LTE Air Int Sec06 031108 v02 PDF

LTE Procedures
LTE Procedures
Informa Telecoms & Media
LTE Procedures
LTE Procedures
LTE Connection States
LTE Procedures
Network Attachment
System Information Broadcast
System Information Block Scheduling
PLMN and Cell Selection
Cell Reselection
IDLE Mode Location Management in LTE
Multiple Tracking Areas
Random Access Procedure
Contention Based Random Access
Non-Contention Based Random Access
Establishing RRC Connections
Registration Procedure
EMM State Machine
Security in LTE
Service Request and Initial Bearer Establishment
ESM State Machine
Connected Mode Mobility
Measurements for Handover
Measurement Scenarios
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
42
44
46
LTE Procedures
LTE Connection States

In order to effectively manage the connection status of the UE for packet based services there
are two state machines in the UE. These have been mention in the previous section with
respect to IDLE and CONNECTED mode. The diagram opposite shows a slightly different view
that takes into account the network architecture related to the connectivity status of the UE.
Packets based services do not require permanent physical connections allocated for the duration
of the packet session (unlike circuit switched connections) therefore the connectivity of the
UEisdriven by the two state machines in the UE, RRC level connectivity and MM level mobility.
When the mobile is considered to be LTE_DETACHED the EPC has no knowledge of the
location of the user and there are no ongoing connections. No communication context exists,
the only information related to the UE and the related subscription resides in the HSS function
ofthe EPC. The UE may be considered powered down whilst the MM state machine is in the
DETACHED state.
On attachment to the EPC the MM state machine is considered ACTIVE or IDLE depending
onthe current activity of the signalling or data connections. Once registered in the system
theUE may establish EPS bearers in order to transfer data and whilst the EPS bearer remains
connected the UE may become LTE_IDLE if no activity take place for a period of time.
The UE will therefore move between LTE_ACTIVE and LTE_IDLE modes on a regular and
frequent basis depending on the characteristics of the data flow, QoS assignment and
networkcapacity.
Whilst the MM state machine is moving between its states the RRC state machine will be
correspondingly transitioning between IDLE and CONNECTED states. When ever there is
arequirement from the upper layer or a paging message is received by the UE it will transition
toCONNECTED state whilst the upper layer information (signalling or data) is transmitted.
UE
NAS Procedures (EMM, ESM)
SGW
LTE_Detached,
LTE_Active,
LTE_Idle
EMM
eNB
RRC_Idle,
RRC_Connected
RRC
S1
Fig. 1 MM and RRC Mobility/Connection States

LTE Procedures
LTE Procedures
The procedures may be categorised as follows;
Network Attachment including RRC connections and EPC registrations

Session Management including EPS Bearer establishment, Security and QoS negotiation
IDLE mode mobility including System Information, Paging, cell selection/reselection, TA
updates
CONNECTED mode mobility including radio connection handover, EPC context
handover, measurements and reporting.
It is not reasonable to examine all possible procedures or scenarios in this section therefore
onlya few procedures under each category outlined above will be covered.
Network Attachment
including RRC connections and EPC
registrations
Session Management
including EPS Bearer establishment,
Security and QoS negotiation
IDLE mode mobility
including System Information, Paging,
cell selection/reselection, TA updates
CONNECTED mode mobility
including radio connection handover,
EPC context handover, measurements
and reporting.
Fig. 2 LTE Procedures

LTE Procedures
Network Attachment
Before any other service or procedure can be carried out the UE must attach and register its
presence in the network, this applies to home network and roaming scenarios. Attachment is
usually carried out when the UE is powered up, the process relies on many other mechanisms
within the network for successful attachment.
The diagram opposite shows the high level functions required for network attachment.
UE
EPC
Radio Ch Scanning
Synchronisation
System Information
Network
Acquisition
PLMN
Selection
System Information
System Information
System Information
Cell Selection
PLMN Selected
Random Access
Random Access Response
RRC
Connection
RRC Connection Request

RRC Connection Response
RRC_Connected
Random Access
NAS
Registration

EMM_Registered
RRC_Idle (time out)
Fig. 3 Procedures Related to Network Attachment

LTE Procedures
System Information Broadcast

There are 3 main parts to the system information broadcast procedures.
First of all the most critical information is transmitted with high frequency in the Master
Information Block (MIB) this includes
Downlink System Bandwidth

Number of Transmit Antennas
PHICH Configuration
System Frame Number (SFN)
The MIB is transmitted every 40mS on the BCCH mapped to the BCH transport channel.
Secondly, less urgent information can be transmitted on the BBCH and mapped to the
DLSCH.This information is contained within System Information Block (SIB) 1. This can
beother wise referred to as a Scheduling Unit 1 (SU-1) and amongst other information
itcontains scheduling information about the other SIBs that may be transmitted. This
messageis transmitted every 80mS.
Scheduling information i.e. the periodicity of the other Scheduling Units (other than SU-1);
One or more PLMN identities (up to 6);
Tracking Area Code;
Cell identity;
One bit for cell barring common for all sharing PLMNs;
One bit for cell reserved for operator use per sharing PLMN (up to 6);
One bit for cell reservation extension common for all sharing PLMNs;
One bit for CSG indication;
Value_tag (Common for all SUs);
SIB mapping information i.e. indication in which SU the SIB is included (FFS).
And finally, other SIBs containing information relating to the system and the behaviour of the
UEin the system. There are 7 additional SIBs that are transmitted according to the schedule
transmitted by SIB-1 or SU-1.
SIB2 Access class and access related parameters
SIB3 Cell selection and Measurement parameters
SIB4 Serving cell frequency parameters including neighbour cell black lists
SIB5 Inter-carrier parameters, thresholds, inter-frequency black lists
SIB6 UTRA cell reselection parameters, thresholds, quality levels, transmit powers
SIB7 GERAN cell selection parameters,, NCELL lists, NCC permitted
SIB8 CDMA Cell selection Parameters, selection thresholds, NCELL lists
10
Master Information Block

Downlink System Bandwidth
Number of Transmit Antennas
PHICH Configuration
System Frame Number (SFN)
System Information Block 1
Scheduling information
SIB mapping information
One or more PLMN identities (up to 6);
Tracking Area Code;
Cell identity;
One bit for cell barring common
One bit for cell reserved for operator use
One bit for cell reservation extension
One bit for CSG indication;
Value Tag
System Information Blocks 2 -8
SIB2 Access class and access related parameters
SIB3 Cell selection and Measurement parameters
SIB4 Serving cell frequency parameters including
neighbour cell black lists
SIB5 Inter-carrier parameters, thresholds, inter-frequency
black lists
SIB6 UTRA cell reselection parameters, thresholds, quality
levels, transmit powers
SIB7 GERAN cell selection parameters,, NCELL lists,
NCCpermitted
SIB8 CDMA Cell selection Parameters, selection
thresholds, NCELL lists
Fig. 4 System Information Blocks
11
LTE Procedures
System Information Block Scheduling

SIB1 contains the schedule of SIB transmission. It indicates how often the system information
will be transmitted and which system information blocks will be transmitted.
It is possible that the some of the system information will change over time. The change
ofinformation must be indicated to the UE. This may be done by changing the scheduling
information transmitted by SIB1. The paging messages may also carry a change indication,
relieving the need for the UE to schedule SIB decodes whilst performing DRX.
The information received y the UE is considered valid for a period of 6 hours, after which the
information will have to be updated.
12
UE
EPC
Master Information Block

SIB 1 Scheduling and SIB Mapping
MIB 40mS
SIB1 80mS
SIB2
SIB3
SIB5
Scheduling
Unit 1
320mS
SIB2
SIB4
SIB7
Scheduling
Unit 2
1280mS
SIB8
Fig. 5 System Information Scheduling

13
LTE Procedures
PLMN and Cell Selection

PLMN Selection is the process where the UE finds ands selects a suitable PLMN. This process
is driven by the subscribed PLMN identity stored on the UICC (SIM card). The UE will first
search for the home PLMN, where the home PLMN is not available the UE will search and find
available PLMNs and rank them in order of priority. The ranking may be driven by preferred
PLMN lists or purely on the basis of best cell, this consideration may include access
technology type (E-UTRAN, UMTS, GERAN etc), signal strength and quality.
Once the PLMN has been selected the UE must make selection of cell on which to camp and
make the initial registration to the system. The initial cell selection process is determined from
UE measurements and cell selection criteria broadcast in the System Information Block. Cells
may be ranked into;
Acceptable Cells; limited services available, cell not barred, cell selection criteria fulfilled
Suitable Cell; normal service, part of a registered or permitted PLMN, not barred, cell selection
criteria fulfilled.
Cells are considered barred or reserved if the access class in the SIB2 is set to indicate barring
or access reserved only for certain access classes.
The UE will select the cell that is fulfils the cell selection criteria and is ranked highest in the list
of available cells. The cell selection may be driven by a stored list or by a new scan.
The minimum criteria for cell selection is ;

Srxlev > 0
Where Srxlev is

14
Srxlev = Qrxlevmeas (Qrxlevmin Qrxlevminoffset) Pcompensation

Qrxlevmeas signal level measured in the cell
Qrxlevmin minimum require signal level required in the cell
Qrxlevminoffset an offset used when searching for a higher priority PLMN, usually when
camped on a VPLMN
Pcompensation currently under study.
Cell selection based on;

Initial cell selection
Stored list
d
Qrxlevmeas [a f]
Srxlev > 0
Srxlev [a f] =
Qrxlevmeas [a f] (Qrxlevmin [a f] Qrxlevminoffset) Pcompensation
Fig. 6 Cell Selection

15
LTE Procedures
Cell Reselection
After initial cell selection the UE will then being to consider cell reselection (and periodically
PLMN reselection if the current PLMN selected is not the HPLMN).
There is no particular need to provide the UE with a list of neighbour cell (NCL) in LTE since the
UE will scan and find available cell autonomously, however there are occasions where the NCL
may be provided i.e. where the system wishes to specify particular cell reselection parameters
for intra and inter cell reselections.
In general intra-frequency (intra-LTE) reselection is based on a ranking process where a ranking
value (R) is calculated for the current serving cell and for the suitable neighbour cells. When a
neighbour cell is ranked higher that the serving cell for a time that exceeds the Treselection
parameter and the current serving cell has been selected for more than 1 second, the UE will
selected the new cell. The UE may also take into account thresholds that consider the speed of
the mobile. In high mobility scenarios it may not be desirable to have the mobile select particular
cells, in this case the reselection calculation may apply certain speed related offsets and
hysteresis parameters.
The ranking of cells is given by;

Rs = Qmeas,s + Qhysts
Rn = Qmeas,n Qoffset
Where
Qmeas is the value of Srxlev measured by the UE
Qhysts and Qoffset are cell reselection paramaters broadcast in the System Info Blocks
Cell reselection will take place when;

Rn > Rs > Treselection
Cell reselection may be further complicated by interRAT processes. The UE will prioritise
cellsbased on the RAT and apply different reselection timers and offsets according to the
parameters sent in the system information blocks.
16
Rs
Rs
Rs
Rs = Qmeas,s + Qhysts
Rn = Qmeas,n Qoffset
Cell reselection occurs;
Rn > Rs for time > Treselection
Treselection and Qhyst may be scaled dependant on the UE mobility State, i.e. High, Medium
Fig. 7 Cell Reselection

17
LTE Procedures
IDLE Mode Location Management in LTE

Location management is important in cellular mobile systems. The level of mobility management
control depends on the current level of connection the UE has with the network. If the UE is
RRC_CONNECTED then the radio access network has a cell level resolution of the location of
the UE, the current cell is updated as the mobile moves from cell to cell during the handover
procedure.
However when the UE is in and IDLE state the radio access network has no information about
the location of the mobile. This information is retained by the serving gateway and mobility
management entities. For IDLE mode UEs the resolution of location information is also much
less detailed than CONNECTED UEs.
The EPC only records the location of the UE on the basis of a Tracking Area (TA). The tracking
area is a defined group of radio cells, much like the Location or Routing Areas of 2.5G networks.
The size of the TA is dependant on the expected level of IDLE mode UEs in any particular area,
the dimensioning goal would be to reduce the amount of TA update signalling seen in any area
and to balance this against the amount of paging load required, generally speaking larger TA
willreduce the amount of update signalling but may increase the required paging load across
the TA. The actual size of the TA will be a matter of system optimisation.
There are 3 opportunities for the UE to perform TA updates with the EPC.
At initial registration
When the UE move to a different TA
Periodically
The periodic update is useful for purging the core network of UEs which are no longer within
network coverage or the device battery has failed.
18
TA4
TA2
TA8
TA1
TA3
TA5
TA7
TA6
Location Updating
At initial registration
When the UE move to a different TA
Periodically
Fig. 8 IDLE Mode Mobility

19
LTE Procedures
Multiple Tracking Areas

A new feature to location management in LTE is the ability for the UE to be registered in
multipleTA. The EPC will signal to the mobile a list of TAs associated with the TA it is currently
registered. The UE may then move between these TAs with out the need for updates to take
place. The list may be updated by the EPC when the mobile performs its periodic TA update.
20
TA4
TA2
TA8
TA1
TA3
TA5
TA7
TA6
Fig. 9 Tracking Area and Multiple Tracking Area Registration

21
LTE Procedures
Random Access Procedure

Random Access (RA) is the procedure used by the UE to move from an RRC_IDLE state
toRRC_CONNECTED state. The following 5 events use the RA procedure;
Initial access from RRC_IDLE;

Initial access after radio link failure;
Handover requiring random access procedure;
DL data arrival during RRC_CONNECTED requiring random access procedure;
UL data arrival during RRC_CONNECTED requiring random access procedure;
The RA process may also be;
22
Contention based
Non-Contention Based
Random Access Procedures

Initial access from RRC_IDLE;
Initial access after radio link failure;
Handover requiring random access
procedure;
DL data arrival during RRC_CONNECTED
requiring random access procedure;
UL data arrival during RRC_CONNECTED
requiring random access procedure;
Random Access Types

Contention Based
Non-Contention Based
Fig. 10 Random Access Events

23
LTE Procedures
Contention Based Random Access

Contention based random access is a 4 step procedure that begins with UE transmitting a
Random Access preamble. The random access preamble is a 5 bit random value chosen by
the UE. The RA preamble will be selected from a group of preamble that are not reserved for
non-contented access.
The RA response is returned to the UE and addressed to the RA-RNTI (unambiguously identifies
which time-frequency resource was utilized by the UE to transmit the Random Access preamble).
The RAPID (RA Preamble Identifier) identifies the preamble chosen by the UE. The response also
contains a temporary C-RNTI which will be upgraded to a permanent C-RNTI after successful
contention resolution. Uplink time alignment information, in 0.5S increments is present in the
response as well as an initial UL grant indicting when the next scheduled UL transmission should
take place as well as the maximum size of the UL transmission, for the UE to signal the next
stage of the RRC sequence, i.e. RRC bandwidth request, answer to paging etc.
The first scheduled transmission will pass information from the UE to the eNB, the nature of the
information depends on the reason for the RA procedure;
Initial access
RRC Connection Request from RRC layer via CCCH
NAS UE Identifier
RLC TM
After Radiolink Failure
RRC Connection Re-Establishment Request via CCCH
RLC TM
After Handover
Ciphered and integrity protected RRC Handover Confirm via DCCH
C-RNTI
Finally any contention in the channel will be resolved by the network returning a Contention
Resolution message containing the C-RNTI. This message promotes the temporary C-RNTI
toa permanent identity which will be used to identify the UE as long as the RRC_CONNECTED
mode remains.
24
UE
RACH
DL-SCH
EPC
Random Access Preamble
[5 bit random
number]
[Timing Advance,
UL Grant,
Temp C-RNTI,
RAPID, addressed
to RA-RNTI]
Scheduled Transmission
CCCH,
DCCH
Contention Resolution
[RRC Connection
Request, RRC
Re-Establishment
Request,
RRC Handover
Confirm;
NAS Message
(TA Update,
Service Request
Attach), C-RNTI]
[C-RNTI]
Fig. 11 Contention Based Random Access

25
LTE Procedures
Non-Contention Based Random Access

This procedure is used when the eNB already has a reference for the requesting terminal.
Itisapplicable for cases of downlink transmission resumption when the UE is in the
RRC_CONNECTED state and for inter-eNB handover cases. At some point in previous
transactions the UE will have been allocated a contention free preamble which does not
belongto the random access preambles broadcast on the BCH. This is likely to have been
allocated to the UE during handover procedure or during data transfer.
The UE will then perform UL random access on the RACH and wait for a response on the
DLSCH. As before the random access response contains the timing alignment, UL grant,
RAPID and also timing alignment for DL data arrival.
26
UE
EPC
DCCH
RA Preamble Assignment
[Handover,
DL Tx Resume,
Assigned
Preamble]
RACH
Random Access Preamble
[Assigned
Preamble]
[Timing Advance,
UL Grant,
C-RNTI, RAPID,
addressed
to RA-RNTI]
DL-SCH
Fig. 12 Non-Contention Based Random Access

27
LTE Procedures
Establishing RRC Connections

In order that signalling or data can be transmitted UL or DL an RRC connection must exist.
Thisprocedure is used to establish a signalling radio bearer (SRB), SRB1 and to optionally
convey NAS signalling to the EPC.
Once SRB1 has been established SRB2 will be setup to convey other lower priority signalling
and to initiate the security procedures across the air interface. SRB2 will also be used to setup
and negotiate Data RB (DRB) in the user plane.
28
UE
RRC_IDLE
EPC
RRC Connection Request
[following
RA Response,
C-RNTI]
RRC Connection Setup
[SRB1
Establishment,
RR Config,
RLC Setup,]
RRC Connection Setup Complete
[PLMN Identity,
MME Identity NAS
Dedicated info]
RRC_
CONNECTED
Establish SRB2, DRB,
Security Mode
Fig. 13 RRC Connection Setup

29
LTE Procedures
The registration procedure allows the mobile to identify itself to the network and to register
forservices supported by the network and the users subscription. It serves as a valuable
network entry procedure allowing security procedures to be initiated and the initial bearer
tobeestablished.
4 main purposes are served by the registration procedure;
30
Mutual user-EPC authentication

Allocation of a NAS temporary identity to protect the IMSI
User location registration (TA registration) to support paging
Establishment of the default or initial bearer, supporting always on connectivity for
certainservices.
Registration Purpose
Mutual user-EPC authentication
Allocation of a NAS temporary identity to
protect the IMSI
User location registration (TA registration)
to support paging
Establishment of the default or initial
bearer, supporting always on connectivity
for certain services.
Fig. 14 Main Reasons for the Registration Process

31
LTE Procedures
The registration procedure begins with the UE establishing an RRC connection (1) followed
bythe Attach Request (2), which is forwarded to the MME. The user identity may be the IMSI
ora previously allocated S-TMSI. The S-TMSI can be used to locate subscriber information
stored in the last registered MME, prompting the forwarding of user MM context data, security
information and other subscription related information. Once the MME has recovered some
subscriber details it can begin the security process (3), namely AKA (Authentication Key
Agreement), AKA procedure is very similar to that used in UMTS, i.e. random challenge
isusedto generate a unique response and additional keys that are used to generate cipher
keys. The MME then recovers the subscriber data from the HSS (Home Subscriber Server)
andupdates the location of the user in the HSS (4).
The MME then coordinates the establishment of the initial bearer with the Serving Gateway
andPDN Gateway. The EMM Attach Accept message is piggybacked in the RB Establishment
Request message and the response is similarly embedded in the RD Establishment
Response(5).
The completion of this procedure has opened up a user plane radio bearer allowing upper layer
applications to make use of the connection to register for user level services, e.g. sign in to a
mail server, sign on to a IM server, register on a SIP server to allow incoming calls.
32
S6
MME
S1
UE
S11
eNB
1
S5
HSS
SGi
Serving GW PDN GW
Random access
procedure
Attach Request (IMSI, S-TMSI)
Authentication
(AKA)
Update Location (IMSI)

Insert Subscriber Data
4
Insert Subscriber Data Ack

Update Location Ack
Create Bearer Request
Create Bearer Response

Attach Accept (new S-TMSI)
RB Est Req (Attach Accept)

RB Est Res (Attach Complete)
Attach Complete
Fig. 15 Registration Procedure

33
LTE Procedures
EMM State Machine

The diagram opposite shows in detail the 8 possible states for the Evolved Mobility
Management (EMM) state machine.
34
EMM-NULL
EMM-TRACKINGAREA-UPDATINGINITIATED
TAU
rejected
EMMDEREGISTERED
INITIATED
Enable
S1 mode
TAU accepted
TAU failed
TAU rejected
(#13, #15)
DETACH accepted
Lower layer failure
Disable
S1 mode
EMMDEREGISTERED
ATTACH
requested
TAU
requested
DETACH requested
(not power off
Network init. DETACH requested

Local DETACH
ATTACH rejected
Network init. DETACH requested
Lower layer failure
DETACH
requested
(power off)
EMMREGISTERED
SR
initiated
SR accepted
SR failed
ATTACH
accepted
Any state
EMMREGISTERED
INITIATED
EMM-SERVICE
REQUEST
INITIATED
Fig. 16 Detailed State Transitions for EMM Machine

35
LTE Procedures
Security in LTE
The security methods used in LTE are the same AKA (Authentication Key Agreement) thatis
used in UMTS
Mutual authentication between the user and network is carried out using secret keys stored
inthe USIM and HLR/AUC. The procedures use algorithms that avoid passing any key over
theair interface.
The procedure begins with either the serving VLR or SGSN requesting authentication data
fromthe HLR/AVC. This results in one or more authentication vectors (AV), each consisting
offive elements (a quintet) being received and stored. The VLR or SGSN selects an AV and
sends two elements (the random number, RAND and authentication token, AUTN) to the UE
over the air interface. The USIM processes both, using RAND to produce a response, RES.
AUTN is used to enable the UE to authenticate the network, and RES is only returned to the
network if the authentication using AUTN succeeds. The returned RES is compared with the
expected response (XRES, one of the five supplied AV elements) and if they coincide, the user
isconsidered authentic.
Authentication processes also generates a cipher key (CK) and integrity key (IK), required by
both UE and SRNC for secure ciphering and integrity functions. The UE calculates CK and IK
during authentication, whilst the RNC is supplied with the values extracted from the selected AV.
In addition to EPC domain protection LTE also supports security mechanisms that go beyond
the boundaries of the network. For example an LTE user may make access via a wireless LAN
or WiMAX network, in that case it is likely that more traditional IP based security would be used,
typically EAP (Extensible Authentication Protocol) which makes use of IP based architecture
andAAA (Authentication, Authorisation and Accounting) servers.
If the LTE EPC is connected to the IMS, then a similar AKA process to that described above
may be implemented in addition to the EPC processes.
36
U.E.
USIM
MME
USERS
HLR/AUC
AV
Distribution
Authentication Data
Request
Generate
AV
Authentication Data
Response AV
Store AV
Select AV
Compute
OK and IK
Compare RES
and XRES
Authentication and
Key Establishment
User Authentication
Verify AUTN Request RAND,
AUTN
Compute
RES
User Authentication
Response RES
Select
CK and IK
AV = authentication vector
RAND = random number
AUTN = authentication token
RES = response
XRES = expected response
CK = cipher key
IK = integrity key
Fig. 17 UMTS/LTE Security Procedure
37
LTE Procedures
Service Request and Initial Bearer Establishment

The sequence shown opposite describes a slightly different scenario for the establishment of
the radio bearers. This sequence is likely to happen when a UE returns to RRC_CONNECTED
from a time out IDLE period. The triggering of the random preamble may be the result of data
from upper layers requesting transmission from the UE or the result of DL data triggering a
paging request from the EPC. In either case the EPS bearer that was established at registration
or established during previous service requests is maintained in the EPC and only requires
reconnection.
In this sequence, once the security procedures are complete the MME begins the process
ofre-establishing existing default and dedicated bearers by sending the Initial Context Setup
Request to the eNB. The eNB will then create a UE context which is used for scheduling data
transfer UL and DL to the UE.
Once the RB has been established across the radio interface the MME then updates the context
data at the Serving GW. The Serving GW does not need to exchange signalling with the PDN GW,
since the PDN GW has maintained the EPS bearer context whilst the UE was in the IDLE state.
It should be noted that as well as setting up resources across the radio interface the procedures
described here will also trigger resource management across the other interfaces of the EPC.
38
S6
MME
S1
UE
S11
eNB
S5
HSS
SGi
Serving GW PDN GW
Preamble
Response
RRC Connection Req (Service Request)
Initial UE Message (Service Request)
Contention Resolution
RRC Connection Re-Config
RRC Connection Re-Config Complete
Authentication
(AKA)
Initial Context Setup Req [EPS Bearer QoS]
RB Est Req
RB Est Res
Initial Context Setup Complete
Update Bearer Request
Update Bearer Response
Application Level Signalling (SIP/SPD) with IMS
Dedicated Bearer Establishment [QoS, IP Address, APN]
Fig. 18 Service Request and Initial Bearer Establishment

39
LTE Procedures
ESM State Machine

The diagram opposite shows in detail the possible state transitions for the Evolved Session
Management (EMS) state machine. The messaging exchanged between the peer EMS will
depending on the current state of the machine.
40
r
b
re
a
S r e
EP ct o S b
t
l
P
au reje d E ct
r
f
re
de ext ate eje
a
r
te nt ic t r
be r are
S
e
it va co ed tex
o
d
EP est S b
Ac
e con
t
l
t
u u P
a
fa req d E est
tiv
e
c
d t te u
A
te tex ica t req
a
tiv con ded tex
c
A
te con
a
v
ti
Bearer context
Ac
inactive
PDN connectivity
reject or
bearer resource
allocation reject
De
ac
co tiva
nt te
ex EP
ta S
cc be
ep ar
t er
Ac
Ac
tiv
at
e
at con de
e te fa
d
co ed xt a ult E
nt ica cc P
ex te ep S
t a d t be
cc EP or are
ep S
r
t be
ar
er
tiv
Bearer context
active
r
re
a
be st
S
e
EP equ
r
re
te t r
a
a
x
v
e
ti e
b
ac ont
S ct
e
P
c
D
E je
e t re
t
a x
tiv nte
c
a co
De
Bearer context
inactive pending
Modify EPS bearer

context accept/reject
Bearer context
active pending
Modify EPS bearer

context request
r
re
a
e
Bearer context
modify pending
Fig. 19 Detailed State Transitions for ESM Machine

41
LTE Procedures
Connected Mode Mobility

When the mobile is in RRC_CONNECTED state the mobility of the UE is governed by the
EUTRAN. The eNB compares the potential handover targets based on the measurement
reports provided by the UE. Ultimately it is the serving eNB that selects the target cell and
determines when the handover should take place.
At the radio level the handover is relatively simple in that the UE will receive a handover
command indicating the new target cell resources and after switch over will confirm the
handover by passing a protected token back to the new eNB in a confirmation message.
The handover process is a more complicated affair when the architecture of the network is
taken in to account. The goal for handover is to ensure that the switchover between resources
on different cell is rapid and, importantly, no data is lost in the process. Ensuring that no
information is lost requires that data packets destined for the UE are buffered I the network
andforwarded to the target eNB during the handover process.
The handover sequence opposite assumes that the X2 interface is present. The process
beginswith a decision by the serving eNB to handover the UE to the target eNB. The handover
decision is based on UL measurement reports that the UE has provided. The reports contain
frequency, signal strength and RAT (Radio Access Technology) information. The actual decision
algorithm is generally left up to the equipment vendors, however the reason for handover will
bebased on thresholds related to signal strength and signal quality. The actual decision may
bemore complex when inter-RAT handovers are considered.
The handover request message sent to the target eNB contains an indication of the resources
required for the new UE. The target eNB allocates all the required resources, prepares the
RRChandover command and passes it back to the serving eNB in the handover request
acknowledge. The serving eNB then begins to forward all unacknowledged RLC buffered
datato the target eNB and issues the handover command to the UE.
The handover confirm message is sent by the UE to the new eNB. The new eNB initiates the
path switch process which informs the MME that there is a new route to the UE. The MME will
update the context data relating to the UE and begin to re-route any new packet to the new eNB.
The eNB will begin to forward the buffered RLC data to the UE when the handover confirm
message is received. The sequence numbers in at the RLC layer and PDCP layers should
ensure that no data is missing, mis-sequenced or duplicated.
In the case where the X2 interface is not supported the serving eNB will make the handover
request via the MME.
42
S1
UE
X2
eNB
S1
MME
S11
eNB
S5
Serving GW PDN GW
Handover
decision
Preparation
Handover Request
Radio resource
allocation
Handover Request Ack
[RRC Handover Command]
Forward Un-Ack RLC PDUs
Handover Command
Handover Confirm
Path Switch Request
Execution
Update Bearer Request

Update Bearer Response
Path Switch Request Ack
Release Resources
Release
resources
Fig. 20 RRC_CONNECTED mode Mobility (Handover) with X2 Interface

43
LTE Procedures
Measurements for Handover

In IDLE mode the UE will follow the directions found in the System Information Broadcasts
oneither the BCCH or DCCH.
In CONNECTED mode the UE will follow the measurement configuration specified by RRC
during the allocation of radio resources. The measurement process depends on a number
ofaspects.
UE capability
DRX settings
intra-frequency or inter-frequency measurements
inter-RAT measurements
The duration of frequency of the measurements and the periodicity of the reporting is all
determined by the RRC. The actual numeric details are still being studied.
44
Measurement Dependencies
UE capability
DRX settings
intra-frequency or inter-frequency
measurements
intra-RATo r inter-RAT measurements
Fig. 21 Measurement Dependencies

45
LTE Procedures
Measurement Scenarios
There are a number of scenarios that need to be considered that encompass the UE
capabilityand scheduling requirements in respect of taking neighbour cell measurements.
theseare dependant on whether the frequencies being measured are considered
intrafrequency or inter-frequency.
Intra-frequency measurements are measurements taken on neighbour cells that operate
onthesame frequency as the serving cell.
Inter-frequency measurements are measurements taken on neighbour cells that operate
onadifferent frequency than the serving cell. It is likely that the UE will require measurement
gaps in order to take measurements of this type.
Whether a measurement is non gap assisted or gap assisted depends on the UEs
capabilityand current operating frequency. The UE determines whether a particular cell
measurement needs to be performed in a transmission/reception gap and the scheduler
needsto know whether gaps are needed: (from TS 36.300)
46
Same carrier frequency and cell bandwidths (Scenario A): an intra-frequency scenario;
notmeasurement gap assisted.
Same carrier frequency, bandwidth of the target cell smaller than the bandwidth of the
current cell (Scenario B): an intra-frequency scenario; not measurement gap assisted.
Same carrier frequency, bandwidth of the target cell larger than the bandwidth of the
currentcell (Scenario C): an intra-frequency scenario; not measurement gap assisted.
Different carrier frequencies, bandwidth of the target cell smaller than the bandwidth
ofthecurrent cell and bandwidth of the target cell within bandwidth of the current
cell(Scenario D): an inter-frequency scenario; measurement gap-assisted scenario.
Different carrier frequencies, bandwidth of the target cell larger than the bandwidth
ofthecurrent cell and bandwidth of the current cell within bandwidth of the target
cell(Scenario E): an inter-frequency scenario; measurement gap-assisted scenario.
Different carrier frequencies and non-overlapping bandwidth, (Scenario F): an interfrequency scenario; measurement gap-assisted scenario.
Scenario A
Scenario B
Scenario C
Scenario D
Scenario E
Scenario F
shown offset for clarity
Current cell
Target cell
Fig. 22 Intra and Inter Frequency Measurement Scenarios

47

LTE Air Int Sec06 031108 v02 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LTE Air Int Sec06 031108 v02 PDF

Uploaded by

Copyright:

Available Formats

LTE Procedures

Informa Telecoms & Media

Informa Telecoms & Media

LTE Connection States

Informa Telecoms & Media

NAS Procedures (EMM, ESM)

Fig. 1 MM and RRC Mobility/Connection States

Network Attachment including RRC connections and EPC registrations

Informa Telecoms & Media

Fig. 2 LTE Procedures

Informa Telecoms & Media

RRC Connection Request

Random Access Response

RRC_Idle (time out)

Fig. 3 Procedures Related to Network Attachment

System Information Broadcast

Downlink System Bandwidth

Informa Telecoms & Media

Master Information Block

System Information Block Scheduling

Informa Telecoms & Media

Master Information Block

Fig. 5 System Information Scheduling

PLMN and Cell Selection

Srxlev = Qrxlevmeas (Qrxlevmin Qrxlevminoffset) Pcompensation

Informa Telecoms & Media

Cell selection based on;

Fig. 6 Cell Selection

Rn > Rs > Treselection

Informa Telecoms & Media

Fig. 7 Cell Reselection

IDLE Mode Location Management in LTE

Informa Telecoms & Media

Fig. 8 IDLE Mode Mobility

Multiple Tracking Areas

Informa Telecoms & Media

Fig. 9 Tracking Area and Multiple Tracking Area Registration

Random Access Procedure

Initial access from RRC_IDLE;

The RA process may also be;

Informa Telecoms & Media

Random Access Procedures

Random Access Types

Fig. 10 Random Access Events

Contention Based Random Access

Informa Telecoms & Media

Random Access Preamble

Random Access Response

Fig. 11 Contention Based Random Access

Non-Contention Based Random Access

Informa Telecoms & Media

Random Access Preamble

Random Access Response

Fig. 12 Non-Contention Based Random Access

Establishing RRC Connections

Informa Telecoms & Media

RRC Connection Request

RRC Connection Setup

RRC Connection Setup Complete

Fig. 13 RRC Connection Setup

Mutual user-EPC authentication

Informa Telecoms & Media

Fig. 14 Main Reasons for the Registration Process