PAGE 1 Service Provider Wi-Fi Bill McFarland, VP Technology, Qualcomm Atheros

PAGE 2 Outline  System capacity discussion  u  Wi-Fi Hotspot 2.0  Hybrid LTE/Wi-Fi small cells

PAGE x Capacity Increase: Needed 5B cumulative smartphone sales estimated for Average traffic per smartphone nearly tripled in MB/Mo, versus 55 MB/Mo in 2010 Over the past five years, AT&T’s wireless data traffic has grown 200X Exponential growth in mobile data utilization

PAGE x Capacity Increase: Possible!  Number of antennas limited by device size  Spectrum limited by availability, government policy  Interference mitigation difficult, can only go so far  Only big lever is to substantially reduce cell size  But cellular deployment models/economics make increasing the number of base stations by 32x expensive and slow nW# users capacity/user ≈ n  W  log 2 (1+ )/# usersSignal Noise Number of Antennas (4x?) More Spectrum (4x?) Mitigate Interference (2x?) Small Cells! (32x?)

PAGE 5 Why Wi-Fi? The capacity is needed, the clients are there The number of devices connected to IP networks will be twice as high as the global population in 2015, up from one networked device per capita in Source: iSuppli, Q2, 2011 Connectivity Forecast. Other Wi-Fi-enabled clients consists of the following: printers – 41M in 2011, 69M in 2015; digital cameras – 7M in 2011; 24M in 2015; gaming consoles – 40M in 2011, 56M in 2015; handheld gaming – 36M in 2011, 35M in 2015; eReaders – 3M in 2011; 15M in 2015; LCD TVs – 18M in 2011; 180 in 2015; DVD Players/Recorders – 12M in 2011; 29M in 2015; STBs – 3M in 2011, 7M in Cisco Visual Networking Index: Forecast & Methodology June, 2011

PAGE 6 How Do we Make Wi-Fi a Service Provider Network?  Transparent, hassle free services discovery (802.11u)  Features to enable cellular offload onto Wi-Fi (Hotspot 2.0)  Seamless operation across cellular and Wi-Fi networks (LTE/Wi-Fi hybrid small cells)

PAGE 7 Wi-Fi Industry Standards Ecosystem Overview IEEE Accord VHT 5G Core Spec Core Spec 11ad (60 GHz) 11ad (60 GHz) WSE Dock ing EXTEND 60 GHz Hot- spot 2.0 WBA GSMA Smart Grid CSEP Home Plug ZigBee WiGig Serial Bus 11ai FILS 11af TVWS TVWS WSA 11aq PAD WPS NAN ‘Social Wi-Fi’ Social SIG Docking Consor- tium Dock- ing TDLS 11ac 11ah Dis- play Wi-Fi Alliance NFC WFD Svs WFD Svs Group Gen Link SG 11u

PAGE u

PAGE u Icon Bar Displays Localized Mobile Services (LMS) (courtesy of Esteban Torres, Cisco)

PAGE 10 How Does 11u Change the Situation? SSID 1 SSID 2 SSID 3 SSID 4 Current Approach: Device scan for SSIDs End user has to associate with SSID to discover the service in the SSID End user launches web browser and enters URL to get web service Current Approach SSID 1 SSID 2 SSID 3 SSID u Approach: Device scans for service (not SSID) Prompts end-user or auto launches service End-user clicks on prompt, automatically associates with SSID, and seamlessly launches a web service u Service Discovery Pre-association Service

PAGE 11 What’s Required to Implement u  The AP needs a “service advertiser”  The client device needs a “service launcher” u-enabled Handset Handset Vendor Wi-Fi Driver Software Update u Protocol stack GUI Handset Vendor Verizon LMS Integrated into WI-Fi IC

PAGE u GUI  u defines messaging and protocols, but these are straightforward  The key will be creating GUI’s that allow users to configure this capability easily and to their liking OFF Mode: Service ON LMS OpenClosed Handset with u GUI My Icons: Target Ascot Starbucks Best Buy - Favorites u Filters Wi-Fi Driver Software Update u Protocol stack GUI u Filters Show me only Coffee houses Hotspot Retail stores LMS

PAGE 13 Hotspot 2.0 (Passpoint)

PAGE 14  Service Provider Wi-Fi is currently not easy to use (manual intervention required) and confusing  Web page redirection creates ease of use problem  Absence of a standardized mechanism for connection establishment  Hotspot network connectivity ≠ Network service  Inconsistent and limited security (local access and authentication mechanism)  No indication that a session has expired – network access is suddenly lost Problem Statement Cellular : Turn on phone and make callHotspot : Turn on Wi-Fi and ? Find Connection Manager Launch Connection Manager Scan for SSIDs Select Correct SSID Associate with SSID ?

PAGE 15 Use case: Cellular-like Experience Automatic and Secure Easy Connectivity for Wi-Fi Subscribers Cellular Automatic and Secure 1. SP subscriber comes to roaming partner 2. Gets service automatically 3. Secure connection Hotspot SP subscriber turns on his phone 2. Gets cellular service automatically 3. Secure connection Cellular Tower (Home SP) Cellular Device 1. Wi-Fi subscriber comes to AP of Home SP 2. Gets Wi-Fi service automatically 3. Secure connection Automatic and Secure Cellular Device Hotspot 2.0 STA (single or dual-mode) Hotspot 2.0 AP (Home SP) Cellular Tower (Roaming Partner) Hotspot 2.0 STA (single or dual-mode) Hotspot 2.0 AP (Roaming Partner) 1. Wi-Fi subscriber comes to AP of Roaming Partner 2. Gets Wi-Fi service automatically 3. Secure connection Source: WFA

PAGE 16 Scope of Work for the WFA Hotspot 2.0 Technical Taskgroup  Development of Specifications  ANQP (Access Network Query Protocol) extensions to u  Operator Policy and Sign On Procedure  Security Enhancements  Development of an Interoperability Testplan  Interoperability Plugfesting

PAGE 17 Wi-Fi Passpoint (Hotspot 2.0) Name + SpecPasspoint, based on Hotspot 2.0 Tech Spec DescriptionSeamless WLAN connectivity for mobile devices, modeled on cell phone networks Key Technologies u 802.1x EAP-SIM, AKA, TLS, TTLS, FAST High Value Use Cases Enable Wi-Fi traffic offload from mobile networks to WLAN. Device to automatically joins network using pre-loaded credentials for preferred Service Provider Networks (Significantly better User Experience). Target CustomerOperators, Infrastructure Vendors, Handheld OEMs, PC, Target ProductsAccess Point, handheld, PC, tablet Key Requirements Release 1: Streamlined network access Release 2: Provisioning of Operator policy Release 3: Seamless Service Across 3GPP and Wi-Fi Access TimeframeRelease 1: launched 6/26 Release 2: late 2013 Release 3: 2014/15

PAGE 18 Qualcomm Confidential and Proprietary — Restricted Distribution - DO NOT COPY MAY CONTAIN U.S. AND INTERNATIONAL EXPORT CONTROLLED INFORMATION — Hotspot 2.0 Procedure  Discovery: The mobile device is scanning for APs with which to associate and for related information useful for network selection  HS 2.0 enables an STA to discover usable APs based on Hotspot Operator Friendly Name, Roaming Consortium list, Venue name, NAI Realm list, Domain Name list, 3GPP Cellular Network information  Additional performance related information is available eg., BSS load, Backhaul capacity, WAN Metrics, Connection Capability, Online Signup providers list, etc.  Registration: The mobile device is setting up a new account with an SP or hotspot provider. If the mobile device already has valid credentials for a given hotspot, this state is short-lived.  Provisioning: The Wi-Fi infrastructure is establishing credential information and providing policy information to the mobile device. If the mobile device already has valid credentials for a given hotspot, this state is short-lived.  Security schemes available are WPA2 Enterprise, EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS  Access: The mobile device has successfully associated and authenticated with the hotspot and can access the services for which the user has subscribed.

PAGE 19 HS2.0 Capabilities and Requirements Interworking IE Roaming Consortium IE BSS Load IE VENUE Name Network Authentication Type Roaming Consortium List IP Address Type Availability NAI Realm List 3GPP Cellular Network Info Domain Name List HS Query List HS Capability List Operator Friendly Name WAN metrics Connection Capability NAI Home Realm Query Operating Calls Indication u HS2.0  Hotspot 2.0 uses protocol defined within the IEEE P802.11u-2011, Amendment 9: Interworking with External Networks  Assist in network selection  Assist in capabilities supported  WFA defined Hotspot 2.0 extensions of the u information elements (ANQP)  Elements exchanged using u (Generic Advertisement Service) GAS frames

PAGE 20 ANQP elements used for HS2.0 (not complete list)  Roaming Consortium  Indicates roaming consortium or SSP (i.e. operator) whose security credentials can be used to authenticate with the AP  Domain Name List  Domain Name of the entity operating the network  Values include: On-line enrollment supported, HTTP/S redirection  Operator Friendly Name  Wi-Fi client can request a list of all the mobile operators' names that are allowed to automatically connect to the Wi-Fi hotspot. If your operator's name is on the list, your device will proceed with connection decisions  WAN Metrics  Provides information on the speed of the WAN connection to the Internet.  Connection Capability  Provides connection status of the most commonly used communications protocols and ports.  Network Access Identifier (NAI) Home Realm Query  Used by the STA to determine if the NAI realms for which it has security credentials are realms corresponding to SPs or other entities whose networks or services are accessible via this BSS. (Which service providers can I connect to here?)  Hotspot (HS) Query List  Provided by STA to AP  Carries identifiers of ANQP elements for which the mobile is querying the AP  Hotspot (HS) Capability List  Provides list of information configured in AP back to the mobile device

PAGE 21 Secure Access – Network Authentication Type Wi-Fi CERTIFIED Passpoint is WPA2™ Secured  Wi-Fi CERTIFIED Passpoint uses following credential type and EAP methods Credential TypeEAP Method CertificateEAP-TLS SIM/USIMEAP-SIM, EAP-AKA Username/Password (with server side certificates) EAP-TTLS with MSCHAPv2 Secure Access

PAGE 22 Hotspot GAS exchanges Hotspot 2.0 capable AP Beacons and Probe Response frame include: RSN IE(WPA2) Interworking Element (includes HESSID and Venue Information) Advertisement Protocol Element (Indicates ANQP) Roaming Consortium Element(A list of roaming consortium identifier) The Hotspot 2.0 Indication element Hotspot 2.0 capable STAs scan for networks and discover an AP advertising Hotspot 2.0 capability. Hotspot 2.0 capable STA uses ANQP to the AP to determine properties of the Hotspot 2.0 Access Network. The Hotspot capable STA selects the ANQP query elements it requires to query the Hotspot 2.0 network for Interworking Service information. GAS Initial Request Frame ( Advertisement Protocol = ANQP; ANQP Query = {Venue Name, Network Auth, Roaming Consortium, IP Address Type, NAI Realm, 3GPP Cellular information, Domain Name; Operator Friendly Name, WAN Metrics, Connection Capability} ) GAS Initial Response Frame ( Advertisement Protocol = ANQP; Venue Name; Network Auth; Roaming Consortium; IP Address Type; NAI Realm; 3GPP Cellular information; Domain Name; Operator Friendly Name,; WAN Metrics; Connection Capability) Hotspot 2.0 capable STA evaluates the response based on its Hotspot 2.0 subscription information and associated policy and choose to associate to the AP. NOTE SSID is not necessary to make the network selection. Associate and WPA2 EAP Authentication Secure WPA2 Data Connectivity

PAGE 23 Hybrid LTE/Wi-Fi Small Cells

PAGE 24 LTE+Wi-Fi Convergence -- Basic  Definition  Single device with LTE small cell and Wi-Fi capabilities  Dynamic offload and hand-off between radios & networks  Basic requirements  Femto + Wi-Fi connection management – Connection method should be invisible to user » Smart policies and control in both terminal and network – Smart system selection/ bandwidth management » Link quality based selection – Preserve cellular management with Wi-Fi offload » Hotspot 2.0 generalization » Billing, roaming, authentication, security  Co-existence  Self organizing LTE, Wi-Fi, and LTE+Wi-Fi

PAGE 25 LTE+Wi-Fi Convergence -- Advanced  Advanced requirements  Femto + Wi-Fi connection management – Enhanced system selection/ bandwidth management » Mobility/ velocity, application requirements – Bandwidth aggregation » TCP layer (multipath TCP) » IP layer (Hy-Fi type) » MAC layer  Traffic shaping, network acceleration and backhaul optimization for LTE+Wi-Fi flows  RF and HW architectures, cost synergies

PAGE 26 Thank you!