Mobility Management in Practice · Mobile IP · Computer Networking Interactive

Section 7.5 asked what any network must do to reach a device that moves. Two complete answers were written down, and only one of them was ever built at scale.

Words you will meet

Handover — moving a device’s radio attachment from one base station to the next, without dropping its connections.
Source and target base station — the one the device is leaving, and the one it is joining.
GTP (GPRS Tunneling Protocol) — the tunnelling protocol 4G and 5G use to carry a device’s datagrams.
TEID (Tunnel Endpoint Identifier) — the number in a GTP header that says which tunnel a datagram belongs to.
Internet Protocol mobility, or Mobile IP — the Internet’s own answer, complete and unused.
Home agent — Mobile IP’s tracker of where a device currently is.
Foreign agent — Mobile IP’s element in the visited network, which reports to the home agent.

Why this matters

Two groups of engineers solved the same problem, twenty years ago, with almost the same design. One solution now carries traffic for billions of phones. The other is a finished standard that nearly nobody runs.

The interesting part is that the difference is not technical. Reading the two side by side is the clearest lesson in this chapter about why some good designs are deployed and others are not.

Four steps, and none of them are new

The book takes one small story and follows it all the way through. A passenger in a car has a smartphone. The phone joins a cellular network that is not its home network. The passenger starts streaming a video. Then the car drives out of one cell and into the next.

Everything that happens uses elements built in section 7.4: the base station, the MME (Mobility Management Entity) , the HSS (Home Subscriber Service) , the S-GW (Serving Gateway) and the P-GW (PDN Gateway) . This section adds no new machinery. It shows the machinery cooperating.

Figure 7.28 — the four steps of one 4G/5G mobility scenario

1. The device associates with a base stationstep 1 of 4

The phone listens on all frequencies, picks a base station, and opens a control-signalling channel with it. It hands over its IMSI, which names the device and names its home network.

A passenger in a car starts a video, then drives out of one cell and into the next. Nothing here is new machinery: every element was built in section 7.4. Step through to see which element acts when.

Read all steps as text

1. The device associates with a base station — The phone listens on all frequencies, picks a base station, and opens a control-signalling channel with it. It hands over its IMSI, which names the device and names its home network.
2. Control plane: the two networks agree the device is here — The base station contacts the MME in the visited network. The MME authenticates the subscriber, and tells the HSS in the home network that the device is now resident here. The HSS updates its database.
3. Data plane: two tunnels are built — The MME configures the path. One tunnel runs from the base station to the Serving Gateway in the visited network. A second runs from that Serving Gateway to the PDN Gateway in the home network. All traffic will pass through home.
4. The car moves, and the device hands over — The phone leaves one cell and enters the next. The base station changes, and so does the far end of tunnel A. Tunnel B does not move at all — the home P-GW never learns that anything happened.

The four steps split cleanly into two pairs. Steps 1 and 2 are control plane: deciding who this device is and recording where it is. Steps 3 and 4 are data plane: building the path its video will travel, and then moving one end of that path while the video keeps playing.

Step 1 and step 2: proving who you are

The phone listens on all frequencies for signals from nearby base stations, learns progressively more about them, chooses one, and opens a control-signalling channel with it. That much is section 7.4.2, unchanged.

What matters here is the one value the phone supplies during association: its International Mobile Subscriber Identity , or IMSI (International Mobile Subscriber Identity) . That single identifier does two jobs at once. It names the device, and it names the device’s home network.

Once the signalling channel exists, the base station contacts the MME in the visited network, and the MME does three things.

First, it obtains the subscriber’s authentication, encryption and service-permission information using the IMSI. That information may already sit in the MME’s local cache, or come from another MME the device contacted recently, or be fetched from the HSS in the home network. The authentication is mutual: the visited network becomes certain of the device’s identity, and the device becomes certain of the network’s.

Second, the MME informs the HSS in the home network that the device is now resident in this visited network, and the HSS updates its database.

Third, the base station and the phone choose the parameters for the data channel they will use. The control channel is already running; this is the one that will carry the video.

In plain words

Step 1 is the phone saying “here is my name, and here is my home network”.

Step 2 is the visited network checking that claim with the home network. The home network then writes down the answer to the question section 7.5 said somebody must always be able to answer: where is this device right now?

Step 3: two tunnels, and why they end where they do

The MME now configures the data plane. Two tunnels are built.

The first tunnel runs between the base station and the Serving Gateway in the visited network. The second runs between that Serving Gateway and the PDN Gateway in the device’s home network.

Notice what that means. Every datagram to or from this phone is tunnelled through its home network, even though the phone and the streaming server may both be far away from home. This is section 7.5.3’s indirect routing, and 4G LTE (Long-Term Evolution) uses it in its symmetric form: traffic in both directions goes home.

What is inside the tunnel

4G and 5G tunnels use the GPRS Tunneling Protocol ( GTP (GPRS Tunneling Protocol) ).

Each GTP header carries a Tunnel Endpoint Identifier ( TEID (Tunnel Endpoint Identifier) ). The TEID says which tunnel a given datagram belongs to.

That one field is what lets many separate flows share the same pair of tunnel endpoints. The sending end labels each datagram. The receiving end reads the label and sorts the datagrams back out. It is multiplexing and demultiplexing, the same idea as section 3.2’s port numbers, applied to tunnels instead of to sockets.

Compare this arrangement with the one in section 7.5, where the device was at home. In both cases the Serving Gateway sits in the same network as the device. The PDN Gateway is always the one in the device’s home network, which may be somewhere else entirely. The gap between those two facts is exactly what indirect routing is.

The alternative that exists but is not used

A design called local breakout is specified. In it the Serving Gateway builds its tunnel to a PDN Gateway in the local, visited network instead, so traffic never travels home.

That removes the detour. In practice, the book reports, local breakout is not widely used. The specification exists; the deployment does not.

Once both tunnels are configured and active, the phone can exchange datagrams with the Internet through the PDN gateway in its home network. The video starts.

Step 4: handover, without stopping the video

A handover happens when a device changes its association from one base station to another. The process is the same whether the device is at home or roaming.

The base station the device is leaving is the source; the one it is joining is the target. A handover changes more than which radio the phone uses: it also changes the base-station end of the Serving-Gateway-to-base-station tunnel from step 3.

Why a handover is started at all

Two reasons are common. The signal between the phone and its current base station may have degraded until communication suffers. Or a cell may be overloaded, and moving some devices to quieter neighbouring cells relieves it.

The phone measures a beacon signal from its current base station, and signals from nearby base stations it can hear. It reports these measurements to the source base station once or twice a second. The source base station decides, using the measurements, the current load of nearby cells, and other factors.

The standard deliberately does not say how

The 4G and 5G standards specify no algorithm for deciding whether to hand over, or which target to choose. That decision is left to the equipment vendor, and it remains an active research area.

This is worth noticing. A standard fixes the messages so that equipment from different vendors can work together; it does not fix the policy. You saw the same split in chapter 5, where the routing protocol is standard and the metric is local.

The seven messages

Figure 7.30 — handover, message by message

message 8 of 8

Click any arrow to see what that message says and why it is sent.

Seven steps. Watch where step 3 falls: the phone is finished less than half way down the ladder, and the remaining four messages are the network tidying up behind it.

Read this diagram as text

source base station sends 1. Handover Request to target base station. The source base station has been reading signal measurements the phone reports once or twice a second. It decides to move the phone, chooses the target, and asks.
target base station sends 2. Handover Request Acknowledge to source base station. The target checks whether it has room for this device and its quality-of-service needs. If it does, it pre-allocates radio resources — time slots and more — and replies with everything the phone will need to join it. This pre-allocation is why handover is fast: the phone skips the slow association protocol.
source base station sends 3. target identity + channel information to phone. The phone now knows which base station to use and how to reach it. From the phone's point of view, handover is complete here — it can send and receive through the target immediately. The network still has work left.
source base station sends 4. forward tunnelled datagrams to target base station. The source stops delivering to the phone. Datagrams still arriving on the old tunnel are forwarded to the target instead, which will pass them on. This is what stops data being lost in the gap.
target base station sends 5a. I am serving this device now to MME. The target tells the MME it has taken over.
MME sends 5b. re-point the tunnel to S-GW. The MME signals the Serving Gateway and the target base station to reconfigure the S-GW-to-base-station tunnel so that it ends at the target. This is the only piece of the data path that changes.
target base station sends 6. tunnel reconfigured to source base station. The target confirms to the source that the tunnel has moved. Only now may the source release the radio and memory resources it was holding for this device.
target base station sends 7. delivery resumes on the new tunnel to phone. The target delivers both kinds of datagram: the ones the source forwarded during the move, and the new ones now arriving on the reconfigured tunnel. It also pushes the phone's outgoing datagrams into the tunnel toward the Serving Gateway.

Lifelines, left to right: phone (mobile device), source base station (access point), target base station (access point), S-GW (router), MME (server).

The ladder makes one thing visible that the numbered list in the book does not. Handover finishes for the phone at step 3, less than half way down. Steps 4 to 7 are the network repairing itself behind a device that has already moved on.

Step 4 is the part that protects the data. The source base station stops delivering to the phone. Datagrams keep arriving on the old tunnel for a short while, so it forwards them to the target, which delivers them later. Without step 4 those datagrams would be lost.

In plain words

The target base station gets everything ready before the phone is told to move. When the phone is finally told, it can start using the new base station immediately, because a place has already been reserved for it.

Then the network moves the tunnel, and only after that does the source release what it was holding.

In the simplest case — two base stations near each other, in the same network — every change is local. The PDN Gateway never learns that anything moved. More complicated handovers need more complicated mechanisms.

What 5G changes

The roaming arrangement described above will also be used in 5G networks. But section 7.4.6 noted that 5G cells are smaller and denser.

Smaller cells mean a moving device crosses more of them. Handover therefore becomes a more critical function, not a less critical one, and low handover delay matters for real-time 5G applications.

The proposed answer is to move the cellular control plane onto the software defined networking framework from chapter 5. That is expected to allow a higher-capacity control plane with lower delay, and it is the subject of considerable current research.

Mobile IP: the same design, in a different vocabulary

Today’s Internet has no widely deployed infrastructure for mobile users of the kind 4G and 5G provide. The book is careful about why: this is not for lack of a technical solution.

The Mobile IP architecture and protocols have been standardized in Internet RFCs for more than twenty years. Research on newer, more secure and more general mobility solutions has continued since.

What blunted its deployment was the absence of a motivating business case, plus the timely arrival of mobility solutions in cellular networks. Twenty years ago, 2G networks had already solved mobile voice — the application that mattered most to mobile users — and 3G voice and data networks were close behind.

The result is a dual-technology arrangement that we had then and still have now. Cellular networks serve you when you are genuinely moving. 802.11 or wired networks serve you when you are stationary, or moving only locally. Those are the two ends of section 7.5’s mobility spectrum.

The architecture is strikingly similar

Table 7.3 — the same architecture, twice

	4G/5G cellulardeployed everywhere	Mobile IPspecified, never widely deployed
Where the subscriber belongs
Where the device is now
The permanent name
What tracks the device
What reports from the visited network
How data reaches the device
The radio attachment

Cells marked ⓘ have a reason behind them — click to read it.

Read the left column and the right column as one idea with two vocabularies. Click any cell for what the pairing does and does not mean.

Every row is a pairing, not a contrast. Mobile IP has a home network where a device holds a permanent IP address, and foreign networks where it is allocated a care-of-address . Its home agent tracks the device by receiving updates from foreign agents, as the HSS receives updates from MMEs. Both designs use indirect routing, and both tunnel between the gateway routers of the home and visited networks.

Three pieces

The Mobile IP standard has three parts.

Agent discovery defines how a foreign agent advertises its mobility services to a device that wants to attach to its network. Those services include giving the device a care-of-address for use in the foreign network, registering it with the home agent, and forwarding datagrams for it.

Registration with the home agent defines how a device, or its foreign agent, registers and deregisters a care-of-address with the device’s home agent.

Indirect routing of datagrams defines how a home agent forwards datagrams to mobile devices, including the forwarding rules, the handling of error conditions, and several forms of tunnelling.

How much of this to carry forward

The book’s coverage of Mobile IP is deliberately brief, and says so. Earlier editions treated it in much more depth, and that retired material is on the book’s website.

Treat the three pieces above as the shape of the standard rather than as material to memorise. The comparison table is the part worth keeping.

The mental model

One picture covers this whole section. A home that always knows where you are, a visited network that tells home when you arrive, and a tunnel between them carrying your data the long way round.

4G and 5G build that picture out of an IMSI, an HSS, an MME and two GTP tunnels. They add a fast handover, so the picture can be redrawn while a video plays. Mobile IP builds the same picture out of a permanent IP address, a home agent, a foreign agent and one tunnel.

The difference between them is not in the picture. It is that one had a business reason to be built.

Check yourself

0 of 6 answered

1.During handover, at which step is the move complete from the phone's point of view?
2.Why does the target base station pre-allocate radio resources at step 2, before the phone has been told anything?
3.In the two tunnels of step 3, where does the second tunnel end?
4.predictTwo base stations are near each other and in the same network, and a phone hands over between them. What does the home PDN Gateway observe?
5.The book says Mobile IP was never widely deployed. What reason does it give?
6.What does the TEID field in a GTP header do?

What to remember

The phone is finished before the network is. Handover completes for the device at step 3 of 7; the remaining four messages re-point the tunnel and release the old resources behind it.
Everything goes home, by design. 4G LTE tunnels a device’s traffic through the PDN Gateway in its home network — indirect routing in its symmetric form — and the specified alternative, local breakout, is not widely used.
Mobile IP failed on business reasons, not technical ones. It maps almost element-for-element onto 4G/5G, has been standardized for over twenty years, and lost to cellular networks that solved mobile voice first.