OpenBTS and the Future of Cellular Networks

Overview
Range Networks is a new breed of Network Equipment Provider. It is meeting the demand for low cost, easy to install GSM cellular networks for remote rural service, rapid deployment and private industrial networks on ships, oil rigs or in mines.

The Range Networks Approach

The defining feature of Range Networks systems is the replacement the conventional 2G/3G network's SS7-MAP structure1and all of its various components (MSCs, BSCs, TRAUs, SGSNs, etc.) with a more modern SIP network, but without any changes to the handsets. This approach offers the following advantages: much lower deployment costs (CAPEX), especially for small operators much lower operating costs (OPEX), for carriers of all sizes plug-in compatibility with existing SIP-based core networks plug-in compatibility with future IMS core networks

1 Signaling System #7 is a protocol that has dominated telephone system core networks since the 1980's. It is the

basis for ISDN and Intelligent Network technologies. The Mobile Application Part (MAP) is an extension added to SS7 in the 1990's to support functions required by cellular networks.

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com

The key ingredient that makes this change possible is OpenBTS, a software defined radio implementation of the GSM radio access network that presents normal GSM handsets as virtual SIP endpoints. In other words, through OpenBTS, any GSM handset appears as a SIP device, without the need for any special software on the phone. Significant cost savings from this approach are due to several factors: For small networks, the core network hardware can be reduced to a single commodity server, or core network applications can even be run on excess resources in the base stations themselves. For larger networks, the core network hardware is based on commodity servers and IP routing equipment. Because all of the cellular network software runs on Linux and connects with commonly used TCP/IP and UDP/IP protocols, the core network can even be virtualized and run in a ``cloud'' service, like Amazon's EC2. All of the proprietary software found in a conventional GSM network can replaced with opensource applications like Apache, SIP Express Router and MySQL, eliminating recurring licensing fees.

Because the new core network is based on IETF internet-age protocols, newly graduated engineers and software developers do not require additional training to deal with archaic SS7 technologies.

Beyond cost savings, the conversion of the network from legacy telco protocols to internet protocols gives the operator new opportunities to implement custom speech, text and USSD applications, using web service technologies like Apache and Ruby, or through cloud-based application platforms like Tropo or Twillio. These applications can even be installed in individual cell sites to provide locally-tailored service.

Components of a Full Scale OpenBTS Network

The figure on the next page shows a full-scale OpenBTS network with complete integration into the internet, PSTN and legacy PLMN. Not all components are necessary for all deployments. In small deployments, all of these components can be run inside one of the OpenBTS units to give a complete ``network in a box''.

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com

Internet Gateway

IP

public IP network

SIP IP SIP/IAX/IP SIP/IAX

private IP network

Gateway Switch SIP-I/SS7 SQL SIP

PSTN

Um SIP/IAX/IP SIP

Subscriber Registry SQL

SIP-I/SS7

DIAMETER SS7-MAP

OpenBTS

Messaging Server

SMPP SS7-MAP

PLMN

In this diagram, the outside networks are: Public Switched Telephone Network (PSTN) This is the conventional global wireline telephone network, based on SS7. Connections to this network are required to place and receive telephone calls. Public Land-Mobile Network (PLMN) This is the conventional global cellular network. The PLMN is similar to the PSTN, but includes features to support handset mobility (the ``MAP''). Connections to this network are required to support cellular roaming Public IP network This is the internet. This includes private, managed, bi-lateral connections between operators using Internet technology. Connections to this network are required to support data services like web browsing and email. Connections to this network can also be used to route telephone calls and text messaging to outside gateway operators with their own connections to the PSTN and PLMN.

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com

The BTS Units

The subscriber radio interface of each BTS unit is the GSM ``Um'' interface2. This is the radio interface used by the cellular handsets and the same interface presented by conventional 2G and 2.5G networks. On its network interface, the BTS unit uses SIP/RTP or IAX for call signaling and SIP for mobility management and SMS. (The advantage of IAX over SIP/RTP is the ability to ``trunk'' vocoder frames from multiple calls into a single UDP packet, thus reducing per-packet network overhead.) Each BTS unit includes a local SIP switch for local call connection and to support trunking between cell sites and the core network.

Subscriber Registry (SR)

The SR is the network's SIP registry, like a conventional SIP registry, but augmented to support mobility and authentication functions associated with GSM. The SR is essentially a database server with an interface for processing SIP REGISTER methods and, optionally, SS7-MAP and/or DIAMETER interfaces into the PLMN (for roaming support). OpenBTS units communicate with the SR via SIP. Other network elements access the SR directly with SQL. Pieces of the SR are also cached locally in the BTS units to reduce network traffic and to allow the BTS units to switch calls locally in the event of a backhaul failure.

Gateway Switch (GS)

The GS is a gateway device used to originate and terminate PSTN/PLMN calls. It can also be used as a central switch for inter-BTS calls. The GS communicates with OpenBTS units using SIP/RTP or IAX and communicates with outside networks using SIP, SIP-I or SS7-TCAP as required. The GS is implemented using an existing SIP switch with an ISDN/SS7 gateway function3 Some networks might contain multiple GS units, for added capacity, for redundancy or to provide special-case support for legally-required services like emergency calls or lawful intercept.

Messaging Server (MS)

The MS serves the same role as the SMSC in a GSM network. It has no equivalent in most VoIP networks. The MS communicates with OpenBTS using SIP/SIMPLE and communicates with conventional SMSCs using SS7-MAP or SMPP. Other internet messaging protocols, like XMPP, can also be supported. Like the SR, the MS is essentially a database server wrapped with a set of protocol interfaces.

Internet Gateway
The purpose of the internet gateway is to bind IP addresses to GPRS data sessions on the handsets. Its function is the same as that of a GGSN, but it is implemented using much simpler Linux IP routing features.

2 3

Named after the ``U'' interface of ISDN, on which GSM is modeled Examples of such products include Asterisk, FreeSWITCH, yate and Cisco 5400 series gateways.}

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com

Network Integration
Connecting to the PSTN
Integration into the PSTN is the same as for any VoIP network via an SS7 or ISDN gateway function in the GS. For small carriers, this service can be purchased from a commercial VoIP carrier, in which case the GS is just a SIP switch.

Connecting to the Legacy PLMN (SMS and Roaming Support)

Integration into the PLMN is similar to integration into the PSTN, but with the addition of the mobile application part (MAP) in the SS7 interface on the GS. With this interface, the OpenBTS network appears as a conventional roaming partner to other cellular carriers.

Connecting to 4G IMS Networks

Because OpenBTS is SIP-based, it is a natural fit into next-generation IMS core networks. A SR is required to translate between 2G SIM and 3G/4G USIM authentication procedures, but speech and SMS transactions are performed directly with the IMS servers. This compatibility allows network operators to operate Range Networks 2G (and future 3G) cell sites in the same core network as their 4G LTE equipment. This mixed-mode operation allows operators to abandon their legacy 2G/3G core networks (and associated licensing and maintenance OPEX) while still running 2G and 3G RANs in those areas where 4G service is not economically justified.

Small Networks and Rapid Deployment

Because OpenBTS allows GSM handsets to be used directly with Asterisk, a SIP PBX that is reasonably easy to configure and operate, it can provide network-in-a-box solutions that are much less complex and much more user-friendly than solutions based on more conventional cellular technology. In these deployments, PSTN speech calling can be provided through nearly any SIP-based VoIP carrier, or combined speech and SMS service is available through Voxeo's Tropo application servers. Range Networks can provide preconfigured accounts and preprogrammed SIMs to simplify the use of these services.

Satellite-Backed Small Sites

For sites backhauled by satellite, operators can achieve considerable bandwidth savings through ``trunking'', in which audio channels are combined to reduce per-packet overhead in the UDP/IP link. This trunking can be combined with low-rate speech codecs to achieve additional bandwidth savings. Additionally, OpenBTS consumes little/ no bandwidth when calls are inactive (traditional BTSs consumer 20+ kbps in idle mode). Range Networks can provide products, services and expertise to configure and operate these trunks and interface them to VoIP services.

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com

Mixed 2G/3G/4G Networks

Range Networks supports 2.5G today and will soon support 3G UMTS, 4G LTE (E-UTRA) and 2.75G (EDGE). Although these technologies have very different air interfaces, in their Range Networks realizations, the core network is always the same. This means that a greenfield carrier can start with a simple 2G network and over time develop a mixed 2G-3G-4G system, using whatever technology is best adapted to particular sites. Core network upgrades are just capacity upgrades, replacing existing servers with more or faster processors as the traffic volume increases, or incremental upgrades to provide new features, like MMS, as the become available.

Published by Range Networks. Content may not be repurposed or reproduced without the express permission of Range Networks. April 2012

www.rangenetworks.com