Module 6
Wireless and Mobile Networks
a. Wireless Links and Network Characteristics
Decreasing signal strength. Electromagnetic radiation attenuates as it passes
through matter (e.g., a radio signal passing through a wall). Even in free space, the signal
will disperse, resulting in decreased signal strength (sometimes referred to as path loss) as
the distance between sender and receiver increases.
Interference from other sources. Radio sources transmitting in the same frequency
band will interfere with each other. For example, 2.4 GHz wireless phones and 802.11b
wireless LANs transmit in the same frequency band. Thus, the 802.11b wireless LAN
user talking on a 2.4 GHz wireless phone can expect that neither the network nor the
phone will perform particularly well. In addition to interference from transmitting
sources, electromagnetic noise within the environment (e.g., a nearby motor, a
microwave) can result in interference. For this reason, a number of more recent 802.11
standards operate in the 5GHz frequency band.
Multipath propagation. Multipath propagation occurs when portions of the
electromagnetic wave reflect off objects and the ground, taking paths of different lengths
between a sender and receiver. This results in the blurring of the received signal at the
receiver. Moving objects between the sender and receiver can cause multipath
propagation to change over time.
The discussion above suggests that bit errors will be more common in wireless
links than in wired links. For this reason, it is perhaps not surprising that wireless link
protocols (such as the 802.11 protocol we’ll examine in the following section) employ
not only powerful CRC error detection codes, but also link-level reliable-data-transfer
protocols that retransmit corrupted frames.
Having considered the impairments that can occur on a wireless channel, let’s
next turn our attention to the host receiving the wireless signal. This host receives an
electromagnetic signal that is a combination of a degraded form of the original signal
transmitted by the sender (degraded due to the attenuation and multipath propagation
effects that we discussed above, among others) and background noise in the environment.
The signal-to-noise ratio (SNR) is a relative measure of the strength of the received signal
(i.e., the information being transmitted) and this noise. The SNR is typically measured in
units of decibels (dB), a unit of measure that some think is used byelectrical engineers
primarily to confuse computer scientists. The SNR, measured in dB, is 20 times the ratio
of the base-10 logarithm of the amplitude of the received signal to the amplitude of the
noise. For our purposes here, we need only know that a larger SNR makes it easier for the
receiver to extract the transmitted signal from the background noise.
(BER)— roughly speaking, the probability that a transmitted bit is received in
error at the receiver—versus the SNR for three different modulation techniques for
encoding information for transmission on an idealized wireless channel. The theory of
modulation and coding, as well as signal extraction and BER, is well beyond the scope of
this text (see [Schwartz 1980; Goldsmith 2005] for a discussion of these topics).
For a given modulation scheme, the higher the SNR, the lower the BER. Since a
sender can increase the SNR by increasing its transmission power, a sender can decrease
the probability that a frame is received in error by increasing its transmission power.
Note, however, that there is arguably little practical gain in increasing the power beyond
a certain threshold, say to decrease the BER from 10-12 to 10-13 . There are also
disadvantages associated with increasing the transmission power: More energy must be
expended by the sender(an important concern for battery-powered mobile users), and the
sender’s transmissions are more likely to interfere with the transmissions of another
sender.
For a given SNR, a modulation technique with a higher bit transmission rate
(whether in error or not) will have a higher BER. For example, with an SNR of 10 dB,
BPSK modulation with a transmission rate of 1 Mbps has a BER of less than 10-7 , while
with QAM16 modulation with a transmission rate of 4 Mbps, the BER is 10-1 , far too
high to be practically useful. However, with an SNR of 20 dB, QAM16 modulation has a
transmission rate of 4 Mbps and a BER of 10-7 , while BPSK modulation has a
transmission rate of only 1 Mbps and a BER that is so low as to be (literally) “off the
charts.” If one can tolerate a BER of 10-7 , the higher transmission rate offered by
QAM16 would make it the preferred modulation technique in this situation. These
considerations give rise to the final characteristic, described next.
Dynamic selection of the physical-layer modulation technique can be used to
adapt the modulation technique to channel conditions. The SNR (and hence the BER)
may change as a result of mobility or due to changes in the environment. Adaptive
modulation and coding are used in the 802.11 WiFi and in 4G and 5G cellular data
networks that we’ll study. This allows, for example, the selection of a modulation
technique that provides the highest transmission rate possible subject to a constraint on
the BER, for given channel characteristics.
A higher and time-varying bit error rate is not the only difference between a wired
and wireless link. Recall that in the case of wired broadcast links, all nodesreceive the
transmissions from all other nodes. In the case of wireless links, the situation is not as
simple. Suppose that Station A is transmitting to Station B. Suppose also that Station C is
transmitting to Station B. With the so-called hidden terminal problem, physical
obstructions in the environment (for example, a mountain or a building) may prevent A
and C from hearing each other’s transmissions, even though A’s and C’s transmissions
are indeed interfering at the destination. A second scenario that results in undetectable
collisions at the receiver results from the fading of a signal’s strength as it propagates
through the wireless medium illustrates the case where A and C are placed such that their
signals are not strong enough to detect each other’s transmissions, yet their signals are
strong enough to interfere with each other at station B. As we’ll see in, the hidden
terminal problem and fading make multiple access in a wireless network considerably
more complex than in a wired network.
Recall from that when hosts communicate over a shared medium, a protocol is
needed so that the signals sent by multiple senders do not interfere at the receivers. In, we
described three classes of medium access protocols: channel partitioning, random access,
and taking turns. Code division multiple access (CDMA) belongs to the family of channel
partitioning protocols. It is prevalent in wireless LAN and cellular technologies. Because
CDMA is so important in the wireless world, we’ll take a quick look at CDMA now,
before getting into specific wireless access technologies in the subsequent sections.
ignal (the code) that changes at a much faster rate (known as the chipping rate)
than the original sequence of data bits idealized CDMA encoding/decoding scenario.
Suppose that the rate at which original data bits reach the CDMA encoder defines the unit
of time; that is, each original data bit to be transmitted requires a one-bit slot time. Let di
be the value of the data bit for the ith bit slot. For mathematical convenience, we
represent a data bit with a 0 value as -1. Each bit slot is further subdivided into M mini-
slots, M = 8, although in practice M is much larger. The CDMA code used by the sender
consists of a sequence of M values, cm, m = 1, . . . , M, each taking a +1 or -1 value. In
the example, the M-bit CDMA code being used by the sender is (1, 1, 1, -1, 1, -1, -1, -1).
b. Wireless LANs
Pervasive in the workplace, the home, educational institutions, cafés, airports, and
street corners, wireless LANs are now one of the most important access network
technologies in the Internet today. Although many technologies and standards forwireless
LANs were developed in the 1990s, one particular class of standards has clearly emerged
as the winner: the IEEE 802.11 wireless LAN, also known as WiFi. In this section, we’ll
take a close look at 802.11 wireless LANs, examining its frame structure, its medium
access protocol, and its internetworking of 802.11 LANs with wired Ethernet LANs.
As summarized in Table 7.1, there are several 802.11 standards [IEEE 802.11
2020]. The 802.11 b, g, n, ac, ax are successive generations of 802.11 technology aimed
for wireless local area networks (WLANs), typically less than 70 m range in a home
office, workplace, or business setting. The 802.11 n, ac, and ax standards have recently
been branded as WiFi 4, 5 and 6, respectively—no doubt competing with 4G and 5G
cellular network branding. The 802.11 af, ah standards operate over longer distances and
are aimed at Internet of Things, sensor networks, and metering applications.
The different 802.11 b, g, n, ac, ax standards all share some common
characteristics, including the 802.11 frame format that we will study shortly, and are
backward compatible, meaning, for example, that a mobile capable only of 802.11 g may
still interact with a newer 802.11 ac or 802.11 ax base station. They also all use the same
medium access protocol, CSMA/CA, which we’ll also discuss shortly, while also 802.11
ax also supports centralized scheduling by the base station of transmissions from
associated wireless devices.
However, as shown in Table 7.1, the standards have some major differences at the
physical layer. 802.11 devices operate in two different frequency ranges: 2.4–2.485 GHz
(referred to as the 2.4 GHz range) and 5.1–5.8 GHz (referred to as the 5 GHz range). The
2.4 GHz range is an unlicensed frequency band, where 802.11 devices may compete for
frequency spectrum with 2.4 GHz phones and appliances such as microwave ovens. At 5
GHz, 802.11 LANs have a shorter transmission distance for a given power level and
suffer more from multipath propagation. The 802.11n, 802.11ac, and 802.11ax standards
use multiple input multiple-output (MIMO) antennas; that is, two or more antennas on the
sending side and two or more antennas on the receiving side that are
transmitting/receiving different signals[Diggavi 2004]. 802.11ac and 802.11 ax base
stations may transmit to multiple stations simultaneously, and use “smart” antennas to
adaptively beamform to target transmissions in the direction of a receiver. This decreases
interference and increases the distance reached at a given data rate. The data rates shown
in are for an idealized environment, for example, a receiver close to the base station, with
no interference—a scenario that we’re unlikely to experience in practice! So as the saying
goes, YMMV: Your Mileage (or in this case your wireless data rate) May Vary.
The fundamental building block of the 802.11 architecture is the basic service set
(BSS). A BSS contains one or more wireless stations and a central base station, known as
an access point (AP) in 802.11 parlance. Shows the AP in each of two BSSs connecting
to an interconnection device (such as a switch or router), which in turn leads to the
Internet. In a typical home network, there is one AP and one router (typically integrated
together as one unit) that connects the BSS to the Internet.
As with Ethernet devices, each 802.11 wireless station has a 6-byte MAC address
that is stored in the firmware of the station’s adapter (that is, 802.11 network interface
card). Each AP also has a MAC address for its wireless interface. As with Ethernet, these
MAC addresses are administered by IEEE and are (in theory) globally unique.
When a network administrator installs an AP, the administrator assigns a oneor
two-word Service Set Identifier (SSID) to the access point. (When you choose Wi-Fi
under Setting on your iPhone, for example, a list is displayed showing the SSID of each
AP in range.) The administrator must also assign a channel number to the AP. To
understand channel numbers, recall that 802.11 operates in the frequency range of 2.4
GHz to 2.4835 GHz. Within this 85 MHz band, 802.11 defines 11 partially overlapping
channels. Any two channels are non-overlapping if and only if they are separated by four
or more channels. In particular, the set of channels 1, 6, and 11 is the only set of three
non-overlapping channels. This means that an administrator could create a wireless LAN
with an aggregate maximum transmission rate of three times the maximum transmission
rate shown in Table 7.1 by installing three 802.11 APs at the same physical location,
assigning channels 1, 6, and 11 to the APs, and interconnecting each of the APs with a
switch.
Now that we have a basic understanding of 802.11 channels, let’s describe an
interesting (and not completely uncommon) situation—that of a WiFi jungle. A WiFi
jungle is any physical location where a wireless station receives a sufficiently strong
signal from two or more APs. For example, in many cafés in New York City, a wireless
station can pick up a signal from numerous nearby APs. One of the APs might be
managed by the café, while the other APs might be in residential apartments near the
café. Each of these APs would likely be located in a different IP subnet and would have
been independently assigned a channel.
Now suppose you enter such a WiFi jungle with your smartphone, tablet, or
laptop, seeking wireless Internet access and a blueberry muffin. Suppose there are five
APs in the WiFi jungle. To gain Internet access, your wireless device needs to join
exactly one of the subnets and hence needs to associate with exactly one of the APs.
Associating means the wireless device creates a virtual wire between itself and the AP.
Specifically, only the associated AP will send data frames (that is, frames containing
data, such as a datagram) to your wireless device, and your wireless device will send data
frames into the Internet only through the associated AP. But how does your wireless
device associate with a particular AP? And more fundamentally, how does your wireless
device know which APs, if any, are out there in the jungle?
The 802.11 standard does not specify an algorithm for selecting which of the
available APs to associate with; that algorithm is left up to the designers of the 802.11
firmware and software in your wireless device. Typically, the device chooses the AP
whose beacon frame is received with the highest signal strength. While a high signal
strength is good, signal strength is not the only AP characteristic that will determine the
performance a device receives. In particular, it’s possible that the selected AP may have a
strong signal, but may be overloaded with other affiliated devices (that will need to share
the wireless bandwidth at that AP), while an unloaded AP is not selected due to a slightly
weaker signal. A number of alternative ways of choosing APs have thus recently been
proposed [Vasudevan 2005; Nicholson 2006; Sundaresan 2006]. For an interesting and
down-to-earth discussion of how signal strength is measured, see [Bardwell 2004].
The process of scanning channels and listening for beacon frames is known as
passive scanning . A wireless device can also perform active scanning, by broadcasting a
probe frame that will be received by all APs within the wireless device’s range. APs
respond to the probe request frame with a probe response frame. The wireless device can
then choose the AP with which to associate from among the responding APs.
After selecting the AP with which to associate, the wireless device sends an
association request frame to the AP, and the AP responds with an association response
frame. Note that this second request/response handshake is needed with active scanning,
since an AP responding to the initial probe request frame doesn’t know which of the
(possibly many) responding APs the device will choose to associate with, in much the
same way that a DHCP client can choose from among multiple DHCP servers. Once
associated with an AP, the device will want to join the subnet (in the IP addressing sense
to which the AP belongs. Thus, the device will typically send a DHCP discovery message
into the subnet via the AP in order to obtain an IP address on the subnet. Once the
address is obtained, the rest of the world then views that device simply as another host
with an IP address in that subnet.
In order to create an association with a particular AP, the wireless device may be
required to authenticate itself to the AP. 802.11 wireless LANs provide a number of
alternatives for authentication and access. One approach, used by many companies, is to
permit access to a wireless network based on a device’s MAC address. A second
approach, used by many Internet cafés, employs usernames and passwords. In both cases,
the AP typically communicates with an authentication server, relaying information
between the wireless device and the authentication server using a protocol such as
RADIUS [RFC 2865] or DIAMETER [RFC 6733]. Separating the authentication server
from the AP allows one authentication server to serve many APs, centralizing the (often
sensitive) decisions of authentication and access within the single server, and keeping AP
costs and complexity low. We’ll see that the new IEEE 802.11i protocol defining security
aspects of the 802.11 protocol family takes precisely this approach.
Once a wireless device is associated with an AP, it can start sending and receiving
data frames to and from the access point. But because multiple wireless devices, or the
AP itself may want to transmit data frames at the same time over the same channel, a
multiple access protocol is needed to coordinate the transmissions. In the following, we'll
refer to the devices or the AP as wireless “stations” that share the multiple access channel
broadly speaking there are three classes of multiple access protocols: channel partitioning
(including CDMA), random access, and taking turns. Inspired by the huge success of
Ethernet and its random access protocol, the designers of 802.11 chose a random access
protocol for 802.11 wireless LANs. This random access protocol is referred to as CSMA
with collision avoidance, or more succinctly as CSMA/CA. As with Ethernet’s
CSMA/CD, the “CSMA” in CSMA/CA stands for “carrier sense multiple access,”
meaning that each station senses the channel before transmitting, and refrains from
transmitting when the channel is sensed busy. Although both Ethernet and 802.11 use
carrier-sensing random access, the two MAC protocols have important differences. First,
instead of using collision detection, 802.11 uses collision-avoidance techniques. Second,
because of the relatively high bit error rates of wireless channels, 802.11 (unlike
Ethernet) uses a link-layer acknowledgment/retransmission (ARQ) scheme. We’ll
describe 802.11’s collision-avoidance and link-layer acknowledgment schemes below.
Before considering collision avoidance, however, we’ll first need to examine
802.11’s link-layer acknowledgment scheme. Recall from that when a station in a
wireless LAN sends a frame, the frame may not reach the destination station intact for a
variety of reasons. To deal with this non-negligible chance of failure, the 802.11 MAC
protocol uses link-layer acknowledgments. Destination station receives a frame that
passes the CRC, it waits a short period of time known as the Short Inter-frame Spacing
(SIFS) and then sends back an acknowledgment frame. If the transmitting station does
not receive an acknowledgment within a given amount of time, it assumes that an error
has occurred and retransmits the frame, using the CSMA/CA protocol to access the
channel. If an acknowledgment is not received after some fixed number of
retransmissions, the transmitting station gives up and discards the frame.
Recall that under Ethernet’s CSMA/CD, multiple access protocol, a station begins
transmitting as soon as the channel is sensed idle. With CSMA/CA, however, the station
refrains from transmitting while counting down, even when it senses the channel to be
idle. Why do CSMA/CD and CDMA/CA take such different approaches here?
To answer this question, let’s consider a scenario in which two stations each have
a data frame to transmit, but neither station transmits immediately because each senses
that a third station is already transmitting. With Ethernet’s CSMA/CD, the two stations
would each transmit as soon as they detect that the third station has finished transmitting.
This would cause a collision, which isn’t a serious issue in CSMA/CD, since both
stations would abort their transmissions and thus avoid the useless transmissions of the
remainders of their frames. In 802.11, however, the situation is quite different. Because
802.11 does not detect a collision and abort transmission, a frame suffering a collision
will be transmitted in its entirety. The goal in 802.11 is thus to avoid collisions whenever
possible. In 802.11, if the two stations sense the channel busy, they both immediately
enter random backoff, hopefully choosing different backoff values. If these values are
indeed different, once the channel becomes idle, one of the two stations will begin
transmitting before the other, and (if the two stations are not hidden from each other) the
“losing station” will hear the “winning station’s” signal, freeze its counter, and refrain
from transmitting until the winning station has completed its transmission. In this
manner, a costly collision is avoided. Of course, collisions can still occur with 802.11 in
this scenario: The two stations could be hidden from each other, or the two stations could
choose randombackoff values that are close enough that the transmission from the station
starting first have yet to reach the second station.
Let’s now consider why hidden terminals can be problematic. Suppose Station H1
is transmitting a frame and halfway through H1’s transmission, Station H2 wants to send
a frame to the AP. H2, not hearing the transmission from H1, will first wait a DIFS
interval and then transmit the frame, resulting in a collision. The channel will therefore be
wasted during the entire period of H1’s transmission as well as during H2’s transmission.
In order to avoid this problem, the IEEE 802.11 protocol allows a station to use a short
Request to Send (RTS) control frame and a short Clear to Send (CTS) control frame to
reserve access to the channel. When a sender wants to send a DATA frame, it can first
send an RTS frame to the AP, indicating the total time required to transmit the DATA
frame and the acknowledgment (ACK) frame. When the AP receives the RTS frame, it
responds by broadcasting a CTS frame. This CTS frame serves two purposes: It gives the
sender explicit permission to send and also instructs the other stations not to send for the
reserved duration.
Although the 802.11 frame shares many similarities with an Ethernet frame, it
also contains a number of fields that are specific to its use for wireless links. The 802.11
frame. The numbers above each of the fields in the frame represent the lengths of the
fields in bytes; the numbers above each of the subfields in the frame control field
represent the lengths of the subfields in bits. Let’s now examine the fields in the frame as
well as some of the more important subfields in the frame’s control field.
Perhaps the most striking difference in the 802.11 frame is that it has four address
fields, each of which can hold a 6-byte MAC address. But why four address fields?
Doesn’t a source MAC field and destination MAC field suffice, as they do for Ethernet?
It turns out that three address fields are needed for internetworking purposes—
specifically, for moving the network-layer datagram from a wireless station through an
AP to a router interface. The fourth address field is used when APs forward frames to
each other in ad hoc mode. Since we are only considering infrastructure networks here,
let’s focus our attention on the first three address fields.
To gain further insight into the purpose of address 3, let’s walk through an
internetworking example in the context. In this figure, there are two APs, each of which
is responsible for a number of wireless stations. Each of the APs has a direct connection
to a router, which in turn connects to the global Internet. We should keep in mind that an
AP is a link-layer device, and thus neither “speaks” IP nor understands IP addresses.
Consider now moving a datagram from the router interface R1 to the wireless Station H1.
The router is not aware that there is an AP between it and H1; from the router’s
perspective, H1 is just a host in one of the subnets to which it (the router) is connected.
Recall that in 802.11, whenever a station correctly receives a frame from another
station, it sends back an acknowledgment. Because acknowledgments can get lost, the
sending station may send multiple copies of a given frame. As we saw in our discussion
of the rdt2.1 protocol, the use of sequence numbers allows the receiver to distinguish
between a newly transmitted frame and the retransmission of a previous frame. The
sequence number field in the 802.11 frame thus serves exactly the same purpose here at
the link layer as it did in the transport layer. Recall that the 802.11 protocol allows a
transmitting station to reserve the channel for a period of time that includes the time to
transmit its data frame and the time to transmit an acknowledgment. This duration value
is included in the frame’s duration field (both for data frames and for the RTS and CTS
frames).
We’ll say just a few words about some of the more important subfields; for a
more complete discussion, you are encouraged to consult the 802.11 specification [Held
2001; Crow 1997; IEEE 802.11 1999]. The type and subtype fields are used to
distinguish the association, RTS, CTS, ACK, and data frames. The to and from fields are
used to define the meanings of the different address fields. (These meanings change
depending on whether ad hoc or infrastructure modes are used and, in the case of
infrastructure mode, whether a wireless station or an AP is sending the frame.) Finally the
WEP field indicates whether encryption is being used or not.
In order to increase the physical range of a wireless LAN, companies and
universities will often deploy multiple BSSs within the same IP subnet. This naturally
raises the issue of mobility among the BSSs—how do wireless stations seamlessly move
from one BSS to another while maintaining ongoing TCP sessions? As we’ll see in this
subsection, mobility can be handled in a relatively straightforward manner when the
BSSs are part of the subnet. When stations move between subnets, more sophisticated
mobility management protocols will be needed.
Let’s now look at a specific example of mobility between BSSs in the same
subnet. Shows two interconnected BSSs with a host, H1, moving from BSS1 to BSS2.
Because in this example the interconnection device that connects the two BSSs is not a
router, all of the stations in the two BSSs, including the APs, belong to the same IP
subnet. Thus, when H1 moves from BSS1 to BSS2, it may keep its IP address and all of
its ongoing TCP connections. If the interconnection device were a router, then H1 would
have to obtain a new IP address in the subnet in which it was moving. This address
change would disrupt (and eventually terminate) any on-going TCP connections at H1.
In, we’ll see how a network-layer mobility protocol, such as mobile IP, can be used to
avoid this problem.
How does it know that the host has moved from one AP to another? As you may
recall from, switches are “self-learning” and automatically build their forwarding tables.
This self-learning feature nicely handles occasional moves (for example, when an
employee gets transferred from one department to another); however, switches were not
designed to support highly mobile users who want to maintain TCP connections while
moving between BSSs. To appreciate the problem here, recall that before the move, the
switch has an entry in its forwarding table that pairs H1’s MAC address with the
outgoing switch interface through which H1 can be reached. If H1 is initially in BSS1,
then a datagram destined to H1 will be directed to H1 via AP1. Once H1 associates with
BSS2, however, its frames should be directed to AP2. One solution (a bit of a hack,
really) is for AP2 to send a broadcast Ethernet frame with H1’s source address to the
switch just after the new association. When the switch receives the frame, it updates its
forwarding table, allowing H1 to be reached via AP2. The 802.11f standards group is
developing an inter-AP protocol to handle these and related issues.
We saw earlier in that different modulation techniques (with the different
transmission rates that they provide) are appropriate for different SNR scenarios.
Consider, for example, a mobile 802.11 user who is initially 20 meters away from the
base station, with a high signal-to-noise ratio. Given the high SNR, the user can
communicate with the base station using a physical-layer modulation technique that
provides high transmission rates while maintaining a low BER. This is one happy user!
Suppose now that the user becomes mobile, walking away from the base station, with the
SNR falling as the distance from the base station increases. In this case, if the modulation
technique used in the 802.11 protocol operating between the base station and the user
does not change, the BER will become unacceptably high as the SNR decreases, and
eventually no transmitted frames will be received correctly.
For this reason, some 802.11 implementations have a rate adaptation capability
that adaptively selects the underlying physical-layer modulation technique to use based
on current or recent channel characteristics. If a node sends two frames in a row without
receiving an acknowledgment (an implicit indication of bit errors onthe channel), the
transmission rate falls back to the next lower rate. If 10 frames in a row are
acknowledged, or if a timer that tracks the time since the last fallback expires, the
transmission rate increases to the next higher rate. This rate adaptation mechanism shares
the same “probing” philosophy as TCP’s congestion-control mechanism—when
conditions are good (reflected by ACK receipts), the transmission rate is increased until
something “bad” happens (the lack of ACK receipts); when something “bad” happens,
the transmission rate is reduced. 802.11 rate adaptation and TCP congestion control are
thus similar to the young child who is constantly pushing his/her parents for more and
more (say candy for a young child, later curfew hours for the teenager) until the parents
finally say “Enough!” and the child backs off (only to try again later after conditions have
hopefully improved!). A number of other schemes have also been proposed to improve
on this basic automatic rate adjustment scheme [Kamerman 1997; Holland 2001; Lacage
2004].
Power is a precious resource in mobile devices, and thus the 802.11 standard
provides power-management capabilities that allow 802.11 nodes to minimize the
amount of time that their sense, transmit, and receive functions and other circuitry need to
be “on.” 802.11 power management operates as follows. A node is able to explicitly
alternate between sleep and wake states (not unlike a sleepy student in a classroom!). A
node indicates to the access point that it will be going to sleep by setting the power-
management bit in the header of an 802.11 frame to 1. A timer in the node is then set to
wake up the node just before the AP is scheduled to send its beacon frame (recall that an
AP typically sends a beacon frame every 100 msec). Since the AP knows from the set
power-transmission bit that the node is going to sleep, it (the AP) knows that it should not
send any frames to that node, and will buffer any frames destined for the sleeping host for
later transmission.
A node will wake up just before the AP sends a beacon frame, and quickly enter
the fully active state (unlike the sleepy student, this wakeup requires only 250
microseconds [Kamerman 1997]!). The beacon frames sent out by the AP contain a list of
nodes whose frames have been buffered at the AP. If there are no buffered frames for the
node, it can go back to sleep. Otherwise, the node can explicitly request that the buffered
frames be sent by sending a polling message to the AP. With an interbeacon time of 100
msec, a wakeup time of 250 microseconds, and a similarly small time to receive a beacon
frame and check to ensure that there are no buffered frames, a node that has no frames to
send or receive can be asleep 99% of the time, resulting in a significant energy savings.
Bluetooth networks seem to have quickly become part of everyday life. Perhaps
you’ve used a Bluetooth network as a “cable replacement” technology to interconnect
your computer with a wireless keyboard, mouse, or other peripheral device. Or perhaps
you’ve used a Bluetooth network to connect your wireless earbuds, speaker, watch, or
health monitoring band to your smartphone or to connect your smartphone to a car’s
audio system. In all of these cases, Bluetooth operates over short ranges (tens of meters
or less), at low power, and at low cost. For this reason, Bluetooth networks are sometimes
referred to as wireless personal area networks (WPANs) or piconets.
Although Bluetooth networks are small and relatively simple by design, they’re
packed with many of the link-level networking techniques that we’ve studied earlier
including time division multiplexing (TDM) and frequency division, randomized backoff,
polling, error detection and correction, reliable data transfer via ACKs and NAKS. And
that’s just considering Bluetooth’s link layer!
Because Bluetooth ad hoc networks must be self-organizing, it’s worth looking
into how they bootstrap their network structure. When a master node wants to form a
Bluetooth network, it must first determine which other Bluetooth devices are within
range; this is the neighbor discovery problem. The master does this by broadcasting a
series of 32 inquiry messages, each on a different frequency channel, and repeats the
transmission sequence for up to 128 times. A client device listens on its chosen
frequency, hoping to hear one of the master’s inquiry messages on this frequency. When
it hears an inquiry message, it backs off a random amount of time between 0 and 0.3
seconds (to avoid collisions with other responding nodes, reminiscent of Ethernet’s
binary backoff) and then responds to the master with a message containing its device ID.
Once the Bluetooth master has discovered all of the potential clients within range,
it then invites those clients that it wishes to join the piconet. This second phase is known
as Bluetooth paging, and is reminiscent of 802.11 clients associating with a base station.
Through the paging process, the master will inform the client of the frequency-hopping
pattern to be used, and the sender’s clock. The master begins the paging process by again
sending 32 identical paging invitation messages, each now addressed to a specific client,
but again using different frequencies, since that client has yet to learn the frequency-
hopping pattern. Once the client replies with an ACK message to the paging invitation
message, the master sends frequency-hopping information, clock synchronization
information and an active member address to the client, and then finally polls the client,
now using the frequency-hopping pattern, to ensure that the client is connected into the
network.
In our discussion above, we have only touched on Bluetooth’s wireless
networking. Higher level protocols provide for reliable data packet transfer, circuitlike
streaming of audio and video, changing transmission power levels, changing
active/parked state (and other states), and more. More recent versions of Bluetooth have
addressed low energy and security considerations. For more information about Bluetooth,
the interested reader should consult [Bisdikian 2001, Colbach 2017, and Bluetooth 2020].
c. Cellular Networks: 4G and 5G
In the previous section, we examined how a host can access the Internet when
within the vicinity of an 802.11 WiFi access point (AP). But as we’ve seen, APs have
small coverage areas, and a host certainly will not be able to associate with every AP it
encounters. As a result, WiFi access is hardly ubiquitous for a user on the move.
By contrast, 4G cellular network access has rapidly become pervasive. A recent
measurement study of more than one million US mobile cellular network subscribers
found that they can find 4G signals more than 90% of the time, with download speeds of
20 Mbps and higher. Users of Korea’s three major cellular carriers are able to find a 4G
signal between 95 and 99.5% of the time [Open Signal 2019]. As a result, it is now
commonplace to stream HD videos or participate in videoconferences while on the move
in a car, bus, or high-speed train. The ubiquity of 4G Internet access has also enabled
myriad new IoT applications such as Internet-connected shared bike and scooter systems,
and smartphone applications such as mobile payments (commonplace in China since
2018) and Internet-based messaging (WeChat, WhatsApp, and more).
The term cellular refers to the fact that the region covered by a cellular network is
partitioned into a number of geographic coverage areas, known as cells. Each cell
contains a base station that transmits signals to, and receives signals from, the mobile
devices currently in its cell. The coverage area of a cell depends on many factors,
including the transmitting power of the base station, the transmitting power of the
devices, obstructing buildings in the cell, and the height and type of the base station
antennas.
In this section, we provide an overview of the current 4G and emerging 5G
cellular networks. We’ll consider the wireless first hop between the mobile device and
the base station, as well as the cellular carrier’s all-IP core network that connects the
wireless first hop into the carrier’s network, other carrier networks, and the larger
Internet. Perhaps surprisingly (given the origins of mobile cellular networks in the
telephony world, which had a very different network architecture from the Internet), we’ll
encounter many of the architectural principles in 4G networks that we encountered in our
Internet-focused studies, including protocol layering, an edge/core distinction, the
interconnection of multiple provider networks to form a global “network of networks,”
and the clear separation of data and control planes with logically centralized control.
We’ll now see these principles through the lens of mobile cellular networks (rather than
through an Internet lens) and thus see these principles instantiated in different ways. And
of course, with a carrier’s network having an allIP core, we’ll also encounter many of the
Internet protocols that we now know well. We’ll cover additional 4G topics—mobility
management in , and 4G security—later, after developing the basic principles needed for
these topics.
The 4G networks that are pervasive as of this writing in 2020 implement the 4G
Long-Term Evolution standard, or more succinctly 4G LTE. In this section, we’ll
describe 4G LTE network shows the major elements of the 4G LTE network architecture.
The network broadly divides into the radio network at the cellular network’s edge and the
core network. All network elements communicate with each other using the IP protocol
we studied. As with earlier 2G and 3G networks, 4G LTE is full of rather obtuse
acronyms and element names.
Mobile Device. This is a smartphone, tablet, laptop, or IoT device that connects
into a cellular carrier’s network. This is where applications such as web browsers, map
apps, voice and videoconference apps, mobile payment apps, and so much more are run.
The mobile device typically implements the full 5-layer Internet protocol stack, including
the transport and application layers, as we saw with hosts at the Internet’s network edge.
The mobile device is a network endpoint, with an IP address (obtained through NAT, as
we’ll see). The mobile device also has a globally unique 64-bit identifier called the
International Mobile Subscriber Identity (IMSI), which is stored on its SIM (Subscriber
Identity Module) card. The IMSI identifies the subscriber in the worldwide cellular
carrier network system, including the country and home cellular carrier network to which
the subscriber belongs. In some ways, the IMSI is analogous to a MAC address. The SIM
card also stores information about the services that the subscriber is able to access and
encryption key information for that subscriber. In the official 4G LTE jargon, the mobile
device is referred to as User Equipment (UE). However, in this textbook, we’ll use the
more reader-friendly term “mobile device” throughout. We also note here that a mobile
device is not always mobile; for example, the device might be a fixed temperature sensor
or a surveillance camera.
Base Station. The base station sits at the “edge” of the carrier’s network and is
responsible for managing the wireless radio resources and the mobile devices with its
coverage area. As we’ll see, a mobile device will interact with a base station to attach to
the carrier’s network. The base station coordinates device authentication and allocation of
resources(channel access) in the radio access network. In this sense, cellular base station
functions are comparable (but by no means identical) to those of APs in wireless LANs.
But cellular base stations have several other important roles not found in wireless LANs.
In particular, base stations create device-specific IP tunnels from the mobile device to
gateways and interact among themselves to handle device mobility among cells. Nearby
base stations also coordinate among themselves to manage the radio spectrum to
minimize interference between cells. In the official 4G LTE terminology, the base station
is referred to as an “eNode-B,” which is rather opaque and non-descriptive. In this
textbook, we will instead use the reader-friendlier term “base station” throughout.
LTE uses a combination of frequency division multiplexing and time division
multiplexing on the downstream channel, known as orthogonal frequency division
multiplexing (OFDM) [Hwang 2009]. (The term “orthogonal” comes from the fact the
signals being sent on different frequency channels are created so that they interfere very
little with each other, even when channel frequencies are tightly spaced). In LTE, each
active mobile device is allocated one or more 0.5 ms time slots in one or more of the
channel frequencies shows an allocation of eight time slots over four frequencies. By
being allocated increasingly more time slots (whether on the same frequency or on
different frequencies), a mobile device is able to achieve increasingly higher transmission
rates. Slot (re)allocation among mobile devices can be performed as often as once every
millisecond. Different modulation schemes can also be used to change the transmission
rate; see our earlier discussion and dynamic selection of modulation schemes in WiFi
networks.
The particular allocation of time slots to mobile devices is not mandated by the
LTE standard. Instead, the decision of which mobile devices will be allowed to transmit
in a given time slot on a given frequency is determined by the scheduling algorithms
provided by the LTE equipment vendor and/or the network operator. With opportunistic
scheduling [Bender 2000; Kolding 2003; Kulkarni 2005], matching the physical-layer
protocol to the channel conditions between the sender and receiver and choosing the
receivers to which packets will be sent based on channel conditions allow the base station
to make best use of the wireless medium. In addition, user priorities and contracted levels
of service (e.g., silver, gold, or platinum) can be used in scheduling downstream packet
transmissions. In addition to the LTE capabilities described above, LTE-Advanced allows
for downstream bandwidths of hundreds of Mbps by allocating aggregated channels to a
mobile device [Akyildiz 2010].
Let’s conclude or study of 4G LTE here by considering two additional important
LTE functions: (i) the process with which a mobile device first attaches to the network
and (ii) the techniques used by the mobile device, in conjunction with core network
elements, to manage its power use. Attachment to a Base Station. This first phase of
device attachment is similar in purpose to, but quite different in practice from, the 802.11
association protocol that we studied. A mobile device wishing to attach to a cellular
carrier network will begin a bootstrap process to learn about, and then associate with, a
nearby base station. The mobile device initially searches all channels in all frequency
bands for a primary synchronization signal that is periodically broadcastevery 5 ms by a
base station. Once this signal is found, the mobile device remains on this frequency and
locates the secondary synchronization signal. With information found in this second
signal, the device can locate (following several further steps) additional information such
as channel bandwidth, channel configurations, and the cellular carrier information of that
base station. Armed with this information, the mobile device can select a base station to
associate with (preferentially attaching to its home network, if available) and establish a
control-plane signaling connection across the wireless hop with that base station. This
mobile-to-base-station channel will be used through the remainder of the network
attachment process.
Mutual Authentication. In our earlier description of the Mobility Management
Entity (MME), we noted that the base station contacts the local MME to perform mutual
authentication—a process that we’ll study in further. This is the second phase of network
attachment, allowing the network to know that the attaching device is indeed the device
associated with a given IMSI, and the mobile device to know that the network to which it
is attaching is also a legitimate cellular carrier network. Once this second phase of
network attachment is complete, the MME and mobile device have mutually
authenticated each other, and the MME also knows the identity of the base station to
which the mobile is attached. Armed with this information, the MME is now ready to
configure the Mobile-device-to-PDN-gateway data path.
Recall in our earlier discussion of advanced features in 802.11 and Bluetooth that
a radio in a wireless device may enter a sleep state to save power when it is not
transmitting or receiving in order to minimize the amount of time that the mobile device’s
circuitry needs to be “on” for sending/receiving data, and for channel sensing. In 4G
LTE, a sleeping mobile device can be in one of two different sleep states. In the
discontinuous reception state, which is typically entered after several hundred
milliseconds of inactivity [Sauter 2014], the mobile device and the base station will
schedule periodic times in advance (typically several hundred milliseconds apart) at
which the mobile device will wake up and actively monitor the channel for downstream
(base station to mobile device) transmissions; apart from these scheduled times, however,
the mobile device’s radio will be sleeping.
If the discontinuous reception state might be considered a “light sleep,” the
second sleep state—the Idle state—which follows even longer periods of 5 to 10 seconds
of inactivity, might be thought of as a “deep sleep.” While in this deep sleep, the mobile
device’s radio wakes up and monitors the channel even less frequently. Indeed, this sleep
is so deep that if the mobile device moves into a new cell in the carrier’s networkwhile
sleeping, it need not inform the base station with which it was previous associated. Thus,
when waking up periodically from this deep sleep, the mobile device will need to re-
establish an association with a (potentially new) base station in order to check for paging
messages broadcast by the MME to base stations nearby the base station with which the
mobile was last associated. These control-plane paging messages, which are broadcast by
these base stations to all mobile devices in their cells, indicate which mobile devices
should fully wake up and re-establish a new data-plane connection to a base station in
order to receive incoming packets.
d. Mobility Management: Principles
Having covered the wireless nature of the communication links in a wireless
network, it’s now time to turn our attention to the mobility that these wireless links
enable. In the broadest sense, a mobile device is one that changes its point of attachment
into the network over time. Because the term mobility has taken on many meanings in
both the computer and telephony worlds, it will serve us well first to carefully consider
forms of mobility.
From the network layer’s standpoint, a physically mobile device will present a
very different set of challenges to the network layer, depending on how active the device
is as it moves between points of attachment to the network. At the one end of the
spectrum, scenario is the mobile user who himself/herself physically moves between
networks, but powers down the mobile device when moving. For example, a student
might disconnect from a wireless classroom network and power down his/her device,
head to the dining commons and connect to the wireless access network there while
eating, and then disconnect and power down from the dining commons network, walk to
the library, and connect to the library’s wireless network while studying. From a
networking perspective, this device is not mobile—it attaches to an access network and
remains in that access network while on. In this case, the device serially associates with,
and later disassociates from, each wireless access network encountered.
In scenario, the device is physically mobile but remains attached to the same
access network. This device is also not mobile from a networklayer perspective.
Additionally, if the device remains associated with the same 802.11 AP or LTE base
station, the device is not even mobile from a link-layer perspective. From a network
standpoint, our interest in device mobility really starts with case (c), where a device
changes its access network (e.g., 802.11 WLAN or LTE cell) while continuing to send
and receiving IP datagrams, and while maintaining higher-level (e.g., TCP) connections.
Here, the network will need to provide handover—a transfer of responsibility for
forwarding datagrams to/from one AP or base station to the mobile device—as the device
moves among WLANs or among LTE cells. We’ll cover handover in detail. If the
handover occurs within access networks belonging to a single network provider, that
provider can orchestrate handover on its own. When a mobile device roams between
multiple provider networks, as in scenario (d), the providers must orchestrate handover
together, which considerably complicates the handover process.
As we learned in our discussions of cellular 4G LTE networks, every subscriber
has a “home” with some cellular provider. We learned that the Home Subscriber Service
(HSS) stores information about each of its subscribers, including a globally unique device
ID (embedded in a subscriber’s SIM card), information about services that the subscriber
may access, cryptographic keys to be used forcommunication, and billing/charging
information. When a device is connected to a cellular network, other than its home
network, that device is said to be roaming on a visited network. When a mobile device
attaches to, and roams on, a visited network, coordination will be required between the
home network and the visited network.
The Internet does not have a similarly strong notion of a home network or a
visited network. In practice, a student’s home network might be the network operated by
his/her school; for mobile professionals, their home network might be their company
network. The visited network might be the network of a school or a company they are
visiting. But there is no notion of a home/visited network deeply embedded in the
Internet’s architecture. The Mobile IP protocol [Perkins 1998, RFC 5944], which we will
cover briefly, was a proposal that strongly incorporated the notion of home/visited
networks. But Mobile IP has seen limited deployment/use in practice. There are also
activities underway that are built on top of the existing IP infrastructure to provide
authenticated network access across visited IP networks. Eduroam [Eduroam 2020] is one
such activity.
To appreciate the potential value of the central point of information and
coordination, consider the human analogy of a 20-something adult Bob moving out of the
family home. Bob becomes mobile, living in a series of dormitories and apartments, and
often changing addresses. If an old friend Alice wants to get in touch, how can Alice find
the current address of Bob? One common way is to contact the family, since a mobile 20-
something adult will often register his or her current address with the family (if for no
other reason than so that the parents can send money to help pay the rent!). The family
home becomes that unique location that others can go to as a first step in communicating
with Bob. Additionally, later postal communication from Alice may be either indirect
(e.g., with mail being sent first to Bob’s family home and then forwarded to Bob) or
direct (e.g., with Alice using the address obtained from Bob’s parents to send mail
directly to Bob).
e. Mobility Management in Practice
In the previous section, we identified key fundamental challenges and potential
solutions in developing a network architecture to support device mobility: the notions of
home and visited networks; the home network’s role as a central point of information and
control for mobile devices subscribed to that home network; control-plane functions
needed by a home network’s mobility management entity to track a mobile device
roaming among visited networks; and data-plane approaches of direct and indirect
routing to enable a correspondent and a mobile device to exchange datagrams. Let’s now
look at how these principles are put into practice! In, we’ll study mobility management in
4G/5G networks; we’ll look at Mobile IP, which has been proposed for the Internet.
Our earlier study of 4G and emerging 5G architectures in acquainted us with all of
the network elements that play a central role in 4G/5G mobility management. Let’s now
illustrate how those elements interoperate with each other to provide mobility services in
today’s 4G/5G networks [Sauter 2014; GSMA 2019b], which have their roots in earlier
3G cellular voice and data networks [Sauter 2014], and even earlier 2G voice-only
networks [Mouly 1992]. This will help us synthesize what we’ve learned so far, allow us
to introduce a few more advanced topics as well, and provide a lens into what might be in
store for 5G mobility management.
Base station association. Recall that, we studied the procedures by which a mobile
device associates with a base station. We learned that the mobile device listens on all
frequencies for primary signals being transmitted by base stations in its area. The mobile
device acquires progressively more information about these base stations, ultimately
selecting the base station with which to associate, and bootstrapping a control-signaling
channel with that base station. As part of this association, the mobile device provides the
base station with its International Mobile Subscriber Identity (IMSI), which uniquely
identifies the mobile device as well as its home network and other additional subscriber
information.
Data-plane configuration of forwarding tunnels for the mobile device. The MME
next configures the data plane for the mobile device. Two tunnels are established. One
tunnel is between the base station and a Serving Gateway in the visited network. The
second tunnel is between that Serving Gateway and the PDN Gateway router in the
mobile device’s home network. 4G LTE implements this form of symmetric indirect
routing—all traffic to/from the mobile device will be tunneled through the device’s home
network. 4G/5G tunnels use the GPRS Tunneling Protocol (GTP), specified in [3GPP
GTPv1-U 2019]. The Tunnel Endpoint ID (TEID) in the GTP header indicates which
tunnel a datagram belongs, allowing multiple flows to be multiplexed and de-multiplexed
by GTP between tunnel endpoints.
Handover management. A handover occurs when a mobile device changes its
association from one base station to another. The handover process described below is the
same, regardless of whether the mobile device is resident in its home network, or is
roaming in a visited network. Datagrams to/from the device are initially (before
handover) forwarded to the mobile through one base station (which we’ll refer to as the
source base station), and after handover are routed to the mobile device through another
base station (which we’ll refer to as the target base station). As we will see, a handover
between base stations results not only in the mobile device transmitting/ receiving
to/from a new base station but also in a change of the base-station side of the Serving-
Gateway-to-base-station tunnel. In the simplest case of handover, when the two base
stations are near each other and in the same network, all changes occurring as a result of
handover are thus relatively local. In particular, the PDN gateway being used by the
Serving Gateway remains blissfully unaware of device mobility. Of course, more
complicated handoff scenarios will require the use of more complex mechanisms [Sauter
2014; GSMA 2019a].
There may be several reasons for handover to occur. For example, the signal
between the current base station and the mobile may have deteriorated to such an extent
that communication is severely impaired. Or a cell may have become overloaded,
handling a large amount of traffic; handing over mobile devices to less congested nearby
cells may alleviate this congestion. A mobile device periodically measures characteristics
of a beacon signal from its current base station as well as signals from nearby base
stations that it can “hear.” These measurements are reported once or twice a second to the
mobile device’s current (source) base station. Based on these measurements, the current
loads of mobiles in nearby cells, and other factors, the source base station may choose to
initiate a handover. The 4G/5G standards do not specify a specific algorithm to be used
by a base station to determine whether or not to perform handover, or which target base
station to choose; this is an active area of research [Zheng 2008; Alexandris 2016].
Today’s Internet does not have any widely deployed infrastructure that provides
the type of services for “on the go” mobile users that we encountered for 4G/5G cellular
networks. But this is certainly not due to the lack of technical solutions for providing
such services in an Internet setting! Indeed, the Mobile IP architecture and protocols
[RFC 5944] that we will briefly discuss below have been standardized by Internet RFCs
for more than 20 years, and research has continued on new, more secure and more
generalized mobility solutions [Venkataramani 2014].
Instead, it has perhaps been the lack of motivating business and use cases [Arkko
2012] and the timely development and deployment of alternative mobility solutions in
cellular networks that has blunted the deployment of Mobile IP. Recall that 20 years ago,
2G cellular networks had already provided a solution for mobile voice services (the
“killer app” for mobile users); additionally, next generation 3G networks supporting
voice and data were on the horizon. Perhaps the dual technology solution—mobile
services via cellular networks when we are truly mobile and “on the go and Internet
services via 802.11 networks or wireline networks when we are stationary or moving
locally—that we had 20 years ago and still have today will persist into the future.
It will nonetheless be instructive to briefly overview the Mobile IP standard here,
as it provides many of the same services as cellular networks and implements many of
the same basic mobility principles. Earlier editions of this textbook have provided a more
in-depth study of Mobile IP than we will provide here; the interested reader can find this
retired material on this textbook’s website. The Internet architecture and protocols for
supporting mobility, collectively known as Mobile IP, are defined primarily in RFC 5944
for IPv4. Mobile IP, like 4G/5G, is a complex standard, and would require an entire book
to describe in detail; indeed one such book is [Perkins 1998b]. Our modest goal here is to
provide an overview of the most important aspects of Mobile IP.
The overall architecture and elements of Mobile IP are strikingly similar to that of
cellular provider networks. There is a strong notion of a home network, in which a
mobile device has a permanent IP address, and visited networks (known as “foreign”
networks in Mobile IP), where the mobile device will be allocated a care-of-address. The
home agent in Mobile IP has a similar function to the LTE HSS: it tracks the location of a
mobile device by receiving updates from foreign agents in foreign networks visited by
that mobile device, just as the HSS receives updates from Mobility Management Entities
(MMEs) in visited networks in which a 4G mobile device resides. And both 4G/5G and
Mobile IP use indirect routing to a mobile node, using tunnels to connect the gateway
routers in the home and visited/foreign networks. Table 7.3 summarizes the elements of
the Mobile IP architecture, along with a comparison with similar elements in 4G/5G
networks.
