellite, etc)
- Baseband unit for processing
- Radio unit to transmit/receive RF signal
- Antenna
With 2G networks, the Baseband and Radio units were located in a weatherproof cabinet or small shelter at the base of the tower (or on the roof of a building). Long RF cabling was used to connect to antennas. RF cabling is expensive, bulky, results in signal attenuation, and it wasn't the best way to design a network.
With modern 3G and 4G networks, the Radio units have been weatherproofed and mounted outdoors, directly beside the antennas, making the RF cabling very short. Now instead we have long fiber cables to connect the Remote Radio Units (RRU) to the Baseband Units (BBU). Fiber is practically lossless for this type of transmission. RRUs are generally built to support one band per radio, but can usually support multiple technologies.For example, a Band 2 radio (1900 MHz) can usually be used for UMTS (3G), LTE, or both at the same time!
In Topic #2, I talked about MIMO and how it requires multiple antennas. It's important to note that multiple antenna elements can be manufactured in a single antenna panel. Here is a picture of an antenna with four ports (four internal antennas). This one antenna can be used to provide 4x4 MIMO:
Here's an example of a Sprint USA rooftop site where you can see the RRUs mounted to the back of the antenna pole:
Rooftop cabinets housing BBU, power equipment, cooling equipment, and transport router:
All of the pictures I am sharing from Canadian sites are from public Google searches.
Rogers (left) and Bell (right) towers side by side in Toronto:
Sometimes operators will share towers to save space. Tower owner will put their equipment higher up for better coverage and lease the lower spots to competitors.
Inside of a shelter will have the same equipment as the cabinets, but more spaced out. Here's an example of a site not in Canada (though they are all similar):
In the last few years, operators have been getting creative in hiding RRU and antenna equipment in order to keep the sites looking clean. Sometimes these sites will be disguised as flagpoles, or simply "empty" poles that have a cover hiding the equipment. Here are some examples:
What if we combine the antenna and RRU into a single product? That could reduce RF cabling even more and increase efficiency. In fact, the major vendors are already doing this with integrated antenna products. For upcoming 5G products that utilize massive MIMO, the radios and antennas will always be integrated.
Ericsson's AIR:
Nokia's RAS:
Huawei's AAU:
What about micro / pico cells? These are just smaller base stations (eNodeB for LTE), with less power and capacity, and a combined RRU + BBU. Here's an example of a pair of Telus outdoor microcells:
Microcells can be installed indoors or outdoors.
Picocells are smaller versions of microcells, and are mainly installed indoors. They look similar to public WiFi access points.
Femtocells are even smaller versions of picocells, purchased directly by end customers to install in their homes/small offices for improved cellular coverage. They use the customer's own internet to route traffic to the operator's network via a secure tunnel. Femtocells are currently not offered by any operators in Canada.
Topic #3: How can I achieve very fast speed test results?
In order to get peak download speeds on your phone, you need to make sure your signal is good and the network is not congested.
The main indicator for a good signal for download speeds is your phone's Signal to Noise (and Interference) Ratio, more commonly known as SNR (or SINR). This shows the cell's power relative to every other signal at the same frequency / channel in decibels (dB). The higher your SINR, the higher speeds you can expect to see. An excellent value for SINR would be 25 - 30 dB.
Number of bars are not related to SINR. You could have full bars with a poor SINR. The bars are showing a different measurement, which doesn't take interference into account. This value is known as RSRP, or the Reference Signal Received Power. RSRP is used for performing handovers, among other things.
For uplink, there's no way to check the SINR at the eNodeB, so the next best indicator would be RSRP. It's not perfect, but it's the best indicator available. An excellent value for RSRP would be -85 dBm or higher (Note: higher means less negative, and -75 dBm would be an example of a higher value).
In terms of network congestion, the Big 3 operators all have excellent core and backhaul networks, so it would be safe to assume there is no limitation there. The only limitation would be at the RAN, but again there's no way to measure this from the phone. As a rule of thumb, networks will be very close to zero utilization after midnight.
Here's an example of some tests I did last year in Toronto on Bell using a Samsung phone. B2 + B4 CA with a total aggregated bandwidth of 35 MHz (20 + 15), using 2x2 MIMO. Peak network capability is 260 Mbps. My results would have been even better after midnight.
For comparison, here are the results from a lab environment, where 260 Mbps is the MAC layer limit. Application layer limit seems to be 249 Mbps.
