See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/305641102

Use Cases for LTE Core Network Mass Testing

Conference Paper · May 2016

CITATIONS READS

0 1,212

2 authors:

Gabor Soos Pal Varga

Budapest University of Technology and Economics Budapest University of Technology and Economics
14 PUBLICATIONS   69 CITATIONS    89 PUBLICATIONS   545 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

MANTIS - Cyber Physical System based Proactive Collaborative Maintenance View project

Arrowhead: Ahead of the Future View project

All content following this page was uploaded by Pal Varga on 08 August 2016.

The user has requested enhancement of the downloaded file.

 Use Cases for LTE Core Network Mass Testing

Gabor Soos Pal Varga

Dept. of Telecommunications and Media Informatics Dept. of Telecommunications and Media Informatics
Budapest University of Technology and Economics Budapest University of Technology and Economics
2 Magyar Tudosok krt., Budapest, Hungary, H-1117 2 Magyar Tudosok krt., Budapest, Hungary, H-1117
Email: soos2g@gmail.com Email: pvarga@tmit.bme.hu

Abstract— Mass testing is an essential part of service acceptance virtualized EPC vendors keep some functions of the systems
procedures. The smooth operation of 4G services requires a in standby mode in case of medium load, to save system
scalable, properly working LTE core network, among others. utilization capacity. This can be a bad approach in case of
This creates a necessity of functional, integration, and mass system failure or transient load.
testing of the LTE core. This latter issue is troublesome, because
This paper briefly introduces the main elements of the LTE
it requires proper handling of all network wide processes - for all
equipment of the validation setup, while their utilization is
Core Network as NUT (Network Under Test), with its main
pushed to its limits. In this paper we describe a mass-testing elements, and the connecting interfaces to the LTE Load
environment, where the Network Under Test (NUT) is the generator. Furthermore, we describe the actual connection of
Evolved Packet Core, and the test equipment simulates hundreds one evolved NodeB (eNB), with the following mass-load use
of thousands of users attach to it, move between its routing areas cases. We show one possible scenario for a simple failure, and
(or even arriving from 2G or 3G segments), and generate traffic its effect to the core system. Later we focus on connecting a
before detaching. In order to unveil the limitations of the NUT, subscriber, and shortly describing the key-generation
use cases need to be defined and carried out. The verification is mechanism used, with mass load of users and their traffic.
encumbered by authentication and encryption procedures,
despite the fact that the endpoints are simulated; so as their keys.
II. ARCHITECTURAL SETUP FOR LTE EPC MASS TESTING
I. INTRODUCTION AND MOTIVATION
Knowing the architectural dependencies and the exact
The LTE Evolved packet Core (EPC) is based on protocols in depth are essential, because the parameters can
continuously evolving 3GPP standards. It is always under cause scalability problems in case of mass testing or live
development, due to the emerging technical and business system introduction.
requirements. The modifications of the systems are mostly
software innovations. These are in most cases merely Fig. 1 represents the core LTE networks elements and the
improvements of earlier existing implementations, where some defined interfaces in between [1]. In our situation SGW-MME-
fixed values are made configurable, or the new code is PGW (Serving Gateway, Mobility Management Entity, Packet
changing the behaviour algorithms inside the EPC. The Data Network Gateway) are part of the NUT, and interfaces
parameters in question sometimes get new values, which in S1-MME [2], S1-U [3], S6a [4] and SGi [5] are interfaces (see
case of low load do not lead to different system behaviour, but Fig. 2) under test [6]. S5, S10 and S11 are internal interfaces in
in case of high load, serious effects can happen. In case of new the NUT, using the same GTP (GPRS Tunneling Protocol) [7]
software or network element, the mass load test is always protocol, and are not under direct test in this scenario.
compulsory to examine the whole system end-to-end, searching
for transients and comparing the results with earlier
measurements.
The EPC devices are based on specialized HW architecture,
which means that part of the SW also bonded to HW features.
This is planned – sooner or later – to be changed to virtual-
HW-based solution. The HW dependencies, like interface and
memory handling, or even HW bonded FPGA based
controlling has to be minimized and separately handled. The
advantage of the virtualized EPC is that it can run on almost
all kinds of HW platform, hence the initial capex can be
minimized. The disadvantage is that the EPC software will not
have many contacts with the physical layer. Testing with low
number of users and with low traffic can result in very
different outcome when compared to cases of heavy mass
load. The demand for mass-load test cases will rise. Lot of the Figure 1. Evolved Packet Core and main interfaces

Figure 2. NUT and Traffic Generator.
A. MME
MME is the main signaling node in the EPC, the UE’s can
connect to the network through the eNB. It also handles SGW
and other MMEs NAS (Non-access Stratum) signaling in case
of handovers, including user authentication, controlling and
roaming functions. The attaching users are initially connected
to the MME in the EPC area [8]. MME connects to the Mass-
Test environment via two interfaces. S1-MME is a reference
point for signaling between MME and eNB, which protocol is
based on IP level, for delivery guarantees provided by SCTP
[9]. The signaling protocol is called S1AP. S6a (also called as
Gr in 2G and 3G) is an IP based interface between MME and
HSS (Home Subscriber Server). The transport is based on
SCTP, while the application signaling is Diameter [10] based.
B. SGW (Serving Gateway)
The SGW’s main function is to control and allocate data
path resources for User sessions in-between the eNBs and the
PGW. The User Plane tunnels are established with GPRS
Tunneling Protocol (GTP), based on the control guidance of
the MME or PGW. The SGW connects to the Mass-Test
environment through the S1-U interface where user traffic is
expected on UDP (User Datagram Protocol) based GTP.
Towards the PGW direction S5 connection is used, which is an
internal interface on the NUT.
C. PGW (Packet Data Network Gateway)
PGW (or PDN-GW) is mainly responsible for connection
to the outside IP network, and reserves endpoint IP addresses.
Furthermore, it handles the UE traffic and related services [11]
like billing, zero rating or Quality of Service controlling can be
affected in this node. This is the edge point of the EPC to the
external IP network. In the test-setup the PGW connects to the
SGW via internal S5 interface, which is out of the scope of the
testing. The SGi interface is connected to the Mass-Test
environment over IP.
D. HSS (Home Subscriber Server)
HSS is the user database in the LTE Network. It contains
all of the user-related rules and attributes. In case of User
attach, the MME queries the HSS for user authentication,
identification rules and permissions. HSS connects to the
HLR/AuC for authentication keys and also registers the
subscribers’ location on the 4G network. In our situation HSS
is part of the Mass-Test environment, where the connecting
interface is S6a, IP and SCTP based Diameter protocol.
III. BACKGROUND OF MASS TESTING USE CASES, TESTING
SCENARIOS
Our goal is to grant reliable, error-free, fast data transfer and
call establishment in a system – irrespectively of the system
size or the load. To achieve it, we test the system step-by-step
from the smallest scale up to the full loaded system [12].
There are several vendors on the market (e.g. Aitia and Ixia),
who offer wide range possibilities of mass testing solutions
[13].
Firstly we analyze the base infrastructure, the connection
between the eNB and MME, and later with few simulated users
we analyze a connection of a user from eNB to the PGW.
Finally we test the EPC as NUT end-to-end, with thousands of
simulated subscribers.
A. The connection of one eNB, the access layer of the EPC
To get convinced by the proper work of the network, first we
examine a use-case where all network node states are stable,
there is no load at all, and we connect only one eNB to the
NUT as represented at Fig. 3. To achieve this, we have to
establish connection on each layer, one another.
Examined EPC Node: MME
Examined interface: S1-MME
Figure 3. Connecting one eNB to the NUT
1. IP connection between MME and eNB addresses
shall be up and running.
2. To establish SCTP layer the protocol shall go
through the establishment phases and shall be
finished INIT, INIT_ACK, COOKIE_ECHO,
COOKIE_ACK. Afterwards it can only send DATA
 and SACK to establish the S1AP protocol. It is very
important, that the SCTP setting on both sides match.
3. The correct S1 Setup can be analyzed on the link and
also on the MME.
4. Status check. After the correct protocol match and
setup request from both side, the MME and eNB shall
know about their pair.
B. Mass load of connecting and disconnecting eNodeBs
After examining the system viability with one eNB in the
previous (III.A) point, now we plan to simulate thousands of
eNBs connection as shown at Fig. 4. During the simulation,
the EPC was started with minimal HW resources. The main
question was: how many eNBs can handle the core without
failures. Furthermore: what happens when we reach the
maximum number of eNBs: will there be any side effect,
failure report; and how it avoids the next connecting eNBs.
The beginning of the use-case is similar to III.A; in advance
point 2 and 3 are repeated with different IP address. The result
of the connection can be verified on the Mass test and also on
the MME side.
Examined EPC Node: MME
Examined interface: S1-MME
Figure 4. Connecting lot of eNB to the NUT
Test allows to examining different features and abilities of the
EPC:
a) The establishment and destruction speed of SCTP
layers among eNBs and MME. We can also check the
COOKIE generation mechanism at both side.
b) The setup and failure handling speed of S1AP.
c) Testing the NUT capability limits of eNB handling.
C. Effect of suddenly disconnected S1AP interface in case of
Mass-loaded EPC and it’s effect to EPC network
processor
At the first point of this chapter (III.A) we tested with one
connecting eNB. After (III.B) we investigated the limits of the
MME with mass-loading them, and now we simulate some
basic failure of the connecting link. One of the most occurring
failures in the networks is the IP as transport layer’s failure.
There are plenty solutions for failovers – such as redundancy
paths, standby routers –, but the failure handover timing is
usually not synchronized among the whole network, which
could cause transients and unexpected signalling storms. At
this point we investigate a situation when the S1-MME
connection is stopped for a different duration. This allows
testing the EPC reaction and its secondary effects on the
whole core network.
Examined EPC Node: MME
Examined interface: S1-MME
1. The SCTP and S1AP connection was established
between MME and Mass-Test device.
2. Based on the method mentioned in III.B, we
connected 10 000 eNBs to the MME.
3. Fix Parameters were: eNB group, TAC,
S1mme_LocalPort, S1mme_RemotePort, changing
parameters: S1mme_Local_IP_Address, eNB_ID
4. Status checking: 10 000 eNBs can be seen in the
MME, with different PeerID, Global ID, the SCTP
path state is active. SCTP HB (HeartBeat) messages
can be seen on the network.
5. The SCTP link is banned for different time intervals.
The SCTP connection usually sends HeartBeat (HB) messages
to check the path. In case of missing several HBs, the link is
marked as down, however HB is still sent to the peer. In case
of HB ACK returns after a link failure, the S1AP Setup is
done immediately. In this situation the setup is not bonded to
the load generator’s setup rate, however all eNBs shall be
connected as shortly as possible. In a wrongly set system, this
can cause 1000/s connection rate. At this point the interface
can overflow, messages can be dropped, and the situations of
losing HB recur. This situation can go to an endless error state.
D. Connecting one user to the EPC, examine the session key
caching from the HSS.
In the previous use-cases the connection of the S1-MME link
was investigated from the network nodes point of view – but
not from the users. To examine the proper subscriber
connection we shall also check the key caching and handling
on the MME. In this case, the S6a connection to the HSS is
also handled by the Mass-Test device as shown at Fig. 5. The
keys – which are needed for the users to connect to the
network – are pre-generated, and can be easily checked when
connecting the users. The HSS shall generate the following
keys in advance: CK, IK AUTN, based on the identifiers,
calculating the Kasme, Integrity and ciphering algorithm
(based mainly on EIA1/EEA1) [14].
Examined EPC Node: MME
Examined interface: S1-MME

Figure 5. Connecting a subscriber to the NUT
1. Subscriber connects to the eNB, request is forwarded
to MME.
2. Based on request, the MME asks authentication key
from the HSS.
3. The HLR-HSS sends back authentication key(s).
4. Between the MME and the subscriber, the
appropriate messages carrying the XRES shall
match. This can be analyzed on the Mass test side.
5. The subscriber establishes signalling connection with
MME, and eNB establishes bearer with SGW for user
data.
E. Mass connection of users to the the EPC.
After checking one subscriber’s proper connection in the
previous section, it is time to examine how many users can be
handled simultaneously by the EPC as shown at Fig. 6.
Examined EPC Node: MME, SGW, PGW
Examined interface: S1-MME, S6a, S1-U, SGi
Figure 6. Mass load of subscribers
1. Connect 50 eNBs to the MME.
2. Based on fix parameters of MNC, MCC, HSS addr.,
and changing IMSI, IMEISC, MSISDN, connect
thousands of Users.
3. Status check on NUT and load generator. Compare
the connected user number between the two sides.
4. To test the data throughput, the Mass Testing
environment can send data (TCP/UDP) packets to
the emulated internet connection, and in return the
traffic can be multiplied.
5. Disconnect the subscribers and eNBs.
View publication stats
The examined features:
a) The maximum connection and disconnection
speed of Users to the EPC.
b) Maximum throughput of the User data in both
uplink and downlink direction.
c) Maximum throughput of User data with different
payload, such as TCP or UDP.
d) Maximum number of connected users to the
NUT.
IV. CONCLUSION
In the use cases above, we described some essential items of
LTE functionality testing. The smooth introduction of a new
feature or interface must be tested with basic one-user
scenario, but to force the system into the live working
conditions, mass-load testing is inevitable. To unveil the
limitations of the NUT (in our case the Evolved Packet Core),
we described several valid setup cases, where the test
equipment simulated thousands of eNBs and hundreds of
thousands of Users, so as their authentication and encryption
procedures, even though the fact the users and nodes were
simulated.
REFERENCES
[1] M. Olsson, S. Sultana, S. Rommer, L. Frid, and C. Mulligan, SAE and
the Evolved Packet Core. Oxford, UK: Academic Press, 2009.
[2] 3GPP TS 36.413, S1 Application Protocol, February 2010 [Online].
Available: http://www.3gpp.org/dynareport/36413.htm
[3] 3GPP TS 29.060, GPRS Tunnelling Protocol, V6.9.0, 2005 [Online].
Available: www.3gpp.org/DynaReport/29060.htm
[4] 3GPP TS 29.272, Mobility Management Entity (MME) and Serving
GPRS Support Node (SGSN) related interfaces based on Diameter
protocol, 2010 [Online]. Available:
www.3gpp.org/DynaReport/29272.htm
[5] Y. Chen, Xavier Lagrange, “Architecture and Protocols of EPC-LTE
with relay”, pp. 9, Telecom Bretagne, May 2013.
[6] P. Varga, P. Olaszi, “LTE core network testing using generated traffic
based on models from real-life data” IEEE ANTS, Chennai, India, 2013.
[7] 3GPP TS 29.274, Evolved General Packet Radio Service (GPRS)
Tunnelling Protocol for Control plane, 2010 [Online]
http://www.3gpp.org/DynaReport/29274.htm
[8] 3GPP TS 29.061, Interworking between the Public Land Mobile
Network (PLMN) supporting packet based services and Packet Data
Networks (PDN), 2010 [Online]. Available:
www.3gpp.org/DynaReport/29061.htm
[9] IETF RFC 4960, Stream Control Transmission Protocol, September
2007 [Online]. Available: https://tools.ietf.org/html/rfc4960
[10] IETF RFC 6733, Diameter Base Protocol, October 2012 [Online].
Available: https://tools.ietf.org/html/rfc6733
[11] 3GPP TS 23.401, General Packet Radio Service (GPRS) enhancements
for Evolved Universal Terrestrial Radio Access Network (E-UTRAN)
access, 2008 [Online]. Available: www.3gpp.org/ftp/Specs/html-
info/23401.htm
[12] P. Olaszi, “Complex Load Testing of Mobile PS and CS
Core,” EuroNOG 2012, September 2012. [Online]. Available:
http://www.data.proidea.org.pl/euronog/2edycja/materials/PeterOlaszi-
Complex Load Testing of Mobile PS and CS Core.pdf
[13] Ixia, LTE Accessing Testing, 2016 [Online]. Available:
https://jp.ixiacom.com/sites/default/files/resources/datasheet/ixload_lte_
access.pdf
[14] D. Kozma, “Network- and service management support through the
analysis of S1AP CDR’s ”, MSc Thesis, 2015.