SmartCell Architecture
The Proven Recipe for Carrier-Class Wi-Fi Deployments

Standards-Based Integration:

Standards for carrier-class Wi-Fi RANs are being driven by several different industry organizations including 3GPP, which has also been very involved in Wi-Fi cellular integration and the Wi-Fi Alliance (WFA), which has been focused on roaming.

Hotspot 2.0 and Wi-Fi Roaming

The successful integration of Wi-Fi RANs into mobile Internet experience requires that the connection process be as easy to use and secure as with cellular. The Wi-Fi Alliance is driving an initiative called Hotspot 2.0 to address this challenge. RUCKUS has been a leader in the HS2.0 work in the WFA, and it's an essential part of RUCKUS's SmartCell Architecture.

The first release of HS2.0 provides support for automatic network discovery and selection along with automatic authentication (aka roaming). In this process, a HS2.0 enabled mobile device can have a dialog (pre-association) with a HS2.0 enabled AP for the purpose of discovering its capabilities, the most important of which include:

• The domain name of the network operator that is proving that AP. If it is the same as the user's home network then the user can move straight to authentication. No roaming required.
• If it is different, then the mobile device needs to discover the roaming relationships that are supported by that AP.
• Other capabilities that can be discovered include backhaul bandwidth, loading on the backhaul, name of the AP operator, authentication method, etc.

Once an AP has been selected, the mobile device will automatically connect to the network using 802.1x with EAP (extensible authentication protocol). There are many EAP methods of which the following are required for HS2.0 compatibility:

• If a mobile device has a Subscriber Identity Module (SIM), then EAP-SIM as defined in RFC-4186
• If a mobile device has a UMTS Subscriber Identity Module (USIM), then EAP-Authentication and Key Agreement (AKA) as defined in RFC-4187. EAP-AKA' (RFC-5448) will be required in HS2.0 Release 2
• All mobile device must support EAP-Transport Layer Security (TLS) as defined in RFC-5216 and which uses an X.509 digital certificate
• All mobile device must support EAP-Tunneled Transport Layer Security (TTLS) as defined in RFC-5281) and which uses username and password, with a server side certificate

Mobile devices will use their existing mobile credentials when they are being authenticated back to the HLR/HSS in the H-PLMN (home network). Hotspot 2.0 also specifies that the Wi-Fi airlink be encrypted using 802.11i. This addresses a security vulnerability with captive portal based authentication, which does not encrypt the airlink. 802.1x/EAP and 802.11i are both part of the Wi-Fi Alliance's WPA2-enterprise certification, which is standard on today's smartphones.

All RUCKUS AP's and controllers are Hotspot 2.0 capable and any RUCKUS 802.11n AP in the field can be upgraded to support HS2.0. HS2.0 capable smartphones from many of the major device vendors are poised to begin shipping in early 2013. And with the industry expected to ship 800 million smartphones this year, it will not take long for the technology to sweep through the industry. The actual HS2.0 equipment certification program in the Wi-Fi Alliance is called Passpoint.

Enabling seamless roaming

We show a user in a visited network having their authentication request proxied back to the home network. The visited network could be an MNO, MSO, enterprise, wireline operator, public venue, or basically any entity with a broad Wi-Fi footprint. The impact of Hotspot 2.0 on mobile networks will be profound, and it doesn't stop with SIM-based devices.

Getting New Credentials
A follow-on program in the WFA addresses the scenario where a HS2.0 capable device does not have a usable credential. In this situation, the AP will direct the user to an online portal where they are given the opportunity to sign-up for a Wi-Fi service. The sign-up process could involve a payment of some sort and then the download of credentials (usually an X.509 digital certificate) to the user's device. Credential provisioning can be used with smartphones, tablets, laptops, and almost anything else that needs Wi-Fi connectivity. Not only can the user automatically connect to APs belonging to the operator for whom they signed up for the service, but also with any roaming partners of that operator (if that feature is enabled in their service package).

The RUCKUS SmartCell Gateway will support an integrated credential provisioning capability, which allows the operator to provide a complete service to the user that addresses the needs of ALL their various wireless devices. The credential provisioning capability includes an integrated certificate server, web server, and AAA server.

Network Selection Policy
A key factor in any multi-RAN architecture is a mechanism for deciding which RAN to use in any given situation. This will require that a policy be downloaded to the mobile device. This is being addressed from two different directions. Hotspot 2.0 Release 2 will address the selection of Wi-Fi roaming partner when more than one is available, and the ANDSF (access network discovery and selection function) effort in 3GPP will look at when to choose Wi-Fi and when to choose cellular.

Wi-Fi Cellular Integration

Wi-Fi RANs can greatly increase the densification of today's mobile networks, but one challenge that must be addressed is in determining when and where to do subscriber management. Wi-Fi RAN traffic can be taken back into the mobile packet core using WLAN gateway technology, or offloaded directly to the Internet. When traffic is taken back into the core, it can leverage the broad suite of subscriber management capabilities that exist there including:

• Billing (pre-paid and post paid)
• Policy enforcement
• Deep packet inspection (content filtering, analytics, parental controls, etc.)
• Authentication and addressing
• Firewall, NAT, and DNS
• Lawful intercept
• Mobility management
• Session management (managing IP bearers and PDP contexts)
• Roaming
• And more

When traffic is offloaded directly to the Internet, many of these services are still required and must be provided at the offload point. It is expected that SIM devices will be backhauled into the mobile packet core and non-SIM devices will be offloaded locally. Wi-Fi is an intriguing technology because of its ability to support non-SIM devices like tablets and laptops. There are hundreds of millions of such devices that need Internet connectivity while on the move. Support for non-SIM devices also allows MNOs to address all the connectivity needs of their subscribers.

3GPP Standards
There have been many efforts over the years by 3GPP (3rd generation partnership project) to define an architecture for integrating Wi-Fi RANs into the mobile packet core. The first such effort was based on the I-WLAN initiative in 2006, which used IPsec to backhaul Wi-Fi traffic to the core. This approach is known as untrusted WLAN access within 3GPP, and it emerged in large part because of the limited security capabilities available in Wi-Fi technology at that time. This approach generated very little traction because of its complexity and the requirement that a client be loaded onto smartphones. Various other approaches using DSMIPv6 and PMIPv6 have also been tried. The real breakthrough came with the work of the S2a Mobility over GTP (SaMOG) working group in 3GPP. Their work was standardized in 3GPP Release 11 and describes an architecture for trusted WLAN access that leverages 802.1x with EAP for authentication, and 802.11i for airlink encryption (the same protocols that are required for Hotspot 2.0). The 3GPP specification calls out a trusted WLAN access gateway (TWAG) that sits between the Wi-Fi RAN and the mobile packet core to provide the gateway function. The TWAG use the 3GPP S2a interface and the GTP v2 tunneling protocol. While 3GPP doesn't provide any guidance on how to use this approach with a 3G network, it can be extended to the Gn interface and GTP v1. The spec also provides support for PMIP (Proxy Mobile IP), which is used by CDMA operators as they transition over to LTE.

The integration of Wi-Fi RANs into the mobile packet core does require that the TWAG create a PDP context (or IP Bearer in LTE speak). The PDP context is a data structure that requires that certain subscriber specific information be passed back into the mobile core including the MSISDN, IMSI, and the APN. This information is passed to the WLAN gateway as part of the EAP authentication process with the mobile device. As the user moves from one radio access technology to another, this context must move with them.

The backhauling of traffic into the mobile packet core opens up the potential for seamless handoff with session persistence as the user moves from a Wi-Fi RAN to a 3G/LTE RAN. This can be accomplished if both sessions are anchored to the same P-GW/GGSN.

SmartCell Architecture

We show the SmartCell Gateway providing the TWAG function for traffic heading into the mobile packet core. Note: the SCG fully supports the 3GPP standard for trusted WLAN access. It supports the S2a and Gn interfaces, and can tunnel traffic with either GTP v1 or GTP v2. From the perspective of the P-GW/ GGSN, traffic coming from the Wi-Fi RAN (via the SCG) looks just like traffic coming from a 3G or LTE RAN. The only way to tell these flows apart is from the RAT (radio access technology) identifier in the PDP context.

For non-SIM traffic the SCG can offload that traffic directly to the Internet. This does require that selected services be provided at the SCG including support for pre-paid and post paid billing, policy enforcement, lawful intercept, DPI, NAT, etc.

An Agile Network Design:

The RUCKUS SmartCell Architecture enables an agile network design that can easily adapt to changes in network architectures and business models. It consists of Wi-Fi access points, WLAN controllers, WLAN gateways, and selected value added services (see Figure 5). The WLAN controller provides a variety of radio resource management (RRM) functions for RUCKUS access points including, amongst other things:

• Management of access points
• Management of security associations as the user is handed off from one AP to another.
• Automatic channel selection function, which enables each AP to select the most appropriate channel for that situation.

The WLAN gateway function sits between the Wi-Fi RAN and the end network, which can be the mobile packet core or the Internet. A steering function is required in the gateway to direct traffic either to the core or to a service complex for local handoff. The directing of traffic would be controlled by operator policy. Non-SIM traffic would be offloaded locally and SIM traffic would most likely flow into the core. Traffic heading into the core would go through the TWAG function, which provides support for trusted WLAN access per 3GPP standards. Traffic that is to be offloaded locally would have subscriber management services provided at the gateway. These services would include support for pre-paid and post paid billing, policy enforcement, deep packet inspection, lawful intercept, amongst other things. Wi-Fi RANs can be built with equipment from a single vendor or they can be multi-vendor. In a multi-vendor architecture the operator could typically deploy APs (and the controllers that support those APs) from a number of different vendors, and direct that traffic toward the WLAN gateway. Connectivity between controllers and gateways from different vendors can be via GRE, PMIP, or QinQ to name a few. GRE is the recommended protocol, but other approaches are certainly valid. The recommended approach in Wi-Fi RAN network design is to connect APs to the gateway by way of the controller, and not have the APs connected directly to the gateway. This approach greatly simplifies multi-vendor interoperability, as it is only necessary for the controllers to interoperate with the gateways (and leaves the APs out of the equation). The interfaces that are open and interoperable in Wi-Fi RANs include the 802.11 airlink, the S2a/Gn interface to the core, IP interface into the Internet, and of course RADIUS (or Diameter).

The SmartCell Gateway
The SmartCell Gateway is the cornerstone of the RUCKUS Architecture. It has been built to enable a very agile approach to Wi-Fi network design that includes support for both mobile packet core integration per 3GPP standards, as well as local traffic offload with services. The SCG also enables a host of very Wi-Fi specific value added services that can provide a compelling user experience as well as increase opportunities for network monetization. We describe some of the capabilities that enable the SCG to thrive in a rapidly changing world.

Flat, distributed cluster architecture Robust, resilient N+1 redundancy Linear scalability, including geographic distribution Separate control, data planes Single management interface, multitenant views Distributed database (client info, keys, stats, AAA, events) Linear scalability for massive transaction volumes Inherent active-active redundancy OptimizedAP/gateway protocol More efficient control communication Enables coordinated implementation of distributed QoS, policy Lightweight, fast Distributed intelligence Local QoS and policy enforcement (including separate queues per user and application class) Local client state machine and 802.11 handshake Reduced communication with GW, increased responsiveness

Flexibility: Enabling the Convergence of Wi-Fi APs and Small Cells
One of the great benefits of the SmartCell Architecture is its ability to draw on the strengths of different RAN technologies in a holistic manner. An example of this can be found in RUCKUS's ability to better enable small cell deployments.

Some of the best places to mount small cells are on street furniture, specifically traffic lights and light poles. These are desirable locations because they are ubiquitous and have AC power but they almost never have Ethernet connectivity. This introduces the potential for Wi-Fi APs to backhaul small cell traffic to a "wired" aggression point in close proximity. That addresses one challenge with many outdoor small cell deployments but there are others including getting access to street furniture. A municipality usually controls access, and they often have some very specific conditions for site acquisition:

• It usually starts with a neutral host solution where an operator is allowed onto their light poles, but they must provide services for everyone. Wi-Fi excels at providing a neutral host solution. Services can be "free" to all users, operators can wholesale services to other operators, or Hotspot 2.0 can be used to enable roaming on that infrastructure.
• Aesthetics also matter greatly in many deployment situations. This is driven by the desire to limit clutter. To this end, there is a premium on putting everything into one box. "Everything" means the small cell radio, the Wi-Fi radio for neutral host, antennas, and the wireless backhaul solution.

Clearly there is a lot of value in the convergence of these two technologies, but what are the impacts on the network? In Figure 7 on the next page, we see how the different functions are handled back in the network. The Wi-Fi AP passes Wi-Fi traffic back into the core via the SCG (WLAN Gateway providing the TWAG function) and the small cell (LTE in this instance) commupnicates with its MME and Serving gateway in the usual manner. This is all transparent to the Wi-Fi AP that is providing backhaul, power, and mounting.

Convergence of Wi-Fi and small cells

Scalability: The Distributed Core Imperative
The integration of Wi-Fi traffic into the mobile core will accelerate an industry trend toward much more distributed mobile packet cores. Technologies like Hotspot 2.0 and 5 GHz enabled smartphones will cause a flood of data traffic to sweep across Wi-Fi RANs worldwide. Hotspot 2.0 makes it easy to get connected and 5 GHz makes it easy to consume huge amounts of bandwidth once the user is connected (see Figure 8). Subscriber management services must also scale to meet this challenge. By moving packet core services out toward the edge of the network, it will be possible to achieve greater scale (especially for high touch services), lower latency, better resiliency, and a more compelling user experience.

Distributed cores will have an impact on the kind of equipment that gets deployed. As functions get pushed to the edge, it places a premium on equipment that can perform a number of different functions at scale. This is a central design tenant of the SmartCell Architecture. Networks will need to rapidly evolve to address continued heavy data usage.

Extensible: Value Added Services
There are a number of value added services that can be enabled at the WLAN gateway and are applicable regardless of where subscriber management is performed. These services allow operators to leverage some of the unique strengths of Wi-Fi.

1) Location Based Services
This represents a large new opportunity for service providers, as it is now possible to locate users with great precision while they are indoors using general-purpose Wi-Fi infrastructure (Note: GPS is not an indoor technology). In most cases, accuracy is down to a few meters. This works through a process that triangulates on a user by getting input from a number of surrounding APs. This information can be used for a whole host of marketing and user experience opportunities that can include pushing coupons to users as they walk through a mall to finding the nearest restroom in a football stadium. Merchants can also use this information to better understand how people move through their stores, including where they are stopping and where they just keep moving. The opportunities here are endless. No special client software is required, as this is totally enabled by the network.

Figure 9 shows the location based services function running on the SmartCell Gateway. It collects information from the APs and uses it to locate the user. This information is then passed to upstream applications.

Figure 9: Enabling location based services

2) Network Wholesaling
This is a capability that is really only possible in Wi-Fi. An operator can deploy a network in a heavily trafficked venue and then enable other operators to share that network by allowing them to broadcast their own SSIDs (today) or advertise roaming relationships on a common SSID when HS2.0 support becomes widespread. There would of course be some sort of financial arrangement involved. The network wholesaling capability is built into the SmartCell architecture, and offers yet another way for operators to better monetize their networks.

3) SmartCell Insight Networking Analytics and Reporting
SmartCell Insight is an application that runs on VMware and provides visibility, trend analysis, and reporting for Wi-Fi RANs. SmartCell Insight does this by collecting data from the network on access point usage that can be used to better gauge the success of a Wi-Fi RAN deployment and help in planning for network expansion. A wide variety of metrics are gathered and these are loaded into the system's database engine, which can then be searched to produce a wide variety of reports. SmartCell Insight has a set of standard reports, and it also supports custom report generation. Data from SmartCell Insight can also be passed to upstream analytics engines via a variety of industry standard APIs.

Proven in deployments worldwide

4) Credential Provisioning
This feature was touched on earlier in the paper and it enables users who don't have a valid credential to sign up for a service and have a credential downloaded to them. This credential would most likely be a digital certificate that the user would pay for, and it would allow them to access APs belonging to that operator and its roaming partners. EAP-TLS would be used for authentication and the airlink would be encrypted. The net result is a SIM-like experience for non-SIM devices like tablets and laptops.

Conclusions:

The SmartCell architecture has been designed to address the needs of mobile operators as they look to greatly increase the densification of their networks. It is focused on high-density locations that are putting the most stress on the macro cellular infrastructure. Wi-Fi is now well positioned to become not just an offload solution, but the 3rd RAN in mobile networks.

The SmartCell Architecture provides the roadmap that will help operators navigate this industry transformation. Its key capabilities include:

• Reliable Wi-Fi connectivity based on adaptive antenna technology to provide increased signal gain toward the user, and greater interference mitigation. This technology has been proven in carrier deployments and 3rd party testing.
• Standards-based integration using the Wi-Fi Alliance Hotspot 2.0 technology, which makes the experience of getting connected as easy and secure as with cellular. Also includes 3GPP standards for Wi-Fi cellular integration.
• An agile design that is scalable, flexible, and extensible enables the network to easily adapt to rapid changes in both technology and business model. This approach also includes a host of value added services like location, network wholesaling, analytics, and credential provisioning, all of which can be used to generate new revenue opportunities and enhance the user experience.