Course - LTE-EPC Signaling - 14 July 2 Eogogics

7/2/2014
1
Copyright Eogogics Inc | www.eogogics.com| +1 703 281 3525
. . . . . . . . . .
Knowledge That Powers Organizations!
LTE/EPC Signaling Course
Presented Onsite at Nextel de Mexico
DCN NTDR-Jnz-f
Copyright Eogogics Inc | www.eogogics.com| +1 703 281 3525 Copyright Eogogics Inc | www.eogogics.com| +1 703 281 3525
Knowledge That Powers Organizations!
Learn Technologies from the Team That
Has Been at the Forefront of New
Technology Rollout for 20+ Years!
Why Eogogics?
Unmatched Expertise: Industry-leading 500-course curriculum based on our first-hand technology experience.
Industry Recognized: Preferred or sole-source provider for Fortune 500 companies, R&D organizations, US government agencies, and trade groups.
High Client Satisfaction: 100% of our classes rate good-to-excellent, 98% client retention, 85% of business from client referrals.
World-class Instructors: With advanced degrees, 15-40 years in the real world, publications, patents, awards/honors. They mix teaching, R&D, and
consulting to keep their technical edge razor sharp. Their instruction is clear, dynamic, and entertaining!
Customized, Practical Courses: Partner with the instructor to design a course focused on your mission critical needs. Classes onsite or on the Web.
Buy Coach, Travel First Class: Using technology to drive down our costs, we offer top-tier instructors and tailored courses for 15% below market.
Knowledge That Can Power Your Organization: Avoid the cost and delay of trial-and-error! Benefit from our 20+ year experience, knowledge of
industry best practices, and unbiased advice. We have been engaged in ground-breaking technology implementation projects worldwide for 20+ years.
Join a Distinguished Clientele That Includes Disney, Lockheed Martin, UBS, Boeing, Raytheon, Dell, AT&T, ABC News, Sprint Nextel, Comcast,
SkyTerra, TruePosition, DIRECTV, L-3 Communications, ITT, SAIC, URS, Shaw, NII, Intelsat, Crown Castle, Harris, Booz Allen Hamilton, Spectra
Energy, Cooper, Bain & Company, DoD, HLS, DoE, DoC, DoJ, national labs, and NASA. Call or email today!
Our Skill Set
Engineering: Systems Eng. (Methodology, Best Practices, Management), Design Creativity, Out-of-the-Box Thinking, GD&T, Statistical Tolerance Analysis, Poka
Yoke, Materials and Processes (Metals, Plastics), Industrial Statistics, Design of Experiments, Statistical Process Control, Root Cause Failure Analysis, Failure Modes
and Effects Analysis, Project and People Management, Delivery Performance Improvement, Quality Management, Cost Reduction, Engineering Economics
Software Engineering: Principles, Writing Requirements, Configuration Management, Testing, Project Management, Project Estimation, Quality Assurance
Telecom: Network Design/Implementation, Traffic Engineering, Security, Management (SNMP, Ethernet OAM), Cloud Computing, Cyber Security, Carrier Ethernet,
ATM, BGP, IP Geo-location, IPv6, MoIP, IP Sec, MPLS, IMS, SIP, SIP Sec, VoIP, VoIP Sec, EoIP, IP TV, CAMEL, SS7, IMS, SIP, Optical Networks (SONET/SDH,
DWDM, CWDM), Mobile Backhaul, OSS/BSS (eTOM, SID, TAM), Unified Communications
Wireless and RF: 5G (Cognizant Radio, SDR, DSA), 4G (LTE, WiMAX), OFDM/MIMO, 3G (UMTS, HSPA), GSM, GPRS/EDGE, CDMA,1xRTT, EVDO,
iDEN, TETRA, MPBN, MVNO, WiFi, Bluetooth, Mobile TV, Positioning/Location, LBS, RF, RF Safety, HF/VHF, Propagation/Fading, Antennas, Microwaves,
SATCOM, Spectrum Engineering, Signal Processing, IEEE WCET Exam
Defense, Public Safety and Security: 5G, 4G, 3G, and NextGen Technologies, Cyber Security/Warfare, Info. Security, E911, 911 (Voice, VoIP), CALEA
Also, Technical Management and Communications, Soft Skills, and Management/Leadership Development
www.eogogics.com, www.gogics.com, sales@eogogics.com, +1 703 281-3525, 1 (888) 364-6442
7/2/2014
2
Notices
Intellectual Property Rights
Copyright 2014, Eogogics Inc.
The contents of this document are the proprietary and copyrighted intellectual property
of Eogogics Inc. They may not be recorded, stored, reproduced, or transmitted by
any means whatsoever without the express, written permission of Eogogics Inc.
Eogogics and Gogics are, respectively, a registered US trade mark and a service
mark of Eogogics Inc. Any other service or trade marks used in this document are
the property of their respective owners.
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
Notices
This Course Builds on the Following Eogogics Courses
(see www.eogogics.com for details):
LTE Advanced System Techniques LTE ADV 4 days
LTE Air Interface Techniques LTE AI 3 days
LTE Signaling and Functionality LTESIG 3 days
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
7/2/2014
3
LTE/EPC Overview
LTE/EPC 3GPP Standards
Evolution Path
7/2/2014
4
Mobile Systems Evolution
TDMA
GSM
PDC
GPRS
EDGE
Edge
Evolution
WCDMA
HSDPA/
HSUPA
HSPA+
cdmaOne CDMA2000
CDMA2000
1xEV/DO
EV/DO
RevA
EV/DO
RevB
2G Evolved 3G 3G
Source:gsacom.com
4G
LTE/EPC
Market Trends
Dramatic uptake in broadband data
Migration to LTE:
From existing WCDMA/GSM networks
From existing CDMA networks
High interest in service convergence
Fixed and wireless
Broadband triple-play with mobility
7/2/2014
5
Market Trends
WLAN access integration
Increased expectations for value-added
services
DPI, policy, charging (subscriber management)
Focus on total cost of ownership
Network simplification, shared resources
Driving forces for LTE/EPC
Efficiency
Fewer payload carrying nodes between
subscriber and service
Shorter latency (service access response,
mobility)
Lowering costs
Lower cost per transmitted bit
7/2/2014
6
Driving forces for LTE/EPC
Improving services
High throughput to enable advanced services
Common user service provision for all of
access technologies
Making use of new/refarmed spectrum
More efficient radio utilization (new modulation
concept, increased spectrum flexibility)
Driving Forces for LTE/EPC
Better integration with other open
standards
Efficient mobility between 3GPP and non-
3GPP using the same user service provision
(GSM, WCDMA, LTE, CDMA2000, WLAN ...)
7/2/2014
7
Network Evolution
2009/10
3GPP Rel-8
eNodeB
MME
P+S-GW
User plane directly
between RAN and
GW!
PDN
2007
3GPP Rel-7
NodeB
RNC
SGSN
GGSN
User plane
essentially
outside SGSN!
PDN
2000
3GPP Rel-99
NodeB
RNC
SGSN
GGSN
User plane
traffic through
all nodes
PDN
SAE/LTE Releases: Evolution Steps
-EPS backbone network, EPC: interconnects the following hosts:
- Mobile Management Entity (MME)
- Home Subscriber Server (HSS)
- Policy and Charging Rules Function (PCRF)
- Serving Gateway (SGW)
- Packet Data Network Gateway (PGW)
7/2/2014
8
SAE/LTE Release 8 Evolution Steps
Moving all RNC functions to the Node B
, SGSN CP functions to the MME, and GGSN functions to the
SAE GW
GGSN
SGSN
RNC
P-GW
S-GW
PDN GateWay
Serving GateWay
Node B / HSPA eNodeB
MME
Mobility Management Entity
(not user plane
functions)
Functional changes compared to the current UMTS Architecture
3GPP Project Coordination Group (PCG)
7/2/2014
9
3GPP LTE and SAE Work Items
SAE
EPC Specifications
(From Rel 8 onwards)
TSG SA
Specification Group Work Item
Result
SAE: System Architecture Evolution
EPC: Evolved Packet Core
LTE
EUTRAN Specifications
(36 series)
TSG RAN
Specification Group Work Item
Result
LTE: Long Term Evolution
EUTRAN: Evolved UMTS Terrestrial Radio Access Network
LTE Specifications
36.201 Physical layer general description
36.211 Physical channels and modulation
36.212 Multiplexing and channel coding
36.213 Physical layer procedures
36.214 Physical layer measurements
36.300 E-UTRA overall description
36.302 Services provided by the physical layer
36.304 UE Functions related to idle mode
36.306 UE radio access capabilities
36.321 Medium Access Control (MAC)
Protocol Specification
36.322 Radio Link Control (RLC)
36.323 Packet Data convergence Protocol (PDCP)
36.331 Radio Resource Control (RRC)
36.101 UE radio transmission and reception (FDD)
36.104 BTS radio transmission and reception (FDD)
36.113 Base station EMC
36.133 Requirements for support of Radio Resource
Management (FDD)
36.141 Base station conformance testing (FDD)
36.401 E-UTRA Architecture Description
36.410 S1 interface general aspects & principle
36.411 S1 interface Layer 1
36.412 S1 interface signalling transport
36.413 S1 application protocol S1AP
36.414 S1 interface data transport
36.420 X2 interface general aspects and principles
36.421 X2 interface layer1
36.422 X2 interface signalling transport
36.423 X2 interface application part X2AP
36.442 UTRAN Implementation Specific O&M Transport
29.274 GTP-C
29.281 GTP-U
All specifications can be found on the
web site www.3gpp.org
23.002 Network Architecture
23.003 Numbering, addressing and identification
23.009 Handover Procedures
23.048 Security mechanisms for USIM application
23.401 GPRS enhancements for eUTRA
23.203 QoS Concept
23.272 CS Fallback in EPS
24.301 NAS Protocol for Evolved Packet System (EPS)
24.302 Access to the EPC via non 3GPP networks
33.401 System Architecture Evolution (SAE);
Security Architecture
7/2/2014
10
LTE/EPC
Architecture & Protocols
What Is LTE/EPC?
Nodes in EPC
& LTE
Functionality
Interfaces
to other
systems
between nodes
EPC
(Core Network)
LTE
(Radio
Access
Network)
7/2/2014
11
EPS Overview Architecture
eNB
eNB
eNB
MME
S1
X2
X2
X2
SAE
(System Architecture
Evolution)
LTE
(Long Term Evolution)
EPC
(Evolved
Packet Core)
E-UTRAN
EPS
(Evolved
Packet
System)
UE
P/S-GW
3GPP Work Items
LTE/EPC Architecture
Evolved
Packet
Core
S1-CP
E-UTRAN
eNodeB eNodeB
LTE
S1-UP
SAE
MME
S-GW
P-GW
S5/S8
X2-UP
X2-CP
MME
S11
S10
HSS
PCRF
S6
Gx
Radio Bearer control,
Connection Mobility Control
Scheduling for both UL and DL.
- terminates user
plane packets
- switches the user
plane to support UE
mobility
handles the charging
for the service.
IP Point of Presence
(PoP)
idle mode moblity
and security
Quality of service
and charging for
each data flow
7/2/2014
12
Evolved Packet System (EPS) &
WCDMA/GPRS
S1-MME S1-U
SGSN
S3
S11
S6a
SGi
X2
S5/S8
EPC
EUTRAN
HSS
Gx
PGW
eNodeB eNodeB
SGW
MSC/VLR
PCRF
GPRS Network
UE
UE: User Equipment
HSS: Home Subscriber Server
PGW: Packet Data Network Gateway
SGW: Serving Gateway
MME: Mobility Management Entity
eNodeB: Enhanced Node B
PCRF: Policy and Charging Rules Function
SGSN: Serving GPRS Support Node
MSC: Mobile Switching Centre
VLR: Visitor Location Register
EPC: Evolved Packet Core
EUTRAN: Evolved UTRAN
LTE Uu
LTE Uu: LTE UTRAN UE Interface
MME
S10
IP Networks
Only most important
interfaces shown here
S4
User Plane
Control Plane
GSM/WCDMA/LTE Architecture - 3GPP
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
13
EPC/LTE Architecture for Non- 3GPP
AAA
ePDG
PDN GW
Serv GW
MME
PCRF
SWx
S10
S11
S5/S8
SGi
S6b
Gx
Gxc
Gxa
Gxb
SWa
S2a
S2b
S2c
STa
SWn
SWm
External
IP networks
S9
S6a
S101
S102
S103
Rx
SWu
HSS
ANDSF
S14
Trusted
non-3GPP
Non-trusted
non-3GPP
IMS
Overall Architecture IMS Platform & Non-3GPP
PCRF
X2-UP
S1-UP
EPC
S1-CP
E-UTRAN
eNodeB eNodeB
S11
MME
S-GW
P-GW
S5/S8
X2-CP
P-CSCF
Gx
Network & Service
management
OSS-RC EMA
MM DNS/ENUM
HSS
S-CSCF
I-CSCF
IMS Control
layer
Platforms / Concepts
TSP/NSP or
TSP/IS
DNS/
ENUM
MGC
MGW
SUN
IS
A-SBG
CPP /
RBS6000
Juniper/
Redback
WPP
GERAN UTRAN
Broadband
Wired Access
GPRS
Packet
Core
SGSN
GGSN
CDMA2000
HRPD
(EV-DO)
WLAN
N-SBG
Internet
S6a
CS Core
MSC
GWMSC
PSTN
PDSN
S1-AP, X2-AP
H.248
ISUP
Diameter
S3
S4
GTP-C
Gxa
S103
S2a
RNC
Other
SIP/UDP or SIP/TCP
Rx+
User data
RTP/UDP GTP/UDP
S101
IMS Connectivity
layer
Service Layer
AS
AS
AS
Application Servers
MTAS
S6d
Uu
7/2/2014
14
EPS Control Plane Protocols
MME eNodeB UE
L1
PDCP
RRC
NAS
SCTP
L2
L1
IP
MAC
RLC
PDCP
S1AP RRC
L1
Relay
LTE Uu
L2
L1
IP
SCTP
S1AP
NAS
L2
L1
IP
UDP
GTP-C
L2
L1
IP
UDP
GTP-C
PGW
L2
L1
IP
UDP
GTP-C
SGW
S1-MME
S11 S5/S8
eNodeB
L2
L1
IP
SCTP
X2AP
X2
eNodeB
L2
L1
IP
SCTP
X2AP
MME
L2
L1
IP
UDP
GTP-C
S10
MME
L2
L1
IP
UDP
GTP-C
MAC
RLC
EPS User Plane Protocols
L1
GTP-U
L2
IP
L1
GTP-U
L2
IP
L1
GTP-U
L2
IP
eNodeB
L2
L1
IP
UDP
X2*
eNodeB
L2
L1
IP
UDP
S5/S8
L2
L1
IP
SGi S1-U LTE Uu
RLC
PDCP
MAC
L1
RLC
MAC
L1
IP
Application
Relay Relay
SGW eNodeB UE PGW
* X2 User plane used
to support Data
forwarding at intra
LTE handover
L1
UDP
GTP-U
L2
IP
UDP UDP
GTP-U GTP-U
PDCP
UDP
7/2/2014
15
EPS Protocol Categories
L3 Signalling
L2 Transport
Non Access Stratum (NAS)
Communication between UE and MME
Radio Resource Control (RRC)
Communication between UE and eNodeB
Packet Data Convergence Protocol (PDCP)
- Ciphering and integrity protection for RRC messages
- IP header compression/decompression for user plane
Radio Link Control (RLC)
- Transfer of RRC messages and user data using:
* Acknowledged Mode (AM)
* Transparent Mode (TM) or
* Unacknowledged Mode (UM)
- Error Correction (ARQ)
Medium Access Control (MAC)
- Error Correction (HARQ)
- Transfer of RRC messages and user data using:
- Priority handling (scheduling)
- Transport Format selection
GPRS Tunneling Protocol Control (GTP-C)
- Communication between MME and SGW
- Communication between SGW and PGW
- Communication between MME and MME
S1 Application Protocol (S1AP)
Communication between eNodeB and MME
X2 Application Protocol (X2AP)
Communication between eNodeB and eNodeB
GPRS Tunneling Protocol User (GTP-U)
Transfers data between GPRS tunneling endpoints
Logical Channels Control
Broadcast Control Channel (BCCH)
DL broadcast of system control information.
Paging Control Channel (PCCH)
DL paging information. UE position not known on cell
level
Common Control Channel (CCCH)
UL/DL. When no RRC connection exists.
Multicast Control Channel (MCCH)
DL point-to-multipoint for MBMS scheduling and control,
for one or several MTCHs.
Dedicated Control Channel (DCCH)
UL/DL dedicated control information. Used by UEs
having an RRC connection.
7/2/2014
16
Logical Channels - Traffic
Dedicated Traffic Channel (DTCH)
UL/DL Dedicated Traffic to one UE, user
information.
Multicast Traffic Channel (MTCH)
DL point-to-multipoint. MBMS user data.
Channel Mapping
UL-SCH PCH DL-SCH
PCCH
Logical Channels
type of information
(traffic/control)
Transport Channels
how and with what
characteristics
(common/shared/mc/bc)
Downlink Uplink
PDSCH
Physical Channels
bits, symbols,
modulation, radio
frames etc
MTCH MCCH BCCH DTCH DCCH DTCH DCCH CCCH
PRACH
RACH
CCCH
MCH BCH
PUSCH PBCH PCFICH PUCCH
-CQI
-ACK/NACK
-Sched req.
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info
MIB SIB
PMCH PHICH PDCCH
ACK/NACK
PDCCH
info
Physical Signals
only L1 info
RS SRS P-SCH S-SCH RS
-meas for DL sched
-meas for mobility
-coherent demod
-half frame sync
-cell id
-frame sync
-cell id group
-coherent demod
-measurements for
UL scheduling
7/2/2014
17
Transport Channels - DL
Broadcast Channel (BCH)
System Information broadcasted in the entire coverage
area of the cell. Beamforming is not applied.
Downlink Shared Channel (DL-SCH)
User data, control signaling and System Info. HARQ and
link adaptation. Broadcast in the entire cell or
beamforming. DRX and MBMS supported.
Paging Channel (PCH)
Paging Info broadcasted in the entire cell. DRX
Multicast Channel (MCH)
MBMS traffic broadcasted in entire cell. MBSFN is
supported.
Transport Channels - UL
Uplink Shared channel (UL-SCH)
User data and control signaling. HARQ and link
adaptation. Beamforming may be applied.
Random Access Channel (RACH)
Random Access transmissions (asynchronous and
synchronous). The transmission is typically contention
based. For UEs having an RRC connection there is some
limited support for contention free access.
7/2/2014
18
Channel Mapping
UL-SCH PCH DL-SCH
PCCH
Logical Channels
type of information
(traffic/control)
Transport Channels
how and with what
characteristics
Downlink Uplink
PDSCH
Physical Channels
bits, symbols,
modulation, radio
frames etc
PRACH
RACH
CCCH
MCH BCH
-CQI
-ACK/NACK
-Sched req.
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info
MIB SIB
PMCH PHICH PDCCH
ACK/NACK
PDCCH
info
Physical Signals
only L1 info
-meas for DL sched
-meas for mobility
-coherent demod
-half frame sync
-cell id
-frame sync
-cell id group
-coherent demod
-measurements for
UL scheduling
Physical Channels and Signals
Physical channels
Physical Downlink Shared Channel (PDSCH)
transmission of the DL-SCH transport channel
Physical Uplink Shared Channel (PUSCH)
transmission of the UL-SCH transport channel
Physical Control Format Indicator Channel (PCFICH)
indicates the PDCCH format in DL
Physical Downlink Control Channel (PDCCH)
DL L1/L2 control signaling
Physical Uplink Control Channel (PUCCH)
UL L1/L2 control signaling
Physical Hybrid ARQ Indicator Channel (PHICH)
DL HARQ info
Physical Broadcast Channel (PBCH)
DL transmission of the BCH transport channel.
Physical Multicast Channel (PMCH)
DL transmission of the MCH transport channel.
Physical Random Access Channel (PRACH)
UL transmission of the random access preamble as given by the RACH
transport channel.
7/2/2014
19
Physical Channels and Signals
Physical signals
Reference Signals (RS)
support measurements and coherent demodulation in uplink and downlink.
Primary and Secondary Synchronization signals (P-SCH and S-SCH)
DL only and used in the cell search procedure.
Sounding Reference Signal (SRS)
supports UL scheduling measurements
Channel Mapping
UL-SCH PCH DL-SCH
PCCH
Logical Channels
type of information
(traffic/control)
Transport Channels
how and with what
characteristics
Downlink Uplink
PDSCH
Physical Channels
bits, symbols,
modulation, radio
frames etc
PRACH
RACH
CCCH
MCH BCH
-CQI
-ACK/NACK
-Sched req.
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info
MIB SIB
PMCH PHICH PDCCH
ACK/NACK
PDCCH
info
Physical Signals
only L1 info
-meas for DL sched
-meas for mobility
-coherent demod
-half frame sync
-cell id
-frame sync
-cell id group
-coherent demod
-measurements for
UL scheduling
7/2/2014
20
NAS Signaling
UE-MME
MME eNodeB UE
L1
PDCP
RRC
NAS
SCTP
L2
L1
IP
MAC
RLC
PDCP
S1AP RRC
L1
Relay
LTE Uu
L2
L1
IP
SCTP
S1AP
NAS
L2
L1
IP
UDP
GTP-C
L2
L1
IP
UDP
GTP-C
PGW
L2
L1
IP
UDP
GTP-C
SGW
S1-MME
S11 S5/S8
eNodeB
L2
L1
IP
SCTP
X2AP
X2
eNodeB
L2
L1
IP
SCTP
X2AP
MME
L2
L1
IP
UDP
GTP-C
S10
MME
L2
L1
IP
UDP
GTP-C
MAC
RLC
7/2/2014
21
NAS Signaling - MME
3GPP TS 24.301
UE Protocol Stack
ROHC/
Ciphering
TM AM
UM/AM
Physical Layer
L2
PDCP
RLC
MAC
RRC
NAS
Integrity/
Ciphering
System Info
Aquisition
Cell
Selection
Paging
Reception
Mobility
Management
Session
Management
Connected
Mode
Mobility
NAS Security
IP
Application
AS Security
RRC
Connection
RB
Managementv
Measurement
Reporting
C
o
n
t
r
o
l
/
R
e
p
o
r
t

S
A
P
s
RA Control
HARQ
Control
7/2/2014
22
NAS Elementary Procedures
EPS Elementary
Procedures
EPS Session Management
EPS Mobility Management
"ready-to-use" IP connectivity and an "always-on" experience
EPS Mobility Management - EMM
3GPP TS 24.301
7/2/2014
23
LTE States
LTE_DETACHED LTE_ACTIVE LTE_IDLE
IP address assigned
Position partially known
DL DRX period
No IP address
Position not known
IP address assigned
Connected to known cell
OUT_OF_SYNC IN_SYNC
DL reception possible
No UL transmission
DL reception possible
UL transmission possible
Power-up
EMM Protocol States - Mobility
ECM-IDLE
EMM-
DEREGISTERED
MME
Tracking Area (TA)
UE
position
not known
in network
Signaling
connection
establishment
Signaling
connection
release
Attach accept,
TAU accept
Detach, Attach reject,
TAU reject
EMM-
REGISTERED
ECM-CONNECTED
Tracking Area Update
(TAU)
Handover
PLMN
selection
UE position known on Cell
level in eNodeB UE pos known on TA level in MME
eNB
RRC_IDLE RRC_IDLE RRC_CONNECTED
ECM: EPS Connection
Management
EMM: EPS Mobility
Management
RRC: Radio Resource
Management
ECM connected =
S1 bearer
+
RRC connection(SRB)
7/2/2014
24
EPS Network Operational Modes
EPS Session Management - ESM
3GPP TS 24.301
7/2/2014
25
EPS Protocol States - Bearers
3GPP TS 24.301
RRC Signaling
UE-MME
7/2/2014
26
MME eNodeB UE
L1
PDCP
RRC
NAS
SCTP
L2
L1
IP
MAC
RLC
PDCP
S1AP RRC
L1
Relay
LTE Uu
L2
L1
IP
SCTP
S1AP
NAS
L2
L1
IP
UDP
GTP-C
L2
L1
IP
UDP
GTP-C
PGW
L2
L1
IP
UDP
GTP-C
SGW
S1-MME
S11 S5/S8
eNodeB
L2
L1
IP
SCTP
X2AP
X2
eNodeB
L2
L1
IP
SCTP
X2AP
MME
L2
L1
IP
UDP
GTP-C
S10
MME
L2
L1
IP
UDP
GTP-C
MAC
RLC
UE Protocol Stack
ROHC/
Ciphering
TM AM
UM/AM
Physical Layer
L2
PDCP
RLC
MAC
RRC
NAS
Integrity/
Ciphering
System Info
Aquisition
Cell
Selection
Paging
Reception
Mobility
Management
Session
Management
Connected
Mode
Mobility
NAS Security
IP
Application
AS Security
RRC
Connection
RB
Managementv
Measurement
Reporting
C
o
n
t
r
o
l
/
R
e
p
o
r
t

S
A
P
s
RA Control
HARQ
Control
7/2/2014
27
RRC States
ECM-IDLE
EMM-
DEREGISTERED
UE position
not known
in network
Signaling
connection
establishment
Signaling
connection
release
Attach accept, TAU
accept
Detach, Attach reject, TAU
reject
EMM-REGISTERED
ECM-CONNECTED
PLMN
selection
RRC_IDLE RRC_IDLE RRC_CONNECTED
RRC Signaling
3GPP TS 25.813
3GPP TS 36.300
3GPP TS 36.331
7/2/2014
28
RRC Messages
CounterCheck
CounterCheckResponse
CSFBParametersRequest
CSFBParametersResponse
DLInformationTransfer
HandoverFromEUTRAPreparationRequest
MasterInformationBlock
MeasurementReport
MobilityFromEUTRACommand
Paging
RRCConnectionReconfiguration
RRCConnectionReconfigurationComplete
RRCConnectionReestablishment
RRCConnectionReestablishmentComplete
RRCConnectionReestablishmentReject
RRCConnectionRelease
RRCConnectionRequest
RRCConnectionSetup
RRCConnectionSetupComplete
SecurityModeCommand
SecurityModeComplete
SecurityModeFailure
SystemInformation
SystemInformationBlockType1
UECapabilityEnquiry
UECapabilityInformation
ULHandoverPreparationTransfer
ULInformationTransfer
CSFBParametersRequestCDMA2000
CSFBParametersResponseCDMA2000
HandoverFromEUTRAPreparationRequest (CDMA2000)
ULHandoverPreparationTransfer (CDMA2000)
RRC Signaling
Idle Mode
7/2/2014
29
System Information Mapping
PCCH/PCH Paging: System Info Modification
MIB SIB1 SIB2 SIB3 SIB4
SI-2 SI-1
SIB5
BCCH
BCH
PBCH PDSCH
BCCH
DL-SCH
PDSCH
DL-SCH
BCCH
TTI=80 TTI= 160 TTI= 320 TTI= 40
System Information Blocks (SIBs)
7/2/2014
30
Idle Mode Cell Selection - Reselection
PLMN Selection
Location
Registration
PLMNs
available
PLMN
selected
Location
Registration
response
Registration
Area
changes
Indication
to user
Manual Mode
Automatic mode
Service requests
NAS Control
Radio measurements
Cell Selection
and Reselection
Support for manual
CSG ID selection
AvailableCSG IDs
to NAS
CSG ID
selected
Core Network Initiated Paging
TAC 1
S1AP Paging message
RRC Paging message
TAC 2
The MME sends the PAGING message to each eNode B
with cells belonging to the tracking area(s) in which the UE
is registered.
Each eNode B can contain cells belonging to different
tracking areas, whereas each cell can only belong to one
TA.
UEs use DRx when in idle mode in order to wake at regular
intervals to check for paging messages.
The paging response back to the MME is initiated on NAS
layer and is sent by the eNB based on NAS-level routing
information.
MME
7/2/2014
31
Paging Signaling
The MME initiates a paging message which is
sent to all eNodeBs in a tracking area(s)
UEs use the Random
Access procedure to
initiate access to the
serving cell
NAS messaging
continues in order to
set up the call
S1-AP: INITIAL UE MESSAGE (FFS)
+ NAS: Service Request
+ eNB UE signalling connection ID
Random Access Procedure
NAS: Service Request
RRC PAGING
S1AP:Paging
MME
RRC Signaling Connected Mode
7/2/2014
32
Signaling Radio Bearer (SRB) Establishment
RRC Connection SRB Establishment
LTE
RRC_
CONNECTED
MME
SIGNALLING RADIO BEARER 1 S1 BEARER
SIGNALLING RADIO BEARER 2
SIGNALLING RADIO BEARER 0
RRC
Connection
Signalling Connection
+
"Signalling Radio Bearers" (SRBs) are defined as Radio Bearers (RB)
that are used only for the transmission of RRC and NAS messages
7/2/2014
33
Signalling Radio Bearers (SRBs)
Signalling Radio Bearers (SRBs) are offered by the PDCP layer to the
RRC layer for transport of RRC (and NAS) messages
SRB0: Used for RRC messages on the CCCH
SRB1: Used for RRC and NAS messages on the DCCH
SRB2: Used for NAS messages, SRB2 has a lower-priority than
SRB1 and is always configured by E-UTRAN after security
activation.
PDCP
RRC
SRB0 SRB1 SRB2
RRC Connection Establishment
RRC Connection Request is initiated by
the higher layers in the UE
RRC Connection Setup
(C-RNTI is allocated)
RRC connection establishment
procedure creates the signaling radio
bearer SRB#1,
RRC Connection Request CCCH/ULSCH
DLSCH RRC Connection Setup
RRC Connection Setup Complete DCCH/ULSCH
RRC IDLE
RRC
CONNECTED
NAS information for authentication
request is piggybacked to the RRC
Connection Setup Complete message
IE/Group Name IE type and reference
RRC Establishment Cause: Emergency Call,
High Priority Access,
MT-Access,
MO-Signalling,
MO-Data
7/2/2014
34
Security Related Procedures
MME
INITIAL CONTEXT SETUP REQUEST
(Integrity Protection Algorithm EIA;
Ciphering Algorithm EEA;
Security Key)
SECURITY MODE COMMAND(EEA;EIA)
SECURITY MODE COMPLETE
2. Decide Algorithms,
Derive Keys
Activate Security for SRB
INITIAL CONTEXT SETUP RESPONSE
RRC Security Mode Command is triggered by the EPC (MME) at S1 signaling message Initial
Context Setup Request includes all security setting needed to start Integrity Protection of
the control plane signaling and Encryption of the both user plane and control plane signaling
(PDCP protocol).
Security setting includes Integrity Algorithm (EIA) Ciphering Algorithm (EEA) and Security key.
Counter Check Function
Used by UTRAN to request from
the UE to verify the amount of data
sent/received for each DRB
RRC COUNTER CHECK
RRC COUNTER CHECK RESPONSE
Additional security measures are added to LTE/SAE by adding Counter
check function UE is requested to check if, for each DRB, the most
significant bits of the COUNT match with the values indicated by E-UTRAN.
When RRC Counter Check is transmitted? Whenever eNB finds
the particular COUNT is exceeded than specific value eNB sends this
message if it suspects that new data is introduced by an intruder in any
DRB which are used for data transfer between UE and eNB.
7/2/2014
35
RRC COUNTER CHECK
Action UE will send Counter Check Response to eNB including:
- drb-CountInfoList,
- drb-Identity,
- counte-Uplick,
- count-Downlink
All IE's correspond to that specific COUNT value.
procedure enables E-UTRAN to detect packet insertion by an intruder
RRC COUNTER CHECK
procedure enables E-UTRAN to detect packet insertion by an intruder
Question Why needed to include an extra protection for intruder
detection? Isnt enough Integrity protection on security mode command?
Answer RRC Counter Check Procedure is part of Periodic local
authentication procedure in LTE in many countries regulations ciphering
the data over the Radio Interface is forbidden for National Security there
is a probability of the data connection being compromised by MAN in
MIDDLE attack.
7/2/2014
36
RRC UL/DL Transparent Messages
Information Transfer
RRC UL INFORMATION TRANSFER (NAS message)
RRC DL INFORMATION TRANSFER (NAS message)
purpose of this procedure transfer NAS or (tunneled) non-3GPP
dedicated information from the UE to E-UTRAN
UE Capability Transfer
RRC UE CAPABILITY ENQUIRY
RRC UE CAPABILITY INFORMATION
S1AP: UE Capability Info Indication
UE Capability Retreival - This procedure retreives UE Radio Capability from UE and provides
it the the MME.
Step 1 eNodeB requests the UE Radio Capability by sending RRC UE Capability Enquiry
message.
Step 2 UE responds to the eNodeB with requested UE Capability in teh UE Capability
Information message
Step 3 eNodeB forwards the received UE Radio Capabilities to teh MME in teh UE
Capability Info Indication
7/2/2014
37
Radio Link Failure RCS Algorithm
RCS Algorithm procedure
Step 1 Upon "radio link problems detected, UE starts timer T310 - In case radio link
recovery happens before T310 expires the UE stops the timer T310 and continues in state
RRC Connected.
Step 2 T310 expires and no recovery takes place UE starts timer T311 and starts searching
for a new cell.
-If the UE finds a cell before T311 expires RRC Connection re-establishment procedure is
triggered.
- In case T311 expiries before UE finds a cell than the UE enters idle mode.
Normal operation
Radio
problem
detection
no recovery during
T310
no recovery during
T311
Return to idle
radio link failure
First Phase Second Phase
RRC_IDLE RRC_Connected
-> RRC Connection Re-
establishment Request
-> New RRC
Connection
Request
Maximum number (counter
N310) of RLC
retransimssions is reached
Radio Link Failure RRC Signaling
RRC CONNECTION RE-ESTABLISHMENT COMPLETE
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT
Procedure:
A waiting timer is started in eNodeB when
- maximum number of RLC retransmissions has been reached, or
- maximum number of PDCCH Ordered Re-synchronization failure are
detected.
During this waiting timer, eNodeB expects from UE to trigger RRC
Connection Re-establishment Request message If no RRC
Connection Re-establishment Request is received during this time, UE is
released back to idle mode.
7/2/2014
38
Radio Link Failure
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT REJECT
What if eNodeB cannot handle the incoming RRC Connection Re-
establishment Request ?
eNodeB will respond with RRC Connection Re-establishment Reject
message to the UE and initiate a UE release procedure towards MME.
RRC Signaling - RRC Mobility
7/2/2014
39
Measurement Configuration Message
RRC CONNECTION RECONFIGURATION
(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
E-UTRAN provides the measurement configuration (events to trigger,
thresholds, time to trigger, neighbors etc) applicable for a UE in
RRC_CONNECTED mode
This is accomplished by dedicated signaling message
RRC Connection Reconfiguration
Measurement Configuration Type of
Measurements
UE receives RRC Connection Reconfiguration message following
types of measurements might be requested:
- Intra-frequency measurements: (serving cell carrier frequency).
- Inter-frequency measurements: (neighbor cell measurements at different
carrier frequencies).
- Inter-RAT measurements of UTRA frequencies.
- Inter-RAT measurements of GERAN frequencies.
- Inter-RAT measurements of CDMA2000 HRPD or CDMA2000 1xRTT
frequencies.
7/2/2014
40
Measurement Configuration
Parameters (1)
Measurement objects:
- For intra-frequency and inter-frequency measurements: object is a
single E-UTRA carrier frequency. Associated with this carrier frequency, E-
UTRAN can configure a list of cell specific offsets and a list of blacklisted
cells.
- For inter-RAT UTRA measurements: object is a set of cells on a single
UTRA carrier frequency.
- For inter-RAT GERAN measurements: object is a set of GERAN
carrier frequencies.
- For inter-RAT CDMA2000 measurements: object is a set of cells on a
single (HRPD or 1xRTT) carrier frequency.
Parameters (2)
Reporting configurations:
- Reporting criteria: The criteria that trigger the UE to send a
measurement report. This can either be periodical or a single event
description.
- Reporting format: The quantities that the UE includes in the
measurement report and associated information (e.g. number of cells to
report).
7/2/2014
41
Parameters (3)
Measurement identities: A reference number
A list of measurement identities each measurement identity links one
measurement object with one reporting configuration.
Measurement identity is used as a reference number in the measurement
report.
Parameters (4)
Quantity configurations: defines the measurement quantities and
associated filtering used for all event evaluation and related reporting of
that measurement type. E.g. RSRP (Reference Signal Received Power) ,
RSRQ (Reference Signal Received Quality).
- quantity configuration for intra-frequency measurements,
- quantity configuration for inter-frequency measurements
- quantity configuration for RAT type.
One filter can be configured per measurement quantity
7/2/2014
42
Parameters (5)
Measurement gaps: Periods that UE may perform measurements, i.e. no
(UL, DL) transmissions are scheduled.
The measurement procedures for different types of cells:
-The serving cell.
-Listed cells - these are cells listed within the measurement object(s).
- Detected cells - these are cells that are not listed within the
measurement object(s) but are detected by the UE on the carrier
frequency(ies) indicated by the measurement object(s).
Measurement Reporting
UE performs measurements and reports back only when event criteria are met!
LTE
LTE
Best Cell
Evaluation
LTE
LTE
Examples:
-Event A3 A neighbour cell
becomes offset better than
serving cell
- Event A2 Serving cell
becomes worse than an
absolute threshold
7/2/2014
43
Measurement Reporting Triggering events
LTE
LT
E
Best Cell
Evaluation
LTE
LTE
Examples:
-Event A3 A neighbour cell
becomes offset better than
serving cell
- Event A2 Serving cell
becomes worse than an
absolute threshold
Measurement Reporting Criteria
Reporting criteria
Reporting threshold
Hysteresis
Time-to-trigger
Reporting interval
7/2/2014
44
Example
RRC Signaling Flow Attach Request
To be discussed in class ..
RRC Signaling Flow Example Attach Request
MME
7. INITIAL UE MESSAGE (Attach Request)
14. INITIAL CONTEXT SETUP REQUEST
(EPS bearers, Attach Accept, Security)
22. INITIAL CONTEXT SETUP RESPONSE
(EPS bearers)
1. System Information
*
4. RRC CONNECTION REQUEST
5. RRC CONNECTION SETUP
15. RRC SECURITY MODE COMMAND
16.RRC SECURITY MODE COMPLETE
6. RRC CONNECTION SETUP COMPLETE (Attach Request)
2. RandomAccess Preamble
3. Random Access Response
20. RRC CONNECTION RECONFIGURATION (Attach Accept, Bearer Setup)
21. RRC CONNECTION RECONFIGURATION COMPLETE
10.RRC DL INFORMATION TRANSFER (Authentication Request)
11. RRC UL INFORMATION TRANSFER (Authentication Response)
DL NAS TRANSPORT (Authentication)
UL NAS TRANSPORT (Auth. Response)
12. RRC DL INFORMATION TRANSFER (Security Mode Command)
13. RRC UL INFORMATION TRANSFER (Security Mode Complete)
DL NAS TRANSPORT (NAS SMC)
UL NAS TRANSPORT (NAS SMC)
Cell
Select
*
23. RRC UL INFORMATION TRANSFER (Attach Complete)) UL NAS TRANSPORT (Attach Complete)
RRC IDLE
RRC IDLE
8.RRC DL INFORMATION TRANSFER (UE Identity Request)
9. RRC UL INFORMATION TRANSFER (UE Identity Response)
DL NAS TRANSPORT (UE Identity Req)
UL NAS TRANSPORT (UEid Response)
17. RRC UE CAPABILITY ENQUIRY
18. RRC UE CAPABILITY iNFORMATION
19. UE CAPABILITY INFO INDICATION
(UE Radio Capability)
24. UE CONTEXT RELEASE COMMAND
26. RRC CONNECTION RELEASE
25. UE CONTEXT RELEASE COMPLETE
RRC
CONNECTED
7/2/2014
45
PDCP Protocol
PDCP Functions
7/2/2014
46
PDCP Architecture
Radio Bearers
UE/E-UTRAN
PDCP ...
RLC
PDCP - PDU
RLC- SDU
PDCP-SAP
RLC UM-SAP RLC AM-SAP
PDCP entity PDCP entity
PDCP-SAP
...
TS 36.323
PDCP Entity Architecture
Radio Interface (Uu)
UE/E-UTRAN E - UTRAN / UE
Transmitting
PDCP entity
Ciphering
Header Compression
(user plane only)
Receiving
PDCP entity
Sequence numbering
Integrity Protection
(control plane only)
Add PDCP header
Deciphering
Remove PDCP Header
In order delivery and duplicate
Detection (U plane)
Integrity Verification
(control plane only)
Packets associated
to a PDCP SDU
Header Compression
(user plane only)
Packets associated
to a PDCP SDU
P
a
c
k
e
t
s
N
O
T

a
s
s
o
c
ia
t
e
d
t
o

a

P
D
C
P
S
D
U

P
a
c
k
e
t
s
N
O
T

a
s
s
o
c
ia
t
e
d
t
o

a

P
D
C
P
S
D
U

TS 36.323
7/2/2014
47
Sequence Numbering
Sequence numbering is used by several functions:
- Reordering of the PDCP PDUs at the receiver side
- Duplicate detection in case of packet forwarding at handover
-Calculation of COUNT, used for integrity protection and ciphering.
Sequence Numbering
WHY: * Reordering
* Duplicate detection
* Integrity protection
* Ciphering
HOW:
PDCP SN:
Next_PDCP_TX_SN
TX_HFN
COUNT
eNB
UE
Ctx
SRB1_UL
DRB_UL
COUNT
COUNT
COUNT
SRB1_DL
DRB_DL
COUNT
UE
COUNT
SRB1_DL
SRB1_UL
DRB_DL
DRB_UL
HFN PDCP SN
COUNT
COUNT
COUNT
7/2/2014
48
Header Compression
WHY: Saving the bandwith by
HOW: *removing redundant info
*Encoding important info
*Hop by Hop
*Unidirectional
RB_UL RB_UL
Header PDCP PDU
PDCP PDU
Header PDCP PDU
CRC
checksum covering the header before
compression is included in the compressed header
Compressed
Header
Contains
encoded data
UE/UE Context
UE/UE Context
For Voice over IP, interactive games,
messaging etc, the payload of the IP
packet is sometimes even smaller than
the header.
Based on the Robust
Header Compression
(ROHC) framework
IETF RFC 3095
Security Handling Integrity &
Ciphering
Integrity protection:
- is implemented in the PDCP layer in order to ensure that the data origin
of the signaling data is indeed the one claimed.
- check also that received data has not been modified in an unauthorized
way.
Data encryption (ciphering): is to ensure that the user data cannot be
eavesdropped on the radio.
7/2/2014
49
integrity protection key K_eNB_RRCInt
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
EIA
COUNT
Direction
K_eNB_RRCInt
PDCP PDU
PDCP PDU
Header
PDCP SDU
Bearer Id
MAC-I
Transmitter
WHY: To ensure data origin
3GPP TS 33.401
Which algorithm to use is decided by eNodeB by
during RRC security activation
Upper layer parameters (required by PDCP):
- BEARER, defined as the radio bearer identifier,
(SRB1 will use the value RB identity 1)
- KEY (KRRCint).
EIA
COUNT
Direction
K_eNB_RRCInt
PDCP PDU
PDCP PDU
Header
PDCP SDU
Bearer Id
MAC-I
P
D
C
P
P
D
U
H
e
a
d
e
r
P
D
C
P
S
D
U
EIA
COUNT
Direction
K_eNB_RRCInt
PDCP PDU
PDCP PDU
Header
PDCP SDU
Bearer Id
XMAC-I
XMAC-I MAC-I
=
Transmitter
Receiver
WHY: To ensure data origin
7/2/2014
50
Ciphering
PLAINTEXT
BLOCK
EEA
COUNT
DIRECTION
BEARER LENGTH
KEYUPenc
KEYSTREAM
BLOCK
CIPHERTEXT
BLOCK
Sender
WHY: To protect the data over radio
3GPP TS 36.331
integrity protection key K_UPenc
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
Required parameters by PDCP for
ciphering (3GPP TS 33.401):
- COUNT
- DIRECTION (DL or UL)
- BEARER (defined as the radio bearer
identifier )
- KEY (the ciphering keys for the control
plane and for the user plane are KRRCenc
and KUPenc, respectively).
Ciphering
PLAINTEXT
BLOCK
EEA
COUNT
DIRECTION
BEARER LENGTH
KEYUPenc
KEYSTREAM
BLOCK
CIPHERTEXT
BLOCK
EEA
DIRECTION
BEARER LENGTH
KEYSTREAM
BLOCK
PLAINTEXT
BLOCK
Sender Receiver
EEA0
EEA1
EEA2
COUNT
WHY: To protect the data over radio
KEYUPenc
7/2/2014
51
RLC Protocol
RLC Functions
3GPP TS 36.322
7/2/2014
52
RLC Sublayers
3GPP TS 36.322
RLC Logical Channels 3GPP TS 36.322
7/2/2014
53
RLC Modes
3GPP TS 36.322
RLC TM Entity
Transmission
buffer
Transmitting
TM-RLC
entity
TM-SAP
radio interface
Receiving
TM-RLC
entity
TM-SAP
UE/ENB ENB/UE
BCCH/PCCH/CCCH BCCH/PCCH/CCCH
- BCCH Broadcast Control Channel (System Information transfer)
- DL/UL CCCH Common Control Channel ( example: RRC Connection Request )
- PCCH Paging Control Channel (Paging)
No Header
7/2/2014
54
RLC Transparent Mode PDU
The RLC TM PDU introduces no overhead
TM is used for signaling on BCCH and
PCCH.
RLC UM Entity
UM RLC entity is supposed to carry user data payload for the time critical services
that tolerate a higher packet loss rate. Eg. Voice over IP.
RLC in Unacknowledged Mode is a licensed feature
7/2/2014
55
RLC Unacknowledged Mode PDU,
5 Bits SN
UMD PDU with 5 bit SN
(Odd number of LIs, i.e. K = 1, 3, 5, )
PDU with 5 bit SN
(Even number of LIs, i.e. K = 2, 4, 6, )
E Extension Field
FI Framing Information
SN Sequence Number
RLC Unacknowledged Mode PDU,
10 Bits SN, cont
(Odd number of LIs, i.e. K = 1, 3, 5, )
(Even number of LIs, i.e. K = 2, 4, 6, )
E Extension Field
FI Framing Information
SN Sequence Number
7/2/2014
56
RLC AM Entity
Transmission
buffer
Segmentation &
Concatenation
Add RLC header
Retransmission
buffer
RLC control
Routing
Reception
buffer & HARQ
reordering
SDU reassembly
DCCH /DTCH DCCH /DTCH
AM -SAP
Remove RLC header
RLC Acknowledged Mode PDU
SO
SO LSF Oct 3
Oct 4
LI2
E LI2 (if K>=3)
E LI1
LI1
D/C RF P FI E SN
SN
Data
Oct N
Oct 1
Oct 2
Oct 5
Oct 6
Oct 7
LIK-1
E LIK-1
E LIK-2
LIK-2
Padding
E LIK
LIK Oct [4.5+1.5*K]
Oct [4.5+1.5*K-1]
Oct [4.5+1.5*K-2]
Oct [4.5+1.5*K-3]
Oct [4.5+1.5*K-4]
Oct [4.5+1.5*K+1]
Present if
K >= 3
D/C Data/Control
E Extension Field
FI Framing Info
LSF Last Segment Flag
P Poll Bit
RF Resegmentation Flag
SN Sequence Number
SO Segment Offset
7/2/2014
57
Positive Acknowledgment
Negative Acknowledgment
7/2/2014
58
Information Element: E Bit
Extension bit indicates whether Data field follows or a set of E
field and LI field follows
Information Element: Length Indicator LI
Length Indicator (LI) field
The LI field indicates the length in bytes of
the corresponding data field element present
in the RLC data PDU delivered/received by
an UM or an AM RLC entity.
The value 0 is reserved.
7/2/2014
59
Information Element:
FI Framing Information Field
Segment Offset SO
The Segment Offset field indicates the
position of the AMD PDU segment in bytes
within the original AMD PDU.
The first byte in the Data field of the original
AMD PDU is referred by the SO field value
"000000000000000"
7/2/2014
60
Last Segment Flag LSF
Resegmentation Flag RF
Value Description
0 AMD PDU
1 AMD PDU segment
7/2/2014
61
Information Element: Poll P
Value Description
0 Status report not requested
1 Status report is requested
Polling bit field
Control Pdu Type CPT
7/2/2014
62
STATUS PDU
NACK_SN
D/C CPT
E1
ACK_SN
ACK_SN
Oct 1
Oct 2
NACK_SN
E1 E2 NACK_SN
NACK_SN
SOstart
SOstart
SOend
SOend
E1 E2
SOend
Oct 3
Oct 4
Oct 5
Oct 6
Oct 7
Oct 8
Oct 9
D/C Data/Control
CPT Control PDU Type
E Extension Field
SO Segment Offset
STATUS PDU Fields
7/2/2014
63
MAC Protocol
MAC Functions
3GPP TS 36.322
7/2/2014
64
MAC Sublayers 3GPP TS 36.321
MAC Functions - UE Side
Random
Access Control
PCCH BCCH CCCH DCCH DTCH MAC-control
Upper layers
PCH BCH DL-SCH UL-SCH RACH
Lower layer
(De-) Multiplexing
Logical Channel Prioritization (UL only)
HARQ
Control
7/2/2014
65
MAC Functions eNodeb Side
Scheduling / Priority Handling
Multiplexing
DCCH DTCH CCCH
HARQ
DL-SCH HARQ
Feedback
Control
HARQ
Demultiplexing
DCCH DTCH
UL-SCH
CCCH
MAC Control
BCCH PCCH
Scheduling / Priority
Handling
HARQ
HARQ
Feedback
P
D
C
C
H
P
U
C
C
H
S
R
S
c
h
e
d
u
l
e
r
BCH PCH DL-SCH
MAC Function Location
7/2/2014
66
MAC Transport Channels
3GPP TS 36.321
MAC DL-SCH Transport Channel
3GPP TS 36.321
7/2/2014
67
Physical Channels
MAC Multiplexing
IP
via S1 or from
UEs stack
Payload
e.g. 1460 Byte
IP
20B
L1
Coding,
Interleaving,
Modulation
CRC
3B
Transport Block
TCP
20B
Payload
e.g. 50 Byte
IP
20B
TCP
20B
PDCP
Header Compression
& Ciphering
PDCP SDU
H
~3B
PDCP
2B
H
~3B
PDCP
2B
PDCP
PDU
RLC
Segmentation
concatenation
RLC
4B
RLC SDU
Concatenation
Segmentation
RLC SDU
RLC
PDU
RLC
2B
MAC
Multiplexing
MAC SDU(e.g. 927 Byte)
MAC
4B
Multiplexing (Padding) MAC
1B
MAC SDU (e.g. 599 Byte)
MAC
PDU
7/2/2014
68
MAC PDU Structure
A MAC PDU header consists of one or more MAC PDU subheaders
Each subheader corresponds to either a MAC SDU (RLC PDU), a MAC
control element or padding.
LCID Logical Channel ID
E Extension Bit
R Reserved
F Length Flag
L Length
MAC Control
element 1
... MAC header
MAC payload
MAC Control
element 2
MAC SDU MAC SDU
Padding
(opt)
...
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID padding
sub-header
MAC PDU
MAC PDU Structure
E Extension Bit
R Reserved
F Length Flag
L Length
MAC Control
element 1
... MAC header
MAC payload
MAC Control
element 2
MAC SDU MAC SDU
Padding
(opt)
...
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID padding
sub-header
A MAC PDU subheader consists of the six header fields R/R/E/LCID/F/L except for the last
subheader in the MAC PDU and for fixed sized MAC control elements.
R/R/E/LCID sub-header
LCID R R E Oct 1
7/2/2014
69
MAC PDU Structure
E Extension Bit
R Reserved
F Length Flag
L Length
MAC Control
element 1
... MAC header
MAC payload
MAC Control
element 2
MAC SDU MAC SDU
Padding
(opt)
...
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID padding
sub-header
Buffer Status Report (BSR) MAC control elements consist of either:
- Short BSR and Truncated BSR format: one LCG ID field and one corresponding Buffer Size
field, or
- Long BSR format: four Buffer Size fields, corresponding to LCG IDs #0 through #3.
MAC Control Elements
Buffer Size LCG ID Oct 1
Short BSR
Buffer Size #0
Buffer
Size #1
Buffer Size #1 Buffer Size #2
Buffer
Size #2
Buffer Size #3
Oct 1
Oct 2
Oct 3
Long BSR
MAC Control Element fields
- LCG ID: Logical Channel Group ID field identifies the group of logical
channel(s) which buffer status is being reported. The length of the field is 2 bits;
- Buffer Size: Buffer Size field identifies total amount of data available across all
logical channels of a logical channel group after the MAC PDU has been built
(scheduled) amount of data is indicated in number of bytes (including all data that
is available for transmission in the RLC layer and in the PDCP layer). The length of
this field is 6 bits
7/2/2014
70
MAC PDU Structure MAC SDUs
E Extension Bit
R Reserved
F Length Flag
L Length
MAC Control
element 1
... MAC header
MAC payload
MAC Control
element 2
MAC SDU MAC SDU
Padding
(opt)
...
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID padding
sub-header
MAC Signaling Procedures
RANDOM ACCESS
7/2/2014
71
Channel Mapping
UL-SCH PCH DL-SCH
PCCH
Logical Channels
type of information
(traffic/control)
Transport Channels
how and with what
characteristics
Downlink Uplink
PDSCH
Physical Channels
bits, symbols,
modulation, radio
frames etc
PRACH
RACH
CCCH
MCH BCH
-CQI
-ACK/NACK
-Sched req.
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info
MIB SIB
PMCH PHICH PDCCH
ACK/NACK
PDCCH
info
Physical Signals
only L1 info
-meas for DL sched
-meas for mobility
-coherent demod
-half frame sync
-cell id
-frame sync
-cell id group
-coherent demod
-measurements for
UL scheduling
MAC Signaling Procedures -
RANDOM ACCESS PROCEDURES
When???
- enable initial access - UE to E-UTRAN (CBRA)
- enable Handover access - UE to E-UTRAN (CFRA)
- establish UL synchronization (CFRA)
- Indicate presence of UL data (when not scheduled for long time) (CFRA)
7/2/2014
72
Random Access CBRA (Contention
Based Random Access)
When???
- used at initial access (initialcall setup)
- subject to collision (ALOHA Protocol)
CBRA
Random Access Preamble
(Randomly selected Preamble Id)
Random Access Response
RRC Connection Request
UE eNB
1.
2.
3.
4. RRC Connection Setup
CBRA RANDOM ACCESS
Initial Access for RRC Connection Establishment
Example
CBRA RANDOM ACCESS
To be discussed in class
7/2/2014
73
CBRA RANDOM ACCESS
BCCH: System Information
CCCH: RRC Connection Request
(Initial UE identity, Cause)
CCCH: RRC Connection Setup
(SRB1 parameters)
DCCH: RRC Connection Setup Complete
(Selected PLMN id, NAS: Attach Request *)
PRACH: RACH preamble
DL-SCH: RACH response
(RAPID; TC-RNTI);
RRC RRC
RRC RRC
RRC
RRC
RRC RRC
e
N
o
d
e
B
rach-Configuration {
preambleInformation { numberOfRA-Preambles n64 },
powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4,
mac-ContentionResolutionTimer sf48 },
maxHARQ-Msg3Tx 1 },
UE randomly selects
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
If no answer is received within
ra-ResponseWindowSize preamble is
sent again based on
preambleInitialReceivedTargetPower + powerRampingStep
PDCCH: RA-RNTI; Scheduling Grant;TA
RA-RNTI = 1+ t_id + 10f_id
MAC allocate TC-RNTI
PUSCH: TC-RNTI
UL SCH: RA message3
PDCCH: TC-RNTI; Scheduling Grant
DL-SCH: C-RNTI; Contention Resolution
UL-SCH: C-RNTI; BSR
Use TC-RNTI to decode DL SCH. If the UE contention
resolution
identity MAC control element matches the RRC connection
request
message promote TC-RNTI to C_RNTI.
The TC-RNTI is "promoted" to a C-RNTI,
i.e. the same 16-bit value
allocated for TC-RNTI
will continue to be used as C-RNTI
after the random access procedure
is successfully concluded.
The 40-bit MAC "UE contention resolution
identity" is identical to the RRC Connection
Request sent in RA message 3.
If the UE sees its preamble, it
will respond with RRCConnectionReq
Including its 40 bit UE-id and Est.
Cause)
MAC
MAC
MAC MAC
MAC MAC
MAC MAC
MAC
MAC
Random Access CFRA (Contention
Free Random Access)
When???
- is used for UEs in handover
- a special preamble is reserved
CFRA
(Pre-allocated Preamble Id)
UE eNB
1.
2.
3.
CFRA RANDOM ACCESS
Handover Access
7/2/2014
74
UE1 is assigned preamble pUE1 by means of RRC
signalling via cell 1 which is the serving cell of UE1
CFRA RANDOM ACCESS
Handover Access
p
UE1
RRC: RACH - ConfigDedicated
Cell 1
Cell 2
p
UE1
p
UE1
Cell 1
Cell 2
p
UE1
Free Random Access)
When???
- is used for UEs in re-synchronization
procedure when non scheduled.
- a special preamble is reserved
CFRA
UE eNB
1.
2.
3.
CFRA RANDOM ACCESS
UE out_of_sync resynchronization process
7/2/2014
75
CFRA RANDOM ACCESS
Uplink re-synchronization
- UE is scheduled for downlink data from eNodeB uplink Scheduler
- UE is out_of_sync (unsynchonized) due to following event:
non scheduled time period > timeAlignmentTimer
and alignment expiration has occurred (UL timing adjustment process)
- eNodeB through PDCCH physical channel on downlink transmission
assigns a reserved preample to UE
- UE uses preample and starts CFRA process to get back synchronization.
PDCCH for DL
data arrival
PDCCH for DL
data arrival
PDCCH for DL
data arrival
PDCCH for DL
data arrival
e
N
o
d
e
B
Free Random Access)
When???
- UE has data (overflowing) into buffer
- eNodeB has not scheduled UE since
long time
- UE requests scheduling using CFRA
random access procedure since it has
been UL out_of_sync
- a special preamble is reserved from
eNodeb and signaled through PDCCH
CFRA
UE eNB
1.
2.
3.
CFRA RANDOM ACCESS
UE UL_Scheduling Request to eNodeb UL scheduler
7/2/2014
76
Example
CFRA RANDOM ACCESS
To be discussed in class ...
CFRA RANDOM ACCESS
no PUCCH resources
no UL Synch (TAT is not running)
has repeated SR on PUCCH max no of times
BCCH: System Information
DL-SCH: RACH response
(RAPID; TC-RNTI);
RRC RRC
e
N
o
d
e
B
rach-Configuration {
preambleInformation { numberOfRA-Preambles n64 },
powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4,
mac-ContentionResolutionTimer sf48 },
maxHARQ-Msg3Tx 1 },
UE randomly selects
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
If no answer is received within
ra-ResponseWindowSize preamble is
sent again based on
preambleInitialReceivedTargetPower + powerRampingStep
PDCCH: RA-RNTI; Scheduling Grant;TA
RA-RNTI = 1+ t_id + 10f_id
MAC allocate TC-RNTI
PUSCH: C-RNTI
UL SCH: msg3 (BSR,
PHR)
PDCCH: C-RNTI; Scheduling Grant
UL-SCH: C-RNTI; BSR
Use C-RNTI to decode DL SCH..
MAC
C-RNTI provides contention resolution
If the UE sees its preamable, it
will respond with Scheduling Request
by sending msg3 containing MAC
control elements( BSR and/or PHR)
and identified by C-RNTI
RLC
RLC
DTCH/DCCH:
Scheduled Unicast Transmission
MAC
MAC MAC
MAC MAC
MAC MAC
MAC
MAC MAC
MAC
7/2/2014
77
UL Time Alignment
UL Time Alignment
Problem statement:
Different UEs within a cell will experience different propagation delay
to/from the cell site, depending on their exact position within the cell
coverage area.
UE 2
UE 1
Normally transmit timing is based
only on the timing of the received
downlink timing as a result their
corresponding uplink transmissions
will thus arrive at the cell site with
potentially very different timing.
Receive-timing differences might be too large orthogonality between
uplink transmissions of different UEs will not be retained subcarriers will
be out_of_sync OFDM orthogonality is lost !!! .
7/2/2014
78
UL Time Alignment
Solution:
A mechanism with an active uplink transmit-timing control is needed to
ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism:
- network measures received uplink timing
of the different UEs.
- adjusts (advance (+) command or retard
() command) transmit timing on a certain
amount.
- timing-control commands are transmitted
as higher-layer signaling (MAC) to the
UEs.
UE 2
UE 1
Timing Advance Command R R Oct 1
UL Time Alignment
Solution:
A mechanism with an active uplink transmit-timing control is needed to
ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism:
- UE has a configurable timer,
timeAlignmentTimer,
- used to control how long the UE is considered
uplink time aligned.
- When timer expires and no timing control
command is received (non scheduled UE)
CFRA Random Access process is needed
- timeAlignmentTimer is valid only in the cell
for which it was configured and started .
UE 2
UE 1
Timing Advance Command R R Oct 1
7/2/2014
79
MAC Scheduler
MAC Scheduler
7/2/2014
80
MAC Scheduler Blocks
MAC Scheduler
data1
data2
data3
data4
User #1 scheduled
User #2 scheduled
Time-frequency
fading, user #1
Time-frequency
fading, user #2
Channel dependant scheduler
- Adapts UE rate to channel conditions
7/2/2014
81
UL-SCH PCH DL-SCH
PCCH
Logical Channels
type of information
(traffic/control)
Transport Channels
how and with what
characteristics
Downlink Uplink
PDSCH
Physical Channels
bits, symbols,
modulation, radio
frames etc
BCCH DTCH DCCH DTCH DCCH CCCH
PRACH
RACH
CCCH
BCH
-CQI
-(N)ACK
-Sched req.
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info
MIB SIB
PHICH PDCCH
ACK/NACK
PDCCH
info
Physical Signals
only L1 info
DL Scheduling UL Scheduling
RS P-SCH S-SCH RS SRS
Scheduled Channels
Scheduled DL Resources
f
t
Two RBs
0.5ms
0.5ms
One Scheduling Block
180 kHz
1 ms
Scheduler
Link Adaptation
SBs
f
SINR
MIMO
7/2/2014
82
UL Scheduler
Modulation, coding
Buffer
Multiplexing Scheduler
Buffer
Uplink channel quality Scheduler
Multiplexing
Buffer
Modulation, coding
Priority handling
Buffer
eNodeB eNodeB
UE UE
C
Q
I
S
t
a
t
u
s
T
F

s
e
le
c
t
i
o
n
Downlink Uplink
Downlink
channel quality
MAC Scheduler
7/2/2014
83
HARQ
HARQ
LTE protocols over IP/ethernet transmission (Link Layer (ethernet), Network
layer (IP) and transport network protocols (TCP, UDP)) are not prepared to
recover from packet header bit errors and packet payload errors.
Although channel dependant MAC Scheduler adjusts scheduling to UE
channel conditions, BER unrecovery conditions might still be a problem that
might introduce large amount of retransmissions over the air interface
One potential solution might be the propagation of BER recovery functions to
higher layer protocols however it might introduce unaccepted delays
Another potential solution might be the choice to discard and fast retransmit
the entire data unit containing bit errors Physical layer Turbo coding correct
errors on receiver and CRC check BER to decide.....
LTE 3GPP standards define two layers of retransmission protection. HARQ on
MAC and ARQ on RLC
7/2/2014
84
HARQ (MAC) and ARQ (RLC)
UL ARQ
Transmitter
UL ARQ
Receiver
UL HARQ
Transmitter
DL HARQ
Receiver
DL HARQ
Transmitter
UL HARQ
Receiver
Sliding Window ARQ
Stop and Wait HARQ
Uplink L1
Downlink L1
RLC Status
(DL HARQ data)
RLC Status RLC PDUs
RLC PDUs
Transport Block +CRC
BLER ~10
-1
RLC
MAC
BLER ~10
-4
to 10
-3
BLER ~10
-4
to 10
-3
RLC PDUs
BLER ~10
-4
to 10
-3
RLC SDUs
BLER ~10
-6
BLER ~10
-1
Accessibility Preamples
7/2/2014
85
Random Access Procedure
RA Preamble Assignment
Scheduled Transmission (MSG3)
Contention Resolution (MSG4)
CFRA
Contention Free
Random Access
Process Steps
0
1
2
3
4
CBRA
Contention Based
Random Access
Process Steps
HARQ
HARQ
Uplink Open Loop Power Control
1) UE measures RS
UE
RBS
3) The power is ramped up until a response is heard
or maximum number of re-attempts is reached
Downlink
(PDCCH) ...
RACH Preamble RACH Response No Response
RA-RNTI
Downlink
(PDSCH)
subframe
1 ms
RA response window
...
...
RAPID
Timing (UL timing)
Scheduling Grant
Indicates RA Response on PDSCH
(Not UE specific)
Uplink
(PRACH)
RA msg 3
preamble
0.8 ms
Power step
preambleInitial power
... ...
Data
... ...
Max uplink cell power
7/2/2014
86
Random Access KPIs Using Drive Test
RBS
Measurement period
#RaAttCbra - #RaSuccCbra
False Preamble probability:
#RaAttCbra
#RaSuccCbra
= X 100
Random Access Success:
Exercises
RRC Signaling UE Log Traces
7/2/2014
87
Mobility Case Studies
Signaling on E-Utran
LTE Node B
LTE NodeB
LTE Node B
X2
X2
Mobility Case X2 Handover
Simplified mobility
scheme to handle the
most common
scenario
Forwarding of user
data on X2 interface
(Selective
Forwarding)
After handover is
completed, EPC is
informed and the
route is optimized
SGW MME
7/2/2014
88
X2 Handover
MME
RRC
CONNECTED
S-GW
Source eNB Target eNB
1. RRC CONNECTION RECONFIGURATION
(Bearer Setup,Measurement conf))
2. RRC Measurement Report
(Event A3)
3. HO
Decision
4. X2 HANDOVER REQUEST
5.Admission
Control
ACKNOWLEDGE
(Handover Command,Measurement conf)
7. X2 SN STATUS TRANSFER
8. Start Data
forwarding
9. Buffer
Forwarded
Data
11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
(Handover Complete)
15. S1 PATH SWITCH REQUEST
16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASE RRC
CONNECTED
14.Data Transfer in Target
21. Forward if any
Data in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
Handover Flow
1. Measurement Command message is included in RRC Connection
Reconfiguration message.
2. criteria event A3 is fulfilled UE will inform the source eNB by
sending Measurement Report.
3. Source eNB makes a handover decision based on Measurement
Report and RRM
7/2/2014
89
4. Source eNB issues a X2 - Handover Request message to the target
eNB passing necessary information to prepare the HO
- UE X2 signaling context reference at source eNB,
- UE S1 EPC signaling context reference,
- target cell ID,
- KeNB,
- RRC context including the C-RNTI of the UE in the source eNB,
- AS-configuration,
- E-RAB context and physical layer ID of the source cell + MAC for
possible RLF recovery).
UE X2 / UE S1 signaling references enable the target eNB to address the
source eNB and the EPC.
E-RAB context includes also necessary RNL and TNL addressing
information, and QoS profiles of the E-RABs.
Handover Flow
X2- Handover Request
7/2/2014
90
X2 Handover
MME
RRC
CONNECTED
S-GW
(Event A3)
3. HO
Decision
5.Admission
Control
ACKNOWLEDGE
8. Start Data
forwarding
9. Buffer
Forwarded
Data
(Handover Complete)
16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
20. X2 UE CONTEXT RELEASE RRC
CONNECTED
21. Forward if any
Data in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
5. AC (Admission Control) is performed by the target eNB
AC dependents on the received E-RAB QoS information
Target eNB configures the required resources according to the received E-
RAB QoS information - reserves a C-RNTI and optionally a RACH
preamble.
Handover Flow
7/2/2014
91
6. Target eNB prepares HO with L1/L2 and sends X2 - Handover
Request Acknowledge to the source eNB.
Message includes transparent container to be sent to the UE as an RRC
message (RRC Connection reconfiguration) to perform the handover.
Container includes:
- new C-RNTI,
- target eNB security algorithm identifiers for the selected security
algorithms,
- dedicated RACH preamble.
Handover Flow
X2 Handover Request Ack
7/2/2014
92
7. Source eNB sends SN STATUS TRANSFER message to the target
eNB
Reason: Inform RLC AM about uplink PDCP SN receiver status -
includes at least the PDCP SN of the first missing UL SDU and may
include a bit map of the receive status of the out of sequence UL SDUs
that the UE needs to retransmit in the target cell if there are any such
SDUs
Reason: Inform RLC AM about downlink PDCP SN transmitter status of
E-RABs includes next PDCP SN that the target eNB shall assign to
new SDUs, not having a PDCP SN yet.
Handover Flow
X2 Handover
MME
RRC
CONNECTED
S-GW
(Event A3)
3. HO
Decision
5.Admission
Control
ACKNOWLEDGE
8. Start Data
forwarding
9. Buffer
Forwarded
Data
(Handover Complete)
16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
20. X2 UE CONTEXT RELEASE
RRC
CONNECTED
21. Forward if any
Data in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
7/2/2014
93
8. Data forwarding is initiated
9. Target eNB buffers received DL data until the UE access the new cell.
10. Source eNB forwards RRC message RRC Connection
Reconfiguration included on X2 - message Handover Request
Acknowledge (includes mobilityControlInformationto the UE).
- source eNB performs necessary integrity protection and ciphering of the
message UE receives RRC Connection Reconfiguration
message with necessary parameters.
Handover Flow
RRC Container, Extract
RRCConnectionReconfiguration message
RRCConnectionReconfiguration-r8-IEs {
measConfig
mobilityControlInfo
radioResourceConfigDedicated
securityConfigHO
MobilityControlInfo ::=
targetPhysCellId
carrierFreq O
carrierBandwidth O
additionalSpectrumEmission O
t304 ENUMERATED { ms50, ms100, ms150, ms200, ms500, ms1000,
ms2000, spare1},
newUE-Identity C-RNTI,
radioResourceConfigCommon
rach-ConfigDedicated ra-PreambleIndex INTEGER (0..63),
ra-PRACH-MaskIndex INTEGER (0..15)
CarrierBandwidthEUTRA ::= SEQUENCE {
dl-Bandwidth ENUMERATED { n6, n15, n25, n50, n75, n100}
ul-Bandwidth ENUMERATED {n6, n15, n25, n50, n75, n100}
CarrierFreqEUTRA ::=
dl-CarrierFreq
ul-CarrierFreq O
SecurityConfigHO ::=handoverType CHOICE {
intraLTE {
securityAlgorithmConfig O
keyChangeIndicator BOOLEAN,
nextHopChainingCount
},
interRAT {
securityAlgorithmConfig
nas-SecurityParamToEUTRA
5 MHz
7/2/2014
94
11. UE synchronizes to target eNB (Check MAC protocol slides, CFRA
Handover Access) and accesses the target cell via RACH
- following a contention-free procedure (dedicated RACH preamble was
indicated in the mobility Control Information content of RRC
Connection Reconfiguration message)
- following a contention-based procedure if no dedicated preamble was
indicated. UE derives target eNB specific keys and configures the
selected security algorithms to be used in the target cell.
12. The target eNB responds with UL allocation and timing advance .
13. UE successfully accessed target cell UE confirms handover
sending
- RRC Connection Reconfiguration Complete message
- C-RNTI
- uplink Buffer Status Report (BSR), whenever possible
Handover Flow
X2 Handover
MME
RRC
CONNECTED
S-GW
(Event A3)
3. HO
Decision
5.Admission
Control
ACKNOWLEDGE
8. Start Data
forwarding
9. Buffer
Forwarded
Data
(Handover Complete)
16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
RRC
CONNECTED
21. Forward if any
Data in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
7/2/2014
95
14. Target eNB starts data transmission to UE
15. target eNB sends an S1: PATH SWITCH message to MME to inform
that the UE has changed cell.
Handover Flow
16. MME sends an UPDATE USER PLANE REQUEST message to the
Serving Gateway
17. Serving Gateway switches the downlink data path to the target side
S-GW sends one or more "end marker" packets on the old path to the
source eNB and then can release any U-plane/TNL resources towards
the source eNB .
18. Serving Gateway sends an UPDATE USER PLANE RESPONSE
message to MME.
19. MME confirms the PATH SWITCH message with the PATH SWITCH
ACKNOWLEDGE message.
Handover Flow
7/2/2014
96
S1 Path Switch Request Acknowledge
X2 Handover
MME
RRC
CONNECTED
S-GW
(Event A3)
3. HO
Decision
5.Admission
Control
ACKNOWLEDGE
8. Start Data
forwarding
9. Buffer
Forwarded
Data
(Handover Complete)
16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
RRC
CONNECTED
21. Forward if any
Data in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
7/2/2014
97
20. Target eNB informs successful handover accomplishment of HO to
source eNB (sending UE CONTEXT RELEASE) this message
triggers the release of resources by the source eNB.
21. source eNB can release radio and C-plane related resources
associated to the UE context
Handover Flow
LTE NodeB
Mobility Case S1 Handover
S1 handover:
Relocation of MME or
SGW
Handover to UTRAN or
GSM
Change of MME pool
area
Signalling is done via EPC
and does not assume the
existance of an X2
interface.
Similar to inter-RAT
handover
Forwarding of user data
either directly between
eNodeB or in-direct via S-
GW (Selective Forwarding)
MME SGW SGW MME
7/2/2014
98
Handover Events
S1 Handover
RRC
CONNECTED
S-GW
(Event A3)
3. HO
Decision
4. S1 HANDOVER REQIRED
(Source to Target Transparent Container )
8. Admission
Control
9. S1 HANDOVER REQUEST ACKNOWLEDGE
(Handover Confirm)
RRC
CONNECTED
T304
TS1RELOCprep
Regenerate
Security Keys
MME MME S-GW
Target Target
5. S10 FORWARD RELOCATION
REQUEST
6. S11 CREATE SESSION REQ/RES
7. S1 HANDOVER REQUEST
RESPONSE
12. S1 HANDOVER COMMAND
COMPLETE/ ACK
Source Source
20. S1 UE CONTEXT RELEASE
COMMAND
(Cause: Successful Handover)
UP Forwarding
Source
Target Source
Source Target Source
Target Source Target Source Source eNB Target eNB
11. S11 CREATE BEARER REQ/RES
17. S1 HANDOVER NOTIFY
7/2/2014
99
Exercises
Mobility Scenarios
Evolved Packet Core (EPC)
7/2/2014
100
EPS Interfaces
3GPP TS 23.401
EPC/LTE Architecture - 3GPP
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
101
LTE/EPC Interfaces
S1: interface between an eNodeB and an EPC provides an
interconnection point between the EUTRAN and the EPC. It is also
considered as a reference point.
- S1-MME: Reference point for the control plane protocol between E-UTRAN
and MME.
- S1-UP : Reference point for the transport for data streams on the S1
interface between E-UTRAN and SGW using the GTP-U protocol
Interface between eNodeB ( X2) provides capability to support radio
interface mobility between eNodeBs, of UEs having a connection with E-
UTRAN.
X2 interface enables inter-connection of eNodeBs and support of
continuation between eNodeBs of the E-UTRAN services offered via the S1
interface
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
102
LTE/EPC Interfaces
Interface between MME and HSS (S6a-interface) used to exchange data
related to the location of the mobile station and to the management of the
subscriber (capability to transfer packet data within the whole LTE service
area), using Diameter S6a/S6d Application signaling.
1. MME informs HSS about location of a mobile station managed by the latter.
2. HSS sends to the MME all the data needed to support the service to the
mobile subscriber.
Exchanges of data may occur when
- mobile subscriber requires a particular service,
- mobile subscriber wants to change some data attached to his subscription
- some parameters of the subscription are modified by administrative means.
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
103
LTE/EPC Interfaces
Interface between MME and S-GW (S11-interface) used to support
mobility and bearer management between the MME and S-GW
Interface between MME and MME (S10-interface) used to support user
information transfer and MME relocation support between the MMEs
Interface between S-GW and PDN-GW (S5 and S8-interface)
interfaces between S-GW and PDN-GW, provides support for functions for
packet data services towards end users during roaming and non-roaming
cases (i.e. S8 is the inter PLMN variant of S5).
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
104
LTE/EPC Interfaces
Interface between MME and SGSN (S3-interface) enables user and
bearer (DRB) information exchange for inter 3GPP access network mobility in
idle and/or active state
Interface between S-GW and SGSN (S4-interface) provides related
control and mobility support between GPRS Core and the 3GPP Anchor
function of Serving GW. In addition, if Direct Tunnel is not established, it
provides the user plane tunnelling
Interface between PCEF - PCRF/H-PCRF/V-PCRF (Gx Reference Point)
provides transfer of policy and charging rules from PCRF to Policy and
Charging Enforcement Function Point (PCEF) in the GW
Interface from PDN-GW to packet data networks (SGi reference point)
reference point between the PDN-GW and a packet data network. It may
be:
- operator external public or private packet data network or
- an intra operator packet data network, e.g. for provision of IMS services
Basic EPC Architecture
PDN GW
Serv GW
MME
PCRF
LTE
S1-MME S1-U
S10
S11
S5/S8
SGi
Gx
Gxc
External
IP networks
S9
S6a
Rx
OCS OFCS
X2
eNB
Gz Gy
HSS
IMS
7/2/2014
105
eNodeB LTE Radio Base Station. Provide Wireless access to the
UE
MME Mobility Management Entity. Management of subscription-
related data for each UE accessing over the LTE-RAN
HSS Home Subscriber Server. User data repository for UEs
accessing over the LTE-RAN
Ser GW Serving Gateway. In charge of user data traffic comming
from the UEs. Interfaces the eNodeBs
PDN GW Packet Data Network Gateway. Anchor point to
interconnect external IP networks
PCRF Policy and Charging Rules Function. Contains
policy control decision and flow-based charging control
functionalities.
OFCS Offline Charging System. Post-processing of
CDRs.
OCS Online Charging System. Real time charging.
7/2/2014
106
The EPC (SAE) Interfaces S3
S3 Interface
enables user and bearer
information exchange for inter
3GPP access network mobility
in idle and/or active state.
Based on Gn reference point
as defined between SGSNs.
Protocol: GTP-C
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
S4 Interface
Provides related control and
mobility support between
GPRS Core and the 3GPP
Anchor function of Serving GW
Is based on Gn reference
point as defined between
SGSN and GGSN.
In addition, if Direct Tunnel is
not established, it provides the
user plane tunnelling.
Protocol: GTP-C / -U
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
7/2/2014
107
The EPC (SAE) Interfaces S5/S8
S5/S8 Interface
Provides user plane tunnelling and tunnel
management between Serving GW and
PDN GW.
Used for Serving GW relocation due to UE
mobility and if the Serving GW needs to
connect to a non-collocated PDN GW for
the required PDN connectivity.
Protocol: GTP (or PMIPv6)
S5 is used in non-roaming scenario (i.e.
Serving GW and PDN GW in visited
network)
S8 is used in roaming scenario (i.e.
Serving GW in visited network and PDN
GW in home network).
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5/S8
SAE GW
The EPC (SAE) Interfaces S6a
S6a Interface
Enables transfer of
subscription and authentication
data for
authenticating/authorizing user
access to the evolved system
(AAA interface) between MME
and HSS.
Protocol: Diameter.
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
7/2/2014
108
The EPC (SAE) Interfaces - Gx
Gx Interface
provides transfer of (QoS) policy and
charging rules from PCRF to Policy and
Charging Enforcement Function (PCEF) in
the PDN GW.
Protocol: DIAMETER
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
S10 Interface
Reference point between MMEs for MME
relocation and MME to MME information
transfer.
Protocol: GTP-C
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
7/2/2014
109
S11 Interface
Reference point between MME and
Serving GW.
Protocol: GTP-C
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
S12 Interface
Reference point between UTRAN and
Serving GW for user plane tunnelling when
Direct Tunnel is established.
Protocol: based on the Iu-u/Gn-u
reference point using the GTP-U protocol
as defined between SGSN and UTRAN
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
7/2/2014
110
The EPC (SAE) Interfaces - SGi
SGi Interface
Reference point between the PDN GW
and the packet data network.
Packet data network may be an operator
external public or private packet data
network or an intra operator packet data
network, e.g. for provision of IMS services.
This reference point corresponds to Gi
and Wi functionalities and supports any
3GPP and non-3GPP access systems
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
The EPC (SAE) Interfaces - SGs
SGs Interface
Reference point between the MME in EPC
network and MSC/VLR in circuit switch
nework (2G/3G).
SCTP based interface.
HSS
HLR
MME SGSN
PCRF
2G 3G
Gb Iu-C
S3
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
SAE GW
MSC
SGs
A
Iu
7/2/2014
111
EPC Core Protocols
MME
S1-MME
S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP
Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2
Iur
Serving
GW
S5
PDN GW
Rx
7/2/2014
112
MME eNodeB UE
L1
PDCP
RRC
NAS
SCTP
L2
L1
IP
MAC
RLC
PDCP
S1AP RRC
L1
Relay
LTE Uu
L2
L1
IP
SCTP
S1AP
NAS
L2
L1
IP
UDP
GTP-C
L2
L1
IP
UDP
GTP-C
PGW
L2
L1
IP
UDP
GTP-C
SGW
S1-MME
S11 S5/S8
eNodeB
L2
L1
IP
SCTP
X2AP
X2
eNodeB
L2
L1
IP
SCTP
X2AP
MME
L2
L1
IP
UDP
GTP-C
S10
MME
L2
L1
IP
UDP
GTP-C
MAC
RLC
EPS User & Control Plane
7/2/2014
113
EPS User Plane Protocols
L1
GTP-U
L2
IP
L1
GTP-U
L2
IP
L1
GTP-U
L2
IP
eNodeB
L2
L1
IP
UDP
X2*
eNodeB
L2
L1
IP
UDP
S5/S8
L2
L1
IP
SGi S1-U LTE Uu
RLC
PDCP
MAC
L1
RLC
MAC
L1
IP
Application
Relay Relay
SGW eNodeB UE PGW
* X2 User plane used
to support Data
forwarding at intra
LTE handover
L1
UDP
GTP-U
L2
IP
UDP UDP
GTP-U GTP-U
PDCP
UDP
S1 Protocol
7/2/2014
114
S1 Interface
S1-AP
Transport
Network
Layer
GTP-U
UDP
IP
Data link layer
Physical layer
User Plane
PDUs
SCTP
IP
Data link layer
Physical layer
Radio
Network
Layer
Control Plane User Plane
Transport Network
User Plane
Transport Network
User Plane
S1 Interface
Two types of S1 interfaces are defined at the boundary depending on the
EPC access point:
S1-MME towards an MME
S1-U towards an S- GW.
There may be multiple S1-MME logical interfaces towards the EPC from
any one eNB. The selection of the S1-MME interface is then determined by
the NAS Node Selection Function.
There may be multiple S1-U logical interfaces towards the EPC from any
one eNB. The selection of the S1-U interface is done within the EPC and
signaled to the eNB by the MME.
7/2/2014
115
S1 Application Protocol (S1-AP)

SCTP
L2
L1
IP
L2
L1
IP
SCTP
S1-MME
eNodeB
MME
S1-AP S1-AP
S1AP: eNBMME Signaling
E-RAB Management
Initial Context Transfer Function
Common ID management
UE Capability Info Indication Function
Mobility Function for UEs in LTE_ACTIVE
Paging
S1 Interface Management Functions
NAS signaling Transport between UE and MME
S1 UE Context Release Function
UE Context Modification Function
Status Transfer
Trace Function
Location Reporting
S1 CDMA 2000 Tunneling Function
Warning Message Transmission Function
MME
7/2/2014
116
S1-AP Functions
Initial Context Transfer function: This functionality is used to
- establish an S1-UE context in the eNB,
- to setup the default IP connectivity,
- to setup one or more E-RAB(s) if requested by the MME,
- transfer NAS signaling related information to the eNB if needed.
Signaling Flow
The E-RAB Modify procedure signal flow
UE eNB
RRC: Connection Reconf.
E-RAB MODIFY REQUEST
MME
E-RAB MODIFY RESPONS
List of RABs and corresponding
QoS Profile to be modified
aswell as an optional NAS
message per RAB
Contains a list of all successfully
modified RABs and possibly a
list of all RABs that failed to be
modified
Includes the optional NAS
message Radio Modify Setup
Note that this RRC procedure is
not always triggered
RRC: Connection Reconf. complete
7/2/2014
117
S1-AP Functions
UE Capability Info Indication function: This functionality is used to
provide the UE Capability Info when received from the UE to the MME.
Mobility Functions for UEs in LTE_ACTIVE in order to enable a change
of eNBs within SAE/LTE (Inter MME/Serving S-GW Handovers) via the S1
interface (with EPC involvement).
Paging: This functionality provides the EPC with the capability to page the
UE.
S1-AP Functions
S1 interface management functions comprise the following:
-Reset functionality to ensure a well defined initialization on the S1
interface.
-Error Indication functionality to allow a proper error reporting/handling in
cases where no failure messages are defined.
-Overload function to indicate the load situation in the control plane of the
S1 interface.
-Load balancing function to ensure equally loaded MMEs within an MME
pool area.
-S1 Setup functionality for initial S1 interface setup for providing
configuration information.
- eNB and MME Configuration Update functions are to update application
level configuration data needed for the eNB and MME to interoperate
correctly on the S1 interface.
7/2/2014
118
S1-AP Functions
NAS Signaling transport function between the UE and the MME is
used:
- to transfer NAS signaling related information and to establish the S1 UE
context in the eNB.
- to transfer NAS signaling related information when the S1 UE context in
the eNB is already established.
S1 UE context Release function: This functionality is responsible for
managing the release of UE specific context in the eNB and the MME.
UE Context Modification function: This functionality allows modification
of the established UE Context in part.
Status Transfer: This functionality transfers PDCP SN Status information
from source eNB to target eNB in support of in-sequence delivery and
duplication avoidance at intra LTE handover.
S1-AP Functions
Trace function: This functionality is to control a trace recording for a UE in
ECM_CONNECTED.
Location Reporting: This functionality allows MME to be aware of the
UEs current location.
S1 CDMA2000 Tunneling function: This functionality is used to carry
CDMA2000 signaling between UE and CDMA2000 RAT over the S1
Interface.
Warning message transmission function:
This functionality provides the means to start and overwrite the
broadcasting of warning message.
7/2/2014
119
S1AP Elementary Procedures, Class 1
7/2/2014
120
7/2/2014
121
X2 Interface
eNodeB Interfaces X2
The interface between eNodeB
Mainly used to support active mode UE
mobility
May also be used for multi-cell Radio
Resource Management (RRM) functions
X2-CP interface will consist of a signalling
protocol called X2-AP on top of SCTP
The X2-UP interface is based on GTP-U
The X2-UP interface will be used to
support loss-less mobility (packet
forwarding).
The X2 interface is a many-to-many interface.
MME/GW
S1 S1 S1
X2 X2
eNode B eNode B eNode B
7/2/2014
122
X2 Protocol Model
X2-AP
Transport
Network
Layer
GTP-U
UDP
IP
Data link layer
Physical layer
User Plane
PDUs
SCTP
IP
Data link layer
Physical layer
Radio
Network
Layer
Control Plane
User Plane
Transport Network
User Plane
Transport Network
User Plane
X2AP: eNBeNB Signaling
Mobility Management
Load Management
Reporting of General Error Situations
Resetting the X2
Setting up the X2
eNodeB Configuration Update
7/2/2014
123
X2AP Functions
Intra LTE-Access-System mobility support for ECM-
CONNECTED UE
allows the eNB to handover the control of a certain UE to another eNB.
Context transfer from source eNB to target eNB
allows the transferring of information required to maintain the E-UTRAN
services for an UE in ECM-CONNECTED from source to target eNB.
Control of user plane transport bearers: source eNB -
target eNB
allows the establishing and releasing unique transport bearers between
source and target eNB during DL/UL data forwarding phases.
Handover cancellation
informs already prepared target eNB for a canceled pre-decided handover
execution releases resources allocated during preparation phase
X2AP Functions
UE context release in source eNB
allows target eNB to trigger release of UE allocated resources
in source eNB.
Load Management
allows exchanging overload and traffic load information
between eNBs for traffic load management. (according to
3GPP information may be spontaneously sent to selected
neighbor eNBs or reported as configured by a neighbor
eNB).
Inter-cell interference coordination (Feature)
allows keeping inter-cell interference under control
neighboring eNBs exchange appropriate information
allowing eNBs assign resources (PRB) to control
interference.
7/2/2014
124
X2AP Functions
Uplink interference load management
indicates uplink interference overload and resource blocks
especially sensitive to inter-cell interference between
neighboring eNBs leads to Neighbor eNBs resource
allocation co-ordination to mutually mitigate interference
caused by their uplink radio resource allocations.
Downlink interference avoidance
allows eNB to inform its neighbors about downlink power
restrictions in its own cells, per resource block, for
interference aware scheduling by the neighbor eNBs.
General X2 management and error handling functions
allow management of signaling associations between eNBs,
surveying X2 interface and recovering from errors.
X2AP Functions
Error indication
allows reporting of general error situations on application level.
Reset
allows eNB1 to inform X2 neighbor eNB2 about:
- recovering from an abnormal failure
- all contexts related to eNB1 and stored in eNB2 shall be
deleted, and the associated resources released.
Trace functions
UE trace recoding sessions on E-UTRAN interfaces initiated by
EPC. The trace initiation information is also propagated to
the Target eNB during handover, attached to certain
handover messages on X2.
Application level data exchange between eNBs
allows eNBs to exchange application level data during setting
up X2 connection and update this information any time.
7/2/2014
125
X2AP Elementary Procedures, Class 1
X2AP Elementary Procedures, Class 2
7/2/2014
126
SCTP
SCTP
SCTP (Stream Control Transmission Protocol) can be
used as the transport protocol for applications where
monitoring and detection of loss of session is required.
It is according to IETF RFC2960 and IETF RCF3309.
Used by S1-AP, X2-AP and Diameter (S6a, S10, Gx
and Rx)
7/2/2014
127
SCTP
SCTP is a transport layer protocol that provides
reliable, in-sequence transport of messages with
congestion control mechanisms.
SCTP is also a connection-oriented protocol that
maintains a relationship between the end points of an
SCTP association for the duration of the message
transmission.
SCTP is designed to transport telecommunications
signaling messages over Internet Protocol (IP)
networks.
PORT
2905 IP1,IP2 SCTP
endpoint
PORT
2905
PORT
2905
IP1,IP2,IP3
IP4,IP5,
IP6,IP7
Primary destination IP5
Primary destination IP1
Message (sequenced delivery)

Inbound/outbound stream
SCTP Association
SCTP Concepts
7/2/2014
128
SCTP Terminology
SCTP Association: An SCTP association is a logical connection
between two SCTP end points.
SCTP End Point: An SCTP End Point is the logical sender and
receiver of SCTP packets.
Heartbeat: The heartbeat is an SCTP message sent on an SCTP
association to monitor the availability of the paths to the remote
addresses of the SCTP association.
Stream: A stream is a sequence of user messages within a single
SCTP association.
Multi Homing: An SCTP association is multi homed if it supports
multiple IP addresses or interfaces at a given SCTP end point.
SCTP Terminology
Primary and Secondary Addresses: A multi homed
SCTP association has one primary address that is used
for receiving data.
remaining supported addresses are secondary
addresses that are spare addresses for the event the
primary address becomes unreachable.
SCTP does not support load sharing between the
multiple addresses of an SCTP association.
7/2/2014
129
SCTP Terminology
SCTP Client and Server: SCTP is used for both client
and server applications in the SGSN-MME.
Example: SGSN-MME acts as an SCTP server when
communicating with the eNodeB SCTP clients over the
S1-MME interface, whereas the SGSN-MME acts as an
SCTP client when communicating with Home Subscriber
Server (HSS) over the S6a interface.
SCTP datagram: The unit of data that constitutes an
SCTP message. Each datagram consists of a common
header followed by one or more chunks. Each chunk
may contain either user data or SCTP control
information. There are a limited set of chunk types
defined in SCTP.
SCTP Singe-Homed to Multi-
Homed SCTP End Point
7/2/2014
130
SCTP - Multi-Homed SCTP End Point
SCTP Services
SCTP offers the following services to its users:
- Acknowledged error-free non-duplicated transfer of user data
- Data fragmentation to conform to configured Maximum Transmission Unit
(MTU) size
- Sequenced delivery of user messages within multiple streams, with an
option for order-of-arrival delivery of individual user messages
- Optional bundling of multiple user messages into a single SCTP packet
- Network-level fault tolerance through support of multi-homing at either end
or at both ends of an association
7/2/2014
131
SCTP Procedure for Initializing an Association
SCTP uses the heartbeat mechanismto avoid half-open states (one end of
a connection has closed without the knowledge of the other end point).
Heartbeat mechanism: sending a heartbeat message to the inactive remote
addresses of the host. The SCTP user can choose the set of addresses on
which the heartbeat mechanism is to be performed.
Association Establishment
- initiated by the SCTP client sending a datagram with a INIT chunk.
- state cookie sent from SCTP server to SCTP client as part of the INIT ACK
chunk.
- SCTP client returns the received state cookie by sending a datagram with a
COOKIE ECHO chunk to the SCTP server.
-SCTP server can now safely create the server side of the association and
finalize the four-way handshake by sending a datagram with a COOKIE ACK
chunk to the SCTP client that creates the client side of the association.
SCTP Node 1
SCTP Node 2
PortID
SCTP entity
SCTP
PortID
SCTP entity
SCTP
IP1,IP2
IP3,IP4,IP5
IP Network
INIT
INIT ACK
COOKIE ECHO
COOKIE ACK
IP R
IP R
IP R
IP R
IP R
Create Association
(destination, # stream)
Communication UP
(assocID)
Communication UP
(assocID)
SCTP Procedure for Initializing an Association
basic service offered by SCTP is the reliable transfer of user messages
between peer SCTP users.
SCTP performs this service using an association between two SCTP end
points
7/2/2014
132
SCTP Message Types

CHUNK TYPES:
ID value Chunk type (SCTP message name)
0 Payload data (DATA)
1 Initiation (INIT)
2 Initiation Acknowledgement (INIT ACK)
3 Selective Acknowledgement (SACK)
4 Heartbeat Request (HEARTBEAT)
5 Heartbeat Acknowledge (HEARTBEAT ACK)
6 Abort (ABORT)
7 Shutdown (SHUTDOWN)
8 Shutdown Acknowledgement (SHUTDOWN ACK)
9 Operation error (ERROR)
10 State Cookie (COOKIE ECHO)
11 Cookie Acknowledgement (COOKIE ACK)
12 Reserved for Explicit Congestion Notification Echo (ECNE)
13 Reserved for Congestion Window Reduced (CWR)
14 Shutdown Complete (SHUTDOWN COMPLETE)
15- 255 Reserved by IETF for future expansion of the protocol
SCTP Message Structure

Verification Tag
Source Port Destination Port
Check Sum
SCTP
Common
Header
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK n
Verification Tag
Check Sum
SCTP
Common
Header
Verification Tag
Check Sum
SCTP
Common
Header
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK 1
User Data
Type Length Flags
CHUNK n
User Data
Type Length Flags
CHUNK n
7/2/2014
133
SCTP Payload Data

TSN
Type=0 Chunk Length Reserved U|B|E
Stream identifier S
Payload protocol identifier
User data ( Sequence N of stream S)
Stream Sequence number N
TSN
Type=0 Chunk Length Reserved U|B|E Type=0 Chunk Length Reserved U|B|E
Stream identifier S
Payload protocol identifier
User data ( Sequence N of stream S)
Stream Sequence number N
NAS
7/2/2014
134
NAS

SCTP
L2
L1
IP
L2
L1
IP
SCTP
S1-MME
eNodeB MME
S1-AP
S1-AP
NAS
MAC
L1
RLC
PDCP
UE
RRC
MAC
L1
RLC
PDCP
RRC
LTE-Uu
NAS
Relay
NAS Functions
NAS protocol supports
- mobility management functionality
- user plane bearer activation, modification and deactivation.
- ciphering and integrity protection of NAS signaling.
Attach: The Attach procedure is initiated by the UE to announce its
presence in the network. On completion, the UE is in the EMM-
REGISTERED state.
UE Requested PDN Connectivity Procedure: PDN Connectivity
Request procedure is used by the UE during an attach to request
the setup of a default EPS bearer to a PDN.
7/2/2014
135
NAS Functions
Authentication: The EPS authentication procedure provides mutual
authentication between the user and the network. For an EPS
subscriber authentication information is collected (if needed) from
the HSS and verified during the Authentication procedure. The
procedure is always initiated and controlled by the network.
TAU: The Periodic TAU procedure is used by the UE to notify the
network about its existence and to show that it is functioning
properly.
Service Request: The Service Request procedure is used to

change the state of the MM context to ECM-CONNECTED, to allow
the UE to send or receive desired data.
Detach: The Detach procedure is used to detach the UE from the
network. It is initiated by the UE or the network. On completion of the
Detach procedure, the UE is in the EMM-DEREGISTERED state
and cannot send and receive data.
SG Application Part
7/2/2014
136
SGs AP
SGs Application Part (SGsAP) protocol sends messages over the SGs
interface.
SCTP supports transferring of the SGsAP signaling messages.
SG AP Protocol
Summary SGsAP procedures over the SGs interfaces (3GPP TS 29.118):
Paging for Non-EPS Services Procedure
used by MSC/VLR to send paging request to the SGSN-MME. Paging is
only supported when the Service indicator IE indicates "SMS indicator".
Other paging requests are rejected.
Location Update for Non-EPS Services Procedure
used by SGSN-MME to initiated location update procedure towards the
Home Subscriber Server (HSS). The procedure is triggered by a
combined attach request or a combined tracking area update request from
the User Equipment (UE).
Non-EPS Alert Procedure
used by the MSC/VLR to request an indication from the SGSN-MME when
any signaling activity from the UE is detected.
7/2/2014
137
SG AP Protocol
Explicit IMSI Detach from EPS Services
This procedure used by the SGSN-MME to indicate to the
MSC/VLR that the UE has been detached from EPS
services. The SGs association between the MSC/VLR and
the SGSN-MME is deactivated for the UE.
Explicit IMSI Detach from Non-EPS Services
This procedure is used by the SGSN-MME to indicate to the
MSC/VLR that the UE has performed IMSI detach from the
non-EPS services.
SGs association between the MSC/VLR and the SGSN-
MME is deactivated for the UE.
SG AP Protocol
Implicit IMSI Detach from Non-EPS Services
used by SGSN-MME to indicate when an internal SGSN-
MME timer mechanism has caused the SGSN-MME to
delete EPS Mobility Management (EMM) context of a UE.
VLR Failure Procedure
used by MSC/VLR to inform the associated MMEs about a
restart, and that the SGs associations are no longer reliable
because the MSC/VLR has lost information about the state
of the UEs and during the failure the MSC/VLR might have
missed signaling messages.
7/2/2014
138
GTP GPRS Tunneling Protocol
What is Tunneling in Networks?
Network use a tunneling protocol when one
network protocol (usually the delivery
protocol should encapsulate a different payload
protocol for:
- carrying a payload over an incompatible delivery-
network,
- provide a secure path through an untrusted
network.
Notice that typically, delivery protocol could
operate at an equal or higher OSI layer in the
model than does the payload protocol.
7/2/2014
139
GTP
GPRS Tunneling Protocol (GTP) is the protocol between GSN nodes in
the GPRS backbone network. Includes both the GTP signaling (GTP-C)
and data (GTP-U) transfer procedures.
In EPC it will be used on S1-U,S10,S11,S4,S5/S8 and S3.
Always in a connection there is a user-plane connection (S1-U, X2-U)
that requires a GTP-U (User payload) tunnel across the EPC Backbone
Network and a GTP-C (Control Signaling) tunnel.
GTP packets use the User Datagram Protocol (UDP) as the transport
protocol. Both signaling and payload are carried on the same ports. The
GTP packets contain a message type field that allows the GTP
protocol to distinguish signaling from payload.
GTP GPRS Tunneling Protocol
S3
S1-U
S11
S12
PGW S5/S8 SGW
MME
SGSN
S10
S16
X2
MSC
UTRAN
HRPD
PDSN
S101
Server
Sv
S4
CDMA
2000
HRPD High Rate Packet Data GTP GPRSTunneling Protocol
PDSN Packet Data Serving Node TEID Tunnel Endpoint Identifier
All interfaces are GTPv2-
C only, except:
S1-U, S12, X2
(only GTPv1-U)
S4, S5/S8 (both)
GTP
Node A
GTP
UDP
IP
L1/L2
GTP
Node B
GTP
UDP
IP
L1/L2
GTP I/F
Destination Port:
GTPv2-C=2123
GTPv1-U=2152
Protocol ID:
UDP=17
TEID=xxx
TEID=yyy
GTP TUNNEL
GTP TUNNEL
Identified in each node by:
[TEID, IP-addr, Port number]
IP Address = AAA
IP Address = BBB
7/2/2014
140
What is TEID in GTP??
GPRS tunneling protocol (GTP) stack assigns a unique tunnel endpoint
identifier (TEID) to each GTP control connection to the peers.
GTP stack also assigns a unique TEID to each GTP user connection
(bearer) to the peers. The TEID is a 32-bit number field in the GTP
(GTP-C or GTP-U) packet
GTP
GTP tunnel is uniquely identified in a given node by the combination of:
IP-addresses + UDP port number + Tunnel Endpoint Identifier
(TEID)
Tunnel is bi-directional two TEIDs, one in each end
GTP-U user plane (S1-U, X2-U), there is a one-to-one relationship
between a tunnel and a bearer there may be multiple user plane
tunnels associated with a given UE.
GTP-C control plane (S10, S11, S4, S5/S8 S3) there always one tunnel
associated with a given UE between two nodes.
7/2/2014
141
GPRS Tunnelling Protocol (GTP-U)
User Plane:

Serving GW PDN GW
S5/S8
a
GTP-U GTP-U
UDP/IP UDP/IP
L2
Relay
L2
L1 L1
PDCP
RLC
MAC
L1
IP
Application
UDP/IP
L2
L1
GTP-U
IP
SGi S1-U LTE-Uu
eNodeB
RLC UDP/IP
L2
PDCP GTP-U
Relay
MAC
L1 L1
UE
GTP-U is indeed a framing protocol which allows multi-protocol packets to be tunneled
through the EPC Backbone to provide a service for carrying user data packets .
GTP-C Protocol Stack
GTP
UDP
IP
L2
L1
GTP
UDP
IP
L2
L1
GTPv2 entit y GTPv2 entity
GTPv2 based
interface
7/2/2014
142
GTP-C v2: MMESGW PGW
Signaling
SGW
Path Management
Tunnel Management
Mobility Management
CS Fallback and SRVCC related msgs
Non 3GPP related msgs
MME
PGW
MME
GTP Message Types
Path Management
7/2/2014
143
Path Management Messages
Echo Request
Echo Response
SGW/
ECHO Request
T3-RESPONSE
ECHO Response
N3-REQUESTS
MME
MME PGW
N3-REQUESTS
T3-RESPONSE
E
C
H
O

R
e
q
u
e
s
t
E
C
H
O

R
e
s
p
o
n
s
e
E
C
H
O

R
e
q
u
e
s
t
E
C
H
O

R
e
s
p
o
n
s
e
T3-RESPONSE
N3-REQUESTS
GTP-C v2: MMESGW PGW
Signaling
SGW
MME
PGW
S11
S5/S8
Create Session Request (QoS)
C
r
e
a
t
e

S
e
s
s
i
o
n
R
e
q
u
e
s
t

(
Q
o
S
)
Session Creation:
E-UTRAN Initial Attach
UE requested PDN connectivity
GTP-C is also used to convey:
-Tracking Area Update procedure with Serving GW change
-S1/X2-based handover with SGW change
-UTRAN Iu mode to E-UTRAN Inter RAT handover with SGW change
-GERAN A/Gb mode to E-UTRAN Inter RAT handover with SGW change
-3G Gn/Gp SGSN to MME combined hard handover and SRNS relocation
procedure
-Gn/Gp SGSN to MME Tracking Area Update procedure
7/2/2014
144
GTP-C MME SGWPGW
TS 29.274
Message Type value
(Decimal)
Message GTP-C
SGSN/MME to PGW (S4/S11, S5/S8)
32 Create Session Request X
33 Create Session Response X
34 Modify Bearer Request X
35 Modify Bearer Response X
36 Delete Session Request X
37 Delete Session Response X
EPC Geographical Parameters
7/2/2014
145
Network Structure
Geographical Parameters
Tracking Area
A Tracking Area (TA) is a geographical domain that
consists of one or more cells.
Size of a TA can range from a part of a city to an entire
province.
TA can be covered by one or multiple MMEs, if MME pool
is used.
UE can move between different TAs within the MME area
without having to change MME.
Network Structure
Tracking Area
All TAs served by the same MME (TAs UE could enter
without initiation a Tracking Area Update (TAU)
procedure) are listed in a Tracking Area Identity (TAI) list.
When the UE leaves the TAI list coverage area it has to
initiate the TAU procedure.
Tracking Area Identity is constructed from the MCC
(Mobile Country Code), MNC (Mobile Network Code) and
TAC (Tracking Area Code)
7/2/2014
146
Network Structure
Tracking Area
A sub domain name shall be derived from the MNC and
MCC by adding the label "tac" to the beginning of the
Home Network Realm/Domain
The TAI FQDN shall be constructed as:
tac-lb<TAC-low-byte>.tac-hb<TAC-high-
byte>.tac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
The TAC is a 16 bit integer. <TAC-high-byte> is the
hexadecimal string of the most significant byte in the TAC
and <TAC-low-byte > is the hexadecimal string of the
least significant byte. If there are less than 2 significant
digits in <TAC-high-byte> or <TAC-low-byte >, "0" digit(s)
shall be inserted at the left side to fill the 2 digit coding.
Tracking Area - Multiple Tracking Areas
TA1
TA4
TA3
TA2
UEs belong to multiple TA
1. UE belongs to TA1, TA3 and TA2.
The UE can move within TA1, TA2 and TA3
without TA update.
2. The UE will perform a TA update when
moving to a cell withinTA4.
3. After succesful TA update in TA4 the UE will
belong to TA2, TA3 and TA4
MME
TA list 1: TA list 2: ..........
- TA1 - TA2
- TA2 - TA3
- TA3 - TA4
7/2/2014
147
Network Structure
MME Pool Area 3GPP optional feature
An area where the UE is served without having to change the serving
MME. An MME pool area is served by one or more MMEs working in
parallel in a pool constellation. MME pool areas are a collection of
complete TAs
MME pool is a group of MMEs that serve a number of eNodeBs.
Each MME in a pool serves the same pool service area or pool
service areas, and the eNodeBs in the respective pool service area
are connected to each of the MMEs in the pool.
A pool service area consists of several TAs served by eNodeBs. As
long as a UE remains in the pool service area, it is attached to a
specific MME. If the MME is unavailable, the eNodeB reroutes the
signalling for the attached UE to another MME in the pool.
MME Pool Area
Pool Service Area MMEs in Pool
7/2/2014
148
Network Structure
MME Pool Area Planning hints
MME pool service area should be generally larger than a
single MME service area thus network experiences
fewer Inter-MME Tracking Area Update (TAU) procedures
and reduced signaling to the Home Subscriber Server
(HSS) and the Serving Gateway.
Increase the pool capacity add more MMEs to the
pool area connected to all eNodeBs in the pool service
area loadsharing algorithms will distribute eNodeBs
traffic to the new MMEs.
Network Structure
SGW Service Area
An area where the UE is served without having to change
SGWs.
SGW service area is served by one or more SGWs in
parallel.
SGW service areas are a collection of complete TAs.
SGWs service areas may overlap each other.
7/2/2014
149
SGW Service Area
SGW Service area is an area where the UE is served without having
to change SGW
MME/SGW relocation occurs primarily only when moving between
MME Pool Areas/SGW service area.
The IP Point of Presence (IP PoP) is fixed in the originally selected
PDN GW
MME
MME
MME
MME
MME
MME
MME
MME
MME
MME
S-GW
Before: S+P-GW
After: P-GW only
SGW SGW SGW SGW SGW SGW SGW SGW
PGW
1
2
S5
IP PoP
S10
EPC Identities
7/2/2014
150
E-UTRAN Identities - Overview
Inside E-UTRAN environment a general protocol id shall
uniquely identify a logical connection associated to a UE
over the S1 (MME) interface or X2 (eNodeB) interface.
These ids are used during signalling message interactions.
Example: Receiving a setup new message containing a
new id from sending node, receiving node shall store the AP
ID of the sending node for the duration of the logical
connection Receiving node shall assign the allocated id
as a logical connection identification in the first returned
message to the sending node.
eNB UE S1AP ID:
shall be allocated to uniquely identify the UE over the S1
interface within an eNB.
Example:
- When MME receives an eNB UE S1AP ID it shall store it
for the duration of the UE-associated logical S1-
connection for this UE.
- Once known to an MME this IE is included in all UE
associated S1-AP signaling.
- Remember: eNB UE S1AP ID is unique within the eNB
logical node.
7/2/2014
151
MME UE S1AP ID:
shall be allocated so as to uniquely identify the UE over the
S1 interface within the MME.
Example:
- When an eNB receives MME UE S1AP ID it shall store it
for the duration of the UE-associated logical S1-
connection for this UE.
- Once known to an eNB this IE is included in all UE
associated S1-AP signaling.
- Remember: MME UE S1AP ID is unique within the MME
logical node.
Old eNB UE X2AP ID:
Old eNB UE X2AP ID shall be allocated so as to uniquely
identify the UE over the X2 interface within a source eNB.
Example:
- When a target eNB receives an Old eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to a target eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: Old eNB UE X2AP ID is unique within the
eNB logical node.
7/2/2014
152
New eNB UE X2AP ID:
shall be allocated so as to uniquely identify the UE over the
X2 interface within a target eNB.
Example:
- When a source eNB receives a New eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to source eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: New eNB UE X2AP ID shall be unique within
the eNB logical node.
eNB1 Measurement ID:
shall be allocated so as to uniquely identify the
measurement configuration over the X2 interface within
the eNB that requests the measurement.
The eNB1 Measurement ID shall be unique within the eNB
logical node.
7/2/2014
153
eNB2 Measurement ID:
shall be allocated so as to uniquely identify the
measurement configuration over the X2 interface within
the eNB that performs the measurement.
eNB2 Measurement ID shall be unique within the eNB
logical node.
EPC PLMN Identity - GUTI
Globally Unique Temporary UE Identity (GUTI)
The purpose of the GUTI is
- to provide an unambiguous identification of the UE that
does not reveal the UE or the user's permanent identity in
the Evolved Packet System (EPS).
- To allow the identification of the MME and network.
Example: Since Attach, TAU and Service Request signaling
is sent non-ciphered, a temporary identity, GUTI or S-
TMSI, is used instead of IMSI in most cases.
7/2/2014
154
Identity - GUTI
Globally Unique Temporary UE Identity (GUTI)
A new GUTI will always be allocated at UE Attach
In 2G/3G networks P-TMSI is used which is locally (national-wide)
unique.
GUTI is globally unique No GUTI collisions can occur due to inter
MME roaming.
GUTI and P-TMSI have no relation to each other
Example: when UE moves from 3G to LTE, a new GUTI is allocated by
the MME independent on the existing 3G allocated P-TMSI + old P-
TMSI is sent to the MME as if it was a GUTI
Identity - GUTI
GUTI Structure
GUTI has two main components:
- one that uniquely identifies the MME which allocated the
GUTI known as GUMMEI
- one that uniquely identifies the UE within the MME that
allocated the GUTI known as M-TMSI
7/2/2014
155
Identity - GUTI
GUTI Structure
Globally Unique MME Identifier <GUMMEI> = <MCC> + <MNC> + <MMEI>.
where <MMEI> = (MME Group ID <MMEGI>) + (MME Code <MMEC>).
<GUTI> = <GUMMEI> + <M-TMSI>.
Attach TAU signaling UE leaves a pool service area (Attach or TAU)
to a new MME outside the pool service area target MME extracts
GUMMEI of serving MME from UE GUTI.
New (target) MME uses this GUMMEI to query the DNS for the address of
the serving (old) MME and fetches the UE context from the old MME.
Identity - GUTI
GUTI Structure- Hints
Paging purposes: mobile is always paged with the S-TMSI S-TMSI
shall be constructed from the MMEC and the M-TMSI.
<S-TMSI> = <MMEC> + <M-TMSI>
The operator shall need to ensure that the MMEC is unique within the
MME pool area and, if overlapping pool areas are in use, unique within
the area of overlapping MME pools.
The GUTI shall be used to support subscriber identity confidentiality, and,
in the shortened S-TMSI form, to enable more efficient radio signalling
procedures (e.g. paging and Service Request).
7/2/2014
156
GUTI, S-TMSI
GUTI
M-TMSI
(4)
MMEGI
(2)
MMEC
(1)
MCC / MNC
(3)
S-TMSI
M-TMSI
(4)
MMEC
(1)
MMEI
GUMMEI
GUTI provides unique identification of the UE that does not reveal
the UE or the user's permanent identity
Mobile is paged with the S-TMSI
EPC PLMN Identity
Globally eNodeB id
used to globally identify an eNodeB
E-UTRAN Cell Global Identifier ECGI id
used to globally identify a cell
E-RAB ID
uniquely identifies an E-RAB for one UE accessing via E-UTRAN.
7/2/2014
157
Identities
Mobile Country Code (MCC) .
Mobile Network Code (MNC).
Mobile Subscriber Identification Number (MSIN)
MCC
Not more than 15 digits
3 digits 2 or 3
MNC MSIN
NMSI
IMSI
Identities
Country Code. National Destination Code . Subscriber
Number
mobile number
National (significant)
Mobile station international
ISDN number
CC NDC SN
7/2/2014
158
Identities
eNodeB S1-AP UE Identity (eNB S1-AP UE ID)
This is the temporary identity used to identify a UE on
the S1-MME reference point within the eNodeB. It is
unique within the eNodeB.
MME S1-AP UE Identity (MME S1-AP UE ID)
This is the temporary identity used to identify a UE on
the S1-MME reference point within the MME. It is unique
within the MME.
Case Studies
EPC Mobility Cases
7/2/2014
159
Thank You!
Please take a moment
to complete the evaluation forms
provided by the instructor.
. . . . . . . . . .
Thank you for participating
in this class. See you in
the next class!
Copyright Eogogics Inc | www.eogogics.com| +1 703 281 3525
. . . . . . . . . .
Eogogics Inc. provides technical and soft-skills training and consulting services
to businesses and government clients in the US and abroad. The Eogogics
principals include seasoned executives who have been involved with exciting,
landmark projects. Our courses are developed by industry veterans with 15+
years experience. They are taught by instructors who are among the most
knowledgeable, experienced, and dynamic available anywhere today.
Eogogics Inc.
www.eogogics.com or www.gogics.com
Phone: +1-703-281-3525, 1 (888) 364-6442 toll free in the US * Email: sales@eogogics.com

Course - LTE-EPC Signaling - 14 July 2 Eogogics

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Course - LTE-EPC Signaling - 14 July 2 Eogogics

Uploaded by

Copyright:

Available Formats

7/2/2014

Message (sequenced delivery)

Service Request: The Service Request procedure is used to

You might also like