Mobility, Location and Handoff Management

Introduction

Mobility management enables a network to find, authenticate and serve a terminal while its point of attachment changes. It combines two related functions. Location management maintains an approximate record of an idle terminal and pages it when traffic arrives. Handoff management preserves an active service as radio links, access technologies or network anchors change.

These functions involve a fundamental trade-off. Frequent location updates improve paging accuracy but consume radio capacity, energy and database resources. Delayed handoff reduces signalling but may increase interruption, packet loss or radio-link failure. Effective design therefore requires mobility models, signalling-cost analysis, secure identity management and standards-compliant context transfer.

Learning Objectives

After studying this chapter, the reader should be able to:

• explain registration, location updating, paging, roaming and authentication;
• distinguish identifiers, location databases and mobility contexts in LTE and 5G;
• evaluate tracking-area and paging strategies using probabilistic and cost models;
• explain tunnelling and mobility anchoring mechanisms;
• compare horizontal, vertical, hard and soft handovers;
• analyse handoff decisions using signal, mobility, queueing and signalling-cost models;
• interpret LTE and 5G handover signalling flows; and
• assess security, privacy, governance and emerging AI-assisted mobility techniques.

1. Mobility-Management Foundations

A mobile terminal may be in one of two broad mobility states:

• Idle or inactive: The network knows an area containing the terminal but not necessarily its current cell. Incoming traffic requires paging.
• Connected: The serving cell and bearer context are known. Mobility is managed through handoff or cell reselection, depending on state.

A complete mobility context may contain:

• permanent and temporary subscriber identifiers;
• serving network and location-area information;
• authentication and security state;
• bearer or protocol data unit session state;
• quality-of-service rules;
• packet sequence numbers and retransmission state;
• charging, policy and roaming information; and
• application or edge-computing context.

1.1 Registration and Location Updating

Registration informs the network that a device is available and establishes an authenticated mobility context. A subsequent location update reports movement into a new registration area, location area or tracking area.

Update policies include:

1. Movement-based updating: Update after crossing a specified number of cell boundaries.

2. Distance-based updating: Update when displacement from the last reported position exceeds a threshold.

3. Timer-based updating: Send periodic updates.

4. Zone-based updating: Update when leaving a predefined set of cells.

5. Predictive updating: Use mobility history or context to determine when uncertainty has become excessive.

In practice, timer, zone and event-based rules are commonly combined.

1.2 Identifiers and Privacy

Permanent identities should not be exposed unnecessarily over radio interfaces. LTE normally uses a temporary Globally Unique Temporary Identifier (GUTI) after initial identification. In 5G, the permanent Subscription Permanent Identifier (SUPI) is normally concealed as a Subscription Concealed Identifier (SUCI) when transmitted over the radio interface. The network later allocates a 5G-GUTI for routine signalling.

Temporary identifiers reduce passive tracking, but location privacy still depends on identifier-refresh policy, signalling protection and resistance to rogue base stations.

2. Standards-Specific Registration and Roaming

2.1 LTE Attach and Database Interaction

An LTE attach commonly involves the user equipment (UE), eNodeB, Mobility Management Entity (MME), Home Subscriber Server (HSS), Serving Gateway (S-GW) and Packet Data Network Gateway (P-GW).

A simplified flow is:

1. The UE establishes an RRC signalling connection and sends a NAS Attach Request, normally containing a temporary identity if available.

2. If the identity cannot be resolved, the MME requests additional identification.

3. The MME obtains an authentication vector and subscription information from the HSS over the S6a interface.

4. EPS Authentication and Key Agreement (EPS-AKA) authenticates the subscriber and derives session keys.

5. NAS and access-stratum security are activated.

6. The MME selects gateways and creates a default EPS bearer.

7. The MME sends Attach Accept, including a tracking-area list and a new GUTI where appropriate.

8. The UE confirms completion, and the HSS records the serving MME.

The MME maintains mobility and bearer-control state; user packets normally pass through GTP-U tunnels among the eNodeB, S-GW and P-GW.

When an LTE UE moves to an area served by another MME, context can be transferred through MME relocation procedures. The S10 interface supports messages such as Forward Relocation Request and Response, carrying subscriber, bearer and security-related context.

2.2 5G Registration

In a 5G standalone system, principal functions include the gNodeB, Access and Mobility Management Function (AMF), Authentication Server Function (AUSF), Unified Data Management (UDM), Session Management Function (SMF), Policy Control Function (PCF) and User Plane Function (UPF).

A simplified 5G registration is:

1. The UE sends a NAS Registration Request through the gNodeB to an AMF, using a 5G-GUTI or SUCI.

2. If an old AMF is identified, the new AMF may request the existing UE context using the `Namf_Communication` service.

3. The AMF interacts with the AUSF and UDM for 5G-AKA or EAP-AKA′ authentication.

4. NAS security is activated after successful authentication.

5. The AMF obtains subscription, access and mobility restrictions from the UDM and policy functions.

6. Registration Accept supplies allowed tracking areas and, where required, a new 5G-GUTI.

7. PDU session establishment is subsequently coordinated by the SMF, which controls UPF forwarding rules.

During inter-AMF mobility, UE context—including security state, PDU-session references and policy information—must be transferred or reconstructed. The target AMF coordinates with SMFs and radio nodes so that control-plane relocation does not unnecessarily disrupt the user plane.

2.3 Roaming

A subscriber roams when served by a visited public land mobile network rather than the home network. Roaming requires identity verification, policy exchange, charging and trust between operators.

In LTE, the visited MME accesses the home HSS through Diameter-based S6a signalling. User traffic may be home routed through an S8 tunnel to the home P-GW or locally broken out where agreements and policy permit.

In 5G roaming, a visited AMF may interact with home-network AUSF and UDM functions. Inter-operator service-based signalling is protected through Security Edge Protection Proxies (SEPPs), particularly across the N32 interface. A home-routed PDU session can carry traffic through visited and home UPFs using an N9 interconnection. Local breakout can reduce latency but complicates policy, charging, lawful access and security governance.

3. Authentication, Authorization and Tunnelling

3.1 Authentication and Key Agreement

Authentication establishes confidence in an identity; authorization determines what that identity may access. They must not be treated as equivalent.

AKA protocols use a long-term subscriber secret held in the secure element and home network. Challenge-response calculations avoid transmitting the secret. Sequence numbers and freshness checks resist replay attacks. Successful authentication produces derived keys for integrity protection and encryption.

5G strengthens privacy through concealed identifiers and introduces explicit serving-network binding in key derivation. Nevertheless, security depends on correct certificate management, inter-operator trust, implementation quality and protection against signalling downgrade or denial-of-service attacks.

3.2 Tunnelling and Mobility Anchors

A tunnel encapsulates a packet inside another packet so that it can traverse a network independently of the endpoint’s current radio location. Examples include:

• GTP-U tunnels in LTE and 5G core networks;
• Mobile IPv6 tunnels between a home agent and mobile node;
• Proxy Mobile IPv6, where network entities manage mobility on behalf of the terminal; and
• encrypted overlays such as IPsec tunnels where confidentiality is required.

A mobility anchor maintains a stable address or session while forwarding packets toward the current attachment point. Anchoring simplifies session continuity but can create indirect routes, additional latency, congestion and a single point of concentration. Distributed mobility management and local UPFs reduce path stretch, although anchor relocation then requires careful session and policy transfer.

4. Location Tracking and Paging

4.1 Tracking Areas

Cells are grouped into location or tracking areas. An idle device updates the network when it leaves its assigned area or tracking-area list. Larger areas reduce update frequency but increase paging load; smaller areas do the reverse.

Tracking-area lists reduce excessive updates near a single boundary by allowing a UE to move among several accepted areas. Poorly designed lists can create registration storms, paging congestion or uneven MME/AMF load.

4.2 Correct Paging-Probability Model

A terminal is normally located in only one cell at a given instant. Paging more cells therefore does not create independent reception attempts. Let

• \(p_i\) be the posterior probability that the terminal is in cell \(i\), with \(\sum_i p_i=1\);
• \(S\) be the set of cells paged in a particular round; and
• \(q_i\) be the probability that a page is successfully decoded, conditional on the terminal being in cell \(i\).

The probability of successful paging in that round is

\[

P_{\mathrm{success}}(S)=\sum_{i\in S}p_iq_i.

\]

Thus,

\[

P_{\mathrm{miss}}(S)=1-\sum_{i\in S}p_iq_i.

\]

If all paged cells have the same decoding probability \(q\), then

\[

P_{\mathrm{success}}(S)=q\sum_{i\in S}p_i.

\]

The expression \((1-q)^n\) is applicable only to \(n\) independent decoding attempts when the correct paging location is already covered in every attempt. It is not the miss probability obtained merely by paging \(n\) different cells.

Worked Example 1: Sequential Paging

Suppose posterior location probabilities for five cells are

\[

(0.45,0.25,0.15,0.10,0.05),

\]

and conditional decoding success is \(q=0.98\) in every cell. Paging the two most likely cells first gives

\[

P_{\mathrm{success}}=0.98(0.45+0.25)=0.686.

\]

Therefore,

\[

P_{\mathrm{miss}}=1-0.686=0.314.

\]

If the remaining three cells are paged in a second round, the total success probability after both disjoint rounds is \(0.98\), assuming the terminal does not move between rounds. The residual 0.02 represents decoding failure, not location uncertainty.

4.3 Paging Strategies

• Blanket paging: Page every cell in the tracking area simultaneously. It minimizes search delay but consumes substantial radio capacity.
• Sequential paging: Page likely cells first and expand the search if necessary.
• Velocity-based paging: Search along a predicted movement corridor.
• Profile-based paging: Rank cells using historical activity.
• Adaptive paging: Adjust paging groups according to congestion, application urgency and uncertainty.

Sequential paging is beneficial only when location probabilities are sufficiently non-uniform and the additional latency is acceptable.

5. Mobility and Signalling-Cost Models

5.1 Fluid-Flow Boundary-Crossing Model

Consider a mobile moving at speed \(v\) in an area of size \(A\), with directions uniformly distributed over \([0,2\pi)\). Let the region have perimeter \(P\). Under spatially uniform terminal density and isotropic direction, the mean outward boundary-crossing rate per terminal is

\[

\lambda_c=\frac{vP}{\pi A}.

\]

Here, \(v\) has units of distance per time, \(P\) has units of distance, and \(A\) has units of distance squared; hence \(\lambda_c\) has units of inverse time.

For geometrically similar regions, \(P=c\sqrt{A}\), where \(c\) is a dimensionless shape factor. Therefore,

\[

\lambda_c=\frac{c}{\pi}\frac{v}{\sqrt{A}}=k\frac{v}{\sqrt{A}},

\]

where \(k=c/\pi\). This scaling is not valid for arbitrary irregular regions or strongly directional mobility.

Worked Example 2: Location-Update Rate

A square tracking region has area \(A=25\ \text{km}^2\), perimeter \(P=20\ \text{km}\), and users move isotropically at \(v=36\ \text{km/h}\). The estimated crossing rate is

\[

\lambda_c=\frac{36\times20}{\pi\times25}=9.17\ \text{h}^{-1}.

\]

The corresponding mean residence time is

\[

E[T_r]=\frac{1}{\lambda_c}=0.109\ \text{h}=6.54\ \text{min}.

\]

The model is a population-average approximation; a commuter travelling along a fixed road may have a very different residence time.

5.2 Update–Paging Cost Optimization

Let a tracking region have area \(A\), each cell have area \(a_c\), and calls or downlink sessions arrive at rate \(r\) per user. Assume:

• update rate \(kv/\sqrt{A}\);
• update signalling cost \(c_u\) per update;
• paging cost \(c_p\) per paged cell; and
• blanket paging of approximately \(A/a_c\) cells.

The expected signalling cost per user per unit time is

\[

C(A)=c_u\frac{kv}{\sqrt{A}}+c_pr\frac{A}{a_c}.

\]

Writing \(\alpha=c_ukv\) and \(\beta=c_pr/a_c\),

\[

C(A)=\alpha A^{-1/2}+\beta A.

\]

Differentiating and setting the derivative to zero gives

\[

-\frac{\alpha}{2}A^{-3/2}+\beta=0,

\]

so the continuous optimum is

\[

A^*=\left(\frac{\alpha}{2\beta}\right)^{2/3}.

\]

Because \(d^2C/dA^2=3\alpha A^{-5/2}/4>0\), this stationary point is a minimum. Operational design must round it to feasible cell groupings and account for nonuniform traffic.

Worked Example 3: Optimal Tracking-Area Size

Let \(c_u=6\) signalling units, \(k=4/\pi\), \(v=30\ \text{km/h}\), \(c_p=1\), \(r=2\ \text{h}^{-1}\), and \(a_c=0.5\ \text{km}^2\). Then

\[

\alpha=6\left(\frac{4}{\pi}\right)(30)=229.18,

\qquad

\beta=\frac{1\times2}{0.5}=4.

\]

Hence

\[

A^*=\left(\frac{229.18}{8}\right)^{2/3}=9.36\ \text{km}^2.

\]

The result is a planning estimate, not a universal optimum: paging-channel capacity, topology, traffic hotspots and AMF/MME distribution may change the preferred design.

5.3 Markov and Predictive Models

A discrete mobility model can represent cells as states of a Markov chain. If \(P_{ij}\) is the probability of moving from cell \(i\) to cell \(j\), a current probability vector \(\boldsymbol{\pi}_t\) evolves as

\[

\boldsymbol{\pi}_{t+1}=\boldsymbol{\pi}_t\mathbf{P}.

\]

The predicted probabilities can rank cells for paging. A first-order Markov model ignores longer history, time of day and intent. Hidden Markov models, recurrent neural networks and trajectory transformers can capture richer patterns, but require representative data and privacy controls.

6. Handoff Concepts and Classification

A handoff or handover transfers an active connection from one serving resource to another.

6.1 Horizontal and Vertical Handover

• Horizontal handover: Movement between access points using the same access technology, such as one LTE cell to another.
• Vertical handover: Movement between different technologies or administrative domains, such as 5G to Wi-Fi.

Horizontal decisions are usually dominated by radio quality and load. Vertical decisions may additionally consider price, energy use, security, throughput, application policy and user preference.

6.2 Hard and Soft Handover

• Hard handover: The old radio link is released before or approximately when the new link is established—“break before make.” LTE traditionally uses hard handover, although packet forwarding and preparation reduce disruption.
• Soft handover: The terminal simultaneously communicates with multiple cells using the same carrier or compatible radio links—“make before break.” This was characteristic of CDMA systems.
• Softer handover: Diversity occurs among sectors of the same base station.

With ideal maximal-ratio combining and independently faded branches, output signal-to-noise ratios add:

\[

\gamma_{\mathrm{out}}=\sum_{i=1}^{m}\gamma_i.

\]

Actual gain may be lower because interference and fading can be correlated. Soft handover improves link robustness but consumes multiple radio resources and demands tight synchronization.

Modern 5G mechanisms blur the simple taxonomy. Dual connectivity, conditional handover and Dual Active Protocol Stack (DAPS) handover can retain selected source and target resources simultaneously, reducing interruption without reproducing classical CDMA soft handover.

7. Handover Decisions and Performance Models

7.1 Measurement-Based Triggering

A common trigger compares filtered target and serving measurements. Handover may be considered when

\[

M_T>M_S+H

\]

continuously for a time-to-trigger interval \(T_{\mathrm{TTT}}\), where \(M_T\) and \(M_S\) are target and serving measurements and \(H\) is hysteresis.

A simple first-order measurement filter is

\[

y[n]=(1-a)y[n-1]+ax[n],\qquad 0<a\leq1,

\]

where \(x[n]\) is the new sample. Filtering, hysteresis and time-to-trigger suppress ping-pong handovers, but excessive values delay mobility response and can cause radio-link failure.

Important metrics include:

• handover success and failure rates;
• interruption time;
• ping-pong rate;
• radio-link failure rate;
• packet loss and reordering;
• signalling messages per handover;
• target-cell resource utilization; and
• energy consumption.

7.2 Queueing Delay in Mobility Control

Control entities may become congested during mass mobility events. If handover requests are approximated as a Poisson process with arrival rate \(\lambda\), service times are exponential with rate \(\mu\), and one server processes requests, an M/M/1 model applies when \(\lambda<\mu\).

The mean time in the system is

\[

E[T]=\frac{1}{\mu-\lambda}.

\]

For \(\lambda=40\) requests/s and \(\mu=50\) requests/s,

\[

E[T]=\frac{1}{10}=0.1\ \text{s}.

\]

The utilization is \(\rho=0.8\). Under the same M/M/1 assumptions, the stationary sojourn time has tail probability

\[

P(T>D)=e^{-(\mu-\lambda)D}.

\]

For a deadline of \(D=0.15\) s, the probability of exceeding the deadline is

\[

e^{-10(0.15)}=0.223.

\]

Real control traffic may be bursty and multi-stage; M/G/1, network-of-queues or simulation models may therefore be more appropriate.

7.3 Signalling-Cost Model

If a user experiences handovers at rate \(\lambda_h\), each handover exchanges an expected \(s_h\) signalling units, and a failed handover incurs penalty \(c_f\) with probability \(p_f\), a basic expected cost rate is

\[

C_h=\lambda_h(s_h+p_fc_f).

\]

The model makes explicit that minimizing message count alone is insufficient: reliability penalties, interruption and user-plane forwarding must also be valued.

8. LTE and 5G Handover Procedures

8.1 LTE X2-Based Handover

A simplified LTE X2 handover proceeds as follows:

1. The source eNodeB configures measurements.

2. The UE sends a Measurement Report.

3. The source decides to hand over and sends an X2 Handover Request to the target.

4. The target performs admission control and returns Handover Request Acknowledge with radio-resource configuration.

5. The source sends an RRC handover command to the UE and may begin forwarding buffered packets.

6. The UE accesses and synchronizes with the target cell.

7. The target sends a Path Switch Request to the MME.

8. The MME updates the S-GW path, and the target confirms completion.

9. Sequence-number status and buffered packets are transferred as required; source resources are released.

If X2 connectivity is unavailable, an S1-based procedure routes preparation signalling through the MME. Inter-MME or inter-S-GW mobility additionally requires core-network relocation.

8.2 5G Xn- and N2-Based Handover

In an Xn-based 5G handover, source and target gNodeBs exchange preparation messages directly. The target admits relevant PDU-session resources, and the UE receives an RRC reconfiguration containing target access information. After successful target access, the target requests path switching through the AMF, which coordinates with affected SMFs and UPFs.

An N2-based handover is used when direct Xn preparation is unsuitable. The AMF relays handover-required and handover-request signalling. If AMF relocation is needed, source and target AMFs exchange or retrieve UE context and coordinate PDU-session continuity.

Conditional handover allows the source to preconfigure one or more candidates. The UE executes a prepared handover when a condition becomes true, reducing reaction delay. DAPS handover maintains source and target protocol stacks for part of the transition, lowering interruption at the cost of duplicate resources and more complex packet handling.

8.3 Context Transfer

Context transfer avoids rebuilding all state from the beginning. Depending on the procedure, transferred information can include:

• security key hierarchy state, such as next-hop information and counters;
• bearer or PDU-session identifiers;
• QoS flows and packet-filter rules;
• PDCP sequence numbers and reordering state;
• buffered downlink packets;
• charging and policy references;
• UE capability information; and
• application or multi-access edge-computing state.

Security context must be fresh and bound to authorized entities. Unprotected or excessive context transfer can enable impersonation, replay or privacy leakage. Edge application migration may dominate latency even when radio and core handover complete quickly.

9. Illustrative Case: Mobility Design for a Smart-Port Network

Background

This fictional case concerns a container port using autonomous vehicles, handheld terminals and video analytics. A private 5G network provides deterministic coverage, while enterprise Wi-Fi serves warehouses. Vehicles cross 5G cells frequently and occasionally move into Wi-Fi-dominant indoor areas.

Problem

The operator observes ping-pong handovers near warehouse doors, delayed paging of idle handheld devices and interruptions when video-processing sessions move between edge sites.

Analysis

Logs show that weak hysteresis causes repeated 5G cell changes. A blanket paging scheme pages 24 cells even though 80% of idle devices are found in six operational zones. Vertical switching to Wi-Fi is triggered by instantaneous signal strength without checking network load or security status. Radio handover completes before the application state has migrated, so video sessions still pause.

Approach and Solution

The engineering team implements:

1. filtered measurements with class-specific hysteresis and time-to-trigger settings;

2. conditional handover for fast vehicles approaching known cell boundaries;

3. probability-ranked sequential paging, with an immediate second-stage expansion for urgent calls;

4. a vertical-handover policy using signal quality, predicted dwell time, Wi-Fi load, authentication state and application latency;

5. coordinated transfer of PDU-session, security, PDCP and edge-application context;

6. local UPF placement to limit path stretch; and

7. dashboards monitoring interruption, paging success, failure, ping-pong and signalling load.

Outcome

The design reduces unnecessary handovers and paging transmissions while maintaining an emergency-call latency threshold. Application interruption falls only after edge-state migration is coordinated with network handover, demonstrating that radio continuity alone does not guarantee service continuity.

Learning Points

• Mobility optimization must be service-aware rather than purely signal-based.
• Paging order should reflect conditional location probabilities.
• Vertical handover requires policy and security evaluation.
• Context transfer must include application state when edge services are involved.
• Improvements in one metric can worsen another; multi-objective monitoring is essential.

10. Challenges, Governance and Contemporary Developments

Dense heterogeneous networks increase handover frequency and make measurement interpretation difficult. Millimetre-wave links can deteriorate rapidly under blockage, while non-terrestrial networks introduce moving coverage footprints and large propagation delays. Network slicing creates additional requirements for slice continuity and admission control.

AI can predict trajectories, rank paging cells and optimize mobility parameters. However, biased training data, concept drift and opaque decisions may create unequal service or unstable control. AI recommendations should be constrained by safety rules, tested against rare events and monitored for drift.

Location records are sensitive personal data. Operators should apply data minimization, retention limits, purpose limitation, access control, audit logging and lawful disclosure processes. Cross-border roaming must respect applicable privacy, cybersecurity and telecommunications regulation. Temporary identifiers, encryption and aggregation reduce risk but do not eliminate it.

Recommended engineering practices include:

• design tracking areas using measured mobility and traffic distributions;
• protect permanent identifiers and refresh temporary identifiers appropriately;
• validate paging models against real location uncertainty;
• tune hysteresis and time-to-trigger jointly rather than independently;
• test overload, mass-mobility and control-plane failure scenarios;
• secure all context-transfer interfaces;
• coordinate radio, transport, core and edge mobility; and
• evaluate latency, reliability, energy, signalling and fairness together.

Chapter Summary

Mobility management integrates registration, location updating, paging, roaming, authentication, tunnelling and handoff. LTE and 5G use temporary identities, authenticated registration and distributed databases to maintain subscriber and session context. Paging performance depends on the probability that the terminal lies within the paged cell set and on conditional decoding success; different cells are not independent paging attempts.

Tracking-area design balances update and paging costs. Fluid-flow, Markov and signalling-cost models provide useful approximations when their assumptions and units are respected. Handoffs may be horizontal or vertical and hard or soft. Their performance depends on measurement filtering, hysteresis, time-to-trigger, admission control, signalling delay and context transfer. LTE X2/S1 and 5G Xn/N2 procedures coordinate radio preparation, path switching and resource release. Contemporary systems increasingly employ conditional handover, dual connectivity, edge-state migration and predictive analytics, while requiring rigorous privacy, security and governance controls.

Key Terms

Registration: The process by which a device announces availability and establishes mobility state with a network.

Location Update: A notification that a terminal’s registered location area has changed.

Paging: Network signalling used to locate and alert an idle terminal.

Tracking Area: A group of cells within which a device can usually move without updating its location.

Roaming: Use of a visited operator’s network by a subscriber of another home network.

Authentication: Verification of the claimed identity of a user, device or network.

Authorization: Determination of the resources and services an authenticated entity may use.

SUCI: A privacy-preserving concealed representation of a 5G subscriber’s permanent identity.

GUTI: A temporary identity used to reduce exposure of a permanent subscriber identity.

Mobility Anchor: A network function maintaining stable session reachability while attachment changes.

Tunnelling: Encapsulation of packets for transport through an intermediate network.

Horizontal Handover: Transfer between access points using the same access technology.

Vertical Handover: Transfer between different access technologies or domains.

Hard Handover: A handover in which the old radio link is released before or around establishment of the new link.

Soft Handover: Simultaneous use of multiple radio links during mobility.

Hysteresis: A measurement margin used to prevent unstable handover reversals.

Time to Trigger: The interval for which a handover condition must persist before execution.

Context Transfer: Movement of security, bearer, protocol, policy or application state between serving entities.

Review Questions

Short Answer Questions

1. Distinguish registration from location updating.

2. Why does increasing the number of cells paged not create independent reception attempts?

3. What is the purpose of a mobility anchor?

4. Differentiate horizontal and vertical handover.

5. What functions do hysteresis and time to trigger perform?

Long Answer Questions

1. Explain the LTE attach procedure and identify the mobility databases and security operations involved.

2. Describe 5G registration and explain the roles of the AMF, AUSF, UDM, SMF and UPF.

3. Compare hard, soft, conditional and DAPS handover in terms of continuity, resource usage and complexity.

4. Explain LTE X2-based and 5G Xn-based handover signalling, including path switching and context transfer.

5. Critically discuss privacy, security and governance issues associated with mobility analytics and roaming.

Analytical / Application Questions

1. A terminal has cell-location probabilities \((0.50,0.30,0.15,0.05)\), and page decoding succeeds with probability 0.96. Calculate the first-round success and miss probabilities when the first two cells are paged.

2. For a square region of area \(16\ \text{km}^2\), users travel isotropically at \(24\ \text{km/h}\). Use the fluid-flow model to estimate the mean boundary-crossing rate and residence time.

3. Design a handover policy for an industrial robot moving between private 5G and Wi-Fi. Justify the metrics, security checks and context that should be transferred.

Multiple Choice Questions with Answers

Question 1

Which expression gives the success probability when a set S of cells is paged once?

A. The sum of p_i q_i over cells in S

B. One minus the product of all p_i

C. The number of cells in S divided by total cells

D. One minus (1-q) raised to the number of cells

Correct Answer: A. The sum of p_i q_i over cells in S

Question 2

When is (1-q)^n a valid paging miss expression?

A. Whenever n different cells are paged

B. For n independent decoding attempts that all cover the correct location

C. Only when the terminal moves after every page

D. Whenever all cells have equal location probability

Correct Answer: B. For n independent decoding attempts that all cover the correct location

Question 3

A square tracking region has area 25 km² and perimeter 20 km. For isotropic motion at 36 km/h, what is the approximate boundary-crossing rate?

A. 0.35 per hour

B. 2.29 per hour

C. 9.17 per hour

D. 28.65 per hour

Correct Answer: C. 9.17 per hour

Question 4

Which 5G function primarily manages registration and access mobility?

A. UPF

B. AMF

C. AUSF

D. PCF

Correct Answer: B. AMF

Question 5

Which mechanism conceals a 5G subscriber's permanent identity over the radio interface?

A. SUCI

B. GTP-U

C. PDCP

D. N9

Correct Answer: A. SUCI

Question 6

Which statement best characterizes a vertical handover?

A. Transfer between sectors of one base station only

B. Transfer between access technologies such as 5G and Wi-Fi

C. Transfer that always maintains simultaneous radio links

D. Cell reselection by an idle terminal within one cell

Correct Answer: B. Transfer between access technologies such as 5G and Wi-Fi

Question 7

In an M/M/1 system with arrival rate 40 requests/s and service rate 50 requests/s, what is the mean system time?

A. 20 ms

B. 25 ms

C. 80 ms

D. 100 ms

Correct Answer: D. 100 ms

Question 8

What is the principal purpose of handover hysteresis?

A. To increase permanent-identity exposure

B. To suppress ping-pong handovers caused by small measurement fluctuations

C. To eliminate authentication during mobility

D. To force blanket paging

Correct Answer: B. To suppress ping-pong handovers caused by small measurement fluctuations

Question 9

Which LTE procedure directly exchanges handover-preparation signalling between source and target eNodeBs?

A. X2-based handover

B. S6a authentication

C. S8 roaming

D. NAS attach

Correct Answer: A. X2-based handover

Question 10

Why can mobility-anchor relocation be beneficial?

A. It guarantees that authentication is unnecessary

B. It eliminates every form of context transfer

C. It can reduce indirect routing and user-plane latency

D. It converts all hard handovers into soft handovers

Correct Answer: C. It can reduce indirect routing and user-plane latency