Unlicensed Mobile Access (UMA)
Handover and Packet Data Performance Analysis
Andres Arjona
Nokia Siemens Networks
andres.arjona@nsn.com
Hannu Verkasalo
Helsinki University of Technology
hannu.verkasalo@tkk.fi
Abstract
UMA is a technology helping cellular operators to
retain control over subscribers in the era of
converging radio access technologies. By supporting
handovers to and from WiFi networks, UMA seems to
be a perfect solution as new mobile services require
performance and seamless mobility. From the cellular
operator point of view UMA does not require
enormous investments and is a good choice for
extending network coverage. This research paper
discusses the technical implications of UMA based on
measurement results for GSM to WiFi handovers and
packet data performance. The measurements show that
UMA works well, and voice handover breaks are
similar or lower than those experienced in traditional
GSM systems. In addition, UMA provides a
considerably higher throughput than GSM systems.
The results showed that the average throughput is
twice or more than in GSM. Therefore, the user
experience for data services improves to 3G-kind of
services.
Keywords: UMA, handovers, mobility, WiFi
1. Introduction
There is an ongoing emergence of various radio
access technologies that provide interesting technical
solutions to offer new services through other than
cellular access. New radio access technologies might
provide higher throughput, and they also ease the load
of cellular access networks. The possibility of using
e.g. home WiFi routers or public WiFi hotspots with
the same handset, provides a challenger alternative to
cellular access, and thus an access to general Internet
services without the operator restricting or managing
the ownership of the customer. This is the core of the
disruptive potential of actors such as Skype, who are
planning a mobile entry.
However, cellular network operators are still in a
key position in the business, and they can leverage on
the substantial subscriber domain and associated
network externalities, economies-of-scale in billing etc.
Furthermore, cellular network operators have also
technologies which might maintain their power
positions in the game. In particular, the UMA
(unlicensed mobile access) technology provides a way
to access the core GSM network through WiFi. This
sounds attractive from the point of view of cellular
network operators, who could thus extend their
network coverage through WiFi hotspots with minimal
additional investment. Improving coverage (especially
indoors) is of great importance in some countries
where adequate GSM coverage indoors and throughout
some other areas in the country is not yet available.
The United States and Japan are good examples of
countries lacking consistent coverage indoors. With
UMA, the operator still manages the core network.
Radio access technologies on the edge of the network
are only used as kind of platforms for packet-switched
tunneling of either circuit or packet-switched
connections to the operator's network.
This research paper discusses the UMA technology
in detail, after which technical performance measures
of the technology are considered. The paper sets out to
technically address whether UMA could work in real
life situations. Focus is put on the handover and packet
data performance of UMA compared to current cellular
networks. Based on the measurement results
conclusions are presented.
2. UMA Overview
The core idea of UMA is to provide an access to the
operator's network through not only cellular, but also
through unlicensed radio access technologies such as
WiFi. Originally, UMA was developed to provide an
access to GSM/EDGE networks through unlicensed
radio access points. The technology, however, is
nowadays developed in the 3GPP consortium under the
name GAN (generic access network), which also
considers the link to WCDMA[3]. Despite the official
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
name being changed to GAN, UMA is used quite a lot
as it was the name with which the idea became public
and familiar in the industry.
The principle for UMA is the possibility to tunnel
connections over unlicensed radio access technologies
back to the operator's network. UMA also supports
seamless handovers between cellular and WiFi. This
new technology provides a means to extend coverage
through e.g. cheap WiFi access points instead of
expensive cellular base stations. UMA could thus
decrease the load of legacy GSM access networks. At
the same time the operator still holds control over the
connection, and therefore can charge upon that. The
possibility to use e.g. WiFi could, however, also reflect
in connection prices, as WiFi hotspots are much
cheaper to deploy than GSM base stations. The key
question is naturally whether the same or different
operator owns the WiFi access network than cellular
network.
The UMA solution does not need much direct
investments. The most critical point is a UMA network
controller (UNC), which provides authentication and
tunneling setup. In the UNC operators can also specify
other restrictions for the access, such as access point
SSID or MAC specifications. Therefore, the cellular
network operator (who also runs the UMA solution)
can specify who can use UMA and how they can use it
in connecting to the operator's core network. The
generic structure of the UMA access system is
illustrated in Figure 1.
Figure 1. UMA access to cellular network
UMA provides a variety of security mechanisms,
too. For example in the authentication IKEv2 and
EAP-SIM/EAP-AKA solutions are used between the
MS (mobile station) and UNC. These solutions
leverage on the SIM card installed in the handset. Once
again this looks good from the operator point of view,
as they are the ones who provided SIM cards and
therefore literally own the customer. IPSec, is used to
create a secure tunnel in which both traffic and
signaling is transported between the MS and the UNC.
UMA provides four possibilities to
manage/prioritize cellular and unlicensed access
networks:
• GSM-only
o MS stays in GSM mode; normal GSM
procedures apply
• GSM-preferred
o If no GSM PLMN available, and if UMA
coverage detected, MS switches to UMA
mode
o When GSM PLMN becomes available, or if
UMAN coverage is lost, MS switches back to
GSM mode
• UMA-preferred
o When UMA coverage is detected, the MS
switches to UMA mode
o When UMA coverage is lost, the MS switches
to GSM mode
• UMAN-only
o MS switches to UMA mode after power-up
sequence (even before UMA coverage is
detected)
From the technical point of view, all in all, UMA is
thus effectively an extension of GSM to the unlicensed
spectrum, while at the same time, it provides a way to
control the customer and direct the traffic back to the
operator's own network.
3. UMA Access and Handovers
The UMA cell is analogous to a GSM base station
controller (BSC). For that reason, it is perceived as
such by the cellular network and roaming between
UMA and GSM is considered an inter-BSC handover.
From the BSC perspective the UNC is just another
BSC. In theory, if the UNC is in the BSC neighbors
list, it is possible to perform a handover. However, the
individual WiFi cells are independent from the UMA
system. Regardless of the similarities between the
UNC and the BSC, the cell size does not directly
correlate.
The UNC can cover any area from which it is
accessible via a broadband connection. Such area can
be e.g. an operator's broadband network or even the
Internet. However, in order to perform handovers
between the UMA and GSM systems, the UNC must
be configured as a neighbor for the BSC in place.
Furthermore, if the UNC is configured as the neighbor
for several BSCs, a single UNC could cover a wide
area of GSM coverage. Since broadband connectivity
can occur from many locations, several access
restriction mechanisms to UMA exist. For example,
the MS can be required to be in an overlapping GSM
cell owned by the cellular operator in order to access
UMA [1].
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
3.1. GSM-UMA Mobility
Handovers between the GSM and UMA systems are
in most of the cases originated by the MS. Depending
on the operating mode, the MS will decide how often it
will attempt to establish a connection and/or start a
handover. The handover triggers are likely to be based
on received signal strength measurements. However,
the standard also provides the means to originate the
handover based on a request from the UNC.
In the case of GSM-to-UMA handovers, the
message flow is depicted in Figure 2 [11]. The initial
state before the handover requires that the call is active
in the GSM system. That is, voice goes through the
BSC and then to the core network (CN). Afterwards,
while the GSM call is ongoing, four main stages take
place. First, when the MS detects WiFi, it will establish
a link with the access point and attempt to establish a
secure IPsec tunnel with the UNC. The establishment
of the secure tunnel requires the mobile station to be
authenticated by the UNC. This procedure is known as
UMA registration. Second, the mobile station initiates
the handover by reporting a UMA neighbor cell as the
highest signal level to the BSC. Assuming that the
operator's BSS is configured with the UMA cell as a
neighbor, the source BSC decides to start the handover
procedure based on the handover report. The handover
procedure between the source BSC, core network and
UNC follows the same signaling flow as the GSM
inter-BSC handover. It is not explicitly visible to the
source BSC that the target handover is the UMA
access. Once the signaling required for the handover
has taken place, a handover command message will be
sent to the MS indicating that the handover can take
place (messages 1 to 6). Third, the MS will start the
actual handover between systems. This procedure
involves two main phases, one to setup a voice stream
connection (messages 7 to 9), and another phase to
transfer the voice stream from the GSM access to the
UMA access. The actual voice break resulting from the
handover will happen only in this second phase of the
handover (messages 10 to 12). Fourth and last, the
previous connection is released from the GSM system
(messages 13 to 14).
Figure 2. GSM-to-UMA Handover Procedure
The message flow for UMA-to-GSM handovers is
depicted in Figure 3 [11]. The initial state before the
handover requires that the call is active in the UMA
system. That is, voice goes through the UNC and then
to the core network. Whilst the UMA call is ongoing,
three main stages take place. First, when the WiFi link
is deteriorated up to a predefined threshold, the MS
determines that the WiFi link is no longer acceptable
for UMA service. However, it is also possible to
trigger the handover via an uplink quality indication
message from the UNC. At this point, the MS sends a
handover required message to the UNC specifying the
signal levels of the neighboring GSM cells.
Subsequently, the UNC selects one of the target cells
and sends a handover request to the core network. The
core network then handles the resource allocation
procedures with the BSC for the GSM call. Once the
resources have been allocated, the MS is notified that
the handover is ready to take place (messages 2 to 7).
Second, the MS will start the actual handover between
systems. This procedure involves two main phases, one
to setup a voice stream connection (messages 8 to 11)
and another to transfer the voice stream from the UMA
access to the GSM access (messages 12 to 14). The
actual voice break resulting from the handover will
happen only in this second phase of the handover.
Third and last, the previous connection is released from
the UMA system (messages 15 to 18).
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
Figure 3. UMA-to-GSM Handover Procedure
3.2. UMA-UMA Mobility
UMA-UMA mobility is out of the scope of the
UMA standards. Therefore, the functionality is based
on traditional WiFi handover mechanisms. As a
consequence, all the mobility issues encountered in
common WIFI deployments exist in UMA as well. For
informational purposes the UMA-UMA handovers are
described in this section as well as some of the
problems that could be encountered.
Handovers in WiFi are designed in such a way that
clients will attempt the handoff until the link quality is
considerably deteriorated. This is a problem when
continuous coverage is built because the client will not
attempt to change the cell even when there is a cell that
provides better signal strength. This ends up in very
late cell changes, poor voice quality and dropped
connections. Furthermore, in some cases, even if the
handover break is short, the perceived voice quality
can be poor for several seconds for several seconds due
to the low signal quality prior to the handover.
Additionally, some access points (AP) may have a
considerably higher load than a subsequent AP even
though they overlap in coverage. In the case of
roaming in different subnets, the client will need to re-
authenticate with the new subnet, which results in
longer delays. To address handover times and roaming
several methods have been developed but in practice
they are not widely implemented nor supported by
current devices. [4][5][6]
Handovers in WIFi are even more problematic in
scenarios in which background data is present. The
presence of data will impact the ability of the voice
packets to get access to the channel regardless of its
priority level. As the amount of data traffic increases,
the probability that a user can access the medium in the
time required to maintain toll-quality voice is
diminished proportionately. If it takes to long for a
client to gain access to the channel, it will lead to an
unacceptable voice delay. Channel access delay plays
a direct role in handovers because constant associations
and re-associations might be required [10]. Laboratory
test results in [9] show that handovers between APs
only have low delays when there is no background
data. However, the presence of background data
increases delays considerably.
4. Testbed and Methodology
The mobility performance of the UMA system
between GSM and UMA handovers was tested with
the environment setup depicted in Figure 4. The testing
methodology consisted of establishing a voice call and
afterwards moving in and out of the UMA coverage by
physically moving away and towards the access point.
All the measurements were carried out in an indoor
environment. Several iterations of this method were
carried out, and differences in speed between
movements in and out of the UMA coverage were
taken into account. In order to measure handover
times, signaling was captured from three interfaces in
the network. Nethawk GSM Analyzer [8] was used to
capture packets in the "A" interface between the core
network and the UNC, and the "A" interface between
the core network and the BSC. Additionally, Wireshark
Protocol Analyzer software [12] was used to capture
packets in the interface between the UNC and the
UMA client.
Figure 4. UMA Test Environment
The accuracy of the captures measurements would
be improved if packet captures were performed at the
ends of the network. That is, directly from the MS
WiFi and GSM interfaces directly. However, this
would require specialized software in the MS and
additional deciphering tools. Therefore, this approach
is not feasible in practice.
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
Packet data performance tests consisted of multiple
iterations of file downloads from a file server in the
Internet (ftp.funet.fi). The server is known to have high
speed bandwidth within Finland, where the tests took
place. The files downloaded were of 2 and 4.2MB sizes
respectively.
5. Measurement Results
The results of the measurements are analyzed and
compared with the GSM system in sections 5.1 and
5.2.
5.1. Handover Performance Results
The results from the handover measurements
carried out are summarized in Table 1 in accordance to
the signaling phases described in 3.1.
Table 1. GSM-UMA Handover Measurements
GSM-to-UMA UMA-to-GSM
UMA
Registration
442 ms
-
Handover
Request
157 ms
290 ms
Voice
Connection
Setup
77 ms
62 ms
Voice
Connection
Transfer
27 ms
199 ms
Connection
Release
10 ms
208 ms
Total
Handover
Time
271 ms
759 ms
It is important to note that the voice break that
occurs due to the handover only takes place during the
voice connection transfer. Furthermore, since the
measurements were based on message capturing, the
time between messages is not an absolute value for the
voice break. Regardless of this, the measurements
reveal that the possible voice break in UMA-GSM
handovers are in line to typical breaks in GSM inter-
BSC handovers (120-220ms)[2] .
Likewise, the UMA software in the MS is likely to
implement packet loss concealment algorithms. Packet
loss concealment algorithms hide transmission losses
in an audio system. Different algorithms exist and
techniques such as packet substitution, prediction,
silence suppression, and white noise can be
implemented to deal with packet losses [7][13].
5.2. Packet Data Performance Results
The results from the packet data performance tests
are summarized in the following equation.
Average TCP Throughput = 268kbps
The results show that even though UMA originally
seemed to be a potential candidate for boosting data
rates while WiFi coverage was available, the average
throughput is not as high as expected. However, the
average throughput of 268kbps is considerably higher
than what is available via GPRS or EDGE in GSM
networks. Current GSM and EDGE networks provide
throughputs around 30kbps and 120kbps respectively.
UMA data throughput is in fact, very similar to the
data rates available in WCDMA (3G) networks.
Therefore, UMA technology is able to improve the
user experience and performance for data services from
GPRS or EDGE to WCDMA-like kind of service.
From the operator's point of view, this means UMA
can provide an additional value to its current services
with a minimal investment.
The reason the very high WiFi data are not possible
is due to several factors both in the wireless network
and the mobile terminal. Some of the current
bottlenecks that we have detected that can limit data
performance are:
• Mobile Terminal processing power
• Gb interface (between UNC and SGSN), which
is normally based on T1 lines with a maximum
bandwidth of 2Mbps to be shared among all
subscribers served by the UNC.
• Subscriber's data throughput limit defined in
the Home Location Register by the operator.
This limit is usually assigned based on the
service subscription type and can vary from
very low rates such as 64kbps to several
Megabits (e.g. 8Mbps for HSDPA subscribers).
• GPRS theoretical data limit, which is around
600kbps.
6. Conclusion
The technical measurements of UMA performance
provided evidence that the solution really works. The
handover times between UMA and GSM are similar to
typical inter-BSC handovers in the GSM system.
Therefore, UMA is at its best in extending the cellular
network operator's current network coverage in indoor
locations. Ceteris paribus, the poorer the initial indoor
cellular reception and possibilities to extend GSM
coverage, the more attractive it would be business-wise
to deploy UMA. Likewise, UMA allows the operator
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
to improve the user experience for data services from
GSM to 3G-like kind of services due to the higher
throughput available in UMA. The measurements
showed that throughput is twice or more than the data
rates available in GSM networks. The promising
measurement results suggest that there is a lot of
potential to extend network coverage and deploy
hotspot kind of access points in special circumstances.
At the same time, the cellular network operator holds
control over subscribers and traffic flows.
7. References
[1] 3rd Generation Partnership Project (3GPP), "Generic
Access (GA) to the A/Gb interface; Mobile GA Interface
Layer 3 Specification", 3GPP Technical Specification,
TS144.318, July 2006.
[2] 3rd Generation Partnership Project (3GPP), "Radio
Subsystem Synchronization", 3GPP Technical
Specification, TS 05.10 V8.12.0, August 2003.
[3] Ericsson, "Generic Access Network, GAN", Ericsson
White Paper , October 2006.
[4] IEEE, "Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications - High
Speed Physical Layer in the 5 GHz Band", IEEE
Standard 802.11a, 1999.
[5] IEEE, "Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications - High
Speed Physical Layer in the 2.4 GHz Band", IEEE
Standard 802.11b, 1999.
[6] IEEE, "Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications -
Amendment: Medium Access Control (MAC)
Enhancements for Quality of Service", IEEE Standard
P802.11e/D12.0, November 2004.
[7] E. Mahfuz, "Packet Loss Concealment for Voice
Transmission over IP Networks" McGill University ,
Master's Thesis, September 2001.
[8] Nethawk GSM Analyzer, www.nethawk.fi
[9] D. Newman, "Voice over Wireless LAN", Network
World , January 2004.
[10] Proxim, "Voice over Wi-Fi Capacity Planning", Proxim
Technical White Paper , Proxim, March 2004.
[11] UMA Consortium, "Unlicensed Mobile Access (UMA)
Architecture (Stage 2)", Technical Specification ,
September 2004. Available from
http://www.umatechnology.org/specifications/index.htm
[12] Wireshark Protocol Analyzer, www.wireshark.org
[13] C.S. Xydeas, and F. Zafeiropoulus, "Model-Based
Packet Loss Concealment for AMR Coders", ICASSP,
IEEE, April 2003.
Second International Conference on Digital Telecommunications (ICDT'07)
0-7695-2910-0/07 $20.00 © 2007
pdf