LTE EPC Signaling

7/2/2014
Knowledge That Powers Organizations!
. . . . . . . . . .
LTE/EPC Signaling Course

Presented Onsite at Nextel de Mexico
DCN NTDR-Jnz-f
© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525
Learn Technologies from the Team That

Has Been at the Forefront of New
Knowledge That Powers Organizations!
Technology Rollout for 20+ Years!
Why Eogogics?
Unmatched Expertise: Industry-leading 500-course curriculum based on our first-hand technology experience.
Industry Recognized: Preferred or sole-source provider for Fortune 500 companies, R&D organizations, US government agencies, and trade groups.
High Client Satisfaction: 100% of our classes rate good-to-excellent, 98% client retention, 85% of business from client referrals.
World-class Instructors: With advanced degrees, 15-40 years in the real world, publications, patents, awards/honors. They mix teaching, R&D, and
consulting to keep their technical edge razor sharp. Their instruction is clear, dynamic, and entertaining!
Customized, Practical Courses: Partner with the instructor to design a course focused on your mission critical needs. Classes onsite or on the Web.
Buy Coach, Travel First Class: Using technology to drive down our costs, we offer top-tier instructors and tailored courses for 15% below market.
Knowledge That Can Power Your Organization: Avoid the cost and delay of trial-and-error! Benefit from our 20+ year experience, knowledge of
industry best practices, and unbiased advice. We have been engaged in ground-breaking technology implementation projects worldwide for 20+ years.
Our Skill Set

•Engineering: Systems Eng. (Methodology, Best Practices, Management), Design Creativity, Out-of-the-Box Thinking, GD&T, Statistical Tolerance Analysis, Poka
Yoke, Materials and Processes (Metals, Plastics), Industrial Statistics, Design of Experiments, Statistical Process Control, Root Cause Failure Analysis, Failure Modes
and Effects Analysis, Project and People Management, Delivery Performance Improvement, Quality Management, Cost Reduction, Engineering Economics
•Software Engineering: Principles, Writing Requirements, Configuration Management, Testing, Project Management, Project Estimation, Quality Assurance
•Telecom: Network Design/Implementation, Traffic Engineering, Security, Management (SNMP, Ethernet OAM), Cloud Computing, Cyber Security, Carrier Ethernet,
ATM, BGP, IP Geo-location, IPv6, MoIP, IP Sec, MPLS, IMS, SIP, SIP Sec, VoIP, VoIP Sec, EoIP, IP TV, CAMEL, SS7, IMS, SIP, Optical Networks (SONET/SDH,
DWDM, CWDM), Mobile Backhaul, OSS/BSS (eTOM, SID, TAM), Unified Communications
•Wireless and RF: 5G (Cognizant Radio, SDR, DSA), 4G (LTE, WiMAX), OFDM/MIMO, 3G (UMTS, HSPA), GSM, GPRS/EDGE, CDMA,1xRTT, EVDO,
iDEN™, TETRA, MPBN, MVNO, WiFi, Bluetooth, Mobile TV, Positioning/Location, LBS, RF, RF Safety, HF/VHF, Propagation/Fading, Antennas, Microwaves,
SATCOM, Spectrum Engineering, Signal Processing, IEEE WCET Exam
•Defense, Public Safety and Security: 5G, 4G, 3G, and NextGen Technologies, Cyber Security/Warfare, Info. Security, E911, 911 (Voice, VoIP), CALEA
•Also, Technical Management and Communications, Soft Skills, and Management/Leadership Development
Join a Distinguished Clientele That Includes Disney, Lockheed Martin, UBS, Boeing, Raytheon, Dell, AT&T, ABC News, Sprint Nextel, Comcast,
SkyTerra, TruePosition, DIRECTV, L-3 Communications, ITT, SAIC, URS, Shaw, NII, Intelsat, Crown Castle, Harris, Booz Allen Hamilton, Spectra
Energy, Cooper, Bain & Company, DoD, HLS, DoE, DoC, DoJ, national labs, and NASA. Call or email today!
www.eogogics.com, www.gogics.com, sales@eogogics.com, +1 703 281-3525, 1 (888) 364-6442

1
7/2/2014
Notices
Intellectual Property Rights
© Copyright 2014, Eogogics Inc.

The contents of this document are the proprietary and copyrighted intellectual property
of Eogogics Inc. They may not be recorded, stored, reproduced, or transmitted by
any means whatsoever without the express, written permission of Eogogics Inc.
Eogogics® and Gogics™ are, respectively, a registered US trade mark and a service
mark of Eogogics Inc. Any other service or trade marks used in this document are
the property of their respective owners.
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
Notices
This Course Builds on the Following Eogogics Courses
(see www.eogogics.com for details):
• LTE Advanced System Techniques – LTE ADV 4 days

• LTE Air Interface Techniques – LTE AI 3 days
• LTE Signaling and Functionality – LTESIG 3 days
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
2
7/2/2014
LTE/EPC Overview
LTE/EPC 3GPP Standards
Evolution Path
3
7/2/2014
Mobile Systems Evolution
Edge
TDMA EDGE Evolution
GPRS
GSM
WCDMA HSDPA/ HSPA+
HSUPA
PDC
LTE/EPC
cdmaOne CDMA2000 CDMA2000 EV/DO EV/DO

1xEV/DO RevA RevB
2G 3G Evolved 3G 4G
Source:gsacom.com
Market Trends
Dramatic uptake in broadband data
Migration to LTE:
• From existing WCDMA/GSM networks
• From existing CDMA networks
High interest in service convergence
• Fixed and wireless
• Broadband triple-play with mobility
4
7/2/2014
Market Trends
WLAN access integration
Increased expectations for value-added
services
• DPI, policy, charging (subscriber management)
Focus on total cost of ownership
• Network simplification, shared resources
Driving forces for LTE/EPC
Efficiency
• Fewer payload carrying nodes between
subscriber and service
• Shorter latency (service access response,
mobility)
Lowering costs
• Lower cost per transmitted bit
5
7/2/2014
Driving forces for LTE/EPC
Improving services
• High throughput to enable advanced services
• Common user service provision for all of
access technologies
Making use of new/refarmed spectrum
• More efficient radio utilization (new modulation
concept, increased spectrum flexibility)
Driving Forces for LTE/EPC
Better integration with other open

standards
• Efficient mobility between 3GPP and non-
3GPP using the same user service provision
(GSM, WCDMA, LTE, CDMA2000, WLAN ...)
6
7/2/2014
Network Evolution
3GPP Rel-99 3GPP Rel-7 3GPP Rel-8
PDN PDN PDN
GGSN GGSN P+S-GW
User plane
SGSN essentially SGSN MME
outside SGSN!
User plane User plane directly

RNC traffic through RNC
between RAN and
all nodes GW!
NodeB NodeB eNodeB
2000 2007 2009/10

SAE/LTE Releases: Evolution Steps

-EPS backbone network, EPC: interconnects the following hosts:
- Mobile Management Entity (MME)
- Home Subscriber Server (HSS)
- Policy and Charging Rules Function (PCRF)
- Serving Gateway (SGW)
- Packet Data Network Gateway (PGW)
7
7/2/2014
SAE/LTE Release 8 Evolution Steps

Functional changes compared to the current UMTS Architecture
Moving all RNC functions to the Node B …

…, SGSN CP functions to the MME, and GGSN functions to the
SAE GW
P-GW PDN GateWay

GGSN Serving GateWay
S-GW
SGSN (not user plane MME Mobility Management Entity

functions)
RNC
Node B / HSPA eNodeB
3GPP Project Coordination Group (PCG)
8
7/2/2014
3GPP LTE and SAE Work Items

Result
Specification Group Work Item
TSG RAN LTE

EUTRAN Specifications
(36 series)
LTE: Long Term Evolution
EUTRAN: Evolved UMTS Terrestrial Radio Access Network
Result
Specification Group Work Item
TSG SA SAE
EPC Specifications
(From Rel 8 onwards)
SAE: System Architecture Evolution
EPC: Evolved Packet Core
LTE Specifications
36.201 – Physical layer general description 36.401 – E-UTRA Architecture Description
36.211 – Physical channels and modulation 36.410 – S1 interface general aspects & principle
36.212 – Multiplexing and channel coding 36.411 – S1 interface Layer 1
36.213 – Physical layer procedures 36.412 – S1 interface signalling transport
36.214 – Physical layer measurements 36.413 – S1 application protocol S1AP
36.414 – S1 interface data transport
36.420 – X2 interface general aspects and principles
36.421 – X2 interface layer1
36.422 – X2 interface signalling transport
36.300 – E-UTRA overall description 36.423 – X2 interface application part X2AP
36.302 – Services provided by the physical layer 36.442 – UTRAN Implementation Specific O&M Transport
36.304 – UE Functions related to idle mode 29.274 – GTP-C
36.306 – UE radio access capabilities 29.281 – GTP-U
36.321 – Medium Access Control (MAC)
Protocol Specification 23.002 – Network Architecture
36.322 – Radio Link Control (RLC) 23.003 – Numbering, addressing and identification
Protocol Specification 23.009 – Handover Procedures
36.323 – Packet Data convergence Protocol (PDCP) 23.048 – Security mechanisms for USIM application
Protocol Specification 23.401 – GPRS enhancements for eUTRA
36.331 – Radio Resource Control (RRC) 23.203 – QoS Concept
Protocol Specification 23.272 – CS Fallback in EPS
33.401 – System Architecture Evolution (SAE);

Security Architecture
36.101 – UE radio transmission and reception (FDD)
36.104 – BTS radio transmission and reception (FDD)
24.301 – NAS Protocol for Evolved Packet System (EPS)
36.113 – Base station EMC
24.302 – Access to the EPC via non 3GPP networks
36.133 – Requirements for support of Radio Resource
Management (FDD)
36.141 – Base station conformance testing (FDD)
All specifications can be found on the

web site www.3gpp.org
9
7/2/2014
LTE/EPC
Architecture & Protocols
What Is LTE/EPC?
Nodes in EPC
& LTE EPC
• Functionality (Core Network)
Interfaces
• to other LTE
(Radio
systems Access
• between nodes Network)
10
7/2/2014
EPS Overview Architecture

3GPP Work Items
EPS EPC
MME P/S-GW SAE
(Evolved (Evolved (System Architecture
Packet Packet Core) Evolution)
System)
S1
E-UTRAN
X2
LTE
eNB eNB (Long Term Evolution)
X2
X2
eNB
UE
LTE/EPC Architecture
Quality of service
and charging for PCRF Gx handles the charging
P-GW
each data flow for the service.
S10 IP Point of Presence
HSS MME MME S5/S8 (PoP)
S6 S11
SAE Evolved - terminates user
Packet idle mode moblity
and security S-GW plane packets
Core
- switches the user
plane to support UE
mobility
S1-CP S1-UP
LTE E-UTRAN
Radio Bearer control,

Connection Mobility Control X2-UP
Scheduling for both UL and DL.
eNodeB eNodeB
X2-CP
11
7/2/2014
Evolved Packet System (EPS) &

WCDMA/GPRS
User Plane IP Networks PCRF: Policy and Charging Rules Function
Control Plane PGW: Packet Data Network Gateway

SGi
S4
HSS: Home Subscriber Server
Gx EPC: Evolved Packet Core

HSS PGW PCRF
SGW: Serving Gateway
S10 S6a S5/S8
UE: User Equipment
EPC
S3 EUTRAN: Evolved UTRAN
SGSN MME SGW
S11 eNodeB: Enhanced Node B
VLR: Visitor Location Register

S1-MME S1-U
MSC/VLR MSC: Mobile Switching Centre
X2 MME: Mobility Management Entity

eNodeB eNodeB
GPRS Network LTE Uu LTE Uu: LTE UTRAN UE Interface
Only most important EUTRAN
UE SGSN: Serving GPRS Support Node
interfaces shown here
GSM/WCDMA/LTE Architecture - 3GPP
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
12
7/2/2014
EPC/LTE Architecture for Non- 3GPP
IMS
ANDSF
S14
External Rx
IP networks
SGi
PCRF Gxb
S9 Gxa
SWx SWm
HSS
AAA
STa SWa
Gx Gxc
S6a
S6b S2b
PDN GW ePDG
S2a S2c
S5/S8
S11 Serv GW S103

MME
S101 SWn
S10
S102
Trusted Non-trusted
non-3GPP non-3GPP
SWu
Overall Architecture – IMS Platform & Non-3GPP

AS Service Layer
AS AS
MTAS Application Servers Network & Service
management
IMS Control
WLAN I-CSCF layer OSS-RC EMA
MGC DNS/ MM DNS/ENUM

Broadband ENUM
Wired Access P-CSCF S-CSCF
PSTN IMS Connectivity Internet

A-SBG layer
N-SBG
Rx+
MGW User data

RTP/UDP GTP/UDP
PCRF
SIP/UDP or SIP/TCP
Gx
GTP-C
CS Core GPRS EPC
GGSN HSS ISUP
Packet S6d
GWMSC Core S1-AP, X2-AP
Gxa CDMA2000
MSC SGSN S6a HRPD H.248
S4 (EV-DO)
S2a PDSN Diameter
P-GW Other
S101
S3 MME RNC
S5/S8 Platforms / Concepts
GERAN UTRAN S11 S103
S-GW
CPP /
RBS6000 TSP/NSP or
S1-CP S1-UP TSP/IS
E-UTRAN
Juniper/
SUN
X2-UP Redback
Uu
eNodeB X2-CP eNodeB

WPP IS
13
7/2/2014
EPS Control Plane Protocols

LTE Uu S1-MME
NAS NAS S11 S5/S8
Relay
RRC S1AP GTP-C GTP-C GTP-C
RRC S1AP
PDCP PDCP SCTP SCTP UDP UDP UDP
RLC RLC IP IP IP IP IP
MAC MAC L2 L2 L2 L2 L2
L1 L1 L1 L1 L1 L1 L1
UE eNodeB X2 MME S10 SGW PGW
X2AP X2AP GTP-C GTP-C
SCTP SCTP UDP UDP

IP IP IP IP
L2 L2 L2 L2
L1 L1 L1 L1
eNodeB eNodeB MME MME

EPS User Plane Protocols

LTE Uu S1-U S5/S8 SGi
Application
IP IP
Relay Relay
PDCP GTP-U
PDCP GTP-U GTP-U GTP-U
RLC RLC UDP UDP UDP UDP
IP IP IP IP
L2
MAC MAC
L2 L2 L2 L2
L1 L1 L1
L1 L1 L1 L1
UE eNodeB X2* SGW PGW

GTP-U GTP-U
* X2 User plane used
UDP UDP
to support ‘Data
IP IP
forwarding at intra
L2 L2
LTE handover’
L1 L1
eNodeB eNodeB
14
7/2/2014
EPS Protocol Categories
L3 Signalling L2 Transport
• Non Access Stratum (NAS) • Packet Data Convergence Protocol (PDCP)
Communication between UE and MME - Ciphering and integrity protection for RRC messages
- IP header compression/decompression for user plane
• Radio Resource Control (RRC)

Communication between UE and eNodeB • Radio Link Control (RLC)
- Transfer of RRC messages and user data using:
* Acknowledged Mode (AM)
• S1 Application Protocol (S1AP) * Transparent Mode (TM) or
Communication between eNodeB and MME * Unacknowledged Mode (UM)
- Error Correction (ARQ)
• X2 Application Protocol (X2AP) • Medium Access Control (MAC)

Communication between eNodeB and eNodeB - Error Correction (HARQ)
- Transfer of RRC messages and user data using:
- Priority handling (scheduling)
• GPRS Tunneling Protocol Control (GTP-C) - Transport Format selection
- Communication between MME and SGW
- Communication between SGW and PGW • GPRS Tunneling Protocol User (GTP-U)
- Communication between MME and MME Transfers data between GPRS tunneling endpoints
Logical Channels – Control

Broadcast Control Channel (BCCH)
• DL broadcast of system control information.
Paging Control Channel (PCCH)
• DL paging information. UE position not known on cell
level
Common Control Channel (CCCH)
• UL/DL. When no RRC connection exists.
Multicast Control Channel (MCCH)
• DL point-to-multipoint for MBMS scheduling and control,
for one or several MTCHs.
Dedicated Control Channel (DCCH)
• UL/DL dedicated control information. Used by UEs
having an RRC connection.
15
7/2/2014
Logical Channels - Traffic
Dedicated Traffic Channel (DTCH)

• UL/DL Dedicated Traffic to one UE, user
information.
Multicast Traffic Channel (MTCH)
• DL point-to-multipoint. MBMS user data.
Channel Mapping
Downlink Uplink
PCCH MTCH MCCH BCCH DTCH DCCH CCCH DTCH DCCH CCCH
Logical Channels
“type of information”
MIB SIB (traffic/control)
PCH MCH BCH DL-SCH UL-SCH RACH

Transport Channels
“how and with what
characteristics”
(common/shared/mc/bc)
-Sched TF DL
-Sched grant UL -CQI
PDCCH -Pwr Ctrl cmd -ACK/NACK
info -HARQ info ACK/NACK -Sched req. Physical Channels
“bits, symbols,
PMCH PBCH PDSCH PCFICH PDCCH PHICH PUCCH PUSCH PRACH modulation, radio
frames etc”
-meas for DL sched
-meas for mobility -half frame sync -frame sync -measurements for
-coherent demod -cell id -cell id group -coherent demod UL scheduling
Physical Signals
“only L1 info”
RS P-SCH S-SCH RS SRS
16
7/2/2014
Transport Channels - DL
Broadcast Channel (BCH)

• System Information broadcasted in the entire coverage
area of the cell. Beamforming is not applied.
Downlink Shared Channel (DL-SCH)
• User data, control signaling and System Info. HARQ and
link adaptation. Broadcast in the entire cell or
beamforming. DRX and MBMS supported.
Paging Channel (PCH)
• Paging Info broadcasted in the entire cell. DRX
Multicast Channel (MCH)
• MBMS traffic broadcasted in entire cell. MBSFN is
supported.
Transport Channels - UL
Uplink Shared channel (UL-SCH)

• User data and control signaling. HARQ and link
adaptation. Beamforming may be applied.
Random Access Channel (RACH)
• Random Access transmissions (asynchronous and
synchronous). The transmission is typically contention
based. For UEs having an RRC connection there is some
limited support for contention free access.
17
7/2/2014
Channel Mapping
Downlink Uplink
Logical Channels

Transport Channels
characteristics”
-Sched TF DL
“bits, symbols,
frames etc”
-meas for DL sched
Physical Signals
“only L1 info”
Physical Channels and Signals

Physical channels
Physical Downlink Shared Channel (PDSCH)
• transmission of the DL-SCH transport channel
Physical Uplink Shared Channel (PUSCH)
• transmission of the UL-SCH transport channel
Physical Control Format Indicator Channel (PCFICH)
• indicates the PDCCH format in DL
Physical Downlink Control Channel (PDCCH)
• DL L1/L2 control signaling
Physical Uplink Control Channel (PUCCH)
• UL L1/L2 control signaling
Physical Hybrid ARQ Indicator Channel (PHICH)
• DL HARQ info
Physical Broadcast Channel (PBCH)
• DL transmission of the BCH transport channel.
Physical Multicast Channel (PMCH)
• DL transmission of the MCH transport channel.
Physical Random Access Channel (PRACH)
• UL transmission of the random access preamble as given by the RACH
transport channel.
18
7/2/2014
Physical Channels and Signals
Physical signals
Reference Signals (RS)
• support measurements and coherent demodulation in uplink and downlink.
Primary and Secondary Synchronization signals (P-SCH and S-SCH)
• DL only and used in the cell search procedure.
Sounding Reference Signal (SRS)
• supports UL scheduling measurements
Channel Mapping
Downlink Uplink
Logical Channels

Transport Channels
characteristics”
-Sched TF DL
“bits, symbols,
frames etc”
-meas for DL sched
Physical Signals
“only L1 info”
19
7/2/2014
NAS Signaling
UE-MME

LTE Uu S1-MME
NAS NAS S11 S5/S8
Relay
RRC S1AP
L1 L1 L1 L1 L1 L1 L1
SCTP SCTP UDP UDP

IP IP IP IP
L2 L2 L2 L2
L1 L1 L1 L1
20
7/2/2014
NAS Signaling - MME

3GPP TS 24.301
UE Protocol Stack
Session Mobility
NAS Security
NAS Management Management
Application
System Info Cell Paging Connected

Aquisition Selection Reception Mode
Mobility IP
RRC RB Measurement
RRC AS Security
Connection Managementv Reporting
Control/Report SAPs
Integrity/ ROHC/
Ciphering Ciphering
PDCP
TM AM
UM/AM
RLC
HARQ
RA Control
MAC Control
L2
Physical Layer
21
7/2/2014
NAS Elementary Procedures
EPS Elementary
Procedures
EPS Session Management EPS Mobility Management
"ready-to-use" IP connectivity and an "always-on" experience
EPS Mobility Management - EMM
3GPP TS 24.301
22
7/2/2014
LTE States
Power-up
LTE_DETACHED LTE_ACTIVE LTE_IDLE

• No IP address •IP address assigned • IP address assigned
• Position not known • Connected to known cell • Position partially known
• DL DRX period
OUT_OF_SYNC IN_SYNC
• DL reception possible • DL reception possible
• No UL transmission • UL transmission possible
EMM Protocol States - Mobility

MME Tracking Area Update Handover
(TAU)
eNB
Tracking Area (TA) ECM: EPS Connection
UE position known on Cell Management
UE pos known on TA level in MME level in eNodeB
EMM: EPS Mobility
Detach, Attach reject, Management
TAU reject
Signaling RRC: Radio Resource
connection Management
establishment
UE
position
ECM connected =
not known
in network ECM-IDLE ECM-CONNECTED
RRC_IDLE RRC_IDLE RRC_CONNECTED S1 bearer
+
PLMN
selection Signaling RRC connection(SRB)
EMM- connection EMM-
DEREGISTERED release REGISTERED
Attach accept,
TAU accept
23
7/2/2014
EPS Network Operational Modes
EPS Session Management - ESM

3GPP TS 24.301
24
7/2/2014
EPS Protocol States - Bearers
3GPP TS 24.301
RRC Signaling
UE-MME
25
7/2/2014

LTE Uu S1-MME
NAS NAS S11 S5/S8
Relay
RRC S1AP
L1 L1 L1 L1 L1 L1 L1
SCTP SCTP UDP UDP

IP IP IP IP
L2 L2 L2 L2
L1 L1 L1 L1

UE Protocol Stack
Session Mobility
NAS Security
NAS Management Management
Application
System Info Cell Paging Connected

Aquisition Selection Reception Mode
Mobility IP
RRC RB Measurement
RRC AS Security
Connection Managementv Reporting
Control/Report SAPs
Integrity/ ROHC/
Ciphering Ciphering
PDCP
TM AM
UM/AM
RLC
HARQ
RA Control
MAC Control
L2
Physical Layer
26
7/2/2014
RRC States
Detach, Attach reject, TAU
reject
Signaling
connection
establishment
UE position
not known
in network
ECM-IDLE ECM-CONNECTED
RRC_IDLE RRC_IDLE RRC_CONNECTED
PLMN
selection Signaling
EMM- connection EMM-REGISTERED
DEREGISTERED release
Attach accept, TAU
accept
RRC Signaling
3GPP TS 25.813
3GPP TS 36.300
3GPP TS 36.331
27
7/2/2014
RRC Messages
SecurityModeCommand
CounterCheck
CounterCheckResponse SecurityModeComplete
CSFBParametersRequest SecurityModeFailure
CSFBParametersResponse SystemInformation
DLInformationTransfer SystemInformationBlockType1
HandoverFromEUTRAPreparationRequest
UECapabilityEnquiry
MasterInformationBlock
MeasurementReport UECapabilityInformation
MobilityFromEUTRACommand ULHandoverPreparationTransfer
Paging ULInformationTransfer
RRCConnectionReconfiguration
RRCConnectionReconfigurationComplete CSFBParametersRequestCDMA2000
RRCConnectionReestablishment
CSFBParametersResponseCDMA2000
RRCConnectionReestablishmentComplete
RRCConnectionReestablishmentReject HandoverFromEUTRAPreparationRequest (CDMA2000)
RRCConnectionRelease ULHandoverPreparationTransfer (CDMA2000)
RRCConnectionRequest
RRCConnectionSetup
RRCConnectionSetupComplete
RRC Signaling
Idle Mode
28
7/2/2014
System Information Mapping
PCCH/PCH ”Paging: System Info Modification”
MIB SIB1 SIB2 SIB3 SIB4 SIB5
SI-1 SI-2
BCCH BCCH BCCH
BCH DL-SCH DL-SCH

TTI= 40 TTI=80 TTI= 160 TTI= 320
PBCH PDSCH PDSCH
System Information Blocks (SIBs)
29
7/2/2014
Idle Mode Cell Selection - Reselection
Manual Mode Automatic mode
PLMN Selection
Indication
to user Location PLMNs
Registration available
response AvailableCSG IDs
to NAS
Support for manual
CSG ID selection
PLMN
selected CSG ID
selected
NAS Control
Cell Selection
and Reselection
Radio measurements
Registration
Area
changes
Service requests
Location
Registration
Core Network Initiated Paging

The MME sends the PAGING message to each eNode B
with cells belonging to the tracking area(s) in which the UE
is registered.
Each eNode B can contain cells belonging to different

tracking areas, whereas each cell can only belong to one
TA.
MME
UEs use DRx when in idle mode in order to wake at regular
intervals to check for paging messages.
The paging response back to the MME is initiated on NAS

layer and is sent by the eNB based on NAS-level routing
S1AP Paging message information.
TAC 2 TAC 1
RRC Paging message
30
7/2/2014
Paging Signaling
The MME initiates a paging message which is
sent to all eNodeBs in a tracking area(s)
MME
UEs use the Random

Access procedure to S1AP:Paging
RRC PAGING
initiate access to the
serving cell
Random Access Procedure
NAS: Service Request

S1-AP: INITIAL UE MESSAGE (FFS)
+ NAS: Service Request
+ eNB UE signalling connection ID
NAS messaging
continues in order to
set up the call
RRC Signaling – Connected Mode
31
7/2/2014
Signaling Radio Bearer (SRB) Establishment
RRC Connection – SRB Establishment

MME
RRC_
CONNECTED
LTE
SIGNALLING RADIO BEARER 0
RRC SIGNALLING RADIO BEARER 1 + S1 BEARER
Connection SIGNALLING RADIO BEARER 2
Signalling Connection
"Signalling Radio Bearers" (SRBs) are defined as Radio Bearers (RB)

that are used only for the transmission of RRC and NAS messages
32
7/2/2014
Signalling Radio Bearers (SRBs)
RRC
SRB0 SRB1 SRB2
PDCP
Signalling Radio Bearers (SRBs) are offered by the PDCP layer to the
RRC layer for transport of RRC (and NAS) messages
• SRB0: Used for RRC messages on the CCCH

• SRB1: Used for RRC and NAS messages on the DCCH
• SRB2: Used for NAS messages, SRB2 has a lower-priority than
SRB1 and is always configured by E-UTRAN after security
activation.
RRC Connection Establishment

IE/Group Name IE type and reference
RRC Establishment Cause: Emergency Call,
High Priority Access,
MT-Access,
MO-Signalling,
MO-Data
”RRC Connection Request” CCCH/ULSCH

RRC IDLE RRC Connection Request is initiated by
the higher layers in the UE
DLSCH ”RRC Connection Setup”
RRC Connection Setup
(C-RNTI is allocated)
”RRC Connection Setup Complete” DCCH/ULSCH

RRC
RRC connection establishment
CONNECTED
NAS information for authentication procedure creates the signaling radio
request is piggybacked to the “RRC bearer SRB#1,
Connection Setup Complete” message
33
7/2/2014
Security Related Procedures

MME
INITIAL CONTEXT SETUP REQUEST

(Integrity Protection Algorithm EIA;
Ciphering Algorithm EEA;
Security Key)
2. Decide Algorithms,
Derive Keys
Activate Security for SRB
SECURITY MODE COMMAND(EEA;EIA)
SECURITY MODE COMPLETE
INITIAL CONTEXT SETUP RESPONSE
RRC Security Mode Command is triggered by the EPC (MME) at S1 signaling message “Initial
Context Setup Request” includes all security setting needed to start Integrity Protection of
the control plane signaling and Encryption of the both user plane and control plane signaling
(PDCP protocol).
Security setting includes Integrity Algorithm (EIA) Ciphering Algorithm (EEA) and Security key.
Counter Check Function
RRC COUNTER CHECK Used by UTRAN to request from

the UE to verify the amount of data
sent/received for each DRB
RRC COUNTER CHECK RESPONSE
Additional security measures are added to LTE/SAE by adding Counter

check function UE is requested to check if, for each DRB, the most
significant bits of the COUNT match with the values indicated by E-UTRAN.
When “RRC Counter Check” is transmitted? Whenever eNB finds

the particular COUNT is exceeded than specific value eNB sends this
message if it suspects that new data is introduced by an intruder in any
DRB which are used for data transfer between UE and eNB.
34
7/2/2014

Action UE will send Counter Check Response to eNB including:
- drb-CountInfoList,
- drb-Identity,
- counte-Uplick,
- count-Downlink
All IE's correspond to that specific COUNT value.
procedure enables E-UTRAN to detect packet insertion by an intruder


procedure enables E-UTRAN to detect packet insertion by an intruder
Question Why needed to include an extra protection for intruder

detection? Isn’t enough Integrity protection on security mode command?
Answer RRC Counter Check Procedure is part of Periodic local

authentication procedure in LTE in many countries regulations ciphering
the data over the Radio Interface is forbidden for National Security there
is a probability of the data connection being compromised by MAN in
MIDDLE attack.
35
7/2/2014
RRC UL/DL Transparent Messages

Information Transfer
RRC UL INFORMATION TRANSFER (NAS message)
RRC DL INFORMATION TRANSFER (NAS message)
purpose of this procedure transfer NAS or (tunneled) non-3GPP

dedicated information from the UE to E-UTRAN
UE Capability Transfer
RRC UE CAPABILITY ENQUIRY
RRC UE CAPABILITY INFORMATION
S1AP: UE Capability Info Indication
UE Capability Retreival - This procedure retreives UE Radio Capability from UE and provides
it the the MME.
Step 1 eNodeB requests the UE Radio Capability by sending RRC UE Capability Enquiry
message.
Step 2 UE responds to the eNodeB with requested UE Capability in teh UE Capability

Information message
Step 3 eNodeB forwards the received ”UE Radio Capabilities” to teh MME in teh UE
Capability Info Indication
36
7/2/2014
Radio Link Failure – RCS Algorithm

First Phase Second Phase
Radio no recovery during no recovery during

Normal operation problem Return to idle
T310 T311
detection
RRC_Connected RRC_IDLE
Maximum number (counter -> New RRC

N310) of RLC radio link failure Connection
retransimssions is reached
Request
-> RRC Connection Re-
RCS Algorithm procedure establishment Request
Step 1 Upon "radio link problems” detected, UE starts timer T310 - In case radio link
recovery happens before T310 expires the UE stops the timer T310 and continues in state
RRC Connected.
Step 2 T310 expires and no recovery takes place UE starts timer T311 and starts searching
for a new cell.
-If the UE finds a cell before T311 expires RRC Connection re-establishment procedure is
triggered.
- In case T311 expiries before UE finds a cell than the UE enters idle mode.
Radio Link Failure – RRC Signaling
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT
RRC CONNECTION RE-ESTABLISHMENT COMPLETE
Procedure:
A waiting timer is started in eNodeB when

- maximum number of RLC retransmissions has been reached, or
- maximum number of PDCCH Ordered Re-synchronization failure are
detected.
During this waiting timer, eNodeB expects from UE to trigger “RRC

Connection Re-establishment Request” message If no “RRC
Connection Re-establishment Request” is received during this time, UE is
released back to idle mode.
37
7/2/2014
Radio Link Failure
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT REJECT
What if eNodeB cannot handle the incoming “RRC Connection Re-

establishment Request” ?
eNodeB will respond with “RRC Connection Re-establishment Reject”

message to the UE and initiate a UE release procedure towards MME.
RRC Signaling - RRC Mobility
38
7/2/2014
Measurement Configuration Message
RRC CONNECTION RECONFIGURATION

(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
E-UTRAN provides the measurement configuration (events to trigger,

thresholds, time to trigger, neighbors etc) applicable for a UE in
RRC_CONNECTED mode
This is accomplished by dedicated signaling message
“RRC Connection Reconfiguration”
Measurement Configuration – Type of

Measurements
UE receives “RRC Connection Reconfiguration” message following

types of measurements might be requested:
- Intra-frequency measurements: (serving cell carrier frequency).

- Inter-frequency measurements: (neighbor cell measurements at different
carrier frequencies).
- Inter-RAT measurements of UTRA frequencies.
- Inter-RAT measurements of GERAN frequencies.
- Inter-RAT measurements of CDMA2000 HRPD or CDMA2000 1xRTT
frequencies.
39
7/2/2014
Measurement Configuration
Parameters (1)
Measurement objects:
- For intra-frequency and inter-frequency measurements: object is a
single E-UTRA carrier frequency. Associated with this carrier frequency, E-
UTRAN can configure a list of cell specific offsets and a list of ‘blacklisted’
cells.
- For inter-RAT UTRA measurements: object is a set of cells on a single
UTRA carrier frequency.
- For inter-RAT GERAN measurements: object is a set of GERAN
carrier frequencies.
- For inter-RAT CDMA2000 measurements: object is a set of cells on a
single (HRPD or 1xRTT) carrier frequency.
Parameters (2)

Reporting configurations:
- Reporting criteria: The criteria that trigger the UE to send a
measurement report. This can either be periodical or a single event
description.
- Reporting format: The quantities that the UE includes in the
measurement report and associated information (e.g. number of cells to
report).
40
7/2/2014
Parameters (3)

Measurement identities: A reference number
A list of measurement identities each measurement identity links one

measurement object with one reporting configuration.
Measurement identity is used as a reference number in the measurement

report.
Parameters (4)

Quantity configurations: defines the measurement quantities and

associated filtering used for all event evaluation and related reporting of
that measurement type. E.g. RSRP (Reference Signal Received Power) ,
RSRQ (Reference Signal Received Quality).
- quantity configuration for intra-frequency measurements,

- quantity configuration for inter-frequency measurements
- quantity configuration for RAT type.
One filter can be configured per measurement quantity
41
7/2/2014
Parameters (5)
Measurement gaps: Periods that UE may perform measurements, i.e. no

(UL, DL) transmissions are scheduled.
The measurement procedures for different types of cells:
-The serving cell.
-Listed cells - these are cells listed within the measurement object(s).
- Detected cells - these are cells that are not listed within the
measurement object(s) but are detected by the UE on the carrier
frequency(ies) indicated by the measurement object(s).
Measurement Reporting
UE performs measurements and reports back only when event criteria are met!
Best Cell Examples:

Evaluation
-Event A3 A neighbour cell
becomes offset better than
serving cell
LTE
LTE - Event A2 Serving cell
becomes worse than an
absolute threshold
LTE
LTE
42
7/2/2014
Measurement Reporting – Triggering events
Best Cell
Evaluation Examples:
-Event A3 A neighbour cell

becomes offset better than
LTE
LT serving cell
E
- Event A2 Serving cell

LTE becomes worse than an
LTE
absolute threshold
Measurement Reporting Criteria

Reporting criteria
• Reporting threshold
• Hysteresis
• Time-to-trigger
• Reporting interval
43
7/2/2014
Example
RRC Signaling Flow – Attach Request
To be discussed in class …..
RRC Signaling Flow Example – Attach Request

MME
1. System Information *
RRC IDLE Cell
Select *
2. Random Access Preamble
3. Random Access Response
4. RRC CONNECTION REQUEST
5. RRC CONNECTION SETUP
RRC 6. RRC CONNECTION SETUP COMPLETE (Attach Request)

7. INITIAL UE MESSAGE (Attach Request)
CONNECTED
8.RRC DL INFORMATION TRANSFER (UE Identity Request) DL NAS TRANSPORT (UE Identity Req)
9. RRC UL INFORMATION TRANSFER (UE Identity Response) UL NAS TRANSPORT (UEid Response)
10.RRC DL INFORMATION TRANSFER (Authentication Request) DL NAS TRANSPORT (Authentication)

11. RRC UL INFORMATION TRANSFER (Authentication Response) UL NAS TRANSPORT (Auth. Response)
12. RRC DL INFORMATION TRANSFER (Security Mode Command) DL NAS TRANSPORT (NAS SMC)
13. RRC UL INFORMATION TRANSFER (Security Mode Complete) UL NAS TRANSPORT (NAS SMC)
15. RRC SECURITY MODE COMMAND 14. INITIAL CONTEXT SETUP REQUEST
(EPS bearers, Attach Accept, Security)
16.RRC SECURITY MODE COMPLETE
17. RRC UE CAPABILITY ENQUIRY
18. RRC UE CAPABILITY iNFORMATION
19. UE CAPABILITY INFO INDICATION
20. RRC CONNECTION RECONFIGURATION (Attach Accept, Bearer Setup) (UE Radio Capability)
21. RRC CONNECTION RECONFIGURATION COMPLETE
22. INITIAL CONTEXT SETUP RESPONSE
(EPS bearers)
23. RRC UL INFORMATION TRANSFER (Attach Complete)) UL NAS TRANSPORT (Attach Complete)
RRC IDLE 24. UE CONTEXT RELEASE COMMAND

26. RRC CONNECTION RELEASE 25. UE CONTEXT RELEASE COMPLETE
44
7/2/2014
PDCP Protocol
PDCP Functions
45
7/2/2014
PDCP Architecture
TS 36.323
UE/E-UTRAN
PDCP-SAP PDCP-SAP Radio Bearers
... PDCP
PDCP entity PDCP entity
PDCP - PDU
RLC - SDU
...
RLC
RLC UM-SAP RLC AM -SAP
PDCP Entity Architecture

UE/E-UTRAN E - UTRAN / UE
Transmitting Receiving
PDCP entity PDCP entity
TS 36.323
In order delivery and duplicate

Sequence numbering
Detection (U plane)
Header Compression Header Compression

(user plane only) (user plane only)
Packets associated
to a PDCP SDU
Packets NOT associated
to a PDCP SDU Packets associated

to a PDCP SDU
Packets NOT associated
to a PDCP SDU
Integrity Protection Integrity Verification

(control plane only) (control plane only)
Ciphering Deciphering
Add PDCP header Remove PDCP Header
Radio Interface (Uu)

46
7/2/2014
Sequence Numbering
Sequence numbering is used by several functions:
- Reordering of the PDCP PDUs at the receiver side
- Duplicate detection in case of packet forwarding at handover
-Calculation of COUNT, used for integrity protection and ciphering.
Sequence Numbering
WHY: * Reordering
* Duplicate detection
* Integrity protection
* Ciphering
eNB
SRB1_UL SRB1_UL COUNT

COUNT
SRB1_DL SRB1_DL COUNT

COUNT
UE
UE Ctx
COUNT DRB_UL DRB_UL COUNT
COUNT
DRB_DL DRB_DL COUNT
HOW:
PDCP SN:
Next_PDCP_TX_SN
TX_HFN
HFN PDCP SN
COUNT
47
7/2/2014
Header Compression
WHY: Saving the bandwith by Based on the Robust
HOW: *removing redundant info Header Compression
*Encoding important info (ROHC) framework
*Hop by Hop IETF RFC 3095
*Unidirectional
For Voice over IP, interactive games,

messaging etc, the payload of the IP
packet is sometimes even smaller than
the header.
UE/UE Context
RB_UL PDCP PDU Header

Header PDCP PDU PDCP PDU RB_UL
CRC Compressed
checksum covering the header before Header
compression is included in the compressed header Contains UE/UE Context
encoded data
Security Handling – Integrity &

Ciphering
Integrity protection:
- is implemented in the PDCP layer in order to ensure that the data origin
of the signaling data is indeed the one claimed.
- check also that received data has not been modified in an unauthorized
way.
Data encryption (ciphering): is to ensure that the user data cannot be

eavesdropped on the radio.
48
7/2/2014
Integrity Protection
3GPP TS 33.401
integrity protection key K_eNB_RRCInt
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
Which algorithm to use is decided by eNodeB by

WHY: To ensure data origin
during RRC security activation
Upper layer parameters (required by PDCP):

PDCP PDU
PDCP PDU
PDCP SDU
Header
- BEARER, defined as the radio bearer identifier,

(SRB1 will use the value RB identity –1) COUNT
Direction
K_eNB_RRCInt
EIA MAC-I
- KEY (KRRCint).
Bearer Id
Transmitter
Integrity Protection
WHY: To ensure data origin
Header
PDCP PDU PDCP SDU
PDCP PDU PDCP PDU

PDCP PDU PDCP PDU
PDCP SDU PDCP SDU
Header Header
COUNT COUNT
Direction Direction
K_eNB_RRCInt
EIA MAC-I XMAC-I
EIA K_eNB_RRCInt
Bearer Id Bearer Id
MAC-I
= XMAC-I
Transmitter Receiver
49
7/2/2014
Ciphering
3GPP TS 36.331
integrity protection key K_UPenc
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
WHY: To protect the data over radio
Required parameters by PDCP for
ciphering (3GPP TS 33.401): COUNT DIRECTION
BEARER LENGTH
- COUNT
- DIRECTION (DL or UL) KEYUPenc EEA
- BEARER (defined as the radio bearer

identifier ) KEYSTREAM
BLOCK
- KEY (the ciphering keys for the control
plane and for the user plane are KRRCenc
and KUPenc, respectively). PLAINTEXT CIPHERTEXT
BLOCK BLOCK

Sender
Ciphering
WHY: To protect the data over radio EEA0
EEA1
EEA2
COUNT DIRECTION COUNT DIRECTION
BEARER LENGTH BEARER LENGTH
KEYUPenc EEA KEYUPenc EEA
KEYSTREAM KEYSTREAM
BLOCK BLOCK
PLAINTEXT CIPHERTEXT PLAINTEXT

BLOCK BLOCK BLOCK
Sender Receiver
50
7/2/2014
RLC Protocol
RLC Functions
3GPP TS 36.322
51
7/2/2014
RLC Sublayers
3GPP TS 36.322
3GPP TS 36.322 RLC Logical Channels
52
7/2/2014
3GPP TS 36.322 RLC Modes
RLC TM Entity
UE/ENB ENB/UE
radio interface
TM-SAP TM-SAP
Transmitting Receiving
TM-RLC TM-RLC
entity entity
Transmission
buffer
No Header
BCCH/PCCH/CCCH BCCH/PCCH/CCCH
- BCCH Broadcast Control Channel (System Information transfer)

- DL/UL CCCH Common Control Channel ( example: RRC Connection Request )
- PCCH Paging Control Channel (Paging)
53
7/2/2014
RLC Transparent Mode PDU
The RLC TM PDU introduces no overhead
TM is used for signaling on BCCH and

PCCH.
RLC UM Entity
UM RLC entity is supposed to carry user data payload for the time critical services
that tolerate a higher packet loss rate. Eg. Voice over IP.
RLC in Unacknowledged Mode is a licensed feature
54
7/2/2014
RLC Unacknowledged Mode PDU,

5 Bits SN
UMD PDU with 5 bit SN PDU with 5 bit SN

(Odd number of LIs, i.e. K = 1, 3, 5, …) (Even number of LIs, i.e. K = 2, 4, 6, …)
E Extension Field
FI Framing Information
SN Sequence Number
RLC Unacknowledged Mode PDU,

10 Bits SN, cont
UMD PDU with 10 bit SN UMD PDU with 10 bit SN

(Odd number of LIs, i.e. K = 1, 3, 5, …) (Even number of LIs, i.e. K = 2, 4, 6, …)
E Extension Field
FI Framing Information
SN Sequence Number
55
7/2/2014
RLC AM Entity
AM -SAP
Transmission
RLC control SDU reassembly
buffer
Remove RLC header

Segmentation & Retransmission
Concatenation buffer
Reception
buffer & HARQ
reordering
Add RLC header

Routing
DCCH /DTCH DCCH /DTCH
RLC Acknowledged Mode PDU
D/C RF P FI E SN Oct 1
SN Oct 2
LSF SO Oct 3
SO Oct 4
E LI1 Oct 5
LI1 E LI2 (if K>=3) Oct 6
LI2 Oct 7
Present if
E LIK-2 Oct [4.5+1.5*K-4]
K >= 3
LIK-2 E LIK-1 Oct [4.5+1.5*K-3]
LIK-1 Oct [4.5+1.5*K-2]
E LIK Oct [4.5+1.5*K-1]
LIK Padding Oct [4.5+1.5*K]
Data Oct [4.5+1.5*K+1]
Oct N
D/C Data/Control
E Extension Field
FI Framing Info
LSF Last Segment Flag
P Poll Bit
RF Resegmentation Flag
SN Sequence Number
SO Segment Offset
56
7/2/2014

Positive Acknowledgment

Negative Acknowledgment
57
7/2/2014
Information Element: E Bit

Extension bit indicates whether Data field follows or a set of E
field and LI field follows
Information Element: Length Indicator LI
Length Indicator (LI) field

The LI field indicates the length in bytes of
the corresponding data field element present
in the RLC data PDU delivered/received by
an UM or an AM RLC entity.
The value 0 is reserved.
58
7/2/2014
Information Element:
FI Framing Information Field
Segment Offset SO
The Segment Offset field indicates the

position of the AMD PDU segment in bytes
within the original AMD PDU.
The first byte in the Data field of the original

AMD PDU is referred by the SO field value
"000000000000000"
59
7/2/2014
Last Segment Flag LSF
Resegmentation Flag RF
Value Description
0 AMD PDU
1 AMD PDU segment
60
7/2/2014
Information Element: Poll P
Polling bit field
Value Description
0 Status report not requested
1 Status report is requested
Control Pdu Type CPT
61
7/2/2014
STATUS PDU
D/C CPT ACK_SN Oct 1

ACK_SN E1 Oct 2
NACK_SN Oct 3
E1 E2 NACK_SN Oct 4
NACK_SN E1 E2 Oct 5
SOstart Oct 6
SOstart SOend Oct 7
SOend Oct 8
SOend NACK_SN Oct 9
D/C Data/Control
CPT Control PDU Type
E Extension Field
SO Segment Offset
STATUS PDU Fields
62
7/2/2014
MAC Protocol
3GPP TS 36.322 MAC Functions
63
7/2/2014
3GPP TS 36.321 MAC Sublayers
MAC Functions - UE Side

Upper layers
PCCH BCCH CCCH DCCH DTCH MAC-control
Logical Channel Prioritization (UL only)
(De-) Multiplexing Control
Random
HARQ
Access Control
PCH BCH DL-SCH UL-SCH RACH

Lower layer
64
7/2/2014
MAC Functions – eNodeb Side

MAC Control
CCCH DCCH DTCH DCCH DTCH CCCH PCCH BCCH
Scheduling / Priority
Scheduling / Priority Handling Handling
Scheduler
Control
Multiplexing Demultiplexing
HARQ
HARQ HARQ
PDCCH
PUCCH
SR
DL-SCH HARQ UL-SCH HARQ PCH BCH DL-SCH
Feedback Feedback
MAC Function Location
65
7/2/2014
3GPP TS 36.321
MAC Transport Channels
MAC DL-SCH Transport Channel

3GPP TS 36.321
66
7/2/2014
Physical Channels
MAC Multiplexing
IP
IP TCP Payload IP TCP Payload
via S1 or from 20B 20B e.g. 50 Byte 20B 20B e.g. 1460 Byte
UE’s stack
PDCP H H
~3B ~3B
Header Compression
& Ciphering PDCP PDCP SDU PDCP PDCP
2B 2B PDU
RLC RLC SDU Segmentation

RLC 4B
Segmentation
RLC RLC SDU RLC
concatenation
Concatenation 2B PDU
MAC MAC SDU (e.g. 599 Byte) Multiplexing (Padding)

MAC 1B
Multiplexing MAC MAC
MAC SDU (e.g. 927 Byte)
4B PDU
L1 Transport Block CRC

Coding, 3B
Interleaving,
Modulation
67
7/2/2014
MAC PDU Structure

LCID Logical Channel ID
R/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L ... R/R/E/LCID/F/L R/R/E/LCID padding
E Extension Bit
sub-header sub-header sub-header sub-header sub-header sub-header R Reserved
F Length Flag
L Length
MAC header
MAC Control MAC Control
element 1 element 2
MAC SDU ... MAC SDU
Padding
(opt)
MAC payload
MAC PDU
A MAC PDU header consists of one or more MAC PDU subheaders
Each subheader corresponds to either a MAC SDU (RLC PDU), a MAC

control element or padding.
MAC PDU Structure
R R E LCID Oct 1
R/R/E/LCID sub-header

R/R/E/LCID/F/LR/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L ... R/R/E/LCID/F/L R/R/E/LCID padding
E Extension Bit
F Length Flag
L Length
MAC header
element 1 element 2
MAC SDU ... MAC SDU
Padding
(opt)
MAC payload
A MAC PDU subheader consists of the six header fields R/R/E/LCID/F/L except for the last
subheader in the MAC PDU and for fixed sized MAC control elements.
68
7/2/2014
MAC PDU Structure

Buffer Status Report (BSR) MAC control elements consist of either:
- Short BSR and Truncated BSR format: one LCG ID field and one corresponding Buffer Size
field, or
- Long BSR format: four Buffer Size fields, corresponding to LCG IDs #0 through #3.
E Extension Bit
F Length Flag
L Length
MAC header
element 1 element 2
MAC SDU ... MAC SDU
Padding
(opt)
MAC payload
MAC Control Elements

Buffer
Buffer Size #0 Oct 1
Size #1
LCG ID Buffer Size Oct 1
Buffer Size #1 Buffer Size #2 Oct 2
Short BSR Buffer
Buffer Size #3 Oct 3
Size #2
Long BSR
MAC Control Element fields
- LCG ID: Logical Channel Group ID field identifies the group of logical
channel(s) which buffer status is being reported. The length of the field is 2 bits;
- Buffer Size: Buffer Size field identifies total amount of data available across all
logical channels of a logical channel group after the MAC PDU has been built
(scheduled) amount of data is indicated in number of bytes (including all data that
is available for transmission in the RLC layer and in the PDCP layer). The length of
this field is 6 bits
69
7/2/2014
MAC PDU Structure – MAC SDU’s

E Extension Bit
F Length Flag
L Length
MAC header
element 1 element 2
MAC SDU ... MAC SDU
Padding
(opt)
MAC payload
MAC Signaling Procedures
RANDOM ACCESS
70
7/2/2014
Channel Mapping
Downlink Uplink
Logical Channels

Transport Channels
characteristics”
-Sched TF DL
“bits, symbols,
frames etc”
-meas for DL sched
Physical Signals
“only L1 info”
MAC Signaling Procedures -

RANDOM ACCESS PROCEDURES
When???
- enable initial access - UE to E-UTRAN (CBRA)
- enable Handover access - UE to E-UTRAN (CFRA)
- establish UL synchronization (CFRA)
- Indicate presence of UL data (when not scheduled for long time) (CFRA)
71
7/2/2014
CBRA RANDOM ACCESS –

Initial Access for RRC Connection Establishment
Random Access – CBRA (Contention CBRA

Based Random Access)
UE eNB
When??? 1.
Random Access Preamble
(Randomly selected Preamble Id)
- used at initial access (initialcall setup) Random Access Response 2.
- subject to collision (ALOHA Protocol) 3. RRC Connection Request
RRC Connection Setup 4.
Example

To be discussed in class
72
7/2/2014

rach-Configuration {
preambleInformation { numberOfRA-Preambles n64 },
eNodeB
powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4,
mac-ContentionResolutionTimer sf48 },
BCCH: System Information
maxHARQ-Msg3Tx 1 }, RRC RRC
PRACH: RACH preamble

UE randomly selects MAC MAC
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
MAC MAC RA-RNTI = 1+ t_id + 10f_id
MAC allocate TC-RNTI
If no answer is received within PDCCH: RA-RNTI; Scheduling Grant;TA
ra-ResponseWindowSize preamble is DL-SCH: RACH response
sent again based on MAC (RAPID; TC-RNTI); MAC
preambleInitialReceivedTargetPower + powerRampingStep
PUSCH: TC-RNTI
UL SCH: RA message3
If the UE sees its preamble, it CCCH: RRC Connection Request
RRC RRC
will respond with RRCConnectionReq (Initial UE identity, Cause) The TC-RNTI is "promoted" to a C-RNTI,
Including its 40 bit UE-id and Est.
i.e. the same 16-bit value
Cause)
allocated for TC-RNTI
The 40-bit MAC "UE contention resolution will continue to be used as C-RNTI
PDCCH: TC-RNTI; Scheduling Grant
after the random access procedure
identity" is identical to the RRC Connection
MAC DL-SCH: C-RNTI; Contention Resolution MAC
Request sent in RA message 3. is successfully concluded.
RRC CCCH: RRC Connection Setup RRC
(SRB1 parameters)
Use TC-RNTI to decode DL SCH. If the UE contention

resolution
identity MAC control element matches the RRC connection
MAC UL-SCH: C-RNTI; BSR
request MAC
message promote TC-RNTI to C_RNTI. DCCH: RRC Connection Setup Complete
RRC (Selected PLMN id, NAS: Attach Request *) RRC
CFRA RANDOM ACCESS –

Handover Access
Random Access – CFRA (Contention

Free Random Access) CFRA
When??? UE eNB
1. (Pre-allocated Preamble Id)
- is used for UEs in handover
Random Access Response 2.
- a special preamble is reserved

3. RRC Connection Request
73
7/2/2014

Handover Access
“ Cell 1 ” “ Cell 2
RRC: RACH - ConfigDedicated
p UE1
UE1 is assigned preamble pUE1 by means of RRC

signalling via cell 1 which is the serving cell of UE1

UE out_of_sync – resynchronization process

When??? UE eNB
- is used for UEs in re-synchronization
procedure when non scheduled. Random Access Response 2.

- a special preamble is reserved
74
7/2/2014

Uplink re-synchronization
- UE is scheduled for downlink data from eNodeB uplink Scheduler
- UE is out_of_sync (unsynchonized) due to following event:
non scheduled time period > timeAlignmentTimer
and alignment expiration has occurred (UL timing adjustment process)
- eNodeB through PDCCH physical channel on downlink transmission
assigns a reserved preample to UE
- UE uses preample and starts CFRA process to get back synchronization.
eNodeB
PDCCH for DL
data arrival

UE UL_Scheduling Request to eNodeb UL scheduler
When??? UE eNB
- UE has data (overflowing) into buffer
Random Access Response 2.
- eNodeB has not scheduled UE since

long time
- UE requests scheduling using CFRA
random access procedure since it has
been UL out_of_sync
- a special preamble is reserved from

eNodeb and signaled through PDCCH
75
7/2/2014
Example

To be discussed in class ...

rach-Configuration {
eNodeB
preambleInformation { numberOfRA-Preambles n64 },

powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4, BCCH: System Information •no PUCCH resources
mac-ContentionResolutionTimer sf48 }, RRC RRC
•no UL Synch (TAT is not running)
maxHARQ-Msg3Tx 1 },
•has repeated SR on PUCCH max no of times
UE randomly selects MAC MAC
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
MAC MAC
RA-RNTI = 1+ t_id + 10f_id
If no answer is received within MAC allocate TC-RNTI
PDCCH: RA-RNTI; Scheduling Grant;TA
ra-ResponseWindowSize preamble is DL-SCH: RACH response
sent again based on MAC (RAPID; TC-RNTI); MAC
preambleInitialReceivedTargetPower + powerRampingStep
If the UE sees its preamable, it

will respond with Scheduling Request MAC PUSCH: C-RNTI MAC
UL SCH: msg3 (BSR,
by sending msg3 containing MAC
PHR)
control elements( BSR and/or PHR)
and identified by C-RNTI
PDCCH: C-RNTI; Scheduling Grant

MAC MAC
C-RNTI provides contention resolution
Use C-RNTI to decode DL SCH..

MAC UL-SCH: C-RNTI; BSR
MAC
RLC DTCH/DCCH:
Scheduled Unicast Transmission RLC
76
7/2/2014
UL Time Alignment

UL Time Alignment
Problem statement:
Different UEs within a cell will experience different propagation delay
to/from the cell site, depending on their exact position within the cell
coverage area.
Normally transmit timing is based

only on the timing of the received
downlink timing as a result their
corresponding uplink transmissions
UE 2
will thus arrive at the cell site with
UE 1
potentially very different timing.
Receive-timing differences might be too large orthogonality between

uplink transmissions of different UEs will not be retained subcarriers will
be out_of_sync OFDM orthogonality is lost !!! .
77
7/2/2014

UL Time Alignment
Solution:
A mechanism with an active uplink transmit-timing control is needed to
ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism:
R R Timing Advance Command Oct 1
- network measures received uplink timing
of the different UEs.
- adjusts (advance (+) command or retard
(–) command) transmit timing on a certain
amount.
- timing-control commands are transmitted
as higher-layer signaling (MAC) to the
UEs. UE 2
UE 1

Solution: UL Time Alignment
A mechanism with an active uplink transmit-timing control is needed to
ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism: R R Timing Advance Command Oct 1
- UE has a configurable timer,

timeAlignmentTimer,
- used to control how long the UE is considered
uplink time aligned.
- When timer expires and no timing control
command is received (non scheduled UE)
UE 2
CFRA Random Access process is needed
UE 1
- timeAlignmentTimer is valid only in the cell

for which it was configured and started .
78
7/2/2014
MAC Scheduler

MAC Scheduler
79
7/2/2014

MAC Scheduler Blocks

MAC Scheduler
Time-frequency
fading, user #1 data1 Channel dependant scheduler
data2
Time-frequency
data3
data4
- Adapts UE rate to channel conditions
fading, user #2
User #1 scheduled
User #2 scheduled
80
7/2/2014

Scheduled Channels
Downlink Uplink
DL Scheduling UL Scheduling
BCCH PCCH DTCH DCCH CCCH DTCH DCCH CCCH
Logical Channels
BCH PCH DL-SCH UL-SCH RACH

Transport Channels
characteristics”
-Sched TF DL
-Pwr Ctrl cmd PDCCH -(N)ACK
-HARQ info ACK/NACK -Sched req.
info Physical Channels
“bits, symbols,
PBCH PDSCH PDCCH PCFICH PHICH PUCCH PUSCH PRACH
modulation, radio
frames etc”
Physical Signals
RS P-SCH S-SCH RS SRS “only L1 info”

Scheduled DL Resources
Scheduler
One Scheduling Block
SBs
Link Adaptation
SINR Two RBs
f MIMO
0.5ms
0.5ms
180 kHz
1 ms
t | +1 703 281 3525

© Copyright Eogogics Inc | www.eogogics.com
81
7/2/2014

UL Scheduler
eNodeB eNodeB
Buffer Buffer
Scheduler Multiplexing Scheduler Uplink channel quality
Modulation, coding
TF selection
Status
CQI
UE UE
Modulation, coding
Downlink
Priority handling Multiplexing
channel quality
Buffer Buffer
Downlink Uplink

MAC Scheduler
82
7/2/2014
HARQ

HARQ
LTE protocols over IP/ethernet transmission (Link Layer (ethernet), Network
layer (IP) and transport network protocols (TCP, UDP)) are not prepared to
recover from packet header bit errors and packet payload errors.
Although channel dependant MAC Scheduler adjusts scheduling to UE

channel conditions, BER unrecovery conditions might still be a problem that
might introduce large amount of retransmissions over the air interface
One potential solution might be the propagation of BER recovery functions to

higher layer protocols however it might introduce unaccepted delays
Another potential solution might be the choice to discard and fast retransmit
the entire data unit containing bit errors Physical layer Turbo coding correct
errors on receiver and CRC check BER to decide.....
LTE 3GPP standards define two layers of retransmission protection. HARQ on

MAC and ARQ on RLC
83
7/2/2014
HARQ (MAC) and ARQ (RLC)

RLC SDUs
BLER ~10-6
RLC
Sliding Window ARQ
UL ARQ UL ARQ
Transmitter Receiver
RLC PDUs RLC Status

RLC Status RLC PDUs
BLER ~10-4 to 10-3 BLER ~10-4 to 10-3 (DL HARQ data)
MAC
DL HARQ UL HARQ Stop and Wait HARQ
UL HARQ DL HARQ
Receiver Transmitter
Receiver Transmitter
BLER ~10-1 Transport Block +CRC

BLER ~10-1
Uplink L1
Downlink L1
Accessibility Preamples
84
7/2/2014
Random Access Procedure
RA Preamble Assignment
0

1 CFRA
Contention Free
Random Access
Random Access Response
2 Process Steps
CBRA
Contention Based Scheduled Transmission (MSG3)
3
Random Access HARQ
Process Steps
Contention Resolution (MSG4)
4
HARQ
Uplink Open Loop Power Control

1) UE measures RS
RBS
UE 3) The power is ramped up until a response is heard

or maximum number of re-attempts is reached
Max uplink cell power
Power step
Data
preambleInitial power
Uplink ... ... ... ...

(PRACH)
preamble RA msg 3
0.8 ms
Indicates RA Response on PDSCH
(Not UE specific)
Downlink ... RA-RNTI
(PDCCH) ... ...
subframe RA response window
1 ms RAPID
Downlink
Timing (UL timing)
(PDSCH)
RACH Preamble RACH Response No Response Scheduling Grant
85
7/2/2014
Random Access KPIs Using Drive Test

Random Access Success:
False Preamble probability:
#RaSuccCbra
= X 100
#RaAttCbra #RaAttCbra - #RaSuccCbra
Measurement period
RBS
Exercises
RRC Signaling – UE Log Traces
86
7/2/2014
Mobility Case Studies
Signaling on E-Utran
To be discussed in class …
Mobility Case – X2 Handover
Simplified mobility
MME SGW scheme to handle the
most common
scenario
Forwarding of user
data on X2 interface
LTE Node B (Selective
Forwarding)
LTE NodeB After handover is
X2
X2 completed, EPC is
LTE Node B informed and the
route is optimized
87
7/2/2014
X2 Handover
S-GW MME
Source eNB Target eNB
RRC 1. RRC CONNECTION RECONFIGURATION
CONNECTED (Bearer Setup,Measurement conf))
2. RRC Measurement Report

(Event A3)
3. HO
Decision
4. X2 HANDOVER REQUEST
5.Admission
TRELOCprep Control
ACKNOWLEDGE
8. Start Data
7. X2 SN STATUS TRANSFER
forwarding
T304 10. RRC CONNECTION RECONFIGURATION
9. Buffer
(Handover Command,Measurement conf) Forwarded
Regenerate Data
Security Keys 11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
(Handover Complete) 14.Data Transfer in Target
15. S1 PATH SWITCH REQUEST
16. S5 USER PLANE
17.Data Transfer in Target UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
RRC 20. X2 UE CONTEXT RELEASE

21. Forward if any
CONNECTED Data in transition
and release
Handover Flow
1. Measurement Command message is included in RRC Connection
Reconfiguration message.
2. criteria event A3 is fulfilled UE will inform the source eNB by

sending Measurement Report.
3. Source eNB makes a handover decision based on Measurement

Report and RRM
88
7/2/2014
Handover Flow
4. Source eNB issues a X2 - Handover Request message to the target
eNB passing necessary information to prepare the HO
- UE X2 signaling context reference at source eNB,
- UE S1 EPC signaling context reference,
- target cell ID,
- KeNB,
- RRC context including the C-RNTI of the UE in the source eNB,
- AS-configuration,
- E-RAB context and physical layer ID of the source cell + MAC for
possible RLF recovery).
UE X2 / UE S1 signaling references enable the target eNB to address the

source eNB and the EPC.
E-RAB context includes also necessary RNL and TNL addressing

information, and QoS profiles of the E-RABs.
X2- Handover Request
89
7/2/2014
X2 Handover
S-GW MME

(Event A3)
3. HO
Decision
5.Admission
TRELOCprep Control
ACKNOWLEDGE
8. Start Data
forwarding
T304 10. RRC CONNECTION RECONFIGURATION
9. Buffer
Regenerate Data
16. S5 USER PLANE
18. S5 USER PLANE
UPDATE RSPONSE

21. Forward if any
and release
Handover Flow
5. AC (Admission Control) is performed by the target eNB
AC dependents on the received E-RAB QoS information
Target eNB configures the required resources according to the received E-

RAB QoS information - reserves a C-RNTI and optionally a RACH
preamble.
90
7/2/2014
Handover Flow
6. Target eNB prepares HO with L1/L2 and sends X2 - Handover
Request Acknowledge to the source eNB.
Message includes transparent container to be sent to the UE as an RRC

message (RRC Connection reconfiguration) to perform the handover.
Container includes:
- new C-RNTI,
- target eNB security algorithm identifiers for the selected security
algorithms,
- dedicated RACH preamble.
X2 Handover Request Ack
91
7/2/2014
Handover Flow
7. Source eNB sends SN STATUS TRANSFER message to the target
eNB
Reason: Inform RLC AM about uplink PDCP SN receiver status -

includes at least the PDCP SN of the first missing UL SDU and may
include a bit map of the receive status of the out of sequence UL SDUs
that the UE needs to retransmit in the target cell if there are any such
SDUs
Reason: Inform RLC AM about downlink PDCP SN transmitter status of

E-RABs – includes next PDCP SN that the target eNB shall assign to
new SDUs, not having a PDCP SN yet.
X2 Handover
S-GW MME

(Event A3)
3. HO
Decision
5.Admission
TRELOCprep Control
ACKNOWLEDGE
8. Start Data
forwarding
T304
10. RRC CONNECTION RECONFIGURATION 9. Buffer
Regenerate Data
16. S5 USER PLANE
18. S5 USER PLANE
UPDATE RSPONSE

21. Forward if any
and release
92
7/2/2014
Handover Flow
8. Data forwarding is initiated
9. Target eNB buffers received DL data until the UE access the new cell.
10. Source eNB forwards RRC message RRC Connection

Reconfiguration included on X2 - message Handover Request
Acknowledge (includes mobilityControlInformation to the UE).
- source eNB performs necessary integrity protection and ciphering of the

message UE receives RRC Connection Reconfiguration
message with necessary parameters.
RRC Container, Extract

RRCConnectionReconfiguration message
RRCConnectionReconfiguration-r8-IEs {
measConfig
mobilityControlInfo
radioResourceConfigDedicated
securityConfigHO
MobilityControlInfo ::=
targetPhysCellId
carrierFreq O
carrierBandwidth O
additionalSpectrumEmission O
t304 ENUMERATED { ms50, ms100, ms150, ms200, ms500, ms1000,
ms2000, spare1},
newUE-Identity C-RNTI,
radioResourceConfigCommon
rach-ConfigDedicated ra-PreambleIndex INTEGER (0..63),
ra-PRACH-MaskIndex INTEGER (0..15)
5 MHz
CarrierBandwidthEUTRA ::= SEQUENCE {
dl-Bandwidth ENUMERATED { n6, n15, n25, n50, n75, n100}
ul-Bandwidth ENUMERATED {n6, n15, n25, n50, n75, n100}
CarrierFreqEUTRA ::=
dl-CarrierFreq
ul-CarrierFreq O
SecurityConfigHO ::=handoverType CHOICE {
intraLTE {
securityAlgorithmConfig O
keyChangeIndicator BOOLEAN,
nextHopChainingCount
},
interRAT {
securityAlgorithmConfig
nas-SecurityParamToEUTRA
93
7/2/2014
Handover Flow
11. UE synchronizes to target eNB (Check MAC protocol slides, CFRA
Handover Access) and accesses the target cell via RACH
- following a contention-free procedure (dedicated RACH preamble was
indicated in the mobility Control Information content of RRC
Connection Reconfiguration message)
- following a contention-based procedure if no dedicated preamble was
indicated. UE derives target eNB specific keys and configures the
selected security algorithms to be used in the target cell.
12. The target eNB responds with UL allocation and timing advance .
13. UE successfully accessed target cell UE confirms handover

sending
- RRC Connection Reconfiguration Complete message
- C-RNTI
- uplink Buffer Status Report (BSR), whenever possible
X2 Handover
S-GW MME

(Event A3)
3. HO
Decision
5.Admission
TRELOCprep Control
ACKNOWLEDGE
8. Start Data
forwarding
T304
Regenerate Data
16. S5 USER PLANE
18. S5 USER PLANE
UPDATE RSPONSE

21. Forward if any
and release
94
7/2/2014
14. Target eNB starts data transmission to UE Handover Flow

15. target eNB sends an S1: PATH SWITCH message to MME to inform
that the UE has changed cell.
Handover Flow
16. MME sends an UPDATE USER PLANE REQUEST message to the
Serving Gateway
17. Serving Gateway switches the downlink data path to the target side
S-GW sends one or more "end marker" packets on the old path to the
source eNB and then can release any U-plane/TNL resources towards
the source eNB .
18. Serving Gateway sends an UPDATE USER PLANE RESPONSE

message to MME.
19. MME confirms the PATH SWITCH message with the PATH SWITCH
ACKNOWLEDGE message.
95
7/2/2014
S1 Path Switch Request Acknowledge
X2 Handover
S-GW MME

(Event A3)
3. HO
Decision
5.Admission
TRELOCprep Control
ACKNOWLEDGE
8. Start Data
forwarding
T304
Regenerate Data
16. S5 USER PLANE
18. S5 USER PLANE
UPDATE RSPONSE

21. Forward if any
and release
96
7/2/2014
Handover Flow
20. Target eNB informs successful handover accomplishment of HO to
source eNB (sending UE CONTEXT RELEASE) this message
triggers the release of resources by the source eNB.
21. source eNB can release radio and C-plane related resources
associated to the UE context
Mobility Case – S1 Handover
S1 handover:
• Relocation of MME or
SGW
• Handover to UTRAN or
MME SGW MME SGW GSM
• Change of MME pool
area
Signalling is done via EPC
and does not assume the
existance of an X2
interface.
Similar to inter-RAT
handover
Forwarding of user data
either directly between
LTE NodeB
eNodeB or in-direct via S-
GW (Selective Forwarding)
97
7/2/2014
Handover Events
S1 Handover
S-GW S-GW MME MME
Source
Source eNB
eNB Target
Target eNB
eNB Source Target Source Target

(Event A3)
3. HO
Decision
4. S1 HANDOVER REQIRED
(Source to Target Transparent Container ) 5. S10 FORWARD RELOCATION
TS1RELOCprep REQUEST
6. S11 CREATE SESSION REQ/RES
7. S1 HANDOVER REQUEST
8. Admission
Control
9. S1 HANDOVER REQUEST ACKNOWLEDGE
10. S10 FORWARD RELOCATION
11. S11 CREATE BEARER REQ/RES RESPONSE
UP Forwarding
12. S1 HANDOVER COMMAND
13. RRC CONNECTION RECONFIGURATION
T304
(Handover Command,Measurement conf)
14 MAC: CFRA Random Access Preamble
Regenerate 15. MAC Random Access Response (UL allocation + TA)
Security Keys 16. RRC CONNECTION RECONFIGURATION COMPLETE
(Handover Confirm) 17. S1 HANDOVER NOTIFY
18.Data Transfer in Target
20. S1 UE CONTEXT RELEASE 19. S10 FORWARD RELOCATION

RRC
COMMAND COMPLETE/ ACK
CONNECTED
(Cause: Successful Handover)
98
7/2/2014
Exercises
Mobility Scenarios
Evolved Packet Core (EPC)
99
7/2/2014
EPS Interfaces
3GPP TS 23.401
EPC/LTE Architecture - 3GPP
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
100
7/2/2014
LTE/EPC Interfaces
S1: interface between an eNodeB and an EPC provides an
interconnection point between the EUTRAN and the EPC. It is also
considered as a reference point.
- S1-MME: Reference point for the control plane protocol between E-UTRAN
and MME.
- S1-UP : Reference point for the transport for data streams on the S1
interface between E-UTRAN and SGW using the GTP-U protocol
Interface between eNodeB ( X2) provides capability to support radio

interface mobility between eNodeBs, of UEs having a connection with E-
UTRAN.
X2 interface enables inter-connection of eNodeBs and support of
continuation between eNodeBs of the E-UTRAN services offered via the S1
interface
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
101
7/2/2014
LTE/EPC Interfaces
Interface between MME and HSS (S6a-interface) used to exchange data

related to the location of the mobile station and to the management of the
subscriber (capability to transfer packet data within the whole LTE service
area), using Diameter S6a/S6d Application signaling.
1. MME informs HSS about location of a mobile station managed by the latter.
2. HSS sends to the MME all the data needed to support the service to the
mobile subscriber.
Exchanges of data may occur when

- mobile subscriber requires a particular service,
- mobile subscriber wants to change some data attached to his subscription
- some parameters of the subscription are modified by administrative means.
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
102
7/2/2014
LTE/EPC Interfaces
Interface between MME and S-GW (S11-interface) used to support

mobility and bearer management between the MME and S-GW
Interface between MME and MME (S10-interface) used to support user

information transfer and MME relocation support between the MMEs
Interface between S-GW and PDN-GW (S5 and S8-interface)

interfaces between S-GW and PDN-GW, provides support for functions for
packet data services towards end users during roaming and non-roaming
cases (i.e. S8 is the inter PLMN variant of S5).
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
103
7/2/2014
LTE/EPC Interfaces
Interface between MME and SGSN (S3-interface) enables user and
bearer (DRB) information exchange for inter 3GPP access network mobility in
idle and/or active state
Interface between S-GW and SGSN (S4-interface) provides related
control and mobility support between GPRS Core and the 3GPP Anchor
function of Serving GW. In addition, if Direct Tunnel is not established, it
provides the user plane tunnelling
Interface between PCEF - PCRF/H-PCRF/V-PCRF (Gx Reference Point)
provides transfer of policy and charging rules from PCRF to Policy and
Charging Enforcement Function Point (PCEF) in the GW
Interface from PDN-GW to packet data networks (SGi reference point)
reference point between the PDN-GW and a packet data network. It may
be:
- operator external public or private packet data network or
- an intra operator packet data network, e.g. for provision of IMS services
Basic EPC Architecture

IMS
OFCS OCS External Rx
Gz Gy
IP networks
SGi
PCRF
S9
HSS
Gx Gxc
S6a
PDN GW
S5/S8
S11 Serv GW
MME
S10
S1-MME S1-U
eNB X2
LTE
104
7/2/2014
eNodeB – LTE Radio Base Station. Provide Wireless access to the

UE
MME – Mobility Management Entity. Management of subscription-

related data for each UE accessing over the LTE-RAN
HSS – Home Subscriber Server. User data repository for UEs

accessing over the LTE-RAN
Ser GW – Serving Gateway. In charge of user data traffic comming

from the UEs. Interfaces the eNodeBs
PDN GW – Packet Data Network Gateway. Anchor point to

interconnect external IP networks
PCRF – Policy and Charging Rules Function. Contains

policy control decision and flow-based charging control
functionalities.
OFCS – Offline Charging System. Post-processing of

CDRs.
OCS – Online Charging System. Real time charging.
105
7/2/2014
The EPC (SAE) Interfaces – S3
S3 Interface
IP networks
•enables user and bearer Gx
information exchange for inter PCRF
3GPP access network mobility
in idle and/or active state. HSS
SGi
•Based on Gn reference point HLR
as defined between SGSNs.
S6a
SAE GW
•Protocol: GTP-C Gr
PDN GW
S5
S4
S11 Serv GW
SGSN MME
S3
S10
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
S4 Interface
IP networks
• Provides related control and Gx
mobility support between PCRF
GPRS Core and the 3GPP
Anchor function of Serving GW HSS
SGi
• Is based on Gn reference HLR
point as defined between S6a
SGSN and GGSN. SAE GW
Gr
• In addition, if Direct Tunnel is PDN GW
not established, it provides the
user plane tunnelling. S5
S4
• Protocol: GTP-C / -U S11 Serv GW

SGSN MME
S3
S10
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
106
7/2/2014
The EPC (SAE) Interfaces – S5/S8
IP networks
Gx
PCRF
HSS
SGi
S5/S8 Interface
HLR
S6a • Provides user plane tunnelling and tunnel
SAE GW
Gr management between Serving GW and
PDN GW PDN GW.
S4
S5/S8 • Used for Serving GW relocation due to UE
mobility and if the Serving GW needs to
S11 Serv GW connect to a non-collocated PDN GW for
SGSN MME the required PDN connectivity.
S3
S10
• Protocol: GTP (or PMIPv6)
Gb Iu-C S12 • S5 is used in non-roaming scenario (i.e.

Serving GW and PDN GW in visited
S1-C S1-U
network)
• S8 is used in roaming scenario (i.e.

2G 3G LTE Serving GW in visited network and PDN
GW in home network).
The EPC (SAE) Interfaces – S6a
IP networks
S6a Interface Gx
PCRF
• Enables transfer of
subscription and authentication HSS
data for SGi
authenticating/authorizing user
access to the evolved system HLR
(AAA interface) between MME S6a
SAE GW
and HSS. Gr
PDN GW
• Protocol: Diameter.
S5
S4
S11 Serv GW
SGSN MME
S3
S10
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
107
7/2/2014
The EPC (SAE) Interfaces - Gx
IP networks
Gx
PCRF
HSS
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S4
S5 Gx Interface
S11 Serv GW
• provides transfer of (QoS) policy and
SGSN MME charging rules from PCRF to Policy and
S3
Charging Enforcement Function (PCEF) in
S10 the PDN GW.
Gb Iu-C S12 • Protocol: DIAMETER

S1-C S1-U
2G 3G LTE
IP networks
Gx
PCRF
HSS
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
S10 Interface
S11 Serv GW
SGSN MME • Reference point between MMEs for MME
S3
relocation and MME to MME information
S10 transfer.
Gb Iu-C S12 • Protocol: GTP-C

S1-C S1-U
2G 3G LTE
108
7/2/2014
IP networks
Gx
PCRF
HSS
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
S11 Interface
S11 Serv GW
SGSN MME • Reference point between MME and
S3
Serving GW.
S10
• Protocol: GTP-C
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
IP networks
Gx
PCRF
HSS
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
S12 Interface
S11 Serv GW
SGSN MME • Reference point between UTRAN and
S3
Serving GW for user plane tunnelling when
S10 Direct Tunnel is established.
Gb Iu-C S12 • Protocol: based on the Iu-u/Gn-u

S1-C S1-U reference point using the GTP-U protocol
as defined between SGSN and UTRAN
2G 3G LTE
109
7/2/2014
The EPC (SAE) Interfaces - SGi
IP networks
Gx
PCRF
HSS
SGi
HLR SGi Interface

S6a
SAE GW • Reference point between the PDN GW
Gr
PDN GW and the packet data network.
S5 • Packet data network may be an operator

S4
external public or private packet data
S11 Serv GW network or an intra operator packet data
SGSN network, e.g. for provision of IMS services.
S3
MME
• This reference point corresponds to Gi
S10 and Wi functionalities and supports any
3GPP and non-3GPP access systems
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
The EPC (SAE) Interfaces - SGs
IP networks
Gx
PCRF
S6a
HSS
SGi
HLR
SGs Interface
SAE GW
Gr
PDN GW • Reference point between the MME in EPC
network and MSC/VLR in circuit switch
nework (2G/3G).
SGs
MSC Serv GW
S11 • SCTP based interface.
SGSN MME
Iu S3
A
S10
Gb Iu-C S12
S1-C S1-U
2G 3G LTE
110
7/2/2014
EPC Core Protocols
IP networks
HLR/HSS
SGi
Gr S6a Rx
PDN GW Gx
S4
S5 PCRF
S3 S11
SGSN MME Serving
GW
S10
Gb Iu CP Iu UP
S1-U
S1-MME
BSC RNC Iur

eNodeB X2
BTS Node B
2G 3G LTE
111
7/2/2014

LTE Uu S1-MME
NAS NAS S11 S5/S8
Relay
RRC S1AP
L1 L1 L1 L1 L1 L1 L1
SCTP SCTP UDP UDP

IP IP IP IP
L2 L2 L2 L2
L1 L1 L1 L1

EPS User & Control Plane
112
7/2/2014
EPS User Plane Protocols

LTE Uu S1-U S5/S8 SGi
Application
IP IP
Relay Relay
PDCP GTP-U
PDCP GTP-U GTP-U GTP-U
RLC RLC UDP UDP UDP UDP
IP IP IP IP
L2
MAC MAC
L2 L2 L2 L2
L1 L1 L1
L1 L1 L1 L1
UE eNodeB X2* SGW PGW

GTP-U GTP-U
* X2 User plane used
UDP UDP
to support ‘Data
IP IP
forwarding at intra
L2 L2
LTE handover’
L1 L1
eNodeB eNodeB
S1 Protocol
113
7/2/2014
S1 Interface
Radio Control Plane User Plane

Network
Layer S1-AP User Plane
PDUs
Transport Transport Network Transport Network

Network User Plane User Plane
Layer
GTP-U
SCTP UDP
IP IP
Data link layer Data link layer
Physical layer Physical layer
S1 Interface
Two types of S1 interfaces are defined at the boundary depending on the

EPC access point:
S1-MME towards an MME
S1-U towards an S- GW.
There may be multiple S1-MME logical interfaces towards the EPC from
any one eNB. The selection of the S1-MME interface is then determined by
the NAS Node Selection Function.
There may be multiple S1-U logical interfaces towards the EPC from any
one eNB. The selection of the S1-U interface is done within the EPC and
signaled to the eNB by the MME.
114
7/2/2014
S1 Application Protocol (S1-AP)
S1-AP S1-AP
SCTP SCTP
IP IP
L2 L2
L1 L1
eNodeB S1-MME
MME
S1AP: eNBMME Signaling

•E-RAB Management
•Initial Context Transfer Function
•Common ID management
•UE Capability Info Indication Function
•Mobility Function for UEs in LTE_ACTIVE
•Paging
•S1 Interface Management Functions MME
•NAS signaling Transport between UE and MME

•S1 UE Context Release Function
•UE Context Modification Function
•Status Transfer
•Trace Function
•Location Reporting
•S1 CDMA 2000 Tunneling Function
•Warning Message Transmission Function
115
7/2/2014
S1-AP Functions
Initial Context Transfer function: This functionality is used to
- establish an S1-UE context in the eNB,
- to setup the default IP connectivity,
- to setup one or more E-RAB(s) if requested by the MME,
- transfer NAS signaling related information to the eNB if needed.
Signaling Flow
The E-RAB Modify procedure signal flow
List of RABs and corresponding
QoS Profile to be modified
aswell as an optional NAS
message per RAB
UE eNB MME
E-RAB MODIFY REQUEST
RRC: Connection Reconf.

Contains a list of all successfully
RRC: Connection Reconf. complete
modified RABs and possibly a
list of all RABs that failed to be
E-RAB MODIFY RESPONS modified
Includes the optional NAS

message ”Radio Modify Setup”
Note that this RRC procedure is
not always triggered
116
7/2/2014
S1-AP Functions
UE Capability Info Indication function: This functionality is used to

provide the UE Capability Info when received from the UE to the MME.
Mobility Functions for UEs in LTE_ACTIVE in order to enable a change

of eNBs within SAE/LTE (Inter MME/Serving S-GW Handovers) via the S1
interface (with EPC involvement).
Paging: This functionality provides the EPC with the capability to page the
UE.
S1-AP Functions
S1 interface management functions comprise the following:
-Reset functionality to ensure a well defined initialization on the S1
interface.
-Error Indication functionality to allow a proper error reporting/handling in
cases where no failure messages are defined.
-Overload function to indicate the load situation in the control plane of the
S1 interface.
-Load balancing function to ensure equally loaded MMEs within an MME
pool area.
-S1 Setup functionality for initial S1 interface setup for providing
configuration information.
- eNB and MME Configuration Update functions are to update application
level configuration data needed for the eNB and MME to interoperate
correctly on the S1 interface.
117
7/2/2014
S1-AP Functions
NAS Signaling transport function between the UE and the MME is
used:
- to transfer NAS signaling related information and to establish the S1 UE
context in the eNB.
- to transfer NAS signaling related information when the S1 UE context in
the eNB is already established.
S1 UE context Release function: This functionality is responsible for

managing the release of UE specific context in the eNB and the MME.
UE Context Modification function: This functionality allows modification
of the established UE Context in part.
Status Transfer: This functionality transfers PDCP SN Status information
from source eNB to target eNB in support of in-sequence delivery and
duplication avoidance at intra LTE handover.
S1-AP Functions
Trace function: This functionality is to control a trace recording for a UE in
ECM_CONNECTED.
Location Reporting: This functionality allows MME to be aware of the

UE’s current location.
S1 CDMA2000 Tunneling function: This functionality is used to carry

CDMA2000 signaling between UE and CDMA2000 RAT over the S1
Interface.
Warning message transmission function:

This functionality provides the means to start and overwrite the
broadcasting of warning message.
118
7/2/2014
S1AP Elementary Procedures, Class 1
119
7/2/2014
120
7/2/2014
X2 Interface
eNodeB Interfaces – X2
The interface between eNodeB
• Mainly used to support active mode UE
mobility
• May also be used for multi-cell Radio
Resource Management (RRM) functions
X2-CP interface will consist of a signalling
protocol called X2-AP on top of SCTP
The X2-UP interface is based on GTP-U
• The X2-UP interface will be used to
support loss-less mobility (packet
forwarding). MME/GW
The X2 interface is a many-to-many interface.
S1 S1 S1
X2 X2
eNode B eNode B eNode B
121
7/2/2014
X2 Protocol Model
Radio Control Plane User Plane

Network
Layer X2-AP User Plane
PDUs
Transport Transport Network Transport Network

Network User Plane User Plane
Layer
GTP-U
SCTP UDP
IP IP
Data link layer Data link layer
Physical layer Physical layer
X2AP: eNBeNB Signaling
Mobility Management
Load Management
Reporting of General Error Situations
Resetting the X2
Setting up the X2
eNodeB Configuration Update
122
7/2/2014
X2AP Functions
Intra LTE-Access-System mobility support for ECM-

CONNECTED UE
allows the eNB to handover the control of a certain UE to another eNB.
Context transfer from source eNB to target eNB

allows the transferring of information required to maintain the E-UTRAN
services for an UE in ECM-CONNECTED from source to target eNB.
Control of user plane transport bearers: source eNB -

target eNB
allows the establishing and releasing unique transport bearers between
source and target eNB during DL/UL data forwarding phases.
Handover cancellation
informs already prepared target eNB for a canceled pre-decided handover
execution releases resources allocated during preparation phase
X2AP Functions
UE context release in source eNB

allows target eNB to trigger release of UE allocated resources
in source eNB.
Load Management
allows exchanging overload and traffic load information
between eNBs for traffic load management. (according to
3GPP information may be spontaneously sent to selected
neighbor eNBs or reported as configured by a neighbor
eNB).
Inter-cell interference coordination (Feature)

allows keeping inter-cell interference under control
neighboring eNBs exchange appropriate information
allowing eNBs assign resources (PRB) to control
interference.
123
7/2/2014
X2AP Functions
Uplink interference load management

indicates uplink interference overload and resource blocks
especially sensitive to inter-cell interference between
neighboring eNBs leads to Neighbor eNBs resource
allocation co-ordination to mutually mitigate interference
caused by their uplink radio resource allocations.
Downlink interference avoidance

allows eNB to inform its neighbors about downlink power
restrictions in its own cells, per resource block, for
interference aware scheduling by the neighbor eNBs.
General X2 management and error handling functions

allow management of signaling associations between eNBs,
surveying X2 interface and recovering from errors.
X2AP Functions
Error indication
allows reporting of general error situations on application level.
Reset
allows eNB1 to inform X2 neighbor eNB2 about:
- recovering from an abnormal failure
- all contexts related to eNB1 and stored in eNB2 shall be
deleted, and the associated resources released.
Trace functions
UE trace recoding sessions on E-UTRAN interfaces initiated by
EPC. The trace initiation information is also propagated to
the Target eNB during handover, attached to certain
handover messages on X2.
Application level data exchange between eNBs

allows eNBs to exchange application level data during setting
up X2 connection and update this information any time.
124
7/2/2014
X2AP Elementary Procedures, Class 1
X2AP Elementary Procedures, Class 2
125
7/2/2014
SCTP
SCTP
SCTP (Stream Control Transmission Protocol) can be
used as the transport protocol for applications where
monitoring and detection of loss of session is required.
It is according to IETF RFC2960 and IETF RCF3309.
Used by S1-AP, X2-AP and Diameter (S6a, S10, Gx

and Rx)
126
7/2/2014
SCTP
SCTP is a transport layer protocol that provides
reliable, in-sequence transport of messages with
congestion control mechanisms.
SCTP is also a connection-oriented protocol that

maintains a relationship between the end points of an
SCTP association for the duration of the message
transmission.
SCTP is designed to transport telecommunications

signaling messages over Internet Protocol (IP)
networks.
SCTP Concepts
Primary destination IP5

PORT PORT
2905 2905
IP4,IP5,
IP6,IP7
IP1,IP2,IP3
Primary destination IP1
Message (sequenced delivery)

IP1,IP2 PORT SCTP
2905
Inbound/outbound stream endpoint
SCTP Association
127
7/2/2014
SCTP Terminology
SCTP Association: An SCTP association is a logical connection
between two SCTP end points.
SCTP End Point: An SCTP End Point is the logical sender and
receiver of SCTP packets.
Heartbeat: The heartbeat is an SCTP message sent on an SCTP

association to monitor the availability of the paths to the remote
addresses of the SCTP association.
Stream: A stream is a sequence of user messages within a single

SCTP association.
Multi Homing: An SCTP association is multi homed if it supports

multiple IP addresses or interfaces at a given SCTP end point.
SCTP Terminology
Primary and Secondary Addresses: A multi homed

SCTP association has one primary address that is used
for receiving data.
remaining supported addresses are secondary

addresses that are spare addresses for the event the
primary address becomes unreachable.
SCTP does not support load sharing between the

multiple addresses of an SCTP association.
128
7/2/2014
SCTP Terminology
SCTP Client and Server: SCTP is used for both client
and server applications in the SGSN-MME.
Example: SGSN-MME acts as an SCTP server when

communicating with the eNodeB SCTP clients over the
S1-MME interface, whereas the SGSN-MME acts as an
SCTP client when communicating with Home Subscriber
Server (HSS) over the S6a interface.
SCTP datagram: The unit of data that constitutes an

SCTP message. Each datagram consists of a common
header followed by one or more chunks. Each chunk
may contain either user data or SCTP control
information. There are a limited set of chunk types
defined in SCTP.
SCTP – Singe-Homed to Multi-

Homed SCTP End Point
129
7/2/2014
SCTP - Multi-Homed SCTP End Point
SCTP Services
SCTP offers the following services to its users:
- Acknowledged error-free non-duplicated transfer of user data
- Data fragmentation to conform to configured Maximum Transmission Unit

(MTU) size
- Sequenced delivery of user messages within multiple streams, with an

option for order-of-arrival delivery of individual user messages
- Optional bundling of multiple user messages into a single SCTP packet
- Network-level fault tolerance through support of multi-homing at either end

or at both ends of an association
130
7/2/2014
SCTP Procedure for Initializing an Association

SCTP uses the heartbeat mechanism to avoid half-open states (one end of
a connection has closed without the knowledge of the other end point).
Heartbeat mechanism: sending a heartbeat message to the inactive remote
addresses of the host. The SCTP user can choose the set of addresses on
which the heartbeat mechanism is to be performed.
Association Establishment
- initiated by the SCTP client sending a datagram with a INIT chunk.
- state cookie sent from SCTP server to SCTP client as part of the INIT ACK
chunk.
- SCTP client returns the received state cookie by sending a datagram with a
COOKIE ECHO chunk to the SCTP server.
-SCTP server can now safely create the server side of the association and
finalize the four-way handshake by sending a datagram with a COOKIE ACK
chunk to the SCTP client that creates the client side of the association.
SCTP Procedure for Initializing an Association

basic service offered by SCTP is the reliable transfer of user messages
between peer SCTP users.
SCTP performs this service using an association between two SCTP end
points SCTP Node 1
SCTP Node 2
Communication UP
Create Association Communication UP (assocID)
(destination, # stream) (assocID)
SCTP entity
SCTP entity
INIT PortID
PortID
INIT ACK
COOKIE ECHO
SCTP SCTP
IP1,IP2 COOKIE ACK IP3,IP4,IP5
IP R IP R
IP Network
IP R
IP R
IP R
131
7/2/2014
SCTP Message Types

CHUNK TYPES:
ID value Chunk type (SCTP message name)
0 Payload data (DATA)
1 Initiation (INIT)
2 Initiation Acknowledgement (INIT ACK)
3 Selective Acknowledgement (SACK)
4 Heartbeat Request (HEARTBEAT)
5 Heartbeat Acknowledge (HEARTBEAT ACK)
6 Abort (ABORT)
7 Shutdown (SHUTDOWN)
8 Shutdown Acknowledgement (SHUTDOWN ACK)
9 Operation error (ERROR)
10 State Cookie (COOKIE ECHO)
11 Cookie Acknowledgement (COOKIE ACK)
12 Reserved for Explicit Congestion Notification Echo (ECNE)
13 Reserved for Congestion Window Reduced (CWR)
14 Shutdown Complete (SHUTDOWN COMPLETE)
15- 255 Reserved by IETF for future expansion of the protocol
SCTP Message Structure
Source Port Destination Port SCTP

Verification Tag Common
Check Sum Header
Type Flags Length

CHUNK 1
User Data
Type Flags Length

CHUNK 1
User Data
Type Flags Length

CHUNK n
User Data
132
7/2/2014
SCTP Payload Data
Type=0 Reserved U|B|E Chunk Length
TSN
Stream identifier S Stream Sequence number N
Payload protocol identifier
User data ( Sequence N of stream S)
NAS
133
7/2/2014
NAS
NAS NAS
Relay
RRC S1-AP
RRC S1-AP
PDCP PDCP SCTP SCTP
RLC RLC IP IP
MAC MAC L2 L2
L1 L1 L1 L1
LTE-Uu S1-MME
UE eNodeB MME
NAS Functions
NAS protocol supports
- mobility management functionality

- user plane bearer activation, modification and deactivation.
- ciphering and integrity protection of NAS signaling.
Attach: The Attach procedure is initiated by the UE to announce its

presence in the network. On completion, the UE is in the EMM-
REGISTERED state.
UE Requested PDN Connectivity Procedure: PDN Connectivity

Request procedure is used by the UE during an attach to request
the setup of a default EPS bearer to a PDN.
134
7/2/2014
NAS Functions
Authentication: The EPS authentication procedure provides mutual
authentication between the user and the network. For an EPS
subscriber authentication information is collected (if needed) from
the HSS and verified during the Authentication procedure. The
procedure is always initiated and controlled by the network.
TAU: The Periodic TAU procedure is used by the UE to notify the

network about its existence and to show that it is functioning
properly.

Service Request: The Service Request procedure is used to
change the state of the MM context to ECM-CONNECTED, to allow
the UE to send or receive desired data.
Detach: The Detach procedure is used to detach the UE from the

network. It is initiated by the UE or the network. On completion of the
Detach procedure, the UE is in the EMM-DEREGISTERED state
and cannot send and receive data.
SG Application Part
135
7/2/2014
SGs AP
SGs Application Part (SGsAP) protocol sends messages over the SGs
interface.
SCTP supports transferring of the SGsAP signaling messages.
SG AP Protocol
Summary SGsAP procedures over the SGs interfaces (3GPP TS 29.118):
Paging for Non-EPS Services Procedure

used by MSC/VLR to send paging request to the SGSN-MME. Paging is
only supported when the Service indicator IE indicates "SMS indicator".
Other paging requests are rejected.
Location Update for Non-EPS Services Procedure

used by SGSN-MME to initiated location update procedure towards the
Home Subscriber Server (HSS). The procedure is triggered by a
combined attach request or a combined tracking area update request from
the User Equipment (UE).
Non-EPS Alert Procedure

used by the MSC/VLR to request an indication from the SGSN-MME when
any signaling activity from the UE is detected.
136
7/2/2014
SG AP Protocol
Explicit IMSI Detach from EPS Services

This procedure used by the SGSN-MME to indicate to the
MSC/VLR that the UE has been detached from EPS
services. The SGs association between the MSC/VLR and
the SGSN-MME is deactivated for the UE.
Explicit IMSI Detach from Non-EPS Services

This procedure is used by the SGSN-MME to indicate to the
MSC/VLR that the UE has performed IMSI detach from the
non-EPS services.
SGs association between the MSC/VLR and the SGSN-
MME is deactivated for the UE.
SG AP Protocol
Implicit IMSI Detach from Non-EPS Services

used by SGSN-MME to indicate when an internal SGSN-
MME timer mechanism has caused the SGSN-MME to
delete EPS Mobility Management (EMM) context of a UE.
VLR Failure Procedure

used by MSC/VLR to inform the associated MMEs about a
restart, and that the SGs associations are no longer reliable
because the MSC/VLR has lost information about the state
of the UEs and during the failure the MSC/VLR might have
missed signaling messages.
137
7/2/2014
GTP – GPRS Tunneling Protocol
What is Tunneling in Networks?

Network use a tunneling protocol when one
network protocol (usually the delivery
protocol should encapsulate a different payload
protocol for:
- carrying a payload over an incompatible delivery-
network,
- provide a secure path through an untrusted
network.
Notice that typically, delivery protocol could

operate at an equal or higher OSI layer in the
model than does the payload protocol.
138
7/2/2014
GTP
GPRS Tunneling Protocol (GTP) is the protocol between GSN nodes in
the GPRS backbone network. Includes both the GTP signaling (GTP-C)
and data (GTP-U) transfer procedures.
In EPC it will be used on S1-U,S10,S11,S4,S5/S8 and S3.
Always in a connection there is a user-plane connection (S1-U, X2-U)

that requires a GTP-U (User payload) tunnel across the EPC Backbone
Network and a GTP-C (Control Signaling) tunnel.
GTP packets use the User Datagram Protocol (UDP) as the transport
protocol. Both signaling and payload are carried on the same ports. The
GTP packets contain a “message type” field that allows the GTP
protocol to distinguish signaling from payload.
GTP – GPRS Tunneling Protocol

GTP GTP I/F GTP
Node A Node B
TEID=yyy
Destination Port:
GTP TEID=xxx GTP TUNNEL GTP
GTPv2-C=2123 UDP UDP

GTPv1-U=2152 IP Address = AAA
IP IP
Protocol ID:
UDP=17 L1/L2 IP Address = BBB L1/L2
GTP TUNNEL
Identified in each node by:
[TEID, IP-addr, Port number]
UTRAN S12
S16 All interfaces are GTPv2-
C only, except:
S4
SGSN S1-U, S12, X2
MSC
(only GTPv1-U)
Server
Sv S3 S4, S5/S8 (both)
HRPD
CDMA S101 MME S11
2000 PDSN
S10
X2 S1-U SGW S5/S8 PGW
HRPD High Rate Packet Data GTP GPRS Tunneling Protocol

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525 PDSN Packet Data Serving Node TEID Tunnel Endpoint Identifier
139
7/2/2014
What is TEID in GTP??

GPRS tunneling protocol (GTP) stack assigns a unique tunnel endpoint
identifier (TEID) to each GTP control connection to the peers.
GTP stack also assigns a unique TEID to each GTP user connection
(bearer) to the peers. The TEID is a 32-bit number field in the GTP
(GTP-C or GTP-U) packet
GTP
GTP tunnel is uniquely identified in a given node by the combination of:
IP-addresses + UDP port number + Tunnel Endpoint Identifier

(TEID)
Tunnel is bi-directional two TEIDs, one in each end
GTP-U user plane (S1-U, X2-U), there is a one-to-one relationship

between a tunnel and a bearer there may be multiple user plane
tunnels associated with a given UE.
GTP-C control plane (S10, S11, S4, S5/S8 S3) there always one tunnel
associated with a given UE between two nodes.
140
7/2/2014
GPRS Tunnelling Protocol (GTP-U)

User Plane:
Application
IP IP
Relay Relay
PDCP GTP-U
PDCP GTP-U GTP-U
GTP-U
RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
MAC MAC L2 L2 L2 L2
L1 L1 L1 L1 L1 L1
LTE-Uu S1-U S5/S8 SGi

a
UE eNodeB Serving GW PDN GW
GTP-U is indeed a framing protocol which allows multi-protocol packets to be tunneled

through the EPC Backbone to provide a service for carrying user data packets .
GTP-C Protocol Stack
GTP GTP
UDP UDP
IP IP
L2 L2
L1 L1
GTPv2 entit y GTPv2 entity

GTPv2 based
interface
141
7/2/2014
GTP-C v2: MMESGW PGW

Signaling
MME PGW
•Path Management
•Tunnel Management
•Mobility Management
•CS Fallback and SRVCC related msgs
•Non 3GPP related msgs
MME
SGW
GTP Message Types

Path Management
142
7/2/2014
Path Management Messages
Echo Request
Echo Response
MME PGW
ECHO Response
ECHO Request
ECHO Response
ECHO Request
T3-RESPONSE
T3-RESPONSE ECHO Request
N3-REQUESTS
MME ECHO Response SGW/
N3-REQUESTS
T3-RESPONSE
N3-REQUESTS
GTP-C v2: MMESGW PGW

Signaling
Session Creation: PGW
•E-UTRAN Initial Attach

Create Session Request (QoS)
•UE requested PDN connectivity
S5/S8
GTP-C is also used to convey:
-Tracking Area Update procedure with Serving GW change
-S1/X2-based handover with SGW change
-UTRAN Iu mode to E-UTRAN Inter RAT handover with SGW change
S11
MME -GERAN A/Gb mode to E-UTRAN Inter RAT handover with SGW change
SGW
-3G Gn/Gp SGSN to MME
Create combined
Session Requesthard handover and SRNS relocation
(QoS)
procedure
-Gn/Gp SGSN to MME Tracking Area Update procedure
143
7/2/2014
TS 29.274 GTP-C MME SGWPGW

Message Type value Message GTP-C
(Decimal)
SGSN/MME to PGW (S4/S11, S5/S8)
32 Create Session Request X
33 Create Session Response X
34 Modify Bearer Request X
35 Modify Bearer Response X
36 Delete Session Request X
37 Delete Session Response X
EPC Geographical Parameters
144
7/2/2014
Network Structure
Geographical Parameters
Tracking Area
A Tracking Area (TA) is a geographical domain that

consists of one or more cells.
Size of a TA can range from a part of a city to an entire

province.
TA can be covered by one or multiple MMEs, if MME pool

is used.
UE can move between different TAs within the MME area

without having to change MME.
Network Structure
Tracking Area
All TAs served by the same MME (TAs UE could enter

without initiation a Tracking Area Update (TAU)
procedure) are listed in a Tracking Area Identity (TAI) list.
When the UE leaves the TAI list coverage area it has to

initiate the TAU procedure.
Tracking Area Identity is constructed from the MCC

(Mobile Country Code), MNC (Mobile Network Code) and
TAC (Tracking Area Code)
145
7/2/2014
Network Structure
Tracking Area
A sub domain name shall be derived from the MNC and

MCC by adding the label "tac" to the beginning of the
Home Network Realm/Domain
The TAI FQDN shall be constructed as:
tac-lb<TAC-low-byte>.tac-hb<TAC-high-
byte>.tac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
The TAC is a 16 bit integer. <TAC-high-byte> is the
hexadecimal string of the most significant byte in the TAC
and <TAC-low-byte > is the hexadecimal string of the
least significant byte. If there are less than 2 significant
digits in <TAC-high-byte> or <TAC-low-byte >, "0" digit(s)
shall be inserted at the left side to fill the 2 digit coding.
Tracking Area - Multiple Tracking Areas

1. UE belongs to TA1, TA3 and TA2.
UE’s belong to multiple TA The UE can move within TA1, TA2 and TA3
without TA update.
2. The UE will perform a TA update when

moving to a cell withinTA4.
TA1
3. After succesful TA update in TA4 the UE will
belong to TA2, TA3 and TA4
TA2
MME
TA3 TA list 1: TA list 2: ..........

- TA1 - TA2
TA4 - TA2 - TA3
- TA3 - TA4
146
7/2/2014
Network Structure
MME Pool Area – 3GPP optional feature
An area where the UE is served without having to change the serving
MME. An MME pool area is served by one or more MMEs working in
parallel in a pool constellation. MME pool areas are a collection of
complete TAs
MME pool is a group of MMEs that serve a number of eNodeBs.

Each MME in a pool serves the same pool service area or pool
service areas, and the eNodeBs in the respective pool service area
are connected to each of the MMEs in the pool.
A pool service area consists of several TAs served by eNodeBs. As

long as a UE remains in the pool service area, it is attached to a
specific MME. If the MME is unavailable, the eNodeB reroutes the
signalling for the attached UE to another MME in the pool.
MME Pool Area

Pool Service Area MMEs in Pool
147
7/2/2014
Network Structure
MME Pool Area – Planning hints
MME pool service area should be generally larger than a
single MME service area thus network experiences
fewer Inter-MME Tracking Area Update (TAU) procedures
and reduced signaling to the Home Subscriber Server
(HSS) and the Serving Gateway.
Increase the pool capacity add more MMEs to the

pool area connected to all eNodeBs in the pool service
area loadsharing algorithms will distribute eNodeBs
traffic to the new MMEs.
Network Structure
SGW Service Area
An area where the UE is served without having to change

SGWs.
SGW service area is served by one or more SGWs in

parallel.
SGW service areas are a collection of complete TAs.
SGWs service areas may overlap each other.
148
7/2/2014
SGW Service Area

Before: S+P-GW
After: P-GW only
S-GW
MME
MME S10
MME
MME
MME
MME MME
MME
IP PoP MME MME
PGW
S5
SGW SGW SGW SGW SGW SGW SGW SGW
1 2
SGW Service area is an area where the UE is served without having

to change SGW
MME/SGW relocation occurs primarily only when moving between
MME Pool Areas/SGW service area.
The IP Point of Presence (IP PoP) is fixed in the originally selected
PDN GW
EPC Identities
149
7/2/2014
E-UTRAN Identities - Overview

Inside E-UTRAN environment a general protocol id shall
uniquely identify a logical connection associated to a UE
over the S1 (MME) interface or X2 (eNodeB) interface.
These id’s are used during signalling message interactions.
Example: Receiving a setup new message containing a

new id from sending node, receiving node shall store the AP
ID of the sending node for the duration of the logical
connection Receiving node shall assign the allocated id
as a logical connection identification in the first returned
message to the sending node.

eNB UE S1AP ID:
shall be allocated to uniquely identify the UE over the S1

interface within an eNB.
Example:
- When MME receives an eNB UE S1AP ID it shall store it
for the duration of the UE-associated logical S1-
connection for this UE.
- Once known to an MME this IE is included in all UE
associated S1-AP signaling.
- Remember: eNB UE S1AP ID is unique within the eNB
logical node.
150
7/2/2014

MME UE S1AP ID:
shall be allocated so as to uniquely identify the UE over the
S1 interface within the MME.
Example:
- When an eNB receives MME UE S1AP ID it shall store it
for the duration of the UE-associated logical S1-
connection for this UE.
- Once known to an eNB this IE is included in all UE
associated S1-AP signaling.
- Remember: MME UE S1AP ID is unique within the MME
logical node.

Old eNB UE X2AP ID:
Old eNB UE X2AP ID shall be allocated so as to uniquely

identify the UE over the X2 interface within a source eNB.
Example:
- When a target eNB receives an Old eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to a target eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: Old eNB UE X2AP ID is unique within the
eNB logical node.
151
7/2/2014

New eNB UE X2AP ID:
shall be allocated so as to uniquely identify the UE over the

X2 interface within a target eNB.
Example:
- When a source eNB receives a New eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to source eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: New eNB UE X2AP ID shall be unique within
the eNB logical node.

eNB1 Measurement ID:
shall be allocated so as to uniquely identify the

measurement configuration over the X2 interface within
the eNB that requests the measurement.
The eNB1 Measurement ID shall be unique within the eNB

logical node.
152
7/2/2014

eNB2 Measurement ID:
shall be allocated so as to uniquely identify the

measurement configuration over the X2 interface within
the eNB that performs the measurement.
eNB2 Measurement ID shall be unique within the eNB

logical node.
EPC PLMN Identity - GUTI

Globally Unique Temporary UE Identity (GUTI)
The purpose of the GUTI is
- to provide an unambiguous identification of the UE that

does not reveal the UE or the user's permanent identity in
the Evolved Packet System (EPS).
- To allow the identification of the MME and network.
Example: Since Attach, TAU and Service Request signaling

is sent non-ciphered, a temporary identity, GUTI or S-
TMSI, is used instead of IMSI in most cases.
153
7/2/2014
Identity - GUTI
Globally Unique Temporary UE Identity (GUTI)
A new GUTI will always be allocated at UE Attach
In 2G/3G networks P-TMSI is used which is locally (national-wide)

unique.
GUTI is globally unique No GUTI collisions can occur due to inter

MME roaming.
GUTI and P-TMSI have no relation to each other

Example: when UE moves from 3G to LTE, a new GUTI is allocated by
the MME independent on the existing 3G allocated P-TMSI + old P-
TMSI is sent to the MME as if it was a GUTI
Identity - GUTI
GUTI Structure
GUTI has two main components:
- one that uniquely identifies the MME which allocated the

GUTI known as GUMMEI
- one that uniquely identifies the UE within the MME that

allocated the GUTI known as M-TMSI
154
7/2/2014
Identity - GUTI
GUTI Structure
Globally Unique MME Identifier <GUMMEI> = <MCC> + <MNC> + <MMEI>.

where <MMEI> = (MME Group ID <MMEGI>) + (MME Code <MMEC>).
<GUTI> = <GUMMEI> + <M-TMSI>.
Attach – TAU signaling UE leaves a pool service area (Attach or TAU)

to a new MME outside the pool service area target MME extracts
GUMMEI of serving MME from UE GUTI.
New (target) MME uses this GUMMEI to query the DNS for the address of
the serving (old) MME and fetches the UE context from the old MME.
Identity - GUTI
GUTI Structure- Hints
Paging purposes: mobile is always paged with the S-TMSI S-TMSI
shall be constructed from the MMEC and the M-TMSI.
<S-TMSI> = <MMEC> + <M-TMSI>
The operator shall need to ensure that the MMEC is unique within the
MME pool area and, if overlapping pool areas are in use, unique within
the area of overlapping MME pools.
The GUTI shall be used to support subscriber identity confidentiality, and,

in the shortened S-TMSI form, to enable more efficient radio signalling
procedures (e.g. paging and Service Request).
155
7/2/2014
GUTI, S-TMSI
GUTI
MCC / MNC MMEGI MMEC M-TMSI
(3) (2) (1) (4)
MMEI
GUMMEI
S-TMSI
MMEC M-TMSI
(1) (4)
GUTI provides unique identification of the UE that does not reveal

the UE or the user's permanent identity
Mobile is paged with the S-TMSI
EPC PLMN Identity

Globally eNodeB id
used to globally identify an eNodeB
E-UTRAN Cell Global Identifier – ECGI id
used to globally identify a cell
E-RAB ID
uniquely identifies an E-RAB for one UE accessing via E-UTRAN.
156
7/2/2014
Identities
Not more than 15 digits
3 digits 2 or 3
MCC MNC MSIN

NMSI
IMSI
› Mobile Country Code (MCC) .

› Mobile Network Code (MNC).
› Mobile Subscriber Identification Number (MSIN)
Identities
Country Code. National Destination Code . Subscriber

Number
CC NDC SN
National (significant)
mobile number
Mobile station international
ISDN number
157
7/2/2014
Identities
eNodeB S1-AP UE Identity (eNB S1-AP UE ID)
• This is the temporary identity used to identify a UE on
the S1-MME reference point within the eNodeB. It is
unique within the eNodeB.
MME S1-AP UE Identity (MME S1-AP UE ID)

• This is the temporary identity used to identify a UE on
the S1-MME reference point within the MME. It is unique
within the MME.
Case Studies
EPC Mobility Cases
To be discussed in class …
158
7/2/2014
Thank You!
Please take a moment

to complete the evaluation forms
provided by the instructor.
. . . . . . . . . .
Thank you for participating
in this class. See you in
the next class!
. . . . . . . . . .
Eogogics Inc. provides technical and soft-skills training and consulting services
to businesses and government clients in the US and abroad. The Eogogics
principals include seasoned executives who have been involved with exciting,
landmark projects. Our courses are developed by industry veterans with 15+
years’ experience. They are taught by instructors who are among the most
knowledgeable, experienced, and dynamic available anywhere today.
Eogogics Inc.
www.eogogics.com or www.gogics.com
Phone: +1-703-281-3525, 1 (888) 364-6442 toll free in the US * Email: sales@eogogics.com
159

LTE EPC Signaling

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LTE EPC Signaling

Uploaded by

Copyright:

Available Formats

7/2/2014

Knowledge That Powers Organizations!

LTE/EPC Signaling Course

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Learn Technologies from the Team That

Our Skill Set

www.eogogics.com, www.gogics.com, sales@eogogics.com, +1 703 281-3525, 1 (888) 364-6442

© Copyright 2014, Eogogics Inc.

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

• LTE Advanced System Techniques – LTE ADV 4 days

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

LTE/EPC 3GPP Standards

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Mobile Systems Evolution

cdmaOne CDMA2000 CDMA2000 EV/DO EV/DO

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving forces for LTE/EPC

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving forces for LTE/EPC

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving Forces for LTE/EPC

Better integration with other open

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

GGSN GGSN P+S-GW

User plane User plane directly

NodeB NodeB eNodeB

2000 2007 2009/10

SAE/LTE Releases: Evolution Steps

- Mobile Management Entity (MME)

- Home Subscriber Server (HSS)

- Policy and Charging Rules Function (PCRF)

- Serving Gateway (SGW)

- Packet Data Network Gateway (PGW)

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

SAE/LTE Release 8 Evolution Steps

Moving all RNC functions to the Node B …

P-GW PDN GateWay

SGSN (not user plane MME Mobility Management Entity

Node B / HSPA eNodeB

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

3GPP Project Coordination Group (PCG)

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

3GPP LTE and SAE Work Items

TSG RAN LTE

33.401 – System Architecture Evolution (SAE);

All specifications can be found on the

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

• Functionality (Core Network)

• between nodes Network)

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

EPS Overview Architecture

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Radio Bearer control,

© Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Evolved Packet System (EPS) &

Control Plane PGW: Packet Data Network Gateway

Gx EPC: Evolved Packet Core

VLR: Visitor Location Register

X2 MME: Mobility Management Entity

GSM/WCDMA/LTE Architecture - 3GPP

BSC RNC Iur