A mobile radio network allows radio user terminals (User Equipment, UE) to connect to phone and/or data (Internet) services. It is a specific type of wireless network following a well-defined architecture, and it ensures seamless communication during user mobility.
It is composed of two main parts:
| Radio Access Network (RAN) | Core Network (CN) |
|---|---|
| Handles the radio connectivity with UEs. Its main architectural element is the Base Station (BS), which connects to UEs through a radio interface (an antenna is needed on both UE and BS) and to the core network through a backhaul network. | Interconnects the RAN to external infrastructures (phone service infrastructure, Internet services infrastructure) and provides connectivity and mobility management functionalities. |
There are two types of core networks. Circuit switching provides access to the phone service (2G and 3G networks). Packet switching provides access to data services (2G, 3G, 4G and 5G) and to the phone service (only 4G and 5G). The rate evolution across generations is the familiar staircase: GSM at ~100 kbit/s (1990–2000), EDGE at ~100 kbit/s–1 Mbit/s, UMTS/HSPA/HSPA+ through 1–100 Mbit/s (2000–2010), LTE and LTE Advanced up to 1 Gbit/s (2010–2020), and 5G beyond (2020–now).
Everything in this course — SDN, NFV, P4, the industrial labs — lands on a mobile network somewhere. This chapter gives the architectural vocabulary (RAN, core, bearers, tunnels, control/user plane) that chapters 13 and 14 will reuse, and it closes the loop with the course's opening claim: the network that was "ossified" for forty years is precisely the one being disaggregated and virtualized in 5G.
The area where the service is offered is divided into cells, each covered by a BS, and approximated by a hexagonal shape for planning purposes. Mobility management relies on four procedures, chosen according to the state of the UE:
The sizing of location areas balances two conflicting signalling needs: bigger LAs mean more signalling due to paging (more cells broadcast) but less signalling due to location updates; smaller LAs mean the reverse. The optimal size depends on two parameters: estimated terminal mobility and estimated incoming traffic. This trade-off reappears in LTE as Tracking Area design and in 5G as the same idle-state reachability problem.
Radio planning is the process that decides the locations and configurations of the BSs to be rolled out. Two main phases:
In old technologies (2G) the frequencies cannot all be used by any cell — that would generate uncontrolled interference to neighbouring cells. Yet to some extent the same frequencies must be reused in different cells. The solution is frequency reuse: a group of adjacent cells using different frequencies is called a cluster; clusters repeat regularly, and each frequency can be used once per cluster. A larger cluster means less interference but fewer resources (capacity) per cell. Reuse efficiency is 1/K where K is the cluster size.
Due to the hexagonal cell shape, only some cluster sizes are valid: the six closest cells using the same frequencies must be at the same distance from a given cell, which gives K = i² + i·j + j² with i ≥ 0, j ≥ 0 (K = 1, 3, 4, 7, 9, …). Cluster size 1 is achievable with orthogonal frequencies (OFDM) or codes (CDM) — the techniques used for 3G, 4G and 5G, which is why frequency planning is not needed there.
Two refinements complete the picture. Sectorial antennas (120° sectors are the most common) change the cellular layout — the BS sits on the border of the cell, not its centre — reducing interference and increasing reuse. Frequency assignment then has constraints: same frequencies cannot be assigned to cells/sectors of the same site (side lobes), and adjacent frequencies should not be assigned to the same cell/sector (adjacent channel interference). Finally, layouts can differ by area based on estimated traffic density — lower cell radius, higher BS density, more channels per unit area — with the cost of more handovers, which is why a macro cell overlapped to small cells (an umbrella cell) can host high-mobility users while low-mobility users stay in the small cells.
GSM (Global System for Mobile Communications) belongs to the 2nd generation of cellular networks — the first digital one (1G was analogue). First deployed in 1991 in Finland, standardized by ETSI, its first architecture was circuit switched, tailored fully on the phone service.
| Element | Role |
|---|---|
| MS (Mobile Station) | Terminal Equipment (TE) + SIM card; the SIM identifies and authenticates the subscriber. |
| BTS (Base Transceiver Station) | GSM base station: manages physical layer connections with MSs, executes resource allocation commands from the BSC. |
| BSC (Base Station Controller) | Manages all radio resources of its BTSs; all BTSs of one BSC belong to the same Location Area. |
| MSC (Mobile Switching Center) | Routes voice calls, with control/signalling functions for calls and mobility — similar to a PSTN phone exchange. |
| VLR (Visitor Location Register) | Database associated to an MSC with temporary info on visiting users. |
| GMSC (Gateway MSC) | MSC connected to PSTN or other mobile radio networks; signalling interworking. |
| HLR (Home Location Register) | Central database of permanent user information and dynamic location info (visited VLR). |
| AUC (Authentication Center) | Authenticates SIM cards attempting to connect to the core network. |
On the radio interface, GSM uses FDM and TDM together: the spectrum is divided into carriers (FDM), and on each carrier time is divided into time slots (TDM) carrying traffic and control channels. The two directions are separated in frequency (Frequency Division Duplex). Traffic channels (TCH) carry voice; the control channels have distinct roles:
| Identifier | Meaning |
|---|---|
| MSISDN | E.164 number used by external networks to reach an MS — permanent and public. |
| MSRN | E.164 number used to route the call within the mobile network to the serving MSC — temporary and private. |
| IMSI | "Absolute" MS identifier, permanently written in the SIM and stored in the HLR. |
| TMSI | Temporary dynamic identifier allocated by the VLR, stored in VLR and SIM — protects the IMSI from tracing. |
| LAI | Identifier of a Location Area, stored in the SIM and the VLR for each MS. |
Security operations are managed by the SIM/TE (the MS) and the BTS/MSC/AUC (the network). Parameters: Ki (univocal 128-bit authentication key stored in AUC and SIM), RAND (128-bit random number generated by the AUC and sent to the MS through the MSC). Algorithms: A3 (authentication, in AUC and SIM), A8 (encryption key Kc generation, in AUC and SIM), A5 (stream cipher, in MS — not the SIM — and BTS). The flow: the network sends RAND; the SIM computes SRES' = A3(Ki, RAND); if SRES' equals the network-computed SRES, access is granted; both sides derive Kc = A8(Ki, RAND) and the air interface is ciphered with A5.
GSM authentication guarantees the SIM — the user identity is assured by the ability to activate the SIM (PIN knowledge) — but the network identity is not verified: man-in-the-middle attacks through IMSI-catchers are possible. Also, when no TMSI/IMSI association exists (first access, phone off for a long time), the IMSI is transmitted in clear. Both gaps are closed only in UMTS (mutual authentication, section 6).
When an MS is turned on: Cell Selection (the BTS with the strongest beacon is chosen), then Registration — either IMSI Attach (same LA as stored in the SIM: the IMSI is marked active in the VLR) or Location Update (no stored LAI or different one). A location update within the same MSC/VLR updates the MS entry {TMSI, IMSI, LAI} in the VLR; across MSCs, the new MSC/VLR retrieves the IMSI from the old VLR (SubscriberIdentity), runs authentication, and updates the HLR entry {IMSI, VLR}, with a new TMSI allocated.
In a call setup, the network side routes an MS-terminated call through the HLR/GMSC to the serving MSC (the MSRN is the routing number), pages the MS in its LA, and the call proceeds; roaming adds the international leg (Home GMSC → Visited GMSC). Mobile Number Portability (MNP) is handled by a number portability database consulted before routing. In handover (active mobility), the network decides based on measurements (received signal strength) and the inter-BSC case adds signalling between the two BSCs through the MSCs.
GPRS (General Packet Radio Service) is a packet data service built on top of GSM: some traffic channels are dedicated to GPRS and dynamically shared in uplink and downlink by different MSs for packet transmission/reception, contention-based (slotted Aloha), up to 170 kbps. A new traffic channel type is defined — PDTCH (Packet Data Traffic Channel) — plus new control channels. EDGE (Enhanced Data rate for Global Evolution) is an evolution of GPRS with updates mostly in the physical layer (new modulations), up to 270 kbps.
Three new nodes appear:
Packet forwarding is based on tunnels — inherited by 3G, 4G and 5G. In GPRS/EDGE there are two: a level-2 tunnel between MS and SGSN (Logical Link Control, LLC) and a level-4 tunnel between SGSN and GGSN (GPRS Tunnelling Protocol, GTP). When the MS moves, tunnels are kept or rebuilt to modify packet forwarding — the same scheme maintained in 3G and recognizable, in evolved form, in LTE's bearers.
UMTS (Universal Mobile Telecommunications System) is the first 3G technology. The main novelty with respect to GSM is in the RAN: a new CDMA radio interface and soft handover. The core network is very similar to GSM/GPRS in functionalities and signalling procedures, and UMTS is the first technology standardized under 3GPP — which continued for all subsequent technologies. It also introduces the concept of bearer services.
| Element | Correspondence / role |
|---|---|
| UE (User Equipment) | Corresponds to the MS. |
| NodeB | Corresponds to the BTS. |
| RNC (Radio Network Controller) | Corresponds to the BSC; radio resource management and some mobility management (e.g. soft handover). The access network (NodeBs + RNCs) is UTRAN. |
| HSS (Home Subscriber Server) | Replaces the HLR and AUC. |
| IMS (IP Multimedia Subsystem) | Establishes multimedia sessions (e.g. voice calls) between IP terminals; session control via SIP. |
| MGW (Media Gateway) | Converts media streams between generations/technologies; may interface to a separate Media Gateway Controller (MGC) for signalling. |
| SGSN / GGSN | As in GPRS — packet-switched side. |
Advancements: higher speed data services (first UMTS release up to 2 Mbit/s; HSPA 14.4 Mbit/s downlink / 5.76 Mbit/s uplink; HSPA+ up to 42 Mbit/s downlink with MIMO antennas — and the concept of "flat network" introduced).
A bearer is a flexible concept designating a "bit pipe" established between certain entities with certain QoS-related attributes — an extension of the GPRS tunnel concept. Four QoS service classes are defined: Conversational (low delay, low jitter — speech, video conferencing), Streaming (reasonably low delay — audio/video streaming), Interactive (low round-trip delay — web applications), Background (delay not critical — store-and-forward, e-mail, SMS, file transfer). QoS attributes: service class, maximum bitrate, guaranteed bitrate, transfer delay, error probability. The most important bearer types: Core Network (CN) Bearer Service (between SGSN and GGSN), Radio Access Bearer (RAB) Service (between UE and SGSN), Radio Bearer Service (between UE and RNC). A RAB must always be established before a user can exchange data.
Soft handover lets a UE be connected to multiple NodeBs at the same time (up to six; the state is set by the RNC). Uplink: transmissions received by multiple NodeBs, the first correctly received data kept by the RNC. Downlink: multiple transmissions towards the UE, the first correctly received data kept by the UE. Advantage: better quality and no service interruption. Disadvantage: more allocated resources.
New authentication scheme: the network sends RAND, AUTN; the SIM checks AUTN and computes XRES'. A correct XRES' authenticates the user; a correct AUTN' authenticates the network. UMTS authentication is mutual — IMSI-catchers are ineffective.
LTE (Long Term Evolution) is the 4th generation network, re-designed according to the "all-IP" paradigm: User Plane and Control Plane protocols are based on IP; circuit switching is no longer supported. It introduces the concept of the flat network — the RAN includes a single device, the eNodeB, and user data follows a "direct path" involving as few nodes as possible. Physical layer upgrades: multi-carrier modulation (OFDM/OFDMA), adaptive modulation and coding, MIMO antenna systems. LTE Advanced is designed to reach 1 Gbit/s. Latency drops from 50/100 ms (HSPA) to 10 ms.
The access network is eUTRAN (evolved UTRAN) with a single node type, the eNodeB — NodeB and RNC functions collapse into it. eNodeBs can coordinate directly over the new X2 interface (handover management, inter-cell coordination); each UE is connected to one MME/SGW among those the eNodeB is connected to.
| EPC element | Role |
|---|---|
| MME (Mobility Management Entity) | Main control-plane node: most of the 2G/3G control-plane functionalities collapse here — authentication and security (assisted by HSS), mobility management (Tracking Area info, handover when X2 is not used), establishment of bearers with the requested QoS (e.g. the best-effort default bearer during attach). |
| SGW (Serving Gateway) | Routes and forwards user data packets; manages the S1 bearer, switches it at handover as triggered by the MME; buffers packets and asks the MME to page when the UE is idle. |
| PGW (PDN Gateway) | Access point to external networks; assigns IP addresses to UEs (DHCP); charging; traffic statistics. |
| HSS (Home Subscriber Server) | Combines HLR and AUC (3G HSS) so multi-standard UEs can access any technology. |
The EPC can serve heterogeneous access networks — LTE, UMTS, GSM/EDGE (3GPP) and Wireless LAN (non-3GPP) — providing mobility (including inter-technology handover) and packet routing/forwarding.
IP packet forwarding in active mobility is based on GTP, organized in bearers: a radio bearer between UE and eNodeB, an S1 bearer between eNodeB and SGW, an S5 bearer between SGW and PGW. Each hop wraps the original UE IP packet in GTP+UDP+IP with the intermediate addresses. When the UE moves and a new eNodeB is chosen, the S1 bearer is switched; the S5 bearer to the PGW is kept.
The biggest architectural evolution from 2G to 4G has two aspects: an all-IP solution and the separation between User Plane and Control Plane flows with an optimized user-plane path. Upon that separation, the idea of virtualizing the control-plane functionalities is born — lower costs, higher flexibility — giving the vEPC: SGW and PGW are split into user-plane (SGW-U, PGW-U) and control-plane (SGW-C, PGW-C) parts, and SGW-C, PGW-C, MME and HSS can be virtualized and potentially moved to the cloud. Virtualization becomes even more important in 5G.
The goal of each new generation (2G → 3G → 4G) was improving rate performance. 5G focuses on other aspects too: latency, reliability, number of users, energy consumption — as important as rate. The main requirements: speed/throughput (capacity), connection density (connectivity), latency/reliability. These map onto three high-level service classes: eMBB (enhanced Mobile Broadband), mMTC (massive Machine-Type Communications), URLLC (Ultra-Reliable Low-Latency Communications).
Network Slicing: NFV and SDN are exploited to create separated and specialized virtual networks — 5G slices. Slices are created by the network operator and "sold" to the slice tenant (e.g. a media provider), which can employ its own virtual network with on-demand resources and QoS tailored to its requirements, and dynamic resource allocation (a residential slice might be 100 Mbit/s by day and 1 Gbit/s by night). Slicing applies to both segments of the network, RAN and core.
Edge Computing: virtualized computing/storage/memory resources are made available in the mobile radio network, usually in the RAN — Mobile Edge Computing → Multi-Access Edge Computing (MEC). Both users' applications and network services (e.g. VNFs) can be hosted at edge nodes; the main advantage is reduced latency.
Millimeter waves (mmWave): frequencies from 24 GHz to 300 GHz (wavelength 10 mm to 1 mm). Appealing because the spectrum is undeveloped — more bandwidth available — and antenna arrays on chip are feasible. Limitations: huge path loss, high rain attenuation and atmospheric absorption, high blockage by obstacles (even humans or furniture). Solution: small cell sizes (radius smaller than 200 m) and high cell density — mmWave provides small-cell access with multi-gigabit rates when densely deployed. In Italy, 2G/3G/4G used frequencies between 900 MHz and 2.6 GHz; 5G auctions assigned the 700 MHz, 3.4–3.8 GHz and 26.5–27.5 GHz bands. Massive MIMO: base stations equipped with arrays of many antennas serving many users simultaneously on the same frequency resources, with beamforming to direct the signal towards the specific receiving device.
5G adopts an architecture where most elements can be virtualized and deployed on a cloud infrastructure, with a complete separation between User and Control Plane (CUPS) — the user plane is optimized to a single function, UPF. The RAN, NG-RAN, is built on the gNB (which replaces the eNB, using the 5G New Radio interface), split into:
The RAN can also be implemented according to SDN principles — SD-RAN: gNB, gNB-CU and gNB-DU are controlled by an SD-RAN controller with applications on top (RAN slicing, handover, …). Note: C-RAN and SD-RAN are orthogonal concepts.
The 5G-Core control-plane entities are connected by service-based interfaces (HTTP) over a message bus — a set of common REST interfaces — which is why the architecture is called Service-Based Architecture (SBA).
| Function | Counterpart in 4G EPC | Role |
|---|---|---|
| AMF (Access & Mobility Management Function) | MME | Mobility management between UE and 5G network. |
| SMF (Session Management Function) | MME + SGW/PGW control-plane | Session management and IP address allocation; a session is the extension of the LTE bearer concept. |
| AUSF (Authentication Server Function) | HSS (authentication part) | Performs authentication with the UE. |
| UDM (Unified Data Management) | HSS (repository part) | Converged subscriber information repository; does not perform authentication. |
| NRF (Network Repository Function) | — (new) | Repository of deployable functions; discovery mechanisms. |
| NEF (Network Exposure Function) | — (new) | Securely exposes network services to users; APIs to/from external systems. |
| NSSF (Network Slice Selection Function) | — (new) | Selects the right Network Slice Instance based on attach information; redirects traffic to the slice. |
| UPF (User Plane Function) | PGW-U + SGW-U | Packet routing/forwarding between RAN and external networks; QoS enforcement. Data flows over a PDU Session with a GTP tunnel between gNB and UPF. |
Two deployment options exist: Stand-Alone (SA) — NG-RAN + 5G-Core from scratch, separate from 4G — and Non-Stand Alone (NSA) — new gNBs connected to the existing 4G EPC, with the core incrementally evolved (EPC → 5G-Core). Current deployments are mostly NSA on existing 4G sites, with frequencies limited to 700 MHz and 3.6–3.8 GHz, and mmWave plans still unclear.
The evolution towards 5G is driven by three concepts: disaggregation (splitting vertically-integrated modules into independent functions), virtualization (running instances of virtualized functions on commodity hardware), commoditization (elastically scaling functions according to workload). Cloud computing concepts play a primary role — the distinction between "networks" and "cloud" is getting narrower. As for 6G (expected by 2030): native AI support, frequencies above 100 GHz, reliability up to 99.99999%, peak rates up to 1 Tbps, microsecond latency — with the pessimistic view that "6G will do what 5G promised".
Each generation answers one question. GSM: circuit-switched digital voice with authentication but no network verification (IMSI-catcher). GPRS/EDGE: the data overlay and the first tunnels (LLC + GTP), inherited forever. UMTS: CDMA, soft handover, bearer services with QoS classes, and mutual authentication. LTE: all-IP, flat network, one RAN node, EPC with CUPS separation and vEPC virtualization. 5G: SBA on a message bus, gNB split, slicing, MEC, mmWave and massive MIMO — NFV/SDN everywhere, which is exactly the next chapter.
The Radio Access Network (RAN) handles radio connectivity with UEs — base stations connecting via radio interface to UEs and via backhaul to the core. The Core Network (CN) interconnects the RAN to external infrastructures and provides connectivity and mobility management. Core types: circuit switching (phone service, 2G/3G) and packet switching (data services in 2G–5G and phone service in 4G/5G).
Cell Selection (idle): the UE picks the BS with the strongest beacon. Location Update (idle): the UE is tracked at Location Area granularity and the database is updated when it crosses an LA boundary. Paging (idle): all BSs of the LA broadcast the UE ID so incoming traffic can be routed. Handover (active): the network re-routes and switches the UE to the new cell (make-before-break).
Bigger LAs → more signalling due to paging, less due to location updates. Smaller LAs → more signalling due to location updates, less due to paging. The optimal size depends on estimated terminal mobility and estimated incoming traffic.
Coverage planning: where to install BSs and how to configure them. Frequency planning: how to assign frequencies to BSs. In 2G, not all frequencies can be used by any cell (interference), but the same frequencies must be reused to some extent: a cluster is a group of adjacent cells using different frequencies; clusters repeat and each frequency is used once per cluster. Larger cluster = less interference but less capacity per cell; reuse efficiency = 1/K.
Valid K values come from K = i² + i·j + j² (i,j ≥ 0): 1, 3, 4, 7, 9, … — the six closest same-frequency cells must be at equal distance. Cluster size 1 is achievable with orthogonal frequencies (OFDM) or codes (CDM), the techniques of 3G/4G/5G — hence frequency planning is not needed.
BTS: base station, physical layer with MSs. BSC: manages radio resources of its BTSs (same Location Area). MSC: routes voice calls, call/mobility control. VLR: database of visiting users for its MSC. GMSC: MSC towards PSTN/other networks. HLR: permanent user info + dynamic location. AUC: authenticates SIMs. Plus the MS (TE + SIM).
The AUC generates RAND and sends it to the MS; the SIM computes SRES' = A3(Ki, RAND) and returns it; equality with the network-computed SRES grants access; both sides derive Kc = A8(Ki, RAND) for the A5 stream cipher. Limits: (1) only the SIM is authenticated — the network identity is not verified, so IMSI-catcher MITM attacks are possible; (2) when no TMSI/IMSI association exists, the IMSI is transmitted in clear.
GPRS is a packet data service on top of GSM: traffic channels dynamically shared by MSs (slotted Aloha), up to 170 kbps; EDGE evolves it with new modulations up to 270 kbps. New nodes: PCU (packet counterpart of BSC), SGSN (IP router in the network, mobility + auth), GGSN (gateway to the Internet). Tunnels: LLC (L2) between MS and SGSN, GTP (L4) between SGSN and GGSN — the schema inherited by 3G and evolved into bearers in 4G/5G.
A bearer is a "bit pipe" between entities with QoS-related attributes — an extension of the GPRS tunnel. Classes: Conversational (low delay, low jitter — speech, video conferencing), Streaming (reasonably low delay — audio/video streaming), Interactive (low round-trip delay — web), Background (delay not critical — e-mail, SMS, file transfer). Attributes include maximum/guaranteed bitrate, transfer delay, error probability. A Radio Access Bearer (UE↔SGSN) must be established before data exchange.
Soft handover connects a UE to multiple NodeBs simultaneously (up to six): uplink transmissions are received by multiple NodeBs and the first correct copy is kept; downlink the UE does the same. Better quality, no interruption; more resources. UMTS authentication is mutual: the network sends RAND + AUTN; the SIM checks AUTN (proving the network knows Ki) and returns XRES' (proving it knows Ki itself) — IMSI-catchers are ineffective.
eUTRAN with a single node type (eNodeB, X2 between them) + EPC: MME (control plane: auth, mobility, bearer establishment), SGW (user-plane routing, S1 bearer management, buffering + paging trigger), PGW (external access point, IP assignment via DHCP, charging, statistics), HSS (subscriber data, combines HLR/AUC). All services on IP; circuit switching no longer supported (VoLTE via IMS, CSFB to 2G/3G via SGs).
GTP bearers: radio bearer (UE↔eNB), S1 bearer (eNB↔SGW), S5 bearer (SGW↔PGW), each wrapping the UE IP packet in GTP+UDP+IP. If the UE is idle (no S1 bearer): the MME pages all eNodeBs in the last known Tracking Area, the SGW buffers the data, and once the UE is located new S1 and radio bearers are set up.
vEPC virtualizes the control plane: SGW and PGW are split into user-plane (SGW-U, PGW-U) and control-plane (SGW-C, PGW-C) parts; SGW-C, PGW-C, MME and HSS can be virtualized and moved to the cloud. It exploits the NFV paradigm for lower costs and higher flexibility, and virtualization becomes even more important in 5G (slicing, MEC, SBA).
eMBB (enhanced Mobile Broadband) answers speed/throughput; mMTC (massive Machine-Type Communications) answers connection density; URLLC (Ultra-Reliable Low-Latency Communications) answers latency/reliability. 5G also adds energy consumption among its goals.
NG-RAN: gNB split into gNB-DU (L1 + lower L2, near the antenna, within 1 ms) and gNB-CU (upper L2 + L3, virtualizable, one CU serving many DUs — C-RAN). 5G-Core: control-plane functions (AMF, SMF, AUSF, UDM, NRF, NEF, NSSF) connected by service-based HTTP interfaces over a message bus; user plane reduced to UPF (CUPS). RAN may follow SDN principles (SD-RAN controller), orthogonal to C-RAN.
SA: NG-RAN + 5G-Core from scratch, separate from 4G. NSA: new gNBs attached to the existing 4G EPC, with the core incrementally evolved. Driving concepts: disaggregation, virtualization, commoditization — cloud computing concepts that make the distinction between networks and cloud narrower.