femtocell white paper 09-01-26v1

Upload: alegemobila-ro

Post on 03-Apr-2018

214 views

Category:

Documents


0 download

TRANSCRIPT

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    1/22

    GSMA Femtocell ProjectA coordinated approach for the mobile industry

    Release 2 February 2009

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    2/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 1

    Contents

    U1 Introduction 2

    U2 Interference and Frequency Management 4

    U3 Requirements on DSL Broadband 6

    U4 Archi tecture and Deployment Guidelines 8

    U5 Femtocell Management 11

    U6 Testing and Certification of Femtocells 14

    U7 Femtocell and Network Security 15

    U8 Femtocell Terminology 18

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    3/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 2

    Chapter 1

    Introduction

    The introduction of Femtocells into the mobile industry is expected to have a major impact on the approach

    that operators use to deploy their networks in the future and potentially on services.

    The prospective benefits to both users and Mobile Operators are substantial, but as with any newtechnology, there are barriers to overcome and issues to be resolved before wide scale deployment canbecome a reality.

    In order to realise the potential benefits of Femtocells, the GSMA has been studying a range of topics withthe objective of accelerating the delivery of Femtocell solutions. The aims of this work are to stimulate furtherinterest in Femtocells, provide guidelines for operators on Femtocell deployment, provide a feature list andminimum requirements for the technology, and support cross industry dialogue with relevant standardsbodies such as the Femto Forum and 3GPP.

    The GSMA Femtocells Project identified a number of key topics where a coordinated industry approachwould benefit the Mobile Industry. This paper provides an overview of the results of the studies carried out on

    these topics, including:

    Radio interference and frequency coordination

    DSL Broadband requirements

    Architecture and deployment guidelines

    Femtocell Management

    Testing and Certification of Femtocell Access Points

    Femtocell and Network Security

    A detailed whitepaper has been published for each of these topics and if further and published papers can be

    found at HTUwww.gsmworld.com UTH

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    4/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 3

    TFigure 1: Femtocell Access Point

    A Femtocell is a low power GSM or 3G base-station that is designed to be suitable for installation atcustomer premises (either in corporate offices or subscribers homes). This can then provide a small footprintof 3G coverage intended primarily or exclusively for the use of the customer housing the Femtocell. In thecase of enterprise/office applications, Femtocells may allow other users to access the Femtocell coveragearea.

    The Femtocell Access Point is connected by Broadband DSL or other IP connection to interface with theGSM or UMTS core packet switched and circuit switched networks. Femtocells work with standard devicesthat are compliant with existing 2G and 3G air interface technologies. This ensures seamless service andgood interoperability with existing networks and avoids the need for specifically adapted handsets.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    5/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 4

    NB AUE A1

    NBartment A

    NB B

    UE B1

    NBartment B

    UEMacro

    NB

    Macro

    Macrocell B

    UE A2

    Macrocell A

    HNB AUE A1

    Apartment A

    HNB B

    UE B1

    Apartment B

    UE

    MacroNB

    Macro

    Macrocell B

    UE A2

    Macrocell A

    4

    13

    2

    5

    6

    UEUE

    Macro

    Chapter 2

    Interference and Frequency Management

    Femto Access Points will be implemented in customers homes and other uncontrolled environments;therefore it is important to understand the potential interference issues that may arise. Femto Access Pointsmay be deployed either using the same carrier frequency as the Macro cellular layer, or using a differentcarrier. There are benefits and drawbacks for each approach, but a common issue is interference between

    Femto Access Points and the macrocell layer when they are in close proximity. There are two maininterference scenarios that need to be considered:

    Management of co-channel interference, which will generally be within thedomain of one operator

    Adjacent channel interference, which maybe caused by interference betweendifferent operator networks.

    2.1 Co-Channel Interference

    In the co-channel deployment there are two main scenarios:

    1. When a Femto Access Points is very close to the macrocell base station, causing the FemtoAccess Points to have a very limited effective coverage range, due to the high received signallevel from the co-channel macrocell.

    2. When a Femto Access Points is too far from the macrocell base station, where the Femto AccessPoint may cause a coverage outage (in some cases extending beyond the home or residence) tomobiles attached to the macrocell due to the low received signal level from the co-channelmacrocell.

    The first instance (Femtocell downlink) provides the main deployment issue, and in the case where a FemtoAccess Points is located very close to the macrocell base station (less than 50 metres) then the FemtoAccess Points may become unusable.

    Interference also affects the Femto Access Points installed in homes that are close to the macrocellbasestation when using the same carrier (i.e. co-channel Femto-Femto interference). This interferenceaffects the downlink and may be experiences in multi occupancy buildings such as flats with low attenuationwalls.

    TFigure 2 Femto/Macrcocell Radio Landscape

    THNB Home Node B, 3GPP term for Femto Access Point

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    6/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 5

    2.2 Adjacent Channel Interference

    Where a Femto Access Point uses a dedicated carrier adjacent to the macrocell carrier frequency, and forcases where there is closed access then further analysis is required. In particular an assessment is neededof the impact on mobiles which are visiting within the home containing an access point on an adjacentcarrier, as they may face service degradation when close to the Femto Access Point. The extent of thedegradation depends on how weak the signal is from the Macro cellular network.

    2.3 Conclusions and Recommendations on Interference

    Femtocells are a promising technology that will extend indoor coverage and additional capacity; howeverthey are subject to interference issues that must be carefully managed. If these issues are not addressedthen it could lead to radio inference stopping a Femtocell from operating or connection issues for handsetsconnecting to the Marco network that are not within the Femtocell access group..

    The severity of interference is related to the specific deployment environment and is more relevant whensharing the same carrier between the macrocell layer and Femto Access Point. The impacts of an outdoormacrocell base station over indoor Femtocell coverage are particularly critical for the Femtocell downlinkwhen macrocells are located very close to a Femto Access Point. Uplink interference of users connected to adistant macrocell can also limit the Femto Access Point performance.

    Mutual interference between Femto Access Points located inside adjacent buildings can cause performance

    to decline, especially in the case of a high density of access points in flats and multi-occupancy buildings. Inthis case it is necessary to coordinate the appropriate installation location of Femto Access Point in individualapartments.

    Interference must be carefully taken into account and managed when deploying Femtocells. Solutions whichcan help to limit the effects are to:

    Ensure that Femto Access Points are not installed too close to a macrocell basestation

    Use a dedicated carrier for the Femtocell layer

    Use an open access deployment scenario (where Femtocells are able to manage trafficof all carrier users).

    It is also desirable for the suppliers of Femtocell solutions to include functionality to the control and limit thetransmitted power, and the ability to self select a suitable scrambling code.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    7/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 6

    Chapter 3

    Requirements on DSL Broadband

    There are two basic scenarios for provisioning of the DSL Broadband connection.

    The first is where there is no interaction between the operator and DSL service provider and no specificrequirements are asked of the DSL service provider. In this case there are a number of implications for the

    Femtocell service and there are several workarounds that operators may consider to mitigate the impacts.In the second case the operator may have a service level agreement with the DSL provider and examples ofservice requirements for this case have been identified.

    The overall recommendation is to limit the requirements on a DSL Provider or ISP to a minimum, i.e. onlyconsider those requirements that could be showstoppers for the roll-out of Femtocell services.

    The three key areas to consider are as follows:

    Providing location information for the Femto Access Point (FAP)

    Broadband Performance: Availability, Bandwidth, Delay, J itter, Packet Loss

    Congestion Management, including contention with other services supported on the Broadband link

    3.1 Providing location information for the Femto Access Point (FAP)

    Three possible solutions are identified as the most suitable methods of providing a Femto Access Pointlocation check.

    1. Use information gathered from the macrocell layer of the network. This information would begathered by the Femtocell searching (sniffing) the Macro layer and providing information back intothe network.

    2. Making it a contractual requirement of the provisioning of a Femtocell service that the customerprovides the location information of the Femto Access Point. It would also be possible to crossreference this information against the billing address information of the DSL provider.

    3. Adding a GPS device into the Femto Access Point and then programming the access point to sendthe exact location to the network.

    Once this information has been received into the network then it could be used to identify the most suitablefrequency and power for the access point to use.

    From these options the GSMA have made further recommendations. The preference should be to use anetwork sniffing method in parallel with the billing address information provided by the ISP as a back upoption. GPS is best used only if there is a regulatory requirement with in a specific country. This is due to thenature of GPS technology, as an access point may be often be located in an areas of poor coverage or inhome locations where the GPS system is likely to suffer from poor satellite coverage.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    8/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 7

    3.2 Broadband Performance: Availability, Bandwidth, Delay, Jitter, Packet Loss of traffic

    A fundamental element of the Femtocell architecture is based on the availability and quality of the broadbandline between the Femto Access Point and the Operators core network. If there are performance issues, or ifthe DSL connection is lost then the access point becomes inoperable.

    To ensure that the performance of the Broadband line is suitable then a potential solution is for the operatorand DSL provider to sign up to a Service Level Agreement (SLA) to ensure availability and to allow theoperator to monitor and assess broadband performance - typical performance indicators are Bandwidth,Delay, J itter and Packet Loss.

    If it is not suitable for an operator to agree with an ISP a set of performance SLAs - for example because itwould be too complex to negotiate or to monitor, manage and police the SLA KPIs - it is recommended toimplement at least a solution where the access point internally monitors the performance of the Broadbandlink and switches off the Femtocell service - including radio - if backhaul quality does not meet theperformance criteria required to support a proper Femtocell service.

    The SLA may also need to include network QoS scheme to ensure QoS marking is consistent across theend-to-end connection. If DSL service provider does not implement QoS, then the DSL service provider shallat least agree not to strip off the QoS markings that Femtocell operator has inserted.

    3.3 Congestion Management

    Congestion of a DSL line could have a major impact on the performance of Femtocells, this is especially thecase in households where there are multiple devices connected to a single DSL line. To protect against thisissue it is recommended that the Femto Access Point has the capability to redirect a call to the macrocelllayer if congestion occurs.

    Femtocell traffic should be prioritised in a consistent way with all other devices and services sharing thesame DSL link.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    9/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 8

    Femto

    Access

    Point

    Mobile

    device

    Home

    GW

    Femto

    GW

    Femto Management

    System

    FAP-MS FGW-MS

    FL

    Fa

    SeGWFixed

    Broadband

    Radio

    i/f

    Fm Fg

    CS core

    PS core

    Subscriber

    Databases

    Fb-cs

    Fb-ps

    Fr

    HPLMN Core Network

    IMS coreFb-ims

    HPLMN RAN

    Chapter 4

    Architecture and Deployment Guidelines

    One of the critical success factors for the deployment of Femtocell technology is to achieve interoperabilitybetween the Femto Access Point and networks. This will enable users to choose access points withoutundue restriction and enable competition between vendors. Operators should be able to deploy networkequipment which can be independent of specific access point vendors. These interoperability requirements

    demand the development of a common architecture and appropriate technical standards to enable a mix-and-match approach to access point and network selection.

    To achieve this objective, the Femto Forum has developed a functional architecture that is shown below, withthe standard attributes that are defined for both the FAP (Femto Access Point) and the FGW (FemtoGateway).

    Figure 3. Femto reference architecture subject to change. Source: Femto ForumP1P.

    T1. Standards work ongoing in 3GPP initial Home Node B and evolved Home Node B standard R8 and R9

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    10/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 9

    TTThe Femto Access Points (FAP) would typically contain functionality:

    3GPP Signaling, User Plane, Radio Resource Management

    IP transport functions

    QoS management functions

    Layer-3 Security functions

    TR-069 Management functions

    Auto configuration

    Firewall functions

    NAT, Security

    The Femto Gateway (FGW) would typically contain functions like:

    3GPP RANAP

    Network timing delivery and synchronisation

    Femtocell authentication and authorisation

    AP Topology hiding

    Network topology hiding

    IP Security functions (IPsec tunnel management functions, IPsec tunnel IP address managementfunctions, etc.)

    Femtocell traffic aggregation and routing

    Auto configurationTPF1

    FPT

    Along with these definitions the need for full interoperability was identified between different vendorsdesigned Femto Access Points and Femto Gateways. There is still further work ongoing in the Femto Forumand within 3GPP to define architectures including an Iuh based architecture with Iucs and Iups towards theCN. To assist in guiding this work, there has been a detailed assessment of the Femtocell requirements thathave been put forward in 3GPP specification TS 22.001 and now also within the new work on TS22.220, anda number of further architecture requirements from the operators perspective have been defined. A detailedexplanation of this work can be found with the GSMA 3G Architecture Operator Deployment Guidelinesdocument.

    PT Note auto configuration functions enabled by Auto Configuration Server

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    11/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 10

    4.1 Conclusions and Further work

    Femtocells are intended for deployment in customers homes, the customer should be given a selection ofdifferent types of operator certified and configured access points from a selection of different vendors tochoose from. All of these should be suitable for connection into an Operators gateway. To obtain sufficientlylarge volumes to achieve economies of scale, standardised solutions and interoperability are seen as crucialto enable Femtocell success.

    Operators require that standardised protocols and interfaces are used between both the Femto Access Pointand the Femto Gateway, and between the Femto Gateway and the mobile network. No extra application

    servers should need to be introduced between access points and the networks.

    In the longer term and to the extent possible there should be full interoperability between FAP and FGW fromall vendors. This is required to achieve the economies of scale needed to exploit the full potential of theforeseen market for Femtocells and to create a sustainable business for the future.

    In order to achieve this, there is a need to continue the standardization activity which is partly completed andongoing as listed below :

    The interface(s) between Femto Gateway and Femto Access Point (known as Iuh in 3GPP Rel 8)

    Security protocols (ongoing Rel 9 work in 3GPP)

    UICC or TPM (trusted platform module) for device (FAP) authentication (Rel 9 work in 3GPP)

    Common discovery and parameters for auto configuration

    Management capabilities based on TR-069, and standard management objects

    Open test interface implemented in the Femto Gateway to ensure interoperability over the Fa (Iuh)secure interface

    Compliance with standards and a commitment to interoperability are important criteria when selecting vendorsolutions for use in networks.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    12/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 11

    Chapter 5

    Femtocell Management

    Radio aspects of the management of Femtocells are likely to be in common with the management ofconventional macro cells, however, due to their nature combined with the large number of Femtocells islikely to raise some new and additional issues.

    5.1 Subscriber premises deployment

    Femto Access Point will be implemented in subscribers homes and other uncontrolled environments.Therefore customers will be able to carry to some activities that will affect the performance of the Femtocelllayer without operator involvement and in an uncontrolled way. Such activities could include;

    Removing and re-applying power

    Moving the physical location of the Femto Access Point

    Disconnecting the DSL line

    Re-setting the Femto Access Point

    Loading the DSL link with other data applications

    Possibly other activities, including tampering with the. Femto Access Point

    5.2 Femtocell deployment scale

    Femtocells have the potential to be very widely deployed, for example it could be foreseen that over themedium term, larger networks may incorporate many millions of Femtocells, the Femtocell population couldrapidly overtake the population of conventional cells, perhaps by several orders of magnitude.

    5.3 Customer care

    Femtocell management may, in some cases, require the intervention of customers and there is a need toconsider customer care processes as part of the Femtocell management system.

    5.4 Integration with other home network systems

    It is expected in some applications, provision of FAP may be linked with DSL modem and other homenetwork devices as part of an overall customer proposition. In these cases, management of Femtocells mayneed to be integrated with the management of these other devices.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    13/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 12

    5.5 Femtocell management requi rements

    Operators will require the provision of management capabilities for Femtocells, consistent with themanagement systems used for conventional macrocells. It will be particularly important for operators toensure that they have secured certain management functions in order to comply with their local regulatoryobligations and to support any needed operational co-ordination between operators. The following list ofrequirements may be useful in establishing contracts with Femtocell suppliers.

    Inventory management (especially for retail based distribution to customers).

    Provisioning of Femtocell customer equipment for individual or groups of Femto Access Points.

    Allow the use of profiles to ensure easy provisioning of Femto Access Points.

    The ability to be able to identify individual Femto Access Points and to link the identity with a specificcustomer and location address.

    Activation / deactivation of Femtocell customer equipment. The ability to enable and disable theFemtocell radio transmissions, overriding any control that the customer may also have.

    Configuration management. The ability to configure the key radio parameters, such as transmitpower, frequency, etc. remotely. Note there may also be auto-configuration of these parameters, butoperators will have the option to manually override any settings.

    Fault management (monitoring, incidents and problem management).

    1. Alarms and reporting should be able to distinguish real faults from situations where users mayregularly turn off their FAP or Broadband connection.

    2. Location sensing and an ability to reconfigure or deactivate the Femto Access Point if its locationchanges.

    Change management, including the ability to provide remote software upgrade.

    Performance and capacity management.

    Service monitoring.

    Management of access control lists. It is expected that Femtocell subscribers will be able to add and

    remove the identities of end-users that are permitted to access the Femtocell. In addition, operatorsshall be able to pre-configure the list, make changes, and override the subscriber settings.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    14/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 13

    5.6 Conclusions and Recommendations

    A comprehensive management system will be a major factor in the success of Femtocell deployment. This isimportant in order to offer good quality of service to customers, and to avoid excessive costs of managingand supporting Femtocell solutions. Operators need the ability to monitor, control and update the FemtoAccess Point in a subscribers home. Many vendors are proposing solutions which use the existingBroadband Forum TR-069 specification to deal with remote management requirements. TR-069 is a robustand proven protocol suite which deals primarily with the requirements of DSL modems and theirconfiguration. The basic elements of the Broadband access of the Femto Access Point can be managed inthis way. However, TR-069 as specified is not sufficient to detail the radio and user configuration parameters,which will either require extension of the current standard or another method of configuration. At the momentBBF and FF are working on a common object model which will be referenced in 3GPP SA5 standard work.

    It is recommended that the industry should collaborate via the Femto Forum, Broadband Forum (formallyknown as the DSL Forum), 3GPP and the Open Mobile Alliance to guide and facilitate the development ofstandard management objects for a Femtocell management system.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    15/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 14

    Chapter 6

    Testing and Certification of Femtocells

    6.1 Testing

    To ensure a positive customer experience and general market acceptance, the Femtocells components(Femto Access Point, Femto Gateway) and any supporting capabilities in terminals must be available well in

    advance of the commercial launch of Femtocell services, To facilitate early delivery of Femtocells and ensureinteroperability with terminals the following key requirements are envisaged:

    Network operators, Femtocell vendors and terminal vendors shall agree common systemspecifications with relevant test equipment vendors, ideally through the appropriate industry bodies.

    Interworking tests (IWT) shall start early during development and debugging phase. Interoperabilitytesting (IOT), conformance testing and type approval are also required to be in place at an earlyenough stage to ensure timely availability of equipment.

    a. Interworking between Terminals and Femto Access Point

    b. Interworking between Femto Access Point and Femto Gateway

    c. Interworking between Femto Gateway and Core Network

    6.2 Certification

    A Femtocell Service Certification Regime will establish confidence in interoperability. This shall have thepurpose of ensuring implementation as well as making the time-to-market as short and as cost efficient aspossible. It is expected that established industry bodies such as the Global Certification Forum (GCF) andthe Femto Forum shall be used.

    The Femtocell Service Certification Regime should cover the following key building blocks of test areas:

    1. Regulatory requirements

    2. RF characteristics

    3. Interoperability and conformance testing on protocol level (layers 1, 2, 3)

    4. Conformance testing on protocol level (layers 1, 2, 3) against validated test equipment where IOTagainst actual Femtocell access point is not possible.

    5. Field testing in live networks

    6. Testing of service quality for the key services offered by Femtocell Access Point systems

    7. Registration

    8. Security audits

    9. Femto Access Point management

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    16/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 15

    The Femtocell Certification activity is split into two separate areas:

    1. Certification of terminals supporting Femtocell services, where existing certification bodies areexpected to continue to deal worth terminal certification.

    2. Certification of Femto Access Points and Femto Gateway, which will require new processes and mayrequire a new certification forum or significant changes to existing terminal certification.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    17/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 16

    Chapter 7

    Femtocell and Network Security

    This section provides a summary of the key security issues identified and related recommendations from theGSMA.

    7.1 Operator Control of access point international location

    As Femtocells operate in licensed radio spectrum there is the need for operators to control the location inwhich they are operating. This control is required because it must be possible for an operator to identify if anaccess point is operating in a country or frequency range outside of their licence. The Femtocellmanagement system should be capable of shutting down or preventing initialisation of an access point if thelocation cannot be established. This requires a connection to the management system during device power-up and then regular location verifications during device operation.

    Technique Granularity Achieved

    AGPS Accurate to

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    18/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 17

    7.2 Femtocell Management

    Specific implementation vulnerabilities may be found in Femtocell products that may require operators toremotely patch a large number of Femto Access Points in the field. Several security vulnerabilities in Wi-Fiaccess points have previously been discovered and it is likely that Femtocell products will also need to beremotely patched on a regular basis for security and performance issues.

    7.3 Femtocell Device Authenti cation

    The use of UICC as proposed in a 3GPP SA3 TR is one option to support device authentication but thisapproach may not be the preferred option. The implementation of an appropriate mechanism to pair theUICC and the FAP would facilitate the authentication of a FAP with a secure token such as a UICC card.Secure pairing requires a secure channel to be established between the Femto Access Point and the UICC.An example implementation is described in ETSI TS 102 484.

    A robust pairing mechanism, that is not susceptible to the type of security compromise that has beenevidenced with SIM lock mechanisms in mobile handsets, could be used to bind the UICC to the FAP. Sucha mechanism would mitigate, if not counter, the risk of the valid authentication token being used in otherunauthorised devices. This would prevent unauthorised devices that are equipped with UICC readers fromobtaining access to the operator IP network.

    More information are available in TR 33.820 where a Trusted Platform Module is mandatory and UICC for

    hosting party authentication is optional to be used and deployed within a FAP.

    7.4 Authorisation

    In a typical consumer offering a Femto Access Point will be purchased from a retail outlet including phoneand computer resellers. The access point will need to be configured with network and user parameters and inall cases any access point must be authorised by the network Operator prior to bringing it into service.

    7.5 Algorithm Licensing

    It is very likely that Femto Access Points will be attacked to allow eavesdropping and unauthorised access.

    Therefore it is essential that access point manufactures ensure that current up to date GSM and UMTSalgorithms are implemented on their equipment.

    7.6 Export Control of Femtocell Access Point

    Due to the operation of Femtocells in licensed spectrum it is essential that the export of Femto Access Pointsis controlled. Without this there are risks of uncontrolled and unwanted operation in areas that are outside ofoperators licensed radio frequencies and therefore interference issues will occur. Ensuring full compliancewith appropriate regulations is the responsibility of individual Femtocell equipment suppliers.

    7.7 Lawful Interception

    Lawful Intercept requirements are not impacted by the introduction of Femtocells. It is recommended thatFemtocell solutions shall support all the current requirements on the macrocell network.

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    19/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 18

    The accuracy of location data for the purposes of lawful interception, and emergency calls, must satisfy localregulatory requirements. The use of a reliable and tamper proof GPS function within the Femto Access Pointshould be considered, if this is the chosen solution.

    7.8 Anti-Fraud protect ion

    The strength of security countermeasures should be appropriate for particular Femto Access Pointdeployments. It is believed that some Femtocell applications may override, or conflict with, some of the

    security mechanisms already inherent in mobile technologies. In particular, there is a concern that Femtocellmobility management procedures may negatively impact the Temporary IMSI (TMSI) feature used, insteadrequiring that the IMSI is requested and transmitted in the clear.

    The GSMA recommends that the secure interfaces are used between the Femto Access Point and mobilenetwork to provide physical and logical security of the Femto Access Points sensitive data to ensure it neverleaves the protected domain within the Femto Access Point. It is also recommended that only TMSIs areused over the air.

    In addition to attacks against deployed Femto Access Points, it is important to remember how the equipmentitself could potentially be used for illegal purposes. It is important that Femtocell equipment is only suppliedto reputable buyers as failure to do so opens up the possibility of Femto Access Points being used to supportillegal call selling and traffic routing activities, avoidance of lawful interception, use as a false base station tolaunch man-in-the-middle attacks, etc.

    7.9 Network and Backhaul Security

    The connection mechanism for Femto Access Points is via the public internet and DSL links, resulting in anumber of new security issues. These issues range from defending against eavesdropping of calls to a userinjecting of malicious traffic into the backhaul network. Any security solution should also efficiently handlemultiple simultaneous calls over the backhaul. The most significant threat exists on the last few metres to theFemto Access Point, which are usually based on Ethernet. Further backhaul over WAN is of secondaryimportance.

    In order to mitigate these concerns GSMA recommends that Femto Access Point traffic except local IP - andInternet breakout traffic) should be secured using IPSEC VPN over xDSL backhaul (however, it is noted

    other candidate security solutions exist including SRTP), with all traffic being secured cryptographicallyincluding the User and Control plane traffic.

    Protection of Control Plane and Management Plane are likely to be required by regulations pertaining in mostcountries. The same could be true for the User Plane but, even in countries where User Plane privacy is notrequired and subsequent encryption not deployed, the risk of eavesdropping locally on the last metres of anyEthernet connection to user provided DSL routers or backhaul must be carefully assessed by the operator.

    7.10 Femtocell Access Point Security/Authentication

    A major threat to the roll out of Femtocells is the development and use of cloned or unauthorised equipment.

    Protection should be provided against non authorised access points connecting to the network. The use ofstolen and unapproved access points should be addressed by device authentication described in a previousrecommendation

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    20/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 19

    Chapter 8

    Femtocell Terminology

    The table below defines some of the new definitions and terminology that will be used when entering into thefield of Femtocells and their deployment. The definitions have been defined by the Femto Forum and withinfor the GSMA Femtocells project. The GSMA support all of these definitions, and believe that they should thestandard terms used in discussion that relate to Femtocell technology.

    Access Control Mechanism for restricting access to a particular FAP to a specific list of Femto users.

    Access Control Lis t List of Femto users with access right to a particular FAP.

    Local (PS) Breakout Mechanism by which a FAP user's packet data traffic, after the FAP user has completedregistration and authentication, is routed to the FAP subscribers local intranet or the backhaulbroadband network providers local network/Internet, instead of being routed via the femto serviceprovider's femto core network.

    Closed Access A Femtocell deployment model where only a defined set of Femto Users can access the FAP.

    Closed SubscriberGroup

    A feature of femtocells that allows access to a Femtozone to be restricted to a particularset of Femto users. This could be members of a household and guests in a residential context,or employees in a corporate environment.

    Enterprise FAP(Enterprise Femto)

    A FAP optimized for corporate environments.

    Still self-install and low power (

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    21/22

    GSMA Femtocells Project

    GSMA 2008 All rights reserved 20

    Femto Access Point(FAP)

    Customer-premises equipment that connects a mobile device over licensed spectrum wireless airinterface (such as 3G and/or 4G) to a mobile operators network using broadband IP backhaul.

    Defining characteristics include: limited number of users (typically four); self-install (zero-touch);low RF power (usually

  • 7/28/2019 Femtocell White Paper 09-01-26v1

    22/22

    GSMA Femtocells Project

    Picocells Mainly indoor cells, with a radius typically less than 100 metres (source: 3GPP 21.905.v8.0.0 or3GPP2 XXX).

    Historically defined within conventional network architecture (Eg Abis over dedicated backhaulconnection) and require specific, manual installation & frequency planning.

    Increasingly, a high-capacity system with higher RF power (e.g. 23dBm), using broadbandbackhaul with and more simultaneous calls e.g. 16 or more, than an FAP or Enterprise Femto.

    This will typically have additional sophisticated functionality eg soft-handoff or support for FemtoCluster. It may still require operator installation.

    Registration This is the process of camping on a femtozone and doing any necessaryLocation Registrations (LR).

    Registration Area An area covered by one or many FAPs governed by an administrative domain,such as, an enterprise or a femto network operator.

    Security Gateway(SeGW) Or FemtoSecurity Gateway(F-SeGW)

    A device establishing secure credentials for FAP and terminals before allowing them to accessservices from core network (CN). In addition, SeGW helps establish Security Association (SA)between FAPs, terminals and core network elements. SeGW may be integrated with FGW orcould be a standalone device sitting between FAP and FGW.

    Super Femto A high-capacity FAP which is typically deployed in an open access environment. This is still self-install and low power (