SDR based LTE Femtocells with Cognition By: Kunal Rele

Executive Summary

Keywords: LTE, Femtocell, Cognition, QoS, SDR, Power control, DSA

Femtocells are cellular access points that connect to a mobile operator’s network using residential DSL or cable broadband connections. Femtocells are regarded as the solution for increasing coverage and capacity to deal with the problem of data explosion. Also, 70% of the mobile traffic originates indoors where the cellular signals are attenuated upto 20 dB. Wi-Fi vs. Femtocells as a business model is an interesting study. Femtocell model has advantages like connectivity to all mobile devices, operator managed QoS instead of Best effort, Seamless connectivity with macrocells, better battery life, ease of configuration and use. Femtocell also bring along the problem of multitier coexistence. The Macrocell NodeB (MNB) and Femtocell/Home NodeB (HNB) need to coexist with each other. Neighboring HNB’s, e.g. in neighboring apartments need to coexist with each other. Also, there is an issue of closed HNB, which allows only a limited set of users creating a Dead-spot for others. This is an ideal case for cognitive radio schemes implementation during the initial Femtocell startup stage when the system can allow a finite delay. Initial LTE deployments might go through the 2.5-3G frequency (850/900 MHz and 2100 MHz) re-farming. To identify the frequency and bandwidth used by the MNB, we decode the broadcast channel of MNB and refer to a central database. This allows identification of the frequency reuse pattern and avoiding the MNB’s. LTE signal detection can identify the neighboring Femtocells and avoid the channels used by them. Also, in an urban setting, due to large number of HNB’s, some HNB’s might not find a vacant channel. In this case, it might need to do intricate power control to control the footprint of transmission. It will need to work along with the selection of different modulation-coding schemes to maintain the promised QoS, which is critical in LTE. SDR’s are very useful in these settings. It’s also useful because, once femtocells are deployed in mass volumes, remote software upgradeability will be vital to address operators' architectural evolution in a cost-effective manner.

Table of Content

I. Introduction A. Business model for LTE Femtocell B. Competition with disruptive technology “Wi-Fi” II. Statement of problem A. Co-existence with MNB’s and HNB’s in a non-congested (Spectrum) environment (Case for DSA based Cognition) B. C o-existence with MNB’s and HNB’s in a congested (Spectrum) environment (Case for parameter Optimization based cognition) C. Re-configurability (Case for Software Defined Radio (SDR)) III. Case for DSA based cognition IV. Case for Parameter optimization based cognition V. Case for Software Defined Radio A. Secure updates of PHY layer waveform and other IP’s (Intellectual Properties) B. Tunable RF Front End VI. Conclusion References

I. Introduction

Fig. 1 Femtocell based cellular architecture A. Business model for LTE Femtocell 

By 2014, its estimated that 1.6 EB of mobile data will be sent and received each month



US-based operators estimate that Smartphone’s use 10-60 times more data than other 3G feature phones



Network enhancements are allowing high data rates and low latency



70-80 percent of mobile data is generated indoors, where macro cells penetration is low by as much as 20 dB.

B. Competition with disruptive technology “Wi-Fi” 1. Wi-Fi over Femtocell a. Large installed base b. Low cost c. Operator independence

d. To make calls or SMS, providers SIP or Unlicensed Mobile Access (Needs a UMA client in the handset is required. Skype can be used too. 2. Femtocell over Wi-Fi a. Support all Phones. (No need for Wi-Fi AND cellular modem) b. Operator Managed services for enhanced QoS, not just Best effort c. Seamless connectivity with Macro cells d. Better Battery life (Handset that had both 3G and Wi-Fi modem ON will drain more power) e. Ease of configuration and use f. Higher security g. Good for critical comm.: Number of types of interference sources less (ISM band for Wi-Fi) h. Content delivery services like applications, games and videos easier to deliver and generates revenues since billing system and format in place.

II. Statement of problem A. Co-existence with MNB’s and HNB’s in a non-congested (Spectrum) environment (Case for DSA based Cognition)

Fig. 2 Multi-tier Femtocell based cellular network 

As seen from the figure above, the Femtocell need to autonomously know the channels used by the MNB’s transmitting in that area and avoid them



Autonomously know the channels used by the neighboring Femtocell’s transmitting in that area and avoid them

B. Co-existence with MNB’s and HNB’s in a congested (Spectrum) environment (Case for parameter Optimization based cognition)

Fig. 3 Co-Channel interference  Impact on MNB’s range and capacity  Interfering MNB-UE near a Femtocell

 Femtocell range limited by MNB  Femtocell service limited by HNB  Femtocell blocked by neighboring Femtocell C. Re-configurability (Case for Software Defined Radio (SDR))  Once femtocells are deployed in mass volumes, remote software upgradeability will be vital to address operators' architectural evolution in a cost-effective manner.  Tunable RF Frequency instead of multiband to cover multiple bands allocated to different providers or standards (UMTS - 2100 MHz and for the lower 850/900 MHz). 

Reconfigurable FPGA for modulation-coding and other parameter optimization

III. Case for DSA based cognition We can avoid interference by carefully controlling transmission power. But, this method cannot guarantee interference-free operation since the femtocell must also provide complete coverage in the user’s home. If the user places the femtocell too close to an outside wall or window, it may not be able to give full coverage while avoiding leakage to a neighbor at the same time. LTE is most likely to be deployed in the GSM band during transition to 4G systems which will be carried out via re-farming of the frequency.

Fig. 4 LTE deployment by 2.5-3G frequency re-farming There are two stages in this Dynamic Spectrum access technique. One is to identify the MNB frequency usage plan and second is to detect and avoid frequencies used by neighboring femtocells. 1. In order to retrieve the frequency planning information, the HNB can decode the MNB’s identity over the air after locking onto the broadcast control channel carrier available in the downlink. It can then use the decoded information to interrogate an operator-specific database through its Internet backhaul and obtain the frequencies and transmission bandwidth allowed for use by LTE femtocells 2. Since a HNB serves only a few home-based users within a very short transmission range, the channel bandwidth is likely to be the smallest possible LTE bandwidth, 1.4 MHz. The key feature that makes the sensing method reliable is the LTE-specific control and synchronization signaling which typically occupies 72 subcarriers i.e. all available subcarriers in 1.4MHz, around the DC carrier. For instance, regardless of TDD or FDD mode, corresponding subcarriers of some OFDM symbols in particular downlink subframes are always allocated, even with no user activity.

Fig. 5 Averaged PSD – Bandwidth power level threshold – Signature slope of LTE The sensing method: 1. The PSD estimate is obtained by computing the square magnitudes of the instantaneous FFT, and averaging over a given time period. This period can be relatively long, since accuracy is more important than speed during Setup. 2. If the LTE signal is present, it is expected that the width of the area above the threshold is around 50–70% of the full LTE signal bandwidth. 3. With an LTE signal present and in the absence of noise, the slopes of the triangle in the windowed spectrum are known.

IV. Case for Parameter optimization based cognition

Fig. 6 Femtocell aided cellular network architechture ‐

When the macrocell and femtocell network utilize the same frequency band, mostly in urban environment, when free channels are exhausted, then the femtocell can create interference with the macrocell, thereby degrading network capacity and quality of service.

‐

In multi-dwelling units such as condominiums and apartments, multiple femtocells can interfere not only with the macrocell network, but also with each other.

Without interference management, there are five potential negative impacts: 1. The desired femtocell signal may be too weak to overcome the unwanted MNB signal, rendering the femtocell’s coverage area too small. o In this case the there is a tradeoff between decreased benefits of the Femtocell plans (Since smaller portion of traffic is handled by the Femtocell) but excellent coverage and capacity. 2. The unwanted femtocell signal may be too strong, relative to the desired macrocell signal, causing users near its centre to lose touch with the macro network and enter a socalled “deadzone”, where, if they are not authorised to use the femtocell, they can’t access the macro network either.

Fig. 7 Dead zones due to closed Femtocells o To address this concern, the femtocell’s maximum transmit power must be set correctly in order to provide a good trade-off between femtocell coverage and deadzone size. The femtocell should adjust its maximum transmit power according to the local RF environment, in order to maintain femtocell coverage while minimizing deadzones. If the resulting deadzones are minimized but not eliminated, macro-UEs will hand over to other macro frequencies, dropping calls only if no other signal is available. 3. The unwanted signal from a femto-connected handset may be too strong, relative to the desired signal from a distant macro-connected handset as received by MNB. This is the so-called “noiserise” phenomenon. The noise (or interference) level experienced by the macro basestation receiver rises, causing the handset link power control algorithms to excessively increase their power to compensate. o For this scenario, the study showed that there is the potential for a small net reduction in capacity of the macro network caused by the presence of femtocells. However, this is more than compensated by the overall increase in capacity provided by the femtocells themselves. 4. The unwanted signal from a macro-connected handset at a great distance from the macrocell but close to the femtocell could potentially drown out the weaker desired signal from the femto-connected handset. This is the so-called “uplink jammer” scenario, which the femtocell designs must address. o The femtocell receiver design must accommodate the potential of a strong uplink jamming signal from the macrocell UE in close proximity by adapting the uplink gain setting. Power control of the desired femtocell UE by the femtocell automatically compensates for the adjusted uplink gain setting of the femtocell.

5. When multiple femtocells have been installed in close proximity – for example, in an apartment block – a femto-UE camped on one femtocell may be affected by a femto-UE camped on a neighbour femtocell. o A key conclusion is that the femto coverage should be restricted to a single apartment. Femtocell downlink power management helps to ensure that this is achieved. Neighbour femto-UEs would then see the macro layer as the best cell they have access to, and so handover to it. As can be observed from the analysis of scenarios, the co-existence mechanisms require multiple objectives to be accomplished like femtocell downlink power management (to find a trade of between interfering and having adequate coverage), control of receiver gain (to take cake of near far problem), UE uplink power management (to avoid raising the noise floor). This in turn would affect other parameters like the modulation-coding to be used, which in turn affects the BER and ultimately the QoS, which is prime for LTE bearer’s. It has been shown previously that cognition through genetic algorithms can be used to optimize the radio parameters by sensing the environment. Interference mitigation techniques can enable very high capacity networks by providing between a 10 and 100 times increase in capacity with minimal deadzone impact and acceptable noise rise

V. Case for Software Defined Radio

Fig. 8 Femtocell interface with the core Once femtocells are deployed in mass volumes, remote software upgradeability will be vital to address operators' architectural evolution in a cost-effective manner. For each femtocell deployment network architecture the software architecture inside the femtocell is different. To this end, femtocell developers are working to ensure that femtocell CPE can be easily and securely configured, diagnosed, and managed remotely. A. Secure updates of PHY layer waveform and other IP’s (Intellectual Properties) a. Parties involved In cellular systems nowadays dongle are being used for pure broadband services like WiMax and LTE. In this case the parties involved are, {HW_M, SP, HW} That is, it involves, hardware manufacturer, Service Provider and the Hardware itself. The new waveforms are stored in the SP Core network. To identify this initial storage we will denote it by the name ST. When the HW detects the availability of new version or is communicated by the SP via automatic update protocols, the update mechanism is initiated. b.

Enrolment

The waveforms are identified by its type and version as well as hardware device compatibility. {W#} Similarly the hardware is identified by manufacturer and type.

{HW#} The waveforms will be attested and stored at the ST along with its identity, W#. Similarly, the HW# will be attested and stored at the ST. c. Secure Update of the waveform Updates of PHY layer waveform is a property of SDR systems that allows rapid developments and implementation of standards along with its continuous improvement. It also helps in fixing bugs in the waveform code and making them more efficient with respect to time and power consumption. An analogy to current systems can be the operating system firmware updates that we receive continuously via internet. But like the issues with these updates, the SDR updates can be manipulated to tweak the performance of the system. It can either harm the system by introducing malicious code or create a monopoly in the network system that would harm other systems. A case of such a manipulation can be increasing the bandwidth of the modulation, in case of OFDMA by increasing the number of subcarriers. Filtering can be eliminated from the signal processing path to decrease the power consumption for the processing but create inter channel interference to other radios. In similar ways different software based signal processing blocks can be tweaked to create adverse effect. This manipulated software’s can be downloaded from online databases very easily. Hence, there is a need to check the integrity of the waveform as well as the need to verify the update provider. Update request: Sign_HW#{W#, nonce} Update: Enc_HW#[Sign_UP#{hash(Waveform), Waveform, length, nonce}] The update request identifies the waveform and also contains a nonce which is just a random number used to prevent replay attacks. The message is signed by private key of the hardware which helps in authenticating the update. The update itself contains the waveform code itself, length, nonce and the hash of the waveform code. Hash is a mathematical function that converts a varied sized data, in our case the waveform code into fixed sized identifier. It’s a one way function and can be assumed unique for our application because collisions are rare. This builds integrity into the system. The complete update can be signed by a private key of the update provider. This provide the authentication of the update provider as the private key for the provider is unique and can be decrypted by only the

public key which the radios can get from certificate lookup authorities. The complete update is encrypted by the public of the receiver.

Fig. Waveform Attestation The general architecture for the loading of the waveforms is shown in the above figure. The waveforms are written from a waveform cache which stores all the recently used waveform in it so that the loading of the waveform on the fly is fast. The waveforms from the updates are stored in a waveform library. These waveforms can comprise of different types of modulations, encoding, filtering etc. When the waveform is written on the FPGA or a section of the code is executed on a processor, or during the boot up phase of the radio the code is tapped. The tapped code undergoes a hash algorithm which is compared against the hash from the secure update. The matching confirms that the code is not manipulated. If the waveform code is manipulated or corrupted, the current update is deleted and a new update is triggered. If this continues twice then the security module gives an error, after which the radio needs to be recertified by the manufacturer or the appropriate authorities. Reconfiguration time of partial reconfiguration in FPGA’s is much smaller (~4-5 ms) than full reconfiguration (~12 ms) B. Tunable RF Front End Tunable RF Frequency instead of multi-band receiver to cover multiple bands allocated to different providers or standards (UMTS - 2100 MHz and for the lower 850/900 MHz). RF Chips – Low cast/power : ‐

Reconfigurable multi-standard MicroTCA wireless transceiver system o Continuous range between 345MHz - 4GHz

o The chip combines LNA, PA driver, Rx/Tx mixer, Rx/Tx filters, synthesisers, Rx gain control, and Tx power control with a minimum requirement for external components o The zero-IF transceiver chip can handle OFDM modulation up to 64QAM, and supports both FDD and TDD full duplex, with a sensitivity of -70dBm at 7MHz bandwidth under 64QAM. Operating current is typically 300mA under FDD operation at 1.8 V and 3.3V, with a standby current of less than 1mA with powerdown modes being software-selectable. Modulated Tx RF output is -10dBm. o It has 6 user-selectable channel bandwidths from 1.5MHz to 28MHz and can be digitally configured to operate in bands from 345MHz to 4GHz. The reconfigurable design supports a variety of network configurations – WCDMA/HSPA, WiMAX and LTE

VI. Conclusion Due to the data explosion there is a need for its offloading as well as due to the attenuation of signal indoor there is a need to indoor nodeB’s. Femtocell is the answer to increase the coverage and the capacity. Wi-Fi falls short of Femtocell because Femtocell can deliver operator plan specific QoS, better battery life, ease of configuration. Due to the challenges of making Femtocells autonomous and easily configurable it brings up the question of multi-tier co-existence. This is an ideal application for Dynamic Spectrum Access. Also in the case of free channel exhaustion, intricate power control needs to be done to control the Femtocell footprint as well as dynamically adapt the receiver gain. This is the case for parameter optimization based cognition. Also, as large numbers of Femtocells get deployed, their PHY layer, logical and control plane needs to be upgraded remotely. It’s also desirable to have multiband capabilities as well as keeping the cost low. Software Defined Radio is a solution that incorporates these requirements. Security is important as the PHY layer and other IP’s needs to be protected against cloning and modification. Hence the discussed, secure remote update mechanism is required.

References [1] Femto Forum's white paper, "Wireless in the home: the need for both 3G femtocells & Wi-Fi access points" [2] “Test your Femtocells Today”, Online: http://cp.literature.agilent.com/litweb/pdf/59903426EN.pdf [3] Assaad Borjak, Danny Webster, Srdjan Milenkovic, “Basestation works for WiMAX, WCDMA and LTE”, Lime Microsystems [4] Manish Singh, “Top ten challenges to Femtocell deployment”, Continuous Computing [5] Femto Forum's white paper, “Femto Forum Summary Report: Interference Management in UMTS Femtocells” [6] J Lotze, SA Fahmy, B Özgül, J Noguera, L Doyle, “Spectrum Sensing On LTE Femtocells for GSM Spectrum Re-Farming using Xilinx FPGAs” [7] E. Simpson, P. Schaumont, "Offline Hardware/Software Authentication for Reconfigurable Platforms," Workshop on Cryptographic Hardware and Embedded Systems 2006 (CHES 06), Yokohama, Japan, October 2006