Abstract
The mobile service was globally popularized with the ease of internet access enabled with the 3rd generation of networks and the broadband wireless speeds enabled with the 4th generation known as the long-term evolution (LTE). LTE became the most popular architecture with around 600 commercially launched networks worldwide. This prompted further advancements for hundreds of gigabits per second speeds and connect tens of billions of devices worldwide. The LTE-advanced and LTE-advanced-pro were introduced as intermediary network enhancements towards the future 5th network generation. For the first time, the 3rd generation partnership project (3GPP) architectures included built-in features for conducting mobile network forensics so investigators can structure and coordinate the investigation with maximum safeguards for the quality of the evidence, users' privacy, and network performance. To fully capitalize on the forensics features, this chapter details all the infrastructural, security, and forensics-related aspects of the modern 3GPP networks.
Top3G: Universal Mobile Telecommunication System (Umts) And High Speed Packet Access (Hspa)
Reference Network Architecture
The third generation of mobile networks resulted from the global effort for unification of the mobile architecture and service delivery. In response to the International Telecommunication Union (ITU) request for IMT-2000, the 3GPP was formed in 1998 to produce the technical specifications for the UMTS. UMTS has evolved the Global System for Mobile (GSM)/General Packet Radio Service (GPRS) architecture to introduce a completely new radio network subsystem, called UMTS Terrestrial Radio Access Network (UTRAN). The Release 99 architecture retained the circuit and packet switched domains from the GSM/GPRS with incremental improvements in response to the demand for increased speeds on the air interface. Release 4 introduced a so-called “bearer independent circuit switched domain” where the Mobile Switching Center (MSC) functions are split between a MSC-Server (MSCS) and Media Gateway (MGW). In GSM, the MSC controls both the signaling and user traffic so the radio access capacity is dependent on the MSC circuit-switching capacity. This limits the network scalability, so UMTS delegates the main control functions to the MSC while the traffic handling is delegated to the MGW, which in turn, can be easily scaled depending on the traffic load. Also, the legacy radio access network is referred to as the GPRS/EDGE Radio Access Network (GERAN) from Release 4 onwards.
Both the UTRAN and the core network were further enhanced with the Release 5. On the air interface, the downlink speeds were enhanced with a reorganization of the radio resource management called High-Speed Packet Downlink Access (HSDPA). In the core, the Home Location Register (HLR) and the Authentication Center (AuC) were merged into the Home Subscriber Server (HSS) and a new subsystem - called IP Multimedia Subsystem (IMS) - was introduced so the packet-switched core domain can support real-time voice and multimedia services (i.e. Voice-over-IP - VoIP). Release 6 enhanced the uplink speeds with the High-Speed Uplink Packet Access (HSUPA) upgrade to complement the HSDPA speeds. Release 7 introduced a joint HSPA+ upgrade to ultimately enhance the peak downlink speeds to 42.2 Mbit/s and peak uplink speeds to 22 Mbit/s.
Figure 1 shows the UMTS architecture from Release 7 (3rd Generation Partnership Project, 2008). The newly introduced elements in the UTRAN are the NodeB, acting as a base station, and the Radio Network Controller (RNC), replacing the Base Station Controller (BSC) and Packet Control Unit (PCU) functionality. The NodeBs communicates with the users over the Uu interface on one side, and with the RNCs over the Iub interface on the other side. The RNCs communicate over the Iur interface to support so-called soft handovers where a user is allowed to receive data simultaneously from multiple NodeBs, so this communication is needed for inter RNC handover scenarios. The other newly introduced interfaces are: Iu-CS for circuit switched user and signaling data between the CS domain and the GERAN, Iu-PS for packet switched user and signaling data between the PS domain and UTRAN, Mc interface between the MSCS and the MGW, and the Go interface between the GPRS Gateway Support Node (GGSN) and the Internet Multimedia Subsystem (IMS).
Key Terms in this Chapter
HSUPA: High-speed uplink packet access.
S-TMSI: Service TMSI.
PHICH: Physical hybrid ARQ indicator channel.
P-GW: Packet gateway.
UL: Uplink direction of communication.
ATM: Asynchronous transfer mode.
EIA: EPS integrity algorithm.
UDP: User datagram protocol.
GUMMEI: Globally unique MME identity.
LCS: Location services.
SAI: Service area identity.
CTCH: Common traffic channel.
2G: 2 nd generation of mobile networks. The most dominant technology is the global system for mobility (GSM).
1G: 1 nd generation of mobile networks.
MMEC: MME code.
GMLC: Gateway mobile location center.
eMM: Evolved mobility management.
MNC: Mobile network code.
HS-DSCH: High-speed downlink shared channel.
ARQ: Automatic reply request.
PSS: Primary synchronization signal.
PCFICH: Physical control format indicator channel.
TD-SCDMA: Time division synchronous code division multiple access.
ASME: Access security management entity.
eNB: Evolved NodeB.
ME: Mobile equipment.
PCH: Paging channel.
LTE: Long-term evolution.
CSI: Channel state information.
AKA: Authentication and key agreement.
AMR: Adaptive multi rate.
EEA: EPS encryption algorithm.
IMS: Internet multimedia subsystem.
DL: Downlink direction of communication
DPS: Dynamic point selection.
GTP-U: GTP user part.
FDMA: Frequency division multiple access.
E-DPDCH: E-DCH dedicated physical data channel.
5G: 5 th generation of mobile networks. Still in standardization phase, the first 5G deployments are envisioned for 2020.
TMSI: Temporary IMSI.
CCCH: Common control channel.
LA: Location area.
MAC: Medium access control/message authentication code.
ARFCN: Absolute radio frequency channel number.
PCI: Physical cell identity.
PUSCH: Physical uplink shared channel.
3G: 3 rd generation of mobile networks. The most dominant technology is universal mobile telecommunication system (UMTS).
PICH: Paging indicator channel.
PMCH: Physical multicast channel.
IN: Intelligent network.
E-RGCH: E-DCH relative grant channel.
PCU: Packet control unit.
TAC: Tracking area code.
PBCH: Physical broadcast channel.
HSPA: High-speed packet access.
RLC: Radio link control.
QoS: Quality-of-service.
NB-IoT: Narrowband-IoT.
RSRQ: Reference signal receive quality.
GSM: Global system for mobile.
PLMN_ID: PLMN identifier.
MSISDN: Mobile subscriber ISDN number.
EPC: Evolved packet core.
DCCH: Dedicated control channel.
C-RNTI: Cell RNTI.
SM: Session management.
S1-AP: S1 application protocol.
SSCF-UNI: Specific coordination function – user network interface protocol.
RNC: Radio network controller.
GPRS: General packet radio service.
MU-MIMO: Multi user MIMO.
SDH: Synchronous digital hierarchy.
BCCH: Broadcast control channel.
ITU: International Telecommunication Union.
SRS: Sounding reference signal.
RSCP: Received signal code power.
WCDMA: Wideband code division multiple access.
IP: Internet protocol.
MME: Mobility management entity.
SCCPCH: Secondary common control physical channel.
DL-SCH: Downlink shared channel.
ESM: Evolved session management protocols.
EUTRAN: Evolved UTRAN.
MIB: Master information block.
TA: Tracking area.
Eps: Evolved packet system.
CoMP: Coordinated multipoint.
AICH: Acquisition indicator channel.
LAA: Licensed assisted access.
UMTS: Universal mobile telecommunication system.
GUTI: Global unique temporal identity.
PSC: Primary scrambling code.
QCI: QoS class identifier.
S-GW: Serving gateway.
MM: Mobility management.
PDCCH: Physical downlink control channel.
FD-MIMO: Full dimensional MIMO.
RAI: Routing area identity.
BTS: Base transceiver station.
MBMS: Multimedia broadcast multicast services.
HI1: Handover interface 1.
GTP-C: Gateway tunneling protocol control part.
RF: Radio frequency.
Cc: Content-of-communication.
DPDCH: Dedicated physical data channel.
RNTI: Radio network temporary identifier.
LEA: Law enforcement agencies.
ECGI: EUTRAN global cell identity.
FFT: Fast Fourier transformation.
PDSCH: Physical downlink shared channel.
SGSN: Serving GPRS support node.
R-PDCCH: Relay physical downlink control channel.
USIM: Universal subscriber identity module.
IFFT: Inverse fast Fourier transformation.
E-DCH: Enhanced dedicated channel.
AMF: Authenticated management field.
IU-UP: Iu interface user part.
IIF: Internal interception function.
NAS: Non-access stratum.
GRE: Generic routing encapsulation.
MMEGI: MME group identity.
MIMO: Multiple in multiple out radio transmission.
DSSS: Direct sequence spread spectrum.
DRS: Demodulation reference signal.
M-TMSI: MME TMSI.
PCCPCH: Primary common control physical channel.
RSSI: Received signal strength indicator.
IRI: Interception-related information.
VoLTE: Voice-over-LTE.
SRB: Signaling radio bearers.
ISDN: Integrated service digital network.
TDMA: Time division multiple access.
4G: 4 th generation of mobile networks. The 4G technologies are long term evolution (LTE) and the advanced version, LTE-advanced. Colloquially, the terms LTE/LTE-A are used as a synonym for 4G as they are the only global standard for mobile communication from the fourth generation.
OFDM: Orthogonal frequency division multiplexing.
NBAP: NodeB application part (NBAP).
UTRAN: UMTS terrestrial radio access network.
HS-SCCH: High-speed shared control channel.
AK: Authentication key.
TAI: Tracking area identity.
HPLMN: Home public land mobile network.
RAB: Radio access bearer.
HSDPA: High-speed packet downlink access.
SSS: Secondary synchronization signal.
DPCCH: Dedicated physical control channel.
MCCH: Multicast control channel.
E-DPCCH: E-DCH dedicated physical control channel.
AEs: Advanced encryption standard.
PS: Packet switched traffic.
LI: Lawful interception.
LAI: Location area identity.
CK: Ciphering key.
mMTC: Massive machine type communication.
LALS: Lawful access location services.
GBR: Guarantied bit rate.
SCH: Synchronization channel.
HE: Home environment.
IoT: Internet-of-things.
HI2: Handover interface 2.
OFDMA: Orthogonal frequency division multiple access.
PUCCH: Physical uplink control channel.
PDCP: Packet data convergence protocol.
SU-MIMO: Single user MIMO.
MCH: Multicast channel.
U-NII: Unlicensed national information infrastructure.
PCCH: Paging control channel.
RN: Relay nodes.
BSC: Base station controller.
SIB: System information block.
QAM: Quadrature amplitude modulation.
BCH: Broadcast channel.
DCH: Dedicated channel.
RANAP: Radio access network application part.
SAE: System architecture evolution.
MGW: Media gateway.
HS-DPCCH: High-speed dedicated physical control channel.
SAC: Service area code.
MCC: Mobile country code.
DTCH: Dedicated traffic channel.
E-HICH: E-DCH hybrid ARQ indicator channel.
SSCOP: Service specific connection-oriented protocol.
IMT-2000: International mobile telecommunications-2000 requirements.
RSRP: Received signal received power.
eLLA: Enhanced LLA.
AuC: Authentication center.
X2-AP: X2-application protocol.
3GPP: 3 rd generation partnership project.
GERAN: GPRS radio access network.
LWA: LTE-WLAN aggregation.
JT: Joint transmission.
ALCAP: Access link control application part.
CA: Carrier aggregation.
LMU: Location measurement units.
E-AGCH: E-DCH absolute grant channel.
HLR: Home location register.
SMLC: Serving mobile location center.
MTCH: Multicast traffic channel.
FDD: Frequency division duplex.
TLLI: Temporary logical link identifier.
URA: UTRAN registration areas.
LEMF: Law enforcement monitoring facility.
SC-FDMA: Single carrier frequency division multiple access.
VOIP: Voice-over-IP.
ECI: EUTRAN cell identity.
PMIP: Proxy mobile IP.
MSCS: MSC-server.
VLR: Visitor location register.
FACH: Forward access channel.
RACH: Random access channel.
EARFCN: Evolved ARFCN.
PRACH: Physical random access channel.
IK: Integrity key.
UE: User equipment.
UICC: Universal integrated circuit card.
P-TMSI: Packet TMSI.
LAC: Location area code.
IMEI: International mobile equipment identity.
RRC: Radio resource control.
SS#7: Signaling system no. 7.
PCRF: Policy charging rules functions.
SQN: Sequence number.
VPLMN: Visiting public land mobile network.
HS-PDSCH: High-speed physical downlink shared channel.
SCTP: Stream control transmission protocol.
E-RAB: Evolved-RAB.
UL-SCH: Uplink shared channel.
HSS: Home subscriber server.
HI3: Handover interface 3.
CPICH: Common pilot channel.
PHY: Physical layer.