Selected Papers

A Cost-effective Ubiquitous WirelessAccess Network
Masayoshi Nakayama†, Shuichi Yoshino,
and Masashi Shimizu
Abstract
Public wireless LAN service businesses, if they are to be a success, will have to be able to expand theirservice areas. This paper describes a cost-effective public wireless access system that combines low-costprivate wired access links with wireless LAN networks. For this purpose, we propose an authentication
scheme with certificates for public terminals and a link-sharing scheme including bandwidth control.
The two-stage authentication scheme protects the access link from unauthorized users. The multiple
wireless LANs making up the wireless network can provide several service classes. We evaluated the
proposed system by computer simulation and the results indicate that it effectively utilizes the accesslinks. Some equipment for this system has been developed and successfully tested.

1. Introduction
Many consumers now have inexpensive, broadband(over 1 Mbit/s) access links to the Internet. The wireless LAN market is also expanding very rapidly due
to its convenience and flexibility. Of course, seamlessconnectivity to the Internet is required, and to meetthis market need, several wireless LAN access services have been developed and put into commercial
service.
On the other hand, the capital investment needed toconstruct wireless networks has recently become asignificant burden on operators facing strong competition. For operators, constructing many base stations
to expand the wireless coverage area has been regarded as an important means of increasing the number ofsubscribers. In particular, when providing a wireless
LAN service, such as a hot-spot service, the operator
must install a great many base stations because each
one covers only a very small area. Consequently, atthis early stage of the business, operators must invest
enough capital to construct base stations, and at thesame time, win customers. Some startup companies† NTT Network Innovation Laboratories
Yokosuka-shi, 239-0847 Japan
E-mail: nakayama.masayoshi@lab.ntt.co.jp

Vol. 2 No. 1 Jan. 2004

have appeared in the wireless market with innovative
schemes for expanding the coverage area. Boingo
Wireless Inc. [1] has started offering commercial
roaming services between wireless Internet accessproviders to expand coverage areas cost-effectively.
In this way, Internet access service providers and network operators are forcing a change in the traditional
cost strategy by making significant price reductions
in a competitive market.
Against this background, NTT has developed a new
network concept with the aim of establishing a costeffective ubiquitous network by combining wired
access links and wireless networks. This paper
describes the proposed network, in which a public
network is constructed from private networks, and its
key technologies, which are authentication and link
sharing. We evaluated the effectiveness of the proposed network concept by computer simulation andassessed the performance of prototype equipment todetermine its feasibility.
2. System concept
We decided that the following three requirements
had to be met by the wireless network to achieve a
cost-effective nomadic broadband network.
• Provide multi-Mbit/s access links
55Selected Papers• Provide seamless access to the network, indoors
and outdoors• Use popular and easy-to-install terminal equipment
We chose the wireless LAN (IEEE802.11 [2]) as
the wireless network considering its low construction
cost and availability. However, the conventional public wireless access systems are constructed by operators and the construction cost for preparing enoughcoverage for consumers is huge. Moreover, the operator must obtain the right to install the base station ateach location, which can be expensive, and construct
cables to the base stations. Thus, it is difficult to start
up services of this kind. To enable an operator to
expand the service area economically, we propose toutilize existing private wireless systems for publicuse.
The service concept is shown in Fig. 1. Conventional wireless LAN systems are constructed separately, and wireless users can use their wireless terminals only in their private wireless network area andin the public area. That is, they cannot use their wireless terminals in another user’s private wireless network area as part of the public wireless network area.
Private wireless networks do not always use all of
their available bandwidth and operators usually purchase the surplus bandwidth for the public network.
The basic concept of the proposed service is that if
users install a gateway connecting a private networkwith a wired access link, they can access public networks via other gateways. The system configurationis shown in Fig. 2. The terms owners and members
are explained in the next paragraph. It consists of i)
wired access links for owners, ii) a core network, iii)
wireless access networks which allow members toaccess the core network, iv) gateways, v) edge nodes,

and vi) an authentication server installed in the core
network by the operators. The typical wireless LAN
coverage is not large and the service areas of the wireless networks cannot be located consecutively like atypical wireless hot-spot service, considering theinvestment cost. Such a system need not provide a
handover function to keep the connection while theuser moves to another service area. That is, even if auser can move to an adjacent wireless service area,
the user must re-connect to the wireless access network in the system that we consider.
The following business model (Fig. 3) achieves
both a cost-effective network and an expanded coverage area. Subscribers to a private network can choose
to become owners by installing a gateway and making a contract with an operator. This gives them theright to access wireless public networks via otherowners’ gateways and allows the operator to leasepart of the bandwidth of the owner’s wired accesslinks to accommodate the wireless public network.
Ordinary public users, whom we call members, canthen use them to access the core network. These days,
broadband access services for consumers are highly
competitive and prices are low. Therefore, operatorsneed to reduce costs. They could reduce the cost of
this system by sharing the cost of the base stations
with owners.
However, the success of this model depends on
operators giving attractive incentives to owners. We
propose the following revenue sharing scheme as theowner’s incentive. The operator measures theowner’s contribution to the networks based on traffic
information, such as the number of accessing members and the quantity of data transmitted by members.
The operator then distributes profits among owners inaccordance with these contributions. This should beCore network

Private#1

Private#2

PublicCore network

Private#3

Private#1(a) Conventional

Private#2

PublicPrivate#3(b) Proposed

Fig. 1. Service concept.

56

NTT Technical Review

Selected Papers

Authentication server

Edge node

Owner A’s
gatewayCore network

Wiredaccess link

Edge node

Edge nodeWiredaccess link Owner B’s
gateway

Wiredaccess link
Privatenetwork

Link sharing
schemeOwner MT
Private network

Publicgateway
Member MT

Owner MT

Publicnetwork

Authentication
schemeMember MT

Member MT

Member MT
Public network
Home/coffee shop etc.
(private-use gateway)
MT: mobile terminal

Member MT
Public network

Member MT

Department store/station etc.
(office-use gateway)

Another space: Wireless link

Fig. 2. System configuration.

Mobile terminal
Gateway
Edge nodeCore
network

Wired access link

Wireless LAN

Private network

Accommodating
public use

Mobile terminal
Gateway

Edge node
Wired access link

Private networkCore
network

Puplic network
Using surplus band

Owner

Incentive

Operator

Fig. 3. Business model.

Vol. 2 No. 1 Jan. 200457

Selected Papers

sufficient incentive for an owner to rent out his or her
access link’s bandwidth.
As described above, the new entity in this scheme isthe owner, who is the go-between between the operators and the subscribers. For a user to willingly installa gateway to become an owner, not only an incentive
but also two more key conditions are needed: security and guaranteed bandwidth. It will be necessary toestablish a link-sharing method to secure the owner’s
bandwidth. Additionally, owners want to keep thesame security level as the private wireless network
and want to avoid unauthorized access via their gateway by fraudulent users. The operator devolves partof its authority to the owners, and this authority is
maintained by giving the proposed network a method
for authenticating its members.
3. Link sharing scheme
Access links are shared by owners and members.
Thus, some bandwidth must be reserved for owners
to maintain an acceptable degree of Internet connectivity. In our access link control scheme, both thegateways and edge nodes control the transmission
speed of packets bound for the access links. Thisshould be able to provide bandwidth control for both
asymmetric traffic and one-way traffic. Because thewireless LAN network’s access scheme is one of random access, the network cannot precisely control its
bandwidth. Consequently our wireless network configuration scheme has a wireless network consistingof several wireless LANs, each using a different frequency.
The proposed scheme is shown in Fig. 4. It divides
wireless LANs physically and part of the access link
logically to accommodate a public network made up
of private networks. The owner avoids degradedthroughput by holding an access competition in thewireless LAN network. When a mobile terminal(MT) enters the area controlled by a gateway, it
should select a frequency (i.e., a wireless LAN network). To select an appropriate one, it detects theextended service set ID (ESSID) of each wireless
LAN within the gateway. If there is a wireless LAN
that has the MT owner’s ESSID, the MT selects thatwireless LAN for private use. If none of the wirelessLANs has the MT owner’s ESSID, then it selects one
at random for public use. Moreover, we define bandwidth control signals transmitted between the gateway and edge router so that the bandwidth can becentrally managed by the owners. This scheme
ensures the consistency of the bandwidth management data kept in the equipment and greatly facilitates maintainability.
4. Authentication scheme
The authentication scheme must identify users andensure that the owner’s access to the core network is
not used as a means of unauthorized access. We use amutual authentication method based on certificates toprevent the gateway from asking the core network

Wired access link
Edge
node

Gateway

Private network’s
traffic

Owner’s private
network
Wireless LAN#1

Public network’s
traffic

Public network
Wireless LAN#2
Bandwidth control

Logical partition

Physical division

Fig. 4. Proposed link-sharing scheme.

58

NTT Technical Review

Selected Papers

4.2 Mobile terminal
authentication
The mobile terminal first searches for a frequency carrying the beacon signal based on the ESSID to
Mutualaccess the public network via
authentication
another owner’s gateway. When it
detects a public network frequency,
the mobile terminal becomes assoMobile terminal
ciated with this gateway to commuGateway authentication
nicate on the media access control(MAC) layer. After that, the mobile
802.11 association
Repeat periodicallyterminal and gateway mutuallyauthenticate each other by exchanging certificates. The gateway asks
the authentication server for authoMutual
rization to authenticate the mobile
authentication
terminal. If this is granted and theon MAC layer
Accessgateway successfully authenticatesauthorization
the mobile terminal, it gives a wired
equivalent privacy (WEP) key to
WEP key
the terminal. All packets for mutual
authentication are defined in the
Mobile terminal authentication
MAC-layer frame and are terminated at the gateways. IEEE802.1x [3]Fig. 5. Proposed authentication scheme.
technology has been used for similar authentication procedures inabout public users. We also use a two-stage authentiwireless networks and is employed as a standard
cation scheme to prevent access to the link by unaufunction in Windows XP and Windows CE, popular
thorized users (Fig. 5). Gateways and mobile termiterminals that can be used in this system without
nals accessing the member network have individual
modification or the installation of any additional procertificates including an individual public key, angrams. However, with IEEE802.1x technology,
individual secret key, and a public key obtained frombefore a gateway has authenticated a mobile terminal,a Certification Authority (CA).
it allows the mobile terminal to transmit authentication packets to the authentication server via access
4.1 Gateway authentication
links. Our scheme, on the other hand, does not allow
The gateways gather traffic information to measure
unauthorized terminals to transmit any packets over
the owner’s contribution in the business model. One
links. Furthermore, the mobile terminals can detectobvious problem is that without adequate counterunauthorized gateways because the authentication ismeasures, unscrupulous gateway owners could reap
performed in both directions. Mobile terminals
benefits by falsely manipulating traffic information.
should run this authentication periodically to mainTo eliminate this possibility, we propose that thetain the owner’s security level.
authentication server should periodically authenticate
5. Simulation of link sharing scheme
the gateways. Owners install certificates and publickeys on their gateways. Gateways use certificates for
We evaluated the proposed scheme by computer
mutual authentication with an authentication server
simulation. We defined two simulation models (Fig.
during startup. Afterwards, member terminals can
6). Model #1 consists of a wired access link and aaccess the Internet via the owner’s gateways. Mutual
wireless LAN network. Model #2 is configured withauthentication between gateways and the authenticaa wired access link and two wireless LAN networks
tion server is repeated periodically to maintain theoperated by one gateway. In Model #1, all mobile tersecurity level of the network.
minals are in the same wireless LAN network. The
Gateway

Authentication server

MAC: media access control
WEP: wired equivalent privacy

Vol. 2 No. 1 Jan. 200459

Selected Papers

Ftp
server

UDP CBR
server100Base-T

Ftp
server100Base-T
Edge node

10Base-T

Edge node

Packet shaping

10Base-T

Gateway

Packet shaping

Gateway

Memberterminal
MT#2

Owner
terminal
MT#1

Memberterminal
MT#2

Owner
terminal
MT#1

IEEE802.11b wireless LAN

Memberterminal
MT#3

Two IEEE802.11b wireless LANs

Model #1
(single wireless network)

Model #2
(two wireless networks)

Fig. 6. Simulation models.

wired access links are 10Base-T Ethernet links, andthe wireless networks are IEEE802.11b networks.
The bandwidth of the access link is controlled bydefining the committed access rate (CAR) for each
network. Applications transmitted over the networks
are ftp (file transfer protocol) and UDP (user datagram protocol) constant bit rate (CBR) traffic. For
such traffic, the application server transmits UDP
packets to the mobile terminals. Mobile terminals‘get’ and ‘put’ files by using ftp. We evaluated theaverage data transmitting/receiving rate of the mobile
terminals on the MAC layer and the utilization of theaccess link.
5.1 Bandwidth control pointFirst, we estimated the bandwidth control for
downlink traffic. The gateway and edge node wereselected as the bandwidth controlled points in Model#1. In case 1, the gateway controlled the downlink
bandwidth. Case 2 used our access link control
scheme and the edge node controlled the access link.
60

There were two mobile terminals in the wireless network. In this simulation, the downlink bandwidth forthe member network in the access link was 1 Mbit/s.
The owner’s bandwidth was not limited. Member
mobile terminal (MT#2) received UDP CBR packets
and owner terminal (MT#1) got files by ftp. The simulation results are shown in Fig. 7.
Although the CBR traffic transmission rateincreased, the data reception rate of MT#2 was kept
constant by limiting the downlink bandwidth. There
were no differences between the two cases in thisregard. However, in case 1, the data receiving rate ofMT#1 decreased with increasing UDP CBR traffic
because the UDP CBR traffic occupied the bandwidth of the access link and MT#1 did not use enoughbandwidth for the ftp protocol. Thus, we could confirm that the proposed scheme can control the bandwidth of one-way traffic such as streaming traffic.
5.2 Wireless network configuration
In the next simulation, we estimated the advantage
NTT Technical Review

Selected Papers

Model #1 (single WLAN)
Model #2 (two WLANs)

Case 1 (controlling at a gateway)
Case 2 (controlling at an edge node)

6

6

100

Case 2

Data receiving rate (Mbit/s)

5

MT#1

4
Case 1
3

2
MT#2

Model #2 is about 1.2 times
higher than Model #1

5

80
Utilization

4
60
MT#1 data
receiving rate3

40
MT#2 data
receiving rate

2

Utilization of access link (%)

Data receiving/transmitting rate of MT (Mbit/s)

Uplink CAR for limited class = 1 Mbit/s

20

1
MT#3 data transmitting rate

10
Both cases
0

0

2
4
6
8
Data transmitting rate of UDP CBR traffic (Mbit/s)

10

0

1
2
3
4
Downlink CAR for member network (Mbit/s)

50Fig. 8. Effect of wireless LAN configuration.

Fig. 7. Effect of bandwidth control.

6. Developed equipmentof using two wireless networks. The bandwidth control points were a gateway and an edge router, and thesimulation models were Models #1 and #2. The
uplink bandwidth for the member network was 1
Mbit/s and the downlink bandwidth varied from 1 to
4 Mbit/s. The member’s mobile terminal (MT#1) andowner’s mobile terminal (MT#2) got files by ftp. The
member’s mobile terminal (MT#3) ‘put’ files by ftp.
The simulation results are shown in Fig. 8. The utilization of the access link using the two wireless networks was 10% more than that of the access link witha single wireless network. Furthermore, MT#1’s data
receiving rate for Model #2 was about 1.2 times higher than that of Model #1. In Model #1, the MT could
not reach the 10-Mbit/s wired access link efficiency
because the maximum throughput of the wireless
LAN (about 6 Mbit/s) was less than that of the accesslink, and there was access competition between member terminals and the owner’s terminal in the wirelessnetwork. On the other hand, in Model #2, the total
throughput of the wireless networks was larger thanthat of the access link, so the MT could effectively
utilize the bandwidth. The proposed wireless network
configuration scheme protected the owner’s bandwidth from the members’ accesses on an access network including wireless networks, so it can efficiently accommodate public networks on private networks.

The gateways have two 10/100-Mbit/s Ethernets(for the access link interface and the owner network
interface) and two IEEE802.11b wireless LANs. Theedge nodes have one core net interface and two accesslink interfaces. The gateways and edge nodes bothhave an IP packet routing function. The gateways also
have IP/MAC filtering and a DHCP (dynamic hostconfiguration protocol) server function. Figure 9shows the developed equipment and Table 1 shows
its specifications.
The gateways and edge nodes use a CBQ (classbased queuing) algorithm [4] as the packet scheduler
to provide accurate bandwidth control and effective
utilization of the access link. The CBQ algorithm has
the characteristic that if some classes have surplus
bandwidth, other classes can use it. The link-sharing
system uses the CBQ algorithm to provide effective
utilization of the access links. Furthermore, it is possible for the owner to consolidate the management of
the access link bandwidth because the gateways andedge nodes can exchange bandwidth-control signaling packets.

Vol. 2 No. 1 Jan. 2004

Fig. 9. Gateway and edge node equipment.

61Selected Papers

Table 1. Specifications of developed equipment.
Equipment Description
Gateway

Features

Specifications
IEEE802.11b compliant
10/100-Mbit/s Ethernet
Packet routing
Packet filtering
DHCP

Interfaces

10/100Base-T × 2
Wireless LAN × 2

Dimensions 430 mm (W) × 280 mm (D) × 50 mm (H)Edge node Features

10/100-Mbit/s Ethernet
Packet routing

Dimensions 430 mm (W) × 280 mm (D) × 50 mm (H)The authentication server, gateways, and authentication module have a mutual authentication function
based on X.509 [5] certificates. Therefore, they cancertify each other autonomously. These modules
complete mutual authentication within one second.
We conducted experiments to test the bandwidth
control performance of the equipment we developed.
Figures 10, 11, and 12 show the experimental setups
and results.
In the first experiment, to measure the packet forwarding performance of the devices, we evaluated thethroughput of an application running on mobile terminals. We assigned the downlink bandwidth of theaccess link for the member network. The applications

were ftp for the owner terminal and UDP CBR for themember terminal. The transmission rate of UDP CBR
was larger than the assigned bandwidth of the downlink for the member network. To prevent any decreasein throughput because of the wireless link characteristics, we replaced the wireless LAN by a 10base-T
Ethernet for the access network.
Figure 11 compares the assigned bandwidth withthe throughput of the MT’s application. The throughput of the member terminal did not exceed the specified bandwidth, and the total throughput of the accesslink was about 8 Mbit/s.
In the second experiment, we evaluated the utilization of the access link to estimate the bandwidth control performance. Traffic was only UDP CBR for themember network. Figure 12 compares the transmitted
packet length with the utilized bandwidth of theaccess link. Despite the change in transmitted packet
length, the equipment could control the utilized bandwidth, keeping it within its assigned limits.
7. Conclusion
We proposed a wireless system that combines
wired and wireless links allowing public ubiquitous
networks to be constructed from private networks.
We described the system’s authentication and linksharing schemes. The authentication scheme lets the
public network be accommodated by private net-

UDP CBR
serverFtp
server

UDP CBR
server100Base-T

100Base-T

Edge node

Edge node

10Base-T

Bandwidth
control

10Base-T

Gateway

Bandwidth
control

Gateway

10Base-T

Memberterminal
Owner
terminal

Memberterminal
First experiment

Second experimentFig. 10. Experimental setups.

62

NTT Technical Review

Selected Papers

8

Throughput (Mbit/s)

6

Ftp throughput of owner network

5
4
3
2

UDP CBR traffic throughput
of member network

Utilized bandwidth of access link (Mbit/s)

6

7

Assigned bandwidth
5 Mbit/s

5

4

4 Mbit/s

3

3 Mbit/s

2

2 Mbit/s

1

1 Mbit/s

1
0.5 Mbit/s
0
1
2
3
4
5
0
Assigned bandwidth of downlink for member network (Mbit/s)

Fig. 11. Packet forwarding performance comparison.

works and distributes profits among users by using
gateway authentication and a two-stage terminal
authentication process with certificates. The use of aclass-based queuing algorithm as the bandwidth control and multiple wireless networks means that the
proposed link-sharing scheme provides various classes of service on access networks including the wireless system. We have developed equipment for thisnetwork to explore the feasibility of the proposed
technologies and have shown that the equipment
developed to date has sufficient processing capacity
to provide two classes of service on a 10-Mbit/s
access link.
If operators adopt these technologies and our proposed business model, they will be able to use theirsubscriber’s private networks to establish a public
network. Such a network would be cost-effective andubiquitous.

0

0

500
1000
1500
Transmitted packet length (byte)

2000

Fig. 12. Bandwidth control performance comparison.

Masayoshi Nakayama
Senior Research Engineer, Wireless Systems
Innovation Laboratory, NTT Network Innovation Laboratories.
He received the B.E. degree in electrical engineering from Kobe University, Kobe in 1984. He
joined NTT Laboratories in 1984 and engaged in
R&D on satellite communication and Internet
systems and ad-hoc network systems. His current
interest is wireless networking technology for
ubiquitous services and mobile satellite Internet
systems. He is a member of the Institute of Electronics, Information and Communication Engineers (IEICE).

Shuichi Yoshino
Senior Research Engineer, Wireless Systems
Innovation Laboratory, NTT Network Innovation Laboratories.
He received the B.E. and M.E. degrees inmechanical engineering from Kanazawa University, Ishikawa in 1990 and 1992, respectively. He
joined NTT Laboratories in 1992 and engaged in
R&D on satellite Internet systems. His current
interest is wireless networking technology for
ubiquitous services. He is a member of IEICE.

References
[1]
[2]

[3]

[4]

[5]

Boingo Wireless, Inc., http://www.boingo.com/
IEEE, “LAN MAN standards of the IEEE computer society. Wireless
LAN medium access control (MAC) and physical layer (PHY) specification,” IEEE Standard 802.11, 1997.
IEEE, “Standards for local and metropolitan area networks: Standard
for port based network access control,” IEEE Draft P802.1X/D11,
Mar. 2001.
S. Floyd and V. Jacobson, “Link-sharing and resource management
models for packet networks,” IEEE/ACM Transactions on Networking, 3(4), Aug. 1995.
ITU-T “Recommendation X.509 Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks.”

Vol. 2 No. 1 Jan. 2004

Masashi Shimizu
Senior Research Engineer, Supervisor, Wireless Systems Innovation Laboratory, NTT Network Innovation Laboratories.
He received the B.E. and M.E. degrees inmechanical engineering from Keio University,
Yokohama in 1986 and 1988, respectively. He
joined NTT Laboratories in 1988 and engaged inresearch on pointing control for deployable spaceantennas and surface error compensation throughfeed distribution control. His recent interest
focuses on active RFID and its applications. He
is a member of IEICE.

63