LTE Basic Signaling Procedure: Security Level

4/3/17 Security Level:
LTE Basic Signaling

Procedure
www.huawei.com
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

System Information
Attach Procedure
Paging Procedure
Handover Procedure

System Information Reception
Process
Why is the system information reception procedure
required ?
The UE configures each layers parameters based on the
parameter settings in the system information received on the

RRC layer before requesting network camping and admission.
What information does the system information contain ?
One master information block (MIB) and 13 system
information blocks (SIBs), including UE parameters set by the

eNodeB.
How is the system information received ?

The figure in the right shows procedure the
system information is received.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page3

MIB Mapping & Delivery
MIB introduction

Carried by BCCH->BCH-
>PBCH
Deliver very basic system
information, including MIB block
system frame number
DL bandwidth Coded block
PHICH configuration
Broadcast period: 40ms
Radio
4
frame
symbols
1 2 3 4 5 6 0 1 2 3 4 5 6
SSS PSS PBCH

40ms PBCH TTI
PBCH Location(FDD)

MIB Mapping & Delivery
MIB introduction

Carried by BCCH->BCH-
>PBCH
Deliver very basic system
MIB block
information, including
system frame number
DL bandwidth Coded block
PHICH configuration
Broadcast period: 40ms
Radio
4
frame
symbols
0 1 2 3 4 5 6 0 1 2 3 4 5 6 0 1 2
PBCH SSS PSS
40ms PBCH TTI
PBCH Location(TDD)

SIB Information
Type Contents
Cell selection and camp related parameters SI period for
SIB1
other SIBs
Common physical channel configuration, UE timer, uplink
SIB2
bandwidth
SIB3 Common parameters for cell reselection
Intra-frequency neighbor list; Neighbor reselection parameters;
SIB4
Neighbor black list
Inter-frequency list and corresponding cell reselection
parameters
SIB5 Inter-frequency neighbor list and corresponding cell reselection
parameters
Inter-frequency black list
SI
SIB6 UMTS frequency list
SIB7 GSM frequency list
SIB8 CDMA2000 frequency list and neighbor list
SIB9 Home eNodeB information
ETWS(Earthquake and Tsunami Warning System) primary
SIB10
notification
SIB11 ETWS secondary notification
SIB12 CMAS(Commercial Mobile Alert System) notification
HUAWEISIB13 MBMS(Multimedia
TECHNOLOGIES CO., LTD. Broadcast Multicast Service)
Huawei Confidential control
Page6
information
SIB Mapping & Delivery
SIBs are mapping on BCCH->DL-SCH-> PDSCH:
SIB1 and SIB2 are mandatory, and others are optional.
Period of SIBs
SIB1: 80ms
From SIB2 to SIB8, SIB10 and SIB11: It is a flexible period, with
80,160,320,640, 1280,2560 and 5120ms.

SIB
1
System Message Tracing Cases
MCC:460
MNC:01
TAC:21
SI Cell ID:7B8FF00
MIB Cell is not barred
Intra-freq
Reselection is
allowed
-128dBm(-64*2=-
128)
Frequency Band 7
List of the SIBs

mapped to this
SystemInformation
message.There is
no mapping
information of
SIB2;

System Information
Attach Procedure
Paging Procedure
Handover Procedure

Attachment Introduction
Function of attachment
The UE registers to the EPC.
During network attach, a default EPS bearer is established
for always-online IP connectivity.
The MME and UE construct the MM context and EPS bearer
context for the UE.
The S-GW and P-GW construct the EPS bearer context for
the UE.
The default bearer is established between the UE and the P-
GW, and the UE obtains the IP address from the P-GW.

Bearer Service Architecture
-A data radio bearer transports the packets of an EPS bearer between a UE
and an eNB. When a data radio bearer exists, there is a one-to-one mapping
between this data radio bearer and the EPS bearer/E-RAB.
An S1 bearer transports the packets of an E-RAB between an eNodeB and a
Serving GW.
An eNB stores a one-to-one
mapping between a data

radio bearer and an S1
bearer to create the binding
between a data radio bearer
and an S1 bearer in both
the uplink and downlink.
3GPP 36.300
EPS Bearer Service Architecture(from 3GPP36.300)

Page 11
EUTRAN Identities
EPS Bearer ID / E-RAB ID
The value of the E-RAB ID used at S1 and X2 interfaces to identify an E-RAB
allocated to the UE is the same as the EPS Bearer ID value used at the Uu
interface to identify the associated EPS Bearer.
eNB UE S1AP ID
eNB UE S1AP ID This is the temporary identity used to identify a UE on
the S1-MME reference point within the eNodeB. It is unique within the
eNodeB.
MME UE S1AP ID
MME UE S1AP ID This is the temporary identity used to identify a UE on
the S1-MME reference point within the MME. It is unique within the MME.
eNB UE X2AP ID
This information element uniquely identifies an UE over the X2 interface
within an eNB.
The Old eNB UE X2AP ID is allocated by the source eNB and the New eNB
UE X2AP ID is allocated by the target eNB;
C-RNTI
C-RNTI: unique identification used for identifying RRC Connection and
scheduling;

Page 12
SRB
"Signalling Radio Bearers" (SRBs) are defined as Radio Bearers (RB)
that are used only for the transmission of RRC and NAS messages.
More specifically, the following three SRBs are defined: (3GPP 36.331
4.2.2)
Radio Bearer
(RB)
SRB DRB
SRB0 SRB1 SRB2

(CCCH) (DCCH) (DCCH
Bears RRC Bears RRC signaling (that Bears NAS

signaling before may include NAS signaling signaling.
the RRC messages) and NAS SRB2 is set up
connection is set signaling transmitted before after AS
up. SRB2 is set up. encryption.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 13
Messages via SRB0/SRB2
Messages via SRB0
RRC Connection Reestablishment
RRC Connection Reestablishment Reject
RRC Connection Reestablishment Request
RRC Connection Reject
RRC Connection Request
RRC Connection Setup
Messages via SRB2
DL Information Transfer ( NAS )
UL Information Transfer ( NAS )
Messages carried by SRB2

Messages via SRB1
RRC Connection CSFB Parameters Request
Reestablishment CDMA2000
Complete
CSFB Parameters Reponse
CDMA2000
RRC Connection Release
Handover From EUTRA Preparation
RRC Connection setup
Request ( CDMA2000 )
Complete
Measurement Report
Security Mode Command
Mobility From UTRA Command
Security Mode Complete
RRC Connection Reconfiguration
Security Mode Failure
UE Capability Enquiry
Complete
UE Capability Information
UL Handover preparation Transfer
UE Information Request
( CDMA2000 )
UE Information Response
HUAWEI TECHNOLOGIES CO., LTD.
DL Information Transfer ( NAS )
Huawei Confidential Page15
NAS Messages Via RRC
Messages(1/2)
RRC Connection Setup Complete Initial NAS

message
ATTACH REQUEST including PDN Connection Request
DETACH REQUEST detach triggered by UE in idle mode
TRACKING AREA UPDATE REQUEST triggered by UE in idle
mode
SERVICE REQUEST
ATTACH ACCEPT
TRACKING AREA UPDATE ACCEPT depending on if there are
services to be established or not )
ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST
ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST
The MODIFY EPS BEARER CONTEXT REQUEST

NAS Messages Via RRC Messages
(2/2) UL Information Transfer DL Information Transfer
GUTI REALLOCATION COMPLETE

AUTHENTICATION RESPONSE
AUTHENTICATION FAILURE GUTI REALLOCATION COMMAND
SECURITY MODE COMPLETE AUTHENTICATION REQUEST
SECURITY MODE REJECT AUTHENTICATION REJECT
IDENTITY RESPONSE SECURITY MODE COMMAND
ATTACH COMPLETE IDENTITY REQUEST
DETACH REQUEST Detach triggered by UE in connection ATTACH REJECT
mode DETACH REQUEST Detach triggered by EPC in
DETACH ACCEPT Detach triggered by EPC connection mode
TRACKING AREA UPDATE REQUEST triggered by UE in DETACH ACCEPT Detach triggered by UE
connection mode TRACKING AREA UPDATING REJECT
TRACKING AREA UPDATE COMPLETE TRACKING AREA UPDATE ACCEPT depending on if
ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT there are services to be established or not
ACTIVATE DEFAULT EPS BEARER CONTEXT REJECT SERVICE REJECT
ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT
MODIFY EPS BEARER CONTEXT REQUEST only modify
ACTIVATE DEDICATED EPS BEARER CONTEXT REJECT
MODIFY EPS BEARER CONTEXT ACCEPT TFT
MODIFY EPS BEARER CONTEXT REJECT PDN CONNECTIVITY REJECT
DEACTIVATE EPS BEARER CONTEXT ACCEPT PDN DISCONNECT REJECT
PDN CONNECTIVITY REQUEST BEARER RESOURCE ALLOCATION REJECT
PDN DISCONNECT REQUEST BEARER RESOURCE MODIFICATION REJECT
BEARER RESOURCE ALLOCATION REQUEST
BEARER RESOURCE MODIFICATION REQUEST

General Procedure of Attachment
Signaling
connection
setup
(RRC and S1
dedicated
signaling)
NAS procedure
(Authentication &
NAS security)
User plane
setup
(Default EPS
bearer setup)

RRC Connection Establishment
Process
During RRC connection setup, SRB1 is set up.
to establish SRB1
to request the
establishment of an
RRC connection.
SRB 0 / CCCH / UL-SCH / PUSCH
SRB 0 / CCCH / DL-SCH / PDSCH
SRB 1 / DCCH / UL-SCH / PUSCH
to confirm the successful

completion of an RRC
connection establishment.

Content of the RRC Connection Request
Message
Information Elements
S-TMSI
UE Identity
Random Value
Emergency
High Priority Access
Establishment Mobile Terminating Access

Cause Mobile Originating Signalling
Mobile Originating Data
Delay Tolerant Access (3GPP Release 10)

Relationship between Establishment
Cause and NAS Procedure
RRC Establishment
NAS Procedure
Cause
Mobile Originating Signaling
Attach Attach Delay Tolerant Access
Emergency
Detach Detach Mobile Originating Signalling
Tracking Mobile Originating Signalling
Area TAU Delay Tolerant Access
Update Emergency
User plane radio resources request Delay Tolerant Access
Emergency
Service
Uplink signaling resources request Delay Tolerant Access
Request Emergency
Paging response for PS core network domain Mobile Terminating Access
PDN connectivity request with cause
Emergency
emergency
Mobile originating CS fallback
Delay Tolerant Access
Extended Mobile terminating CS fallback Mobile Terminating Access
Service Mobile originating CS fallback emergency call Emergency
Request Mobile Terminating Access
Packet services via S1 Delay Tolerant Access
Emergency

RRC Connection
Establishment Tracing
Cases

Initial UE Message
After RRC connect establishment , eNodeB delivers the first NAS
message , which is carried by RRC Connection Setup Complete
in Uu interface and Initial UE Message in S1 interface, to MME.
Initial UE Message includs the following NAS procedure:
EMM: Attach request
ESM: PDN connectivity request to transfer the
initial layer 3
message to the
MME over the S1
NOTE: the first UL NAS message is always
received in the RRC CONNECTION SETUP
COMPLETE message.

Initial UE Message Tracing Cases(1/2)
The NAS-PDU IE contains a UE - MME

message that is transferred without
interpretation in the eNB.

Initial UE Message Tracing
Cases(2/2)

NAS Procedure Introduction
After UE sends the first NAS message to MME, MME
initiates NAS procedure for authentication and NAS
security
By the authentication process, a new set of cipher keys are
generated.
If MME could not obtain IMSI from UEs old TMSI, then it initials UE
identity flow to let UE report its IMSI
By the security command process, MME could perform
ciphering and integrity protection for NAS

Authentication&NAS Encryption
Procedure
NAS messages are transparently transmitted through the
eNodeB in both uplink and downlink.
DOWNLINK NAS TRANSPORT
IE/Group Name Presence
Message Type M
MME UE S1AP ID M
eNB UE S1AP ID M
NAS-PDU M
Handover O
Restriction List
Authentication
Procedure UPLINK NAS TRANSPORT
IE/Group Name Presence
Message Type M
MME UE S1AP ID M
NAS security eNB UE S1AP ID M
Procedure NAS-PDU M
E-UTRAN CGI M
TAI M

Authentication&NAS Encryption Procedure
Example
The first DL NAS Transfer
message contains MME
UE S1AP ID mapping to By the reception of MME
UE S1AP ID IE in eNB the
eNB UE S1AP ID to UE-associated logical S1-
connection is established.
identify a certain UEs
message in SI interface.

Initial UE Context Setup Procedure
When a UE attempts to access the network, the EPC requests
the eNodeB to set up the initial context for the UE.
During the initial UE context setup procedure, the default bearer
is set up for the UE. According to 3GPP TS 23.401, the EPC
allocates a default bearer to the UE when the UE initially
accesses the PDN. This default bearer is released only when the
UE exits the PDN.

Initial UE Context Setup Procedure -
Request
The purpose of the Initial Context
Setup procedure is to establish the
necessary overall initial UE Context
including E-RAB context, the
(SGW IP)
Security Key, Handover Restriction GTP Tunnel Endpoint Identifier,
used for the user plane transport
List, UE Radio capability and UE between eNB and the SGW
Security Capabilities etc.

1

Initial UE Context Setup Request
Case 3

Initial UE Context Setup Process -
Response
IEs(Information Elements) in Initial Context Setup
Response message are as following:

Initial UE Context Setup Response Case

AS Security Setup
Purpose:
Activated AS security
algorithms, including
integrity protect and
ciphering, which is
independent and
different with NAS
security procedure.
Integrity protect: only
for Control Plane SRB,

supporting AES, snow3G
and Null
Ciphering: for both
Control Plane SRB and

User Plane DRB,
supporting AES, snow3G
and Null

UE Capability Query Process
If no UE capability in MME, eNodeB will trigger UE
capability query and store it and also inform MME.
If MME already stored UE capability, it will forward to
eNodeB via S1 initial contexts setup request
message.

UE Capability Query Tracing Cases
RRC UE Cap Enquiry
LTE only UE
3GPP Release & UE category
Supported band class RRC UE Cap Info
Inter-frequency measurement
capability
Features(such as ARN)
supported indicator (see
36.331)
Process
The purpose of this procedure is to modify an RRC connection, e.g.
to establish/ modify/ release RBs, to perform handover, to setup/
modify/ release measurements. As part of the procedure, NAS
dedicated information may be transferred from E-UTRAN to the UE.
This process is also used

for radio bearer
management during E-
RAB setup, no specific
message except for RRC
Connection
Reconfiguration
messages is used for
signaling exchange
between eNodeBs and
RRC Reconfiguration Case SRB2&DRB
Setup
Key IEs
radioResourceConfiguration
(for SRB2 and possible
DRBs) default bearer
setup
nas-DedicatedInformation
default bearer setup
RRC Reconfiguration
process can also be used
for the following
configuration
measurementConfiguration
measurement control
mobilityControlInformation
handover command

RRC Reconfiguration Measurement
Control Message

Release Process of Signaling Connection
Overview
This process involves the following releases:
Release of S1 connection
Release of RRC connection, including all radio bearers and signaling
connections between UEs and eNodeBs
The signaling connection release process starts in either
of the following scenarios:
The MME sends a UE Context Release Command message to the
eNodeB.
The eNodeB sends a UE Context Release Request message to the
MME upon detecting the causes such as timer expiration in the
eNodeB, a handover, or other radio events. In this situation, release
process of signaling connection is triggered when the MME responds
with a UE Context Release Command message.

Release Process of Signaling
Connection
Reasons for S1 Dedicated Signaling Release
1.eNodeB triggers for example, detect UE is in user
inactivity for a long time
2. eNodeB O&M system triggers
3. MME O&M system triggers
UE eNodeB MME S-GW

1. S1-AP: S1 UE Context Release Request
The purpose of this
procedure is to release 2.1 Release Access Bearers Request
the RRC connection, 2.2 Release Access Bearers Response
which includes the
release of the 3. S1-AP: S1 UE Context Release Command
established radio
bearers as well as all
4. RRC connection release
radio resources.
5. S1-AP: S1 UE Context Release Complete

Release of S1 Signaling
Connection
Release of S1-AP and S1-U connections
Before the S1 connection is released
MME
eNodeB S-GW P-GW
MME
After the S1 connection is released

eNodeB S-GW P-GW

Release of Signaling Connection
Cases S1AP
Key IEs
MME UE S1AP ID
eNB UE S1AP ID
Cause

leaseCause ::= ENUMERATED {loadBalancingTAUrequired,
other, cs-FallbackHighPriority, spare1}

ATTACH - UE Trace

ATTACH Trace
Uu Interface Trace
S1 Interface Trace

System Information
Attach Procedure
Paging Procedure
Handover Procedure

Paging Procedure
Triggered by:
MME or eNodeB
Although the procedure is triggered by different originators,
the paging mechanism in Uu interface is the same.
MME-triggered paging eNodeB-triggered paging

When the MME initiates a paging When a SI message is changed, the
procedure, the eNodeB transmits eNodeB will send a paging
the paging message on the PCCH message to notify change(s) of one
to the UEs in all the cells or more SI message(s) and send
belonging to TAs in a TAL the updated SI message in the next
specified in the paging message. SI message modification period.
The paging message contains the To ensure all UEs in EMM registered
UE ID and domain information, mode in the cell can receive the SI
which indicates the paging message, the eNodeB sends paging
source. messages in all possible time
The UE ID may be S-TMSI or IMSI. during the DRX cycle.
Paging Procedure

Service Request Procedure Overview
Trigger time
After attaching to a network, a UE will be in the idle mode, then when
the UE wants to initiate any service, it will active the service request
procedure. That is to say, the service request procedure is triggered
when the following two conditions are met:
The UE has no RRC connection but uplink data initiates requests.
The UE is in ECM idle mode and downlink data arrives.
Trigger condition
UE-triggered (service request)
EPC-triggered (paging+ service request or the eNodeB needs to
initiate a signaling procedure for UEs in idle mode, such as the detach
procedure)
Result
Uu interface: a RRC connection.
S1 interface: a S1-AP connection and a S1-U Bearer.

Paging
Uu Interface Trace in eNodeB
S1 Interface Trace in eNodeB

System Information
Attach Procedure
Paging Procedure
Handover Procedure

Event
Event A1 (Serving becomes better than threshold)
Event A2 (Serving becomes worse than threshold)
Event A3 (Neighbour becomes offset better than serving)
Event A4 (Neighbour becomes better than threshold)
Event A5 (Serving becomes worse than threshold1 and

neighbour becomes better than threshold2)
Event B1 (Inter RAT neighbour becomes better than

threshold)
Event B2 (Serving becomes worse than threshold1 and inter
RAT neighbour becomes better than threshold2)

Event Definition
Event Definition Formula Usage
A1-1(Entering): Ms-Hys>Thresh A1 used to terminate the inter-

A1 S-cell signal becomes better than threshold
A1-2(Leaving): Ms+Hys<Thresh frequency measurement
A2 used to trigger the inter-
A2-1(Entering): Ms+Hys<Thresh
A2 S-cell signal becomes worse than threshold frequency measurement (same
A2-2(Leaving): Ms-Hys>Thresh
system and Inter RAT)
A3-1(Entering):
N-cell signal becomes better than S-cell signal with Mn+Ofn+Ocn-Hys>Ms+Ofs+Ocs+Off A3 used to handle intra frequency
A3
pre-defined offset of Off A3-2(Leaving): handover and ICIC determination
Mn+Ofn+Ocn+Hys<Ms+Ofs+Ocs+Off
A4-1(Entering):
Mn+Ofn+Ocn-Hys>Thresh A4 used to handle inter frequency
A4 N-cell signal becomes better than threshold
A4-2(Leaving): handover
Mn+Ofn+Ocn+Hys<Thresh
B1-1(Entering):
Mn+Ofn-Hys>Thresh B1 used to handle Inter RAT
B1 Inter RAT N-cell signal becomes better than threshold
B1-2(Leaving): handover
Mn+Ofn+Hys<Thresh
S-cell signal becomes worse than threshold1 and N-

A5 A2 + A4 eRAN3.0
cell signal becomes better than threshold2
S-cell signal becomes worse than threshold1 and inter
B2 A2 + B1 eRAN3.0
RAT N-cell signal becomes better than threshold2

Handover Outline
Three Scenarios for Handover Within System
S1 S1
X2
Handover Handover Handover
Uu Uu Uu Uu Uu Uu
Intra-eNodeB Handover Inter-eNodeB Handover with X2

Inter-eNodeB Handover with S1
Note: If both a X2 and S1 links are available, the
X2 link is preferentially used for the inter-eNodeB
handover.
Handover Procedure
Handover consists of three stages:
HO Measurement: UE does the measurement based on the
measurement configuration from eNodeB, and report to eNodeB;
HO Decision: It is eNodeB to decide if trigger handover based on the
measurement result UE report;
HO Execution: Based on the decision, eNodeB control UE handover to
target cell;
The whole handover procedure follows
network control and UE assistant.
Six steps needed
Issuing Measurement Control-> Measurement Result Report->Handover
Decision->Resource Preparation->Handover Execution->Source cell
Resource Release

Measurement Control

Measurement Report

Handover Command

Introduction to Intra-eNodeB
Handover
Simple for Intra-eNodeB Handover
Handover only update Uu interface resource, source and target cell
resource requirement and target cell resource release are
implemented by eNodeB internal information;
No Inter-eNodeB data forward, no random access for UE, and no

information interaction with core network;

Intra-eNodeB Handover Procedure
UE send measurement
in source cell
eNodeB send HO command
after finishing admission and
radio resource allocation.
UE access in target cell

HO complete, release
source cell resource.

Handover Signaling Within
eNodeB
Uu interface trace in UE side
Uu interface trace in eNodeB side

Inter-eNodeB Handover with X2
Interface
When A3 event is triggered, and the target cell

and source cell belong to different eNodeB with X2
interface, inter-eNodeB handover with X2 interface
happened;
When source eNodeB received UE measurement report, and
decide UE to handover to target cell, apply the resource
from target eNodeB through X2 interface. When finish the
target cell resource preparation, then inform UE to handover
to target cell through reconfiguration information. When
handover is complete, target eNodeB inform source eNodeB
release source cell radio resource. In addition, the data from
the source eNodeB not to send in time need to forward to
target eNodeB.

Inter-eNodeB Handover Procedure
with X2 Interfacee(1/2)
User has accessed, and begun to use
Source eNodeB send measurementthe service
control information to inform UE to
initiate the neighbor measurement.
Source eNB send Handover Request
When Target eNB receives the
information
Source eNodeB toTarget
make HO eNB to initiate the
decision
UE send the report to eNBHO when detect the cellHandoverReq information from Source
preparation procedure.
based on HO algorithm and current
fulfill the HO condition. eNB, admission control based on the
status. traffic result
information
Target eNB send admission and and radio resource
configuration will be done.
radio source configuration information
to source eNB, and then HO
Source eNB send the HO command
information from Target eNB preparation
to UE to finished.
inform HO.
Inform the SN and HFN information to
target eNB, used for data
retransmission and encryption
integrity protection.

Inter-eNodeB Handover Procedure
with X2 Interface (2/2)
UE send HO confirm information to

target eNB after finishing randomWhen Target eNB receive Handover
access to target eNB. Confirm information from UE, will
intiate the Path Switch procedure to
MME to complete the user plane HO.
When finish S-GW user plan HO, MME

will send Path Switch Rsp to Target
eNB.
When Path Switch finished, target eNB
will inform source eNB to release
resource, and complete HO procedure.

Inter-eNB with X2 interface
Uu interface signaling trace in UE side
Uu interface signaling trace in source eNodeB
Source eNodeB X2 interface trace same with that of in target

eNB
Uu interface signaling trace in target eNodeB
S1 interface signaling trace in target eNodeB

Inter-eNB HO with S1
Interface
HO with S1 interface is similar to HO with X2
interface, the difference is there is no direct path
between eNBs. Handover Request Handover
Request Acknowledge and data forward need to be
forwarded by S1 interface.

Inter-eNB HO Procedure with
S1(1/2)
Source eNB send HO required

MME
information to MME forward
the HO required
information to target eNB inform to
prepare to HO.
When Target eNB complete admission
and radio resource
MME send ACKconfiguration, reply MME
information toSource
eNB HandOverAck information
Like HO with X2 interface, source eNB

need send SN information to target eNB
through MME.

Inter-eNB HO Procedure with
S1(2/2)
UE access to target
eNodeB
Target eNB inform MME HO

complete
MME inform source eNB

release resource
Source eNB reply release complete, HO

finish.

Inter-eNodeB HO with S1Interface
Uu Interface Trace signaling in UE Side
Uu Interface Trace signaling in Source eNodeB
S1 Interface Trace signaling in Source eNodeB
Uu Interface Trace signaling in Target eNodeB
S1 Interface Trace signaling in Target eNodeB

Protocol Proposed
1. TS 36.300 Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal
Terrestrial
Radio Access Network (E-UTRAN); Overall description;
2. TS 36.331 Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control
(RRC); Protocol specification;
3. TS 23.401 General Packet Radio Service (GPRS) enhancements for Evolved Universal
Terrestrial Radio Access Network (E-UTRAN) access;
4. TS 24.301 Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS);

QoS Architecture in EPS
QCI: QoS Class Indicator

ARP: Allocation and Retention Priority, Mainly
used for admission
GBR: Guaranteed Bit Rate
MBR: Maximum Bit Rate
AMBR: Aggregation Maximum Bit Rate

QoS Parameters: QCI
QCI
Value range: 1 to 9
Each EPS bearer is defined with a QCI.
The QCI determines how an IP packet on a bearer is processed on the user plane.

Page 73
QoS Parameters: GBR and Non-
GBR
GBR bearer
For a GBR bearer, a fixed amount of bandwidth resources is
preserved, regardless of whether the resources are used or
not.
QCI, ARP, GBR , MBR
Non-GBR bearer
For a non-GBR bearer, no fixed amount of bandwidth
resources is preserved, and therefore traffic is not ensured.
QCI, ARP, AMBR

Page 74
QoS Parameters: AMBR
Aggregate Maximum Bit Rate (AMBR)
The AMBR is applicable only to non-GBR bearers.
APN-AMBR (uplink and downlink)
The APN-AMBR limits the aggregate bit rate that can be
provided across all non-GBR bearers related to all PDN
connections on the same APN.
The APN-AMBR is provided by the P-GW which E-UTRAN
doesnt need
UE-AMBR (uplink and downlink)
The UE-AMBR is the aggregate maximum bit rate that is
expected on all the non-GBR bearers related to a UE.
The UE-AMBR is provided on the eNodeB.

AMBR Case
APN-AMBR1
Default PDN1
PGW
PDN Context A Bearer
APN:A
UE-AMBR
PDN Context B APN-AMBR2

Default
PGW Bearer Bearer(GBR) PDN2
Dedicated
PDN Context C APN:B
APN-AMBR3 APN:C Default

PDN Context D Bearer PDN3
PGW Default
Bearer Bearer(Non-GBR) PDN4
Dedicated
APN:D
APN-AMBR4

EPS Bearer Types and Associations
EPS bearer types based on the EPS bearer types based on bit rate guarantee
setup time
Default bearer Non-GBR bearers (for non-
The default bearer is a user
realtime services)
bearer that meets default Non-GBR bearers are not
QoS requirements for data allocated fixed network

and signaling. resources. They are applicable
The default bearer is set up
to non-realtime services, such
when a UE initially attaches as email, FTP, and HTTP
to the EPS. It remains services.
established to provide the UE
with always-on IP
connectivity. GBR bearers (for realtime
Dedicated bearer services)
Dedicated bearers are SAE GBR bearers are permanently
bearers used for specific allocated dedicated network

services. resources. They are applicable
All bearers except default
to realtime services, such as
bearers are dedicated voice, video, and realtime
bearers.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidentialgaming services.
Page78
UE ID in EUTRAN(AS Layers)
RNTI(Radio Network Temporary Identifier): consists
of 32 bits
Type Scenario How to Acquire Valid Rage
Used to identify the Based on the RACH
RA-RNTI random access preamble location within a cell
response 0001~003C
Used to identify the
Temporar UE before contention eNodeB assign it in random
y resolution during access response message within a cell
C-RNTI random access 003D~FFF3
procedure
eNodeB assign it after RRC
Identify RRC
C-RNTI connection setup within a cell
connected UE
003D~FFF3
Indentify the UE when eNodeB assign it when
SP-
adopt semi-persist enter the SPS mode within a cell
SCRNTI
scheduling (003D~FFF3)
Identify the paging Whole
P-RNTI FFFE(Fixed)
message scheduling network
Identify the SIB Whole
SI-RNTI FFFF(Fixed)
message scheduling network
UE ID in EPC (NAS Layer)
Type Name Source Function
International
Unique UE ID, used for the UE
IMSI Mobile Subscriber USIM
authentication
Identity
Temporary Mobile Temporary UE ID in specific MSC

MSC
TMSI Subscriber server, used to replace IMSI for
server
Identity security
packet temporary Temporary UE ID in specific

P-TMSI mobile subscriber SGSN SGSN, used to replace IMSI for
identity security
Globally Unique
Global temporary UE ID, used to
GUTI Temporary MME
replace IMSI for security.
Identifier
Shortened form of the GUTI to
SAE Temporary
enable more efficient radio
S-TMSI Mobile Station MME
signalling procedures(e.g. paging
Identifier
and Service Request)

GUTI Composition and Related
Concepts
The GUTI is allocated when the UE performs initial
registration(i.e.Attach) with an MME, and is then
typically changed whenever the UE performs some EMM-
procedure such as TA Update.
GUMMEI
MMEI
GUTI
12 bits 8~12 bits 16 bits 8 bits 32 bits
S-TMSI

Thank you
www.huawei.com

LTE Basic Signaling Procedure: Security Level

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LTE Basic Signaling Procedure: Security Level

Uploaded by

Copyright:

Available Formats

4/3/17 Security Level:

LTE Basic Signaling

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

parameter settings in the system information received on the

information blocks (SIBs), including UE parameters set by the

How is the system information received ?

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page3

SSS PSS PBCH

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page4

PBCH SSS PSS

40ms PBCH TTI

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page5

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page7

List of the SIBs

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page8

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page10

mapping between a data

EPS Bearer Service Architecture(from 3GPP36.300)

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

SRB0 SRB1 SRB2

Bears RRC Bears RRC signaling (that Bears NAS

Messages carried by SRB2

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page16

GUTI REALLOCATION COMPLETE

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page17

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page18

SRB 0 / CCCH / UL-SCH / PUSCH

SRB 0 / CCCH / DL-SCH / PDSCH

SRB 1 / DCCH / UL-SCH / PUSCH

to confirm the successful

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page19

Establishment Mobile Terminating Access

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page20

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page21

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page22

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page23

The NAS-PDU IE contains a UE - MME

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page24

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page25

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page26

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page27

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page28

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page29

Security Capabilities etc.

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page30

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page31

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page32

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page33

for Control Plane SRB,

Control Plane SRB and

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page34

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page35

3GPP Release & UE category

Supported band class RRC UE Cap Info

This process is also used

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page38

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page39

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page40

UE eNodeB MME S-GW

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page41