Most national governments consider the radio spectrum a valuable national resource and heavily regulate its commercial use. Governments typically auction off licenses for the right to transmit over a portion of the spectrum, which can be very expensive. The traditional business model for cellular carriers is based on access to this licensed business has coalesced worldwide around a single 4th generation (4G) radio technology standard called Long Term Evolution, commonly referred to as LTE.

1. LTE & Wi-Fi: Options for
Uniting Them for a Better
User Experience

2. 2
Most national governments consider the radio
spectrum a valuable national resource and
heavily regulate its commercial use.
Governments typically auction off licenses for
the right to transmit over a portion of the
spectrum, which can be very expensive.
The traditional business model for cellular
carriers is based on access to this licensed
spectrum. They license slices of spectrum from
the local regulator and sell their customers
access to it. After decades of parallel evolution
on the two sides of the Atlantic through
multiple generations of technologies, the
business has coalesced worldwide around a
single 4th generation (4G) radio technology
standard called Long Term Evolution,
commonly referred to as LTE.
However, if a wireless device promises to “play
nice,” most regulators will allow it to transmit
on a slice of spectrum set aside for that
purpose: the license-exempt, license-free or
simply unlicensed bands. Playing nice means
adhering to certain rules that will be verified
when the device is certified. The rules are
derived from basic human civility:
I will not shout too loudly—there is a
limitation on transmit power, with the
Effective Isotropic Radiated Power (EIRP)
limited to anything between 4W (36 dBm)
to 25 mW (14 dBm).
I will share the resource, not monopolize
it—these are rules about the duty cycle, the
maximum duration of transmit bursts,
minimum duration of silence after
transmission, and an obligation to “listen
before talk (LBT).”
I will yield to users who have been deemed
by society to be serving a higher need than
I have—as we would pull over to give way
to a fire engine or ambulance, unlicensed
spectrum users must move away from a
frequency if they detect equipment like
airport weather radar operating on it.
While the exact situation varies by country,
generally speaking there are three unlicensed
bands of greatest interest today when it comes to wireless
broadband:
The 2.4 GHz band (λ ≈ 12 cm) has 83 MHz between
2.400 and 2.483 GHz. This band is almost
uniformly available worldwide and is heavily used
by consumer devices.
The 5 GHz band (λ ≈ 5½ cm) has 775 MHz between
5.150 and 5.925 GHz. This band is gaining
popularity in consumer devices—mostly in
premium and high-end devices for now—but its
allocation is fragmented and less uniform across
countries.
The 60 GHz band (λ ≈ ½ cm) has 9,000 MHz
between 57 and 66 GHz. This band is relatively new
and promising, though the laws of physics put some
limitations on the ways it can be used.
The dominant wireless broadband technology in these
three bands is Wi-Fi, which is based on the IEEE 802.11
wireless LAN standard. Wireless LAN technology is now
heavily used for private networks in homes as well as in
the workplace. Then there is public Wi-Fi, which is
common in cafés, restaurants, airports, hotels, shopping
malls, and increasingly on trains and planes. Sometimes
it is complimentary, and sometimes we have to pay for it.
In fact, in several small, densely populated developed
nations such as Singapore, Wi-Fi can be found almost
anywhere.
While cellular carriers have been good at providing
coverage—especially outdoors—they face both coverage
and capacity challenges as the demand for broadband
internet access grows.
There can be a coverage problem at the network’s
edge, in locations where installing radio
infrastructure, such as towers, cannot be justified
financially.
There is a coverage problem indoors, because the
materials a building is made of—especially stone,
concrete, steel and metallized sun-control
film—can block radio signals to and from the
carrier’s cell tower outdoors.
There can be a capacity problem in “hotspots”
where many people congregate. This isn’t a
problem if the carrier has enough licensed
spectrum to address this demand. However,
spectrum licenses are expensive, and budgeting
spectrum for the capacity demands of hotspots
would leave most of that spectrum unused

3. 3
In recent years, cellular carriers have been looking
at the unlicensed spectrum for ways to address all
of these challenges.
01 —
02 —
03 —
over most of the carrier’s coverage footprint.
The other way to handle the demand is to
put radio infrastructure equipment closer
together—for example cell towers—thereby
having smaller cells where the demand is
higher. The downside of this approach is it
increases interference and causes more
handovers—which do not help beyond a
point. Such hotspots may be:
Outdoors, such as stadiums and
entertainment venues, as well as
locations like Times Square, Piccadilly
Circus and Shibuya Crossing.
Indoors, such as shopping malls, airports
and railway stations—public indoor
spaces inside buildings that get
significant numbers of walk-in users.
Clearly, as explained above, a coverage
problem is also present in such locations,
so the carrier gets hit with a double
whammy which is difficult to address for
two reasons:
First, the cellular carrier, the walk-in
user and the building owner are distinct
and separate entities. Since the building
blocks radio signals to and from its
network outside, the obvious answer is to
install radio infrastructure—a distributed
antenna system (DAS) fed by one of the
carrier’s base stations—within the
building. Unfortunately, while the carrier
“owns” the user and the spectrum
license, it has no rights to the space
inside the building.
Second, the owner of the building has no
spectrum license, but he controls the
space inside the building. He would
presumably like to monetize it by cutting
some kind of deal with the carrier, but
since there are typically multiple carriers
in the area—anywhere from two to six on
an average—it may be against the
building owner’s interest to play favorites
between them by allowing only one of
them to install a DAS.
Unlicensed spectrum infrastructure can
substitute licensed spectrum coverage in
network-edge locations. Due to the
regulatory limitations on transmit power,
however, all such coverage using
unlicensed spectrum can only be of the
hotspot or “hot-zone” variety: that is,
only terminals that are in the vicinity of
the infrastructure can be served.
For indoor terminals in poor
signal-to-noise (SNR) locations, it is
possible to use indoor unlicensed
spectrum infrastructure to compensate
for higher path loss between outdoor cell
towers and indoor locations. This offers
an option to keep only low-bitrate
signaling on licensed spectrum while
using unlicensed spectrum to deliver
most of the payload traffic.
In situations of capacity crunch, it is
possible to augment the available air-link
capacity by diverting overflow traffic
from licensed spectrum to be delivered
over unlicensed spectrum. This allows for
the combination of:
serving more terminals in locations
that have many users in one place; and
providing a thicker data pipe to
terminals, which potentially provides
substantially higher bit rates for all
applications that use “best effort”
Quality of Service.
In the specific instance of public indoor spaces,
solutions based on unlicensed spectrum are also
attractive for building owners, as they can install
unlicensed-band radio infrastructure in their
buildings. They can then “rent out” the use of this
infrastructure equitably to all carriers in the area,
and the carriers can use it to serve their respective
subscribers who walk into those buildings. The
end user gets high-quality connectivity, the carrier
gets the goodwill from satisfied customers, and
the building owner makes some money. It’s a
win-win situation all around.

4. Building owners may actually be ahead of the
game. Indeed, an increasing percent of them are
investing in public Wi-Fi, which is the dominant
form of radio access in the unlicensed spectrum.
Quite a lot of the public Wi-Fi is running without
the involvement of any carrier, however, and in
the rest of the public Wi-Fi deployment the
involvement of the carrier is very loose. As a
consequence, the end-user experience is not
“seamless.”
In fact, it can be argued that there is a threat to
the carriers in this case. When the end user
connects through the unlicensed spectrum
infrastructure belonging to the building owner,
the carrier adds value by being a broker between
the two—it’s a trusted intermediary known to
both parties. However, this role can be fulfilled
equally well by a Wi-Fi aggregator, such Boingo
or iPass, that exist for that very purpose.
10
So how should a carrier play this game? To
understand the challenge, we have to familiarize
ourselves with the structure of a cellular broadband
network. Figure 1 shows what a LTE network looks
like when only the internet-access service is
considered.
The User Equipment (UE) is the end-user’s
smartphone, which may be a carrier-locked model
purchased from the carrier or an “unlocked” model
bought in the open market. The Subscriber Identity
Module (SIM) is the tiny smart card that goes into
the phone: it is in fact a computer in its own right,
and holds the subscription credentials that
authenticate the phone to the network when
required.
The Evolved Node B (ENB) is the LTE radio base
station. The Mobility Management Entity (MME)
and the Serving Gateway (SGW) are functions of the
LTE core network that, in case of roaming, must be
in the “visited network” to which the end-user is
connected.
Figure 1: The LTE internet service flow
The red line is the path taken by the data packets, the green lines are for authentication, the blue lines are for signal control,
and the yellow line is for credit control and authorization.
ENBUE
MME
HSS
OCS
AAA
PGWSGW Internet
Licensed
SIM

5. The PDN Gateway (PGW) is the point where
the LTE network connects to the Internet. It is
the function that allocates dynamic IP
addresses to each UE as they connect, and it is
the last router that IP packets addressed to the
UE have to pass through. It is a function of the
packet core that may be located in the visited
network or the home network—the choice is up
to the carrier.
The Home Subscriber Server (HSS), Online
Charging System (OCS) and AAA Server are
systems that must be in the subscriber’s home
network whether or not they are roaming. The
HSS/AAA holds the subscription information
for the end user and their authentication
credentials, while the OCS maintains his credit
balance to enable prepaid pay-as-you-go
service.
Figure 2
The key to this solution is to leverage the user’s SIM
for authentication using a technique known as
EAP-SIM/EAP-AKA. Additionally, technologies such
as Hotspot 2.0 can be used by the Wi-Fi network to
advertise its willingness to accept visitors from the
user’s carrier, which can help automate the process.
After the user’s Wi-Fi session is over, the Wi-Fi
network will send the accounting records to the
carrier, billing settlement will take place offline, and
the user will be charged for the usage in their next
phone bill.
For now, this technique has one advantage over
methods discussed below: almost any smartphone on
sale today can access Wi-Fi using unlicensed spectrum.
However, there are some shortcomings: Service
continuity—commonly called handover—with the
cellular mobile broadband service offered by the
carrier is not possible. Simply put, when the user
comes into the Wi-Fi network from outside, any data
sessions, such as TCP/IP connections, will need to be
restarted. It will be up to the application whether that
is acceptable.
The red line indicates the path taken by
the data packets flowing between the UE
and the Internet.
The green lines indicate paths used
primarily for authentication.
The blue lines indicate paths used by
more general control signaling that is
used to set up, modify and tear down the
connectivity.
The yellow line indicate the path taken by
‘online charging’ credit control
interactions that make prepaid services
possible.
With Figure 1 as the reference point, consider
Figure 2 which shows the entry-level way
carriers can tap into the unlicensed spectrum.
Prepaid service is not possible. This may not be a
big problem in economies such as the US where
postpaid and contracts are standard practice.
However, in some of the largest cellular markets
in the world, including China and India, prepaid
service is the dominant model.
UE
HSS
OCS
AAA
InternetWi-Fi
Unlicensed
SIM

6. Figure 3
In fact, it is difficult to distinguish this model
from the business models pursued by Wi-Fi
aggregators. Something is required to make it
more attractive, which is captured in Figure 3.
In this new model, called the trusted WLAN, the
carrier extends its core network to the site where
the Wi-Fi is deployed, and provides a connection
between the Wi-Fi network and the PGW. In one
fell swoop, the carrier solves the problems of
connecting to the user:
To be sure, there are a few blemishes:
12
Since the user traffic is not carried by the
carrier at all—the red line does not touch any
of the carrier’s infrastructure—the carrier will
probably be able to claim only a small share
of revenue.
The user traffic is transported over the
carrier’s infrastructure (the PGW), so the
carrier can claim a larger share of the
revenue.
Since the PGW knows about credit control,
all of a sudden the carrier can now handle
users who have prepaid plans.
The PGW is, in fact, the same as the one used
for cellular access, so it is possible to
maintain service continuity as the UE moves
between LTE and Wi-Fi radio accesses: the
PGW can ensure the IP address allocated to
the UE will be the same.
To take advantage of the network’s
new-found ability to maintain service
continuity, the UE has to learn about some
new signaling procedures. Specifically, it has
to replace the ubiquitous Dynamic Host
Configuration Protocol (DHCP) protocol with
something else. Luckily, this is a software
change, and the UE can execute the new
tricks with a software update.
Whenever the UE moves between Wi-Fi and
LTE radios, there is signaling traffic to and
from the PGW. This is undesirable: not only
does it create potentially avoidable load on
the PGW when the user is roaming, but it can
slow down the handovers.
The decision to move to Wi-Fi and back to
LTE is left to the end-user (or at least the
policy they configured in the phone,) so
sometimes the UE will be on Wi-Fi when the
carrier would rather have it on LTE, or vice
versa.
Also when the UE chooses Wi-Fi, the entire
traffic to and from the UE is subject to the
interference-prone uncertainties of the
unlicensed spectrum. It may be preferable to
set aside a portion of the traffic to be
transported over the licensed spectrum which
the carrier has more control over.
This model is as good as it gets in locations where
the carrier is depending on unlicensed spectrum
to substitute licensed spectrum coverage.
However, if the UE is located where both LTE and
Wi-Fi are available, it may be less than
satisfactory from the carrier’s point of view.
UE
HSS
OCS
AAA
PGW InternetWi-Fi
Unlicensed
SIM

7. There is a fork on the road ahead when
addressing these two challenges. The left fork
addresses challenge 1, as captured in Figure 4.
Figure 4
Figure 5
In this approach—called Network Based IP Flow
Mobility (NBIFOM)—the UE maintains simultaneous
LTE and Wi-Fi connections, and offloads only a part of
its traffic to Wi-Fi. The data traffic is partitioned based
on each packet’s:
Remote IP Address (i.e. of the server in the
Internet)
Protocol (i.e. TCP, UDP, SCTP, ICMP, ESP,
GRE, …)
Local Port Number (i.e. at the UE end)
Remote Port Number (i.e. at the server in the
Internet)
Security Parameter Index (for ESP packets)
Flow Label (for IPv6 packets)
“Type of Service” or DSCP “Traffic Class” field
In this solution, called RAN Controlled LTE
WLAN Interworking (RCLWI), the decision to
pick LTE or W-Fi is handled by the ENB. The
UE maintains an LTE connection whenever it
can see the LTE network—irrespective of
whether it is using offload-to-Wi-Fi or not. The
UE keeps the ENB informed of the
measurements of the Wi-Fi networks around
itself. Based on this information, the ENB
commands the UE to start or stop offloading to
Wi-Fi, and specifically to which Wi-Fi network.
This approach can pinpoint all communications from
the terminal to a particular server on the internet. In
the world of 3GPP/LTE protocols, the data traffic to
and from the internet can be split into a maximum of
11 distinct partitions, called bearers.
Unfortunately, RCLWI doesn’t address challenge 2
and NBIFOM does not address challenge 1.
Fortunately, there is a third approach captured in
Figure 6, named LTE WLAN Aggregation (LWA), that
addresses both challenges.
HSS
OSS
AAA
PGW Internet
Wi-Fi
Unlicensed
UE
Licensed
ENB
Measurements →
← Orders
SIM
ENB
UE
MME HSS
OCS
AAA
PGWSGW Internet
Wi-Fi
Unlicensed
Licensed
SIM

8. Figure 6
Figure 7
This solution incorporates both UE-reported
Wi-Fi measurements from RCLWI and the use of
different radios for different bearers—or IP flows,
sometimes called packet pipes—from NBIFOM.
Unlike NBIFOM, the Wi-Fi leg no longer requires
a separate AAA operation—instead, the Wi-Fi
infrastructure can “borrow” the authentication
from the LTE side.
Recognizing that the choice between the LTE
radio and Wi-Fi radio is ultimately significant
only between the UE and the base station, this
solution splits or merges the traffic at the base
station (ENB) and leaves the packet core (PGW)
entirely out of the picture. LWA is completely
transparent to the core network, which remains
entirely unaware of whether each data packet is
carried over Wi-Fi or LTE. Not only does this
reduce the signaling overhead between the access
and core networks, it simplifies charging
enormously: no per-user charging is required for
traffic that is offloaded to Wi-Fi.
12
Switched Bearer mode, where the entire
bearer is diverted over LWA. It may be
diverted back to LTE but only by signaling
between the UE and ENB.
Split Bearer mode, where the decision of
whether the packet goes over Wi-Fi or LTE is
taken on a packet-by-packet basis. No
signaling exchange is necessary.
Typically, only non-GBR (guaranteed
bitrate), best-effort bearers will be diverted.
Diversion of GBR bearers is permitted, but it is
understood that the bit rate is not guaranteed in
Wi-Fi.
But how is the data packet actually transported?
Figure 7 explains the protocol stack applicable for
LWA user traffic, which is the Payload IP layer.
The stack to the left is used to transport data in
regular Wi-Fi, while the one to the right is used in
regular LTE. The stack in the middle is used when
LTE data is diverted over Wi-Fi in LWA, and it
inherits qualities from both sides.
The control plane continues to use LTE on the
licensed spectrum, which is a path the carrier has
more control over. For the bearers carrying user
traffic, there are two possible modes of operation:
ENB
UE
MME
HSS
OCS
AAA
PGWSGW Internet
Wi-Fi
Unlicensed
Licensed
SIM
Wi-Fi MAC
Wi-Fi PHY
2.4, 5 or 60 GHz
Payload IP
LTE MAC
LTE PHY
Licensed Band
LTE PDCP
LTE RLC
Payload IP
Wi-Fi MAC
Wi-Fi PHY
2.4, 5 or 60 GHz
LWAAP
Payload IP
LTE PDCP
Wi-Fi U-Plane Stack LWA U-Plane Stack LTE U-Plane Stack

9. Figure 8
3
Consider what this means in the context of the
building depicted in Figure 8. The Wi-Fi
Installation belongs to the building owner. The
two carriers in the area are represented by the
colors red and blue. The red and blue lines in the
picture denote the Xw interfaces for the respective
carriers.
In the Wi-Fi Medium Access Control (MAC),
the packet header—technically the SNAP
header—contains a 2-byte field called
EtherType. When IP packets are transported
over Wi-Fi, this field is hexadecimal ‘0800’ for
IPv4 packets and hexadecimal ‘86DD’ for IPv6
packets. For LWA, this field is set to
hexadecimal ‘9E65’, which tells the Wi-Fi
infrastructure that what follows in the packet is
not a naked IP packet but is encapsulated using
LTE PDCP. LWA introduces a 1-byte ‘LWAAP
header’ that identifies the bearer to which the
packet belongs.
In Release 13 LWA, only downlink traffic can
be diverted. Diversion of uplink will be allowed
from the Release 14 version of the standards.
LWA is derived from a 3GPP architecture
called dual connectivity (DC) that will
eventually enable network infrastructure that
uses multiple, and possibly very different radio
technologies simultaneously to transfer data
fast and efficiently to and from the UE. This
architecture is very flexible. It works with
simple IP connectivity between the
infrastructure-side radios without the need for
strict synchronization between them. This
feature—along with the standardization of the
interface (named Xw) between the ENB and
Wi-Fi infrastructure—allows LWA to address a
variety of configurations.
The Wi-Fi installation in the building can
serve multiple carriers—potentially all
the carriers in the area.
Each outdoor ENB can serve multiple
LWA-capable Wi-Fi installations. This
makes it possible for the Wi-Fi
installation in any number of buildings in
the outdoor base station’s coverage
footprint to support the ENB’s LTE
coverage. It does this by augmenting its
capacity and by compensating for any
coverage degradation that may have
occurred due to radio-penetration losses.
This is a win-win-win situation for everyone:
building owners, carriers and end users.
The possibilities extend beyond LWA, to License
Assisted Access (LAA), which is shown in Figure 9.
Here, we dispense with Wi-Fi altogether, and carry
traffic on the unlicensed spectrum using a form of
the LTE air interface.
Small Cell
ENB
Lightweight
AP
DAS
Remote
Outdoor
(Tower)
ENB
Outside Basement Ceiling
DAS
Headend
Carrier A @(
UE
Floor
Packet
Core
Packet
Core
To another building
ABuilding
Carrier B
Wi-Fi Installation
DAS Installation
LTE
LTE
Wi-Fi
Wi-Fi
Wireless LAN
Controller

10. Figure 9
Every LTE smartphone already has a
Wi-Fi radio, making LWA possible
right now with just a software update.
LAA would require new smartphones
with LTE-over-unlicensed-band radios.
Carrier aggregation integrates the
packet schedulers of the component
radios, which requires the radios to be
tightly synchronized. In practice, the
radios must be integrated into the
same base-station hardware in the
same location. Separating the licensed
and unlicensed radios would require a
very demanding “ideal backhaul”
between them and limit the
deployment flexibility of LAA
considerably.
Regulatory requirements such as “listen
before talk (LBT)” can reduce
throughput of the LTE air interface
(which was not designed for such
restrictions) to below what is offered by
Wi-Fi (which was designed for such
restrictions).
This idea is derived from the Carrier
Aggregation (CA) architecture developed for
LTE Advanced. The 3GPP has already
welcomed the 5 GHz unlicensed band into
the LTE fold, designating it TDD Band 46
(5150-5925 MHz). While LAA can bring
additional efficiencies over LWA, in practice
LWA appears to be the optimal solution for
the following reasons: Still, every one of the options above is
available to the carriers and equipment
manufacturers today. There are even side
roads, including options based on running
IPSEC (IKEv2/ESP) over Wi-Fi on the UE
that allow carriers to partner with Wi-Fi
networks that wish to join the game but are
unwilling to upgrade their Wi-Fi
infrastructure to support new 3GPP-specific
interface protocols.
All the options that involve Wi-Fi in the
unlicensed spectrum may eventually be
supported by handsets through software
updates, making them available to carriers
on equal terms. In the meantime, however,
Aricent believes LWA is a technology that
has great potential and capabilities that
could make it the eventual winner.
16
ENBUE
MME
HSS
OCS
AAA
PGWSGW Internet
Unlicensed
Licensed
SIM

11. 17
Aricent is a global design and engineering company innovating for the digital
era. With more than 12,000 design and engineering talent and over 25 years of
experience, we help the world’s leading companies solve their most important
business and technology innovation challenges - from Customer to Chip.
© 2016 Aricent. All rights reserved.
All Aricent brand and product names are service marks, trademarks, or registered marks of Aricent in
the United States and other countries.
About Aricent
Contact
Avijit Ghosh, AVP and Global R&D Lead
Email: avijit.ghosh@aricent.com