1. Session: 6 S. K. Nayak6.1 Mobile Computing Session 6 CDMA S. K. Nayak Synergy, Dhenkanal

2. Session: 6 S. K. Nayak6.2 Spread Spectrum A technique in which the transmission bandwidth W and message bandwidth R are related as W >> R Counter intuitive Achieves several desirable objectives for e.g. enhanced capacity Source: Abhay Karandikar

3. Session: 6 S. K. Nayak6.3 Types of Spread Spectrum Systems Frequency Hopping Direct Sequence Frequency Hopping –Slow Frequency Hopping - multiple symbols per hop –Fast Frequency Hopping - multiple hops per symbol Care is taken to avoid or minimize collisions of hops from different users

4. Session: 6 S. K. Nayak6.4 Frequency Hopping Typical frequency-hopping waveform pattern

5. Session: 6 S. K. Nayak6.5 Direct Sequence Transmitter side of system

6. Session: 6 S. K. Nayak6.6 Direct Sequence (contd...) Receiver side of system

7. Session: 6 S. K. Nayak6.7 Code Division Multiple Access - CDMA Multiple users occupying the same band by having different codes is known as a CDMA - Code Division Multiple Access system Let W - spread bandwidth in Hz R = 1/T b = Date Rate (data signal bandwidth in Hz) S - received power of the desired signal in W J - received power for undesired signals like multiple access users, multipath, jammers etc in W E b - received energy per bit for the desired signal in W N 0 - equivalent noise spectral density in W/Hz

8. Session: 6 S. K. Nayak6.8 CDMA (contd…) What is the tolerable interference over desired signal power?

9. Session: 6 S. K. Nayak6.9 CDMA (contd…) In conventional systems W/R  1 which means, for satisfactory operation J/S < 1 ExampleLet R = 9600; W = 1.2288 MHz (E b /N 0 ) min = 6 dB (values taken from IS-95) Jamming margin (JM) = 10log 10 (1.2288*106/9.6*103) - 6 = 15.1 dB  32 This antijam margin or JM arises from Processing Gain (PG) = W/R = 128 If (E b /N 0 ) min is further decreased or PG is increased, JM can be further increased

10. Session: 6 S. K. Nayak6.10 CDMA (contd…) JM is a necessary but not a sufficient condition for a spread spectrum system. For eg. FM is not a spread spectrum system JM can be used to accommodate multiple users in the same band If (Eb/N0)min and PG is fixed, number of users is maximized if perfect power control is employed. Capacity of a CDMA system is proportional to PG.

11. Session: 6 S. K. Nayak6.11 Universal Frequency Reuse Objective of a Wireless Communication System – Deliver desired signal to a designated receiver – Minimize the interference that it receives One way is to use disjoint slots in frequency or time in the same cell as well as adjacent cells - Limited frequency reuse In spread spectrum, universal frequency reuse applies not only to users in the same cell but also in all other cells No frequency plan revision as more cells are added

12. Session: 6 S. K. Nayak6.12 Universal Frequency Reuse (contd...) As traffic grows and cells sizes decrease, transmitted power levels in both directions can be reduced significantly Resource allocation of each user’s channel is energy (instead of time and frequency) Hence interference control and channel allocations merge into a single approach

13. Session: 6 S. K. Nayak6.13 Spreading Codes It is desired that each user’s transmitted signal appears noise like and random. Strictly speaking, the signals should appear as Gaussian noise Such signals must be constructed from a finite number of randomly preselected stored parameters; to be realizable The same signal must be generated at the receiver in perfect synchronization We limit complexity by specifying only one bit per sample i.e. a binary sequence

14. Session: 6 S. K. Nayak6.14 PN Sequences A deterministically generated sequence that nearly satisfies randomness properties is referred to as a Pseudorandom Sequence (PN) Periodic binary sequences can be conveniently generated using linear feedback shift registers (LFSR) If the number of stages in the LFSR is r, P  2 r - 1 where P is the period of the sequence

15. Session: 6 S. K. Nayak6.15 PN Sequences (contd…) However, if the feedback connections satisfy a specific property, P = 2 r - 1. Then the sequence is called a Maximal Length Shift Register (MLSR) or a PN sequence. Thus if r=15, P=32767.

16. Session: 6 S. K. Nayak6.16 PN Sequences Specified in IS-95 A “long” PN sequence (r =42) is used to scramble the user data with a different code shift for each user The 42-degree characteristic polynomial is given by: –x 42 +x 41 +x 40 +x 39 +x 37 +x 36 +x 35 +x 32 +x 26 +x 25 +x 24 +x 23 +x 21 +x 20 +x 1 7 +x 16 +x 15 +x 11 +x 9 +x 7 +1 The period of the long code is 2 42 - 1  4.4*10 2 chips and lasts over 41 days

17. Session: 6 S. K. Nayak6.17 IS-95 CDMA Direct Sequence Spread Spectrum Signaling on Reverse and Forward Links Each channel occupies 1.25 MHz Fixed chip rate 1.2288 Mcps Reverse CHForward CH 847.74 MHz892.74 MHz 45 MHz

18. Session: 6 S. K. Nayak6.18 Spreading Codes in IS-95 Orthogonal Walsh Codes –To separate channels from one another on forward link –Used for 64-ary orthogonal modulation on reverse link. PN Codes –Decimated version of long PN codes for scrambling on forward link –Long PN codes to identify users on reverse link –Short PN codes have different code phases for different base stations

19. Session: 6 S. K. Nayak6.19 Forward Link Modulation I-PN Seq Q-PN Seq Forward Traffic Channel 9.6 kbps 4.8 kbps 2.4 kbps 1.2 kbps Long Code Generator Convolutional Encoder & repetition MUXMUX ++ WiWi Power Control bits 19.2 kbps Decimator x x Block Interleaver

20. Session: 6 S. K. Nayak6.20 Forward Link Modulation (contd…) Q-PN Seq all 0s (no data) x x x I-PN Seq Q-PN Seq 1.2 kbps I-PN Seq 4.8 kbps Convolutional Encoder & Repetitor Sync channel Block Interleaver x x x W32W32 W0W0 Pilot channel

21. Session: 6 S. K. Nayak6.21 Paging Channel Convolutional Encoder & Repetitor Block Interleaver x x + Long PN code Decimator 9.6 kbps 4.8 kbps 1.2288 Mcps I-PN Seq Q-PN Seq 19.2 ksps Forward Link Modulation (contd…)

22. Session: 6 S. K. Nayak6.22 Reverse Link Modulation The signal is spread by the short PN code modulation (since it is clocked at the same rate) Zero offset code phases of the short PN code are used for all mobiles The long code PN sequence has a user distinct phase offset.

23. Session: 6 S. K. Nayak6.23 Power Control in CDMA CDMA goal is to maximize the number of simultaneous users Capacity is maximized by maintaining the signal to interference ratio at the minimum acceptable Power transmitted by mobile station must be therefore controlled Transmit power enough to achieve target BER: no less no more

24. Session: 6 S. K. Nayak6.24 Two factors important for power control Propagation loss due to propagation loss, power variations up to 80 dB a high dynamic range of power control required Channel Fading average rate of fade is one fade per second per mile hour of mobile speed power attenuated by more than 30 dB power control must track the fade

25. Session: 6 S. K. Nayak6.25 Power Control on Forward Link and Reverse Link On Forward Link to send just enough power to reach users at the cell edge On Reverse Link to overcome the ‘near-far’ problem in DS- CDMA

26. Session: 6 S. K. Nayak6.26 Types of Power Control Open Loop Power Control (on FL) Channel state on the FL estimated by the mobile – measuring the signal strength of the pilot channel RL transmit power made inversely proportional to FL power measured Mobile Power = Constant – Received power (dBm) (dBm) (dBm) Works well if FL and RL are highly correlated –slowly varying distance and propagation losses –not true for fast Rayleigh Fading.

27. Session: 6 S. K. Nayak6.27 Closed Loop Power Control (on RL) Measurement of signal strength on FL as a rough estimate Base station measures the received power on RL Measured signal strength compared with the target Eb/No (power control threshold) Power control command is generated asking mobile to increase/decrease Must be done at fast enough a rate (approx 10 times the max Doppler spread) to track multi-path fading

28. Session: 6 S. K. Nayak6.28 Outer Loop Power Control Frame error rate (FER) is measured Power control threshold is adjusted at the base station

29. Session: 6 S. K. Nayak6.29 Power Control in IS-95A At 900 MHz and 120 km/hr mobile speed Doppler shift =100Hz In IS 95-A closed loop power control is operated at 800 Hz update rate Power control bits are inserted (‘punctured’) into the interleaved and encoded traffic data stream Power control step size is +/- 1 dB Power control bit errors do not affect performance much

30. Session: 6 S. K. Nayak6.30 Diversity Techniques in CDMA Rationale for Diversity:- if ‘p’ is the probability that a given path in a multi-path environment is below a detection threshold, then the probability is ‘p L ’ that all ‘L’ paths in an L-path multi-path situation are below the threshold

31. Session: 6 S. K. Nayak6.31 Diversity Techniques Frequency Diversity –transmission of signal on two frequencies spaced further apart than the coherence bandwidth –inherent in spread spectrum system if the chip rate is greater than the coherence bandwidth Time Diversity –transmission of data at different times –repeating the data ‘n’ times –interleaving and error correcting codes used in IS-95

32. Session: 6 S. K. Nayak6.32 Diversity Combining Space Diversity –Multi-path tracking (Path Diversity) –Transmission space diversity Signal can be emitted from multiple antennas at a single cell site Selection Diversity (SD) Equal Gain Diversity (EGC) Maximal Ratio Combining (MRC) MRC is an optimal form of diversity RAKE receiver in IS-95 is a form of MRC

33. Session: 6 S. K. Nayak6.33 Selection Diversity Combining User data Channel with the highest SNR is chosen (L-1) channel outputs are ignored Diversity Ch #1 Diversity Ch #2 Diversity Ch #L Receiver #1 Receiver #L z1z1 Receiver #2 z2z2 Select largest SNR channel zLzL …..

34. Session: 6 S. K. Nayak6.34 Equal Gain Combining (EGC) n 1 (t) Z Symbol decision statistics are combined with equal gains to obtain overall decision statistics. Diversity Ch #1 Diversity Ch #2 Diversity Ch #L + + Receiver #1 z1z1 + Receiver #L Receiver #2 Combiner Transmitted Signal zLzL z2z2 n L (t) n 2 (t)

35. Session: 6 S. K. Nayak6.35 Maximal Ratio Combining(MRC) Similar to EGC – decision statistics are summed or combined In EGC – each channel is multiplied by equal gain In MRC – each channel is multiplied by gain proportional to the square root of SNR of the channel This gives optimal combining Output SNR Requires knowledge of SNR of each channel as well as phase of the diversity signal

36. Session: 6 S. K. Nayak6.36 MRC Diversity Ch (α 1 Φ 1 ) Diversity Ch (α 2 Φ 2 ) Diversity Ch (α L Φ L ) + + + x x x User Data g 1 g2g2 gLgL n L (t) n 2 (t) n 1 (t) r 1 r 2 r L Combiner

37. Session: 6 S. K. Nayak6.37 RAKE Receiver Concept Multi-path diversity channels Problem –to isolate various multi-path signals –How to do this ? If the maximal delay spread (due to multi-path) is T m seconds and if the chip rate then individual multi-path signal components can be isolated Amplitudes and phases of the multi-path components are found by correlating the received waveform with delayed versions of the signal Multi-path with delays less than 1 /T c can’t be resolved

38. Session: 6 S. K. Nayak6.38 Rake Receiver in IS-95 Rake Receiver is used in Mobile receiver for combining –Multi-path components –Signal from different base stations (resolve multi-path signals and different base station signals) 3 Parallel Demodulator (RAKE Fingers) –For tracking and isolating particular multi-path components (up to 3 different multi-path signals on FL) 1 Searcher – Searches and estimates signal strength of multi-path pilot signals from same cell site pilot signals from other cell sites –Does hypothesis testing and provides coarse timing estimation

39. Session: 6 S. K. Nayak6.39 Rake Receiver (contd…) Rake on FL Searcher Receiver 3-Parallel Demod- ulator Diversity Combiner (Mobile Station Rake Receiver) –Search receiver indicates where in time the strongest replicas of the signal can be found

40. Session: 6 S. K. Nayak6.40 Handoff in CDMA System Soft Handoff –Mobile commences Communication with a new BS without interrupting communication with old BS –same frequency assignment between old and new BS –provides different site selection diversity Softer Handoff –Handoff between sectors in a cell CDMA to CDMA hard handoff –Mobile transmits between two base stations with different frequency assignment

41. Session: 6 S. K. Nayak6.41 Soft Handoff- A unique feature of CDMA Mobile Advantages Contact with new base station is made before the call is switched Diversity combining is used between multiple cell sites – additional resistance to fading If the new cell is loaded to capacity, handoff can still be performed for a small increase in BER Neither the mobile nor the base station is required to change frequency

42. Session: 6 S. K. Nayak6.42 Soft Handoff Architecture MSC BSC BTS BSC BTS R new link old link R R- handoff request sent to the old cell energy measurements are made at the mobile R

43. margin exceeds T_ADD T_DROP Time Base A Base B B added to candidate list B_Active Drop timer starts Drop timer resets Drop timer expires Signal levels during Handoff E b /I o

44. Session: 6 S. K. Nayak6.44 CDMA Authentication & Encryption Authentication Key (or A-Key) Master Key Used for generation of the sub-keys (intermediate & session keys) for use in authentication & encryption Shared Secret Data SSD_A Shared Secret Data SSD_B Intermediate Keys Used for Authentication of the mobile Session Keys Voice Privacy Mask/ Private Long Code Mask Voice Encryption Data Key Data Encryption CMEA Key Signaling Msg Encryption Used for generation of Session Keys Source: Amit Balani

45. Session: 6 S. K. Nayak6.45 A-Key (Authentication Key) The A-Key or Authentication Key is A 64 bit permanent secret number stored in the permanent memory of the mobile. Pre-programmed and stored securely on the mobile phone during factory settings. Known only to the mobile and its associated HLR/AC. Is used to generate the SSD (Shared Secret Data) – the intermediate keys.

46. Session: 6 S. K. Nayak6.46 SSD –Shared Secret Data The SSD (Shared Secret Data) A 128 bit number that is stored in the semi-permanent memory of the mobile. Is a temporary number that is updated during SSD updates. SSD is divided into two parts, SSD_A (64 bits) and SSD_B (64 bits) which is used to generate the session keys for Voice, data and Signaling messages The SSD is calculated simultaneously by both MS and AC The SSD can be shared with the VLR

47. Session: 6 S. K. Nayak6.47 ESN-MIN-MDN ESN (Electronic Serial Number) The ESN is the 32 bit electronic serial number of the mobile phone. The ESN is pre-programmed by the phone manufacturer during factory settings. The ESN is unique to each mobile on the network and is used in conjunction with the mobile number to identify the mobile on the network. MIN (Mobile Identification Number) The MIN is the 10 digit number which is assigned by the Service Providers to a mobile phone in the network. The MIN is unique to each mobile on the network and is used in conjunction with the ESN to identify the mobile on the network. MDN (Mobile Directory Number) The MDN is the10 digit dialable number assigned by the Service Provider to a mobile phone on its network. The MDN may be the same as the MIN (it depends on how the Service Provider provisions this pair on its networks).

48. Session: 6 S. K. Nayak6.48 A-keyESNA-keyESN RAND SSD CAVE SSD_ASSD_B CAVE SSD_BSSD_A ESN RAND ? Authentication Signature (18 bit) RAND SSD MSC MS VPM (PLCM) BS SSD Gen Procedure-CAVE MIN Long Code Generator Channel Coding Voice LCD MUX Power Control Walsh Code Q Pilot PN I Pilot PN BBF Cos(2πft) Sin(2πft) LCD : Long Code Decimator CMEA key Data Key E-CMEA Signaling Message CMEA key ORYX Data Data Key HLR/AC VPM (PLCM) Data KeyCMEA Key ………. Forward Link Reverse Link Authentication and Encryption -CDMA

49. Session: 6 S. K. Nayak6.49 A-keyESNA-keyESN RAND SSD CAVE SSD_ASSD_B CAVE SSD_BSSD_A ESN RAND ? Authentication Signature (18 bit) RAND SSD MSC MS VPM (PLCM) BS SSD Gen Procedure-CAVE MIN Long Code Generator Channel Coding Voice LCD MUX Power Control Walsh Code Q Pilot PN I Pilot PN BBF Cos(2πft) Sin(2πft) LCD : Long Code Decimator CMEA key Data Key E-CMEA Signaling Message CMEA key ORYX Data Data Key HLR/AC VPM (PLCM) Data KeyCMEA Key ………. Forward Link Reverse Link Authentication and Encryption -CDMA CAVE: Cellular Authentication & Voice Encryption

50. Session: 6 S. K. Nayak6.50 A-keyESNA-keyESN RANDSSD-64 bit SSD_ASSD_B SSD_A ? (RANDSSD) SSD Update Order HLR/AC MS BS SSD Gen Procedure-CAVE RANDBS-32bit CAVE MSC CAVE AUTHBS SSD Update Procedure (RANDBS) BS Challenge Order (AUTHBS) BS Challenge Response SSD Update Confirmation Order Or SSD Update Rejection Order (RANDSSD) SSD Update Request (AUTHBS) BS Challenge Confirmation Order Paging Channel / Forward Traffic Channel Access Channel / Reverse Traffic Channel MIN ESN MIN SSD Update Response

51. Session: 6 S. K. Nayak6.51 MS A-keyESNA-keyESN RANDSSD-64 bit SSD_ASSD_B SSD_A ? MS BS CAVE MSC/HLR/AC CAVE AUTHR-18 bit Authentication: Global Challenge MIN ESN MIN (RAND) Authentication Challenge AUTHR-18 bit RAND 32 bit Paging Channel / Forward Traffic Channel Access Channel / Reverse Traffic Channel (AUTH=01) Access Parameter - Permit Access - Deny Access - Initiate SSD Update - Initiate Unique Challenge (AUTHR, RANDC, COUNT) Authentication Challenge Response

52. Session: 6 S. K. Nayak6.52 A-keyESNA-keyESN RANDSSD-64 bit SSD_ASSD_B SSD_A ? MS BS CAVE MSC/HLR/AC CAVE AUTHU-18 bit Authentication: Unique Challenge MIN ESN MIN (RANDU) Authentication Challenge (AUTHU) Authentication Challenge Response AUTHU-18 bit RANDU 24 bit Paging Channel / Forward Traffic Channel Access Channel / Reverse Traffic Channel (AUTH=01) Access Parameter (AUTHU) Authentication Challenge Response - Permit Access - Deny Access - Initiate SSD Update

53. Session: 6 S. K. Nayak6.53 How is Authentication Invoked RAND (32)Digits* (24)ESN (32)SSD_A (64) AUTH_SIGNATURE-CAVE AUTHR (18) -When a mobile is trying to Register onto the network by sending a Registration message on the Access Channel -When a Mobile attempts to Originate a call by sending an Origination message on the Access Channel RAND (32)IMSI_S1 (24)ESN (32)SSD_A (64) AUTH_SIGNATURE-CAVE AUTHR (18) * Last 6 digits transmitted by the MS

54. Session: 6 S. K. Nayak6.54 How is Authentication Invoked RAND (32)Digits* (24)ESN (32)SSD_A (64) AUTH_SIGNATURE-CAVE AUTHR (18) -When a Mobile is trying to Terminate a call by sending a Page Response message on the Access Channel -When a Mobile attempts to send a Data Burst message on the Access Channel RAND (32)IMSI_S1 (24)ESN (32)SSD_A (64) AUTH_SIGNATURE-CAVE AUTHR (18) * Last 6 digits of the destination