PC/EPC technıcal overview

Introduction
 Evolution towards one global standard: LTE
2nd Generation 3th Generation 4th Generation

GPP2

3GPP

3GPP
Core network domaıns
 2G/3G Terminology
› APN – Access Point Name
– Identifies an IP packet data network (PDN)
– Used to define a type of service provided by the PDN (e.g. mms,
WAP,…)
– APN contains network identifier and operator identifier
› E.g: internet.mnc003.mcc286.gprs
– APN-resolution
› process of DNS look-up to determine the GGSN (IP) serving this
APN
 3G Terminology
› PDP Context – Packet Data Protocol Context
– data structure present on both the SGSN and the GGSN, which
contain the subscriber’s session information.
– Secondary PDP-context
› Reuses IP address of primary context with different Qos
– Total of 11 PDP contexts can co-exist.
– NSAPI (network service access point identifier)
› used to identify a PDP context from the same MS.

 Primary PDP context (PDP_Address_1, QOS_1,

APN2
NSAPI_1
 Primary PDP context (PDP_Address_2, QOS_2, 
NSAPI_2

APN1
 Secondary PDP context (PDP_Address_2, QOS_3,
NSAPI_3
RAN
UE /SGS GGSN
N
3G Terminology
MSISDN
– Mobile Subscriber Integrated Services Digital Network Number
– i.e. Phone number
– ITU-T E.164
– Limited to 15 digits long:
› CC –Country Code
› NDC – National Destination code (optional)
› SN – Subscriber Number

 CC  NDC  SN

1-3
digits Max. 15 digits
3G Terminology
IMSI
– International Mobile Subscriber Identity
– unique number per (U)SIM
– Linked to MSISDN in HLR
– ITU-T E.212
– usually 15 digits long, can be shorter
› MCC – Mobile Country Code
› MNC – Mobile Network code (Europe: 2 digits, North America: 3
digits)
› MSIN – Mobile Subscriber Identification Number
 MCC  MNC  MSIN

3 digits 2/3
digits
Max. 15 digits
 2G/3G Packet Network Overview
Signaling
Signaling and Traffic
AUC Authentication Center SMS
BSC Base Station Controler AUC FNR
FNR
BTS Base Transceiver Station
EIR Equipment Identity Register H Gd GMLC
FNR Flexible Number Register EIR SCP
EIR
GGSN Gateway GPRS Support Node Gf IP
GMLC Gateway Mobile Location Centre HLR
MSC Mobile Switching Center HLR Lg Network
RNC Radio Network Controler Ge
Gr
SCP Service Control Point
SGSN Serving GPRS Support Node SGSN (G) Gi
Gn
SMS Short Message Service Gn
MSC/ GGSN
SGSN (G)
MSC Server Gs Gn

Gom Gom
A bis Gb
BTS BSC
O&M
GSM BSS

Gp Gp
Other
PLMN
SGSN/
GGSN
2G/3G Packet Network Overview
Signaling
Signaling and Traffic
AUC SMS
FNR
FNR
H Gd GMLC
EIR SCP
EIR
Gf IP
HLR
HLR Lg Network
Ge
AUC Authentication Center Gr
BSC Base Station Controler SGSN (W) Gi
BTS Base Transceiver Station Gn
Gn
EIR Equipment Identity Register
FNR Flexible Number Register SGSN (W) GGSN
Gn
GGSN Gateway GPRS Support Node
GMLC Gateway Mobile Location Centre
MSC Mobile Switching Center
RNC Radio Network Controler Gom Gom
SCP Service Control Point
SGSN Serving GPRS Support Node
SMS Short Message Service O&M

Gp Gp
Other
Iu
Iub PLMN
Node B RNC
SGSN/
WCDMA RAN GGSN
PSCN Network elements

SGSN (Serving GPRS Support

Node). IP networks
Charging
Authentication & retrieval of
subscriber data from HLR
Routing area list management
Idle mode UE reach-ability & DL
packet buffering
HLR
GGSN selection GGSN

Inter RAT node signaling & anchor

point for mobility
Bearer management functions SGSN
Local mobility anchor for inter-RNC
handovers
Lawful interception
GSM WCDMA
PS Core Simple Architectrue.

IP networks
GGSN (Gateway GPRS Support
Charging
Node).

 IP anchor point for GTP-tunnel

 UE IP address allocation
HLR
 Connectivity to packet data network GGSN
 Per-user based packet filtering and
policing
 Lawful interception SGSN

GSM WCDMA
PS Core Simple Architectrue.

SASN ( Service Aware Support

Node):
IP networks
Charging
Complete DPI and heuristic
traffic inspection.
charging models:
› Volume, time and event HLR GGSN
handling, Prepaid, and Advice of
Charge.
›QoS management, usage and SGSN
service based.

GSM WCDMA
PSCN Network elements
› RNC: Radio Network Controller
– radio resource management
– some of the mobility management functions
– the point where encryption is done before user data is sent to and from the mobile
– The RNC connects to the Circuit Switched Core Network through MSC (Mobile
switching Center) and to the SGSN (Serving GPRS Support Node) in the Packet
Switched Core Network

› EIR: Equipment Identity Register

– keeps a list of mobile phones which are to be monitored or are to be banned from the
network

› HLR/AuC: Home Location Register/ Authentication Center

– Central database with mobile phone subscriber data
– AuC: function to authenticate user who tries to connect to the Core Network
Core network Elements,
Interfaces, and Protocols
Overview of Core Protocols

SGSN
GGSN
 PSCN Elements, Interfaces, and Protocols
Control Plane

Data Plane

HLR/AuC

MAP Gr

GTP-C

Gn/Gp Gi
RANAP
SGSN GTP-U GGSN IP
Iu-PS

GTP-U Gn
UE
GTP-U

Gr interface: to get subscription data of

Node B the User
RNC
Gi interface: to access a PDN network,
e.g., the Internet
Overview of Protocols: GTP

SGSN
GGSN
GTP Versions

There are 3 versions of GTP-C protocols

GTP-C v0
GTP-C v1: Gn/Gp interfaces between SGSN/GGSN
GTP-C v2: S5 between PGW/SGW and S11 between MME/SGW

 There are 2 versions of GTP-U protocols GTP-C

Gn/Gp Gi
GTP-U GGSN IP
GTP-U v0 Iu-PS SGSN
GTP-U Gn
GTP’ in Ga interface
UE GTP-U

Node
GTP-U v1 B RNC
Gn/Gp interfaces between SGSN/GGSN
S5-U interfaces
S1-U interfaces
 Sample GTP-v1/v2 Control messages
 GTP-v1 control messages(3G):  GTP-v2 control messages (LTE):

Message Type Description Message Type Description

16 Create pdp context request 32 Create Session Request

17 Create pdp context response 33 Create Session Response

 
18 Update pdp context request 34 Modify Bearer Request

19 Update pdp context response 35 Modify Bearer Response

20 Delete pdp context Request 36 Delete Session Request

21 Delete pdp context Response

37 Delete Session Response

38 Change Notification Request

39 Change Notification Response

Overview of Protocols : MAP

SGSN
GGSN
MAP
› Mobile Application Part

› 3GPP TS29.002
HLR/AuC
MAP Gr

› Services provided:
– Mobility services
› Authentication SGSN

› Location management (roaming) UE

› Managing service subscriber information Node

B RNC
MAP
› Protocol structure:

– Operation specifier = type of packet

› purgeMS,
› sendIdentification,
› updateGprsLocation,
› provideSubscriberInfo,
› sendAuthenticationInfo,
› authenticationFailureReport,
› checkIMEI,
› insertSubscriberData,
› deleteSubscriberData,

› ….

– MAP parameters (depending on operation)

› Imsi
›…
Overview of Protocols : RANAP

SGSN
GGSN
RANAP
– Radio Access Network Application Part

– 3GPP TS 25.413
RANAP
– ASN.1 encoding Iu-PS SGSN

UE

– RANAP is used for the following tasks: Node

› Relocation B RNC

› Radio Access Bearer Management

› Paging
› Transport of signaling between a UE and the Core Network
Overview of Protocols : NAS

SGSN
GGSN
NAS
› Non-access-stratum
› 3GPP TS24.301
› Supports traffic and signaling messages between UE and CN

› NAS protocols:
Non Access Stratum
(GMM/GSM/DATA)

– GMM
UE
GPRS Mobility Management
SGSN
– GSM
GPRS Session Management GM GS GM GS
M M M M
– CC RNC RNC SGSN
Call Control (in CS domain) GTP-U
RANAP RANAP
– SMS SCCP
UDP
SCCP
Short Message Services IP
Radio Radio M3UA M3UA
–… Protocols Protocols SCTP
Layer2
SCTP

IP Iu (Data) IP

Layer2 Layer2
Uu Iu (Control)
NAS
GMM/GSM
› 3GPP TS24.008

› GPRS Mobility management (GMM)

– supports the mobility and roaming of UE
– Functions
› Attach / Detach
› Authentication
› Location Management
› Paging

› GPRS Session management (GSM)

– Supports PDP context handling of a UE
– Functions
› PDP context activation/modification/deactivation
NAS
GMM/GSM
Header structure  
– Protocol discriminator:
› GMM: ‘1000’
› GSM: ‘1010’
– Message type:
Uniquely defines the function and format of each message.
› GMM
- Attach request/accept/complete/reject
- Routing area update request/accept/complete
- Authentication and ciphering req/resp
› GSM
- Activate PDP context request/accept/reject
- Deactivate PDP context request/accept
- Modify PDP context request/accept
– Information elements:
Various information elements depending on message type
3G Call flows
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC
UE wants to attach to the ISD

network.
ISD Ack

Gr UGL Ack

Identifier: IMSI Attach accept

Attach complete

(GMM-attach-request)

SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request

SAI request
Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

SGSN requests authentication HLR/AuC

UGL

ISD

vectors from the HLR/AuC to ISD Ack

authenticate the UE. Gr

Attach accept
UGL Ack

Identifier: IMSI Attach complete

(MAP -Send authentication info request)

SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC ISD

HLR sends the Authentication ISD Ack

vectors to the SGSN. Gr

Attach accept
UGL Ack

(MAP -Send authentication info response) Attach complete

Authentication Vector (AV)

SGSN
Iu-PS  = Quintupletlist:
• RAND = network challenge
• XRES = expected user
UE response
• Ck = Ciphering Key
• iK = Integrity key
Node B • AUTN = Authentication token
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC ISD

Authentication of the UE: ISD Ack

SGSN sends AV’s (RAND and AUTN) to the Gr UGL Ack

Attach accept

UE. Attach complete

(GMM – authentication and ciphering Request)

SGSN
Iu-PS

UE

Node B

RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC
Authentication of the UE:
ISD

ISD Ack

UE calculates the response and sends it to Gr UGL Ack

the SGSN.
Attach accept

Attach complete

(GMM – Authentication and ciphering response)

SGSN
Iu-PS

UE

Node B

RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC
If authentication is successful,
ISD

ISD Ack

the SGSN will start the Location Gr UGL Ack

Update procedure.
Attach accept

Attach complete

First it informs the HLR of where

the UE is located.
(MAP –Update GPRS Location)
SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

The HLR sends then information HLR/AuC

UGL

ISD

about the subscriber to the ISD Ack

SGSN. Gr
Attach accept
UGL Ack

(MAP –Insert subscriber data) Attach complete

SGSN
Iu-PS
Suscriber data (GPRS data list):
•PDP context ID
UE
• type = PPP or IP
• IP address (static or dynamic)
Node B • APN
RNC • QoS
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

SGSN informs HLR it has HLR/AuC

UGL

ISD

successfully received the ISD Ack

subscriber’s data. Gr
Attach accept
UGL Ack

(MAP – Insert Subscriber Data Ack) Attach complete

SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC
HLR confirms to the SGSN ISD

ISD Ack

that the location update is Gr UGL Ack

successfully finished. Attach accept

Attach complete

(MAP – Update GPRS Location Ack)

SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UGL

HLR/AuC ISD

SGSN accepts the ISD Ack

attachment of the UE. Gr

Attach accept
UGL Ack

Identifier: IMSI Attach complete

(GMM – Attach Accept)

SGSN
Iu-PS

UE

Node B
RNC
 Attach
Control Plane  UE  SGSN  HLR
Attach request
SAI request

Data Plane
SAI response

Auth. and ciphering req.

Auth. and ciphering resp.

UE confirms to the SGSN that it

UGL

HLR/AuC ISD

received the attach accept. The ISD Ack

UE is now attached to the Gr

Attach accept
UGL Ack

network. Attach complete

(GMM – Attach Accept)

SGSN
Iu-PS

UE

Node B
RNC
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

Gn/Gp

SGSN GGSN
Iu-PS
UE is attached and wants to access the
internet. It requests to setup a pdp-context.
UE
APN (-NI) is provided in the message.
(GSM –Activate PDP Context Request)
Node B

RNC
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

Gn/Gp

SGSN GGSN
Iu-PS
SGSN looks up the IP of the GGSN
that serves the provided APN (NI + OI).
UE
(OI is added by the SGSN)
(DNS Lookup)
Node B
RNC
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

TEID = 0x451c0000

GTP Control Plane Tunnel

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS TEID = 0x2110001c

SGSN requests the GGSN to set up

UE
a pdp-context for the UE.
SGSN-side TEID’s are provided (cfr. LTE)
Node B (GTP-C – Create PDP Context Request)
RNC
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

TEID = 0x451c0000

GTP Control Plane Tunnel

TEID = 0x000f4240

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS TEID = 0x2110001c TEID = 0x001e8480

GGSN sets up the pdp context and

UE
responds to the SGSN.
GGSN-side TEID’s are provided. (cfr. LTE)
Node B IP address for the UE is provided.
RNC (GTP-C – Create PDP Context Response)
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

TEID = 0x451c0000
GTP Control Plane Tunnel
TEID = 0x000f4240

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS TEID = 0x2110001c TEID = 0x001e8480
1c

SGSN now requests the RNC to set up

e

00
el lan

10
12
nn P

0x

the radio access bearer (RAB) and data-

Tu ata

UE
D

D
EI
TP

T

tunnel (GTP-U) between SGSN and RNC.

G

Node B
SGSN-side TEID as well as the IP for the GTP-U
RNC tunnel are provided.
IP address for the UE is provided.
(RANAP – RAB Assignment request)
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

TEID = 0x451c0000
GTP Control Plane Tunnel
TEID = 0x000f4240

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS TEID = 0x2110001c TEID = 0x001e8480
1c
e

00

RNC confirms to the SGSN it has set up

el lan

10
12
nn P

0x
Tu ata

the RAB and the GTP-U tunnel.

=

UE
D

D
EI
TP

T
G

RNC-side TEID and IP for GTP-U tunnel are

0c
00
00

provided.
00

Node B
0x
=

(RANAP –RAB assignment response)

D

RNC
EI
T
 PDP Context Activation
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  DNS  GGSN
Activate PDP Context Request

GTP Data Plane Tunnel GTP-U DNS req.

DNS resp.

Radio Access Bearer

Create PDP Context req.

Create PDP Context resp.

Control Plane RAB assignment req.

RAB assignment resp.

Data Plane Activate PDP Context Accept

TEID = 0x451c0000
GTP Control Plane Tunnel
TEID = 0x000f4240

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS TEID = 0x2110001c TEID = 0x001e8480
1c
e

00

SGSN informs the UE the pdp context

el lan

10
12
nn P

0x
Tu ata

is established.
=

UE
D

D
EI
TP

T
G

IP address for the Ue is provided.

0c
00
00
00

Node B (GSM – Activate PDP Context Accept)

0x
=
D

RNC
EI
T
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr
GTP Control Plane Tunnel

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS
e
el lan

MS-initiated detach:
nn P
Tu ata

UE
D
TP

UE informs SGSN it wants to detach

G

Node B
from the network (e.g. power-off).
RNC (GMM – Detach Request)
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr
GTP Control Plane Tunnel

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS
e
el lan
nn P

SGSN requests to GGSN to delete the PDP

Tu ata

UE
D
TP

context.
G

(GTP-C – Delete PDP Context request)

Node B
RNC
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr
GTP Control Plane Tunnel

Gn/Gp

SGSN GTP Data Plane Tunnel GGSN

Iu-PS
e
el lan
nn P

GGSN responds to SGSN and GTP

Tu ata

UE
D
TP

tunnels on Gn are teared down.

G

(GTP-C – Delete PDP Context response)

Node B
RNC
Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr

Gn/Gp

SGSN GGSN
Iu-PS
e
el lan
nn P

SGSN informs the UE that the UE is

Tu ata

UE
D
TP

detached from the network.

G

(GMM – Detach Accept)

Node B
RNC
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr

Gn/Gp

SGSN GGSN
Iu-PS
e
el lan
nn P

SGSN informs the RNC to release the Iu

Tu ata

UE
D
TP

(including radio resources) for this specific

G

Node B
UE.
RNC (RANAP – Iu-Release request)
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr

Gn/Gp

SGSN GGSN
Iu-PS
e
el lan
nn P

RNC informs the SGSN that the

Tu ata

UE
D
TP

corresponding resources are released.

G

(RANAP – Iu-Release response)

Node B
RNC
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr

Gn/Gp

SGSN GGSN
Iu-PS

After a certain time (the purge_time) the

UE subscriber data on the SGSN is
considered out of date and not valid
Node B
anymore. SGSN informs the HLR of this
RNC by performing a MS Purge.
(MAP – Purge MS)
 Detach
GTP Control Plane Tunnel GTP-C  UE  RNC  SGSN  GGSN
Detach request

GTP Data Plane Tunnel GTP-U Delete PDP Context req.

Delete PDP Context resp.

Radio Access Bearer Detach Accept

Iu - Release  HLR

Control Plane Iu - Release resp.

Purge MS

HLR/AuC Purge MS ack.

Data Plane
Gr

Gn/Gp

SGSN GGSN
Iu-PS

HLR updates its database by removing

the UE’s known location and confirms
UE

the MS Purge towards the SGSN.

Node B (MAP – Purge MS Ack)
RNC
4G evolutıon
Video
•• Capacity
Capacity OTT GSM
•• Multiple
Multiple
WCDMA
•• QoS
QoS Access
Access
•• Bandwidth
Bandwidth •• All
All Traffic
Traffic
Performance Single
CDMA Platform
Non-trusted
Non-3GPP

50B connected devices Trusted

Non-3GPP

Why evolve?

IP SS7
All IP Cost
•• Next
Next Gen
Gen •• TCO
TCO
ATM FR
•• VoIP
VoIP
•• VoLTE
VoLTE
•• O&M
O&M
•• Expand
Expand
 Evolution from 3g to LTE

3GPP Rel-99 User plane

traffic through
all nodes

PDN
nodeB RNC SGSN GGSN

3GPP Rel-7 User plane

outside of
SGSN

SGSN PDN
nodeB RNC GGSN

3GPP Rel-8 User plane directly

between RAN and
GW for all LTE
traffic.

MME
SAE
PDN
EnodeB GW
EPC Highlights
EPC Terminology
DEFAULT and dedicated Bearers
› QoS requirements are different depending on the service
required by UE

› Radio and transport network are shared by all users

› EPS fulfills different service requirements implementing

QoS

› EPS bearer is the basic tool to handle QoS

› Each EPS bearer is associated with a set of QoS

parameters (delay, bit error, scheduling policy, etc.)
DEFAULT and dedicated Bearers
› A PDN connection has at least one EPS bearer, but it could
have several EPS bearers at the same time

› Each EPS bearer could have different QoS requirements

depending on the Service

› The first EPS bearer established is called Default Bearer

› Additional EPS bearers that may be activated for a PDN

connection are called: Dedicated Bearers
DEFAULT and dedicated Bearers

PDN Connection

Default Bearer
Dedicated Bearers
APN-1

UE Linked Bearer Id (LBI) S-GW

eNodeB P-GW
IP
EPS Bearer Id (EBI)

EPS Bearer Id (EBI)

APN-2
 DEFAULT and dedicated Bearers
App1 App2 Service1Service2

UL TFT DL TFT

Bearer Marked with QCI 5

Bearer Marked with QCI 3

QCI 3  PNP X QCI 3  PNP A

QCI 5  PNP Y QCI 5  PNP B

UE RAN / eNodeB GW

Wireless network
Requires:
› QoS Class Identifiers (QCIs)
› Separate Bearer (UEGW) per QCI  Each Bearer Marked with a QCI
› UL/DL Traffic Flow Template (TFT) per Bearer
DEFAULT and dedicated Bearers
AF

HSS Rx
App2 Subscriber
data
S6a: PCRF
subscribed
App1
QoS Service
Gx: PCC rules: Policies
QCI, SDF template,
BitRates, ARP

UL TFT
QCI=Y, Bit Rates

DL TFT
QCI=X, Bit Rates
Service Data
S5/S8 Flows
bearer QoS
Terminal eNB MME Serving GW PDN GW
DEFAULT and dedicated Bearers
› TFT filters may contain the following attributes:

– Remote IP address and Subnet Mask

– Protocol Number (IPv4)/Next Header (IPv6)
– Local Port Range
– Remote Port Range
– IPSec Security Parameter Index (SPI)
– Type Of Service (TOS) (IPv4)/Traffic class (IPv6)
– Flow Label (IPv6)
EPC archıtecture &
ınterfaces
EPC Architecture – 3GPP
IP networks
AAA PCEF
SASN
ANDSF
HLR/HSS
HLR/HSS
HLR
GGSN

SAPC
PCRF

PDN
GW
SGSN- EPG
SGSN MME Serving
MME GW ePDG
ePDG

HSGw/
EWG
TWAG

BSC RNC
eNodeB
enodeB Trusted Non-trusted
BTS Node B non-3GPP non-3GPP

2G 3G LTE
 PCRF
•Provides Service Data
Flow gating

LTE/EPC Architecture •Set QoS for each Service

Data Flow
•Define Charging for each Service
Data Flow
HSS •Enables IMSBearer QoS Control
• Correlation between Application
•Maintain and provide subscription
HSS data and Bearer External
charging
•
•User Identification handlingIP
Notification of networks
bearer events to Rx
SASN
application function
LTEAuthorisation
•Access •Packet Inspection and
•Provide Keys•Bearer bindings towards Serv-GW
for Authentication Service Classification
for PMIP based S5 PCRF
and Encryption •Credit control
SGi
S GW part •User Registration management •Quality of Service
• Maintain knowledge
• In visited network in case of roamingof used PDN GW
control LTE
• Intra-LTE mobility anchor SASN
•Content filtering
• Packet routing & forwarding •Access control Gx
LTE • Lawful intercept
PDN GW part
•Policy control
S6a • External IP point of interconnect
• LTE idle mode DL buffering • •Content enrichment
MME IP address allocation
• Charging per UE, PDN and QCI •Traffic redirection
• Authentication • Packet routing & forwarding
PDN GW
•Usage records
• Bearer bindings for PMIP S5/S8
• NAS signalling • Lawful itercept •Security
• GW selection • Policy enforcement
S5/S8
• In home
• Roaming (S6a to home HSS)or visited network
S11
• Bearer management
MME • Idle mode tracking Serv GW
S10 • Paging
• Inter-MME and IRAT mobility
•NAS Ciphering and Integrity LTE
S1-MME protection S1-U
LTE
eNodeB
• Cell resource managemen
• Broadcast information
• MME selection
• Transfer of transparent NA
eNB • Routing of user data towa
• Intra-LTE handover, inter-M

X2
LTE LTE handover initiation, inter-R
initiation
• QoS realization
• Security
LTE/EPC Interfaces
IMS

HSS External
IP networks Rx

PCRF
SGi

SASN
Gx

PDN GW
S10
S5/S8
S11
MME Serv GW

S1-MME S1-U

eNB

X2 LTE
LTE/EPC Interfaces
IMS

HSS External
IP networks Rx

PCRF
S6a SGi

SASN
Gx

PDN GW
S10
S5/S8
S11
MME Serv GW

S1-MME S1-U

eNB

X2 LTE
LTE/EPC Interfaces
IMS

HSS External
IP networks Rx

PCRF
S6a SGi

SASN
Gx

PDN GW
S10
S5/S8
S11
MME Serv GW

S1-MME S1-U

X2-AP GTP-U

SCTP UDP X2 Interface eNB

IP Connects
L2
neigboring
X2 LTE
eNodeBs
L1
LTE/EPC Interfaces
IMS

HSS External
IP networks Rx

PCRF
S6a SGi

SASN
Gx

PDN GW
S10
S5/S8
S11

S1-AP MME Serv

Serv GW
GW
SCTP
S1-MME Interface
IP Reference point for
control plane protocol S1-MME S1-U
L2
between E-UTRAN
L1 and MME
S1-U Interface
Reference point for GTP-U
X2-AP GTP-U
user plane protocol
UDP
SCTP UDP between E-UTRAN
X2
X2 eNB
X2Interface
Interface
Interface and MME IP
IP
Connects
Connects
Connects
L2 neigboring
neigboring
neigboring X2 LTE L2
eNodeBs
eNodeBs
eNodeBs L1
L1
LTE/EPC Interfaces
Diameter IMS
S6a Interface
SCTP AAA interface between
HSS External
MME and HSS that
IP
enables user access to IP networks Rx
L2
the EPS
L1 PCRF
S6a SGi

SASN
Gx

PDN GW
S10
S5/S8
S11

S1-AP MME Serv

Serv GW
GW
SCTP
S1-MME Interface
IP Reference point for
control plane protocol S1-MME S1-U
L2
between E-UTRAN
L1 and MME
S1-U Interface
Reference point for GTP-U
X2-AP GTP-U
user plane protocol
UDP
SCTP UDP between E-UTRAN
X2
X2 eNB
X2Interface
Interface
Interface and MME IP
IP
Connects
Connects
Connects
L2 neigboring
neigboring
neigboring X2 LTE L2
eNodeBs
eNodeBs
eNodeBs L1
L1
LTE/EPC Interfaces
Diameter IMS
S6a Interface
S6aInterface
SCTP AAAinterface
AAA interfacebetween
between
HSS External
MMEand
MME andHSS
HSSthat
that
IP
enablesuser
enables useraccess
accesstoto IP networks Rx
L2
theEPS
the EPS
L1 PCRF
S6a SGi

GTPv2-C SASN
Gx
UDP S10 Interface
IP Interface between
MMEs
L2
PDN GW
L1
S10
S5/S8
S11

S1-AP MME Serv

Serv GW
GW
SCTP
S1-MME Interface
IP Reference point for
control plane protocol S1-MME S1-U
L2
between E-UTRAN
L1 and MME
S1-U
S1-U Interface
Interface
Reference
Reference point
point for
for GTP-U
X2-AP GTP-U
user
user plane
plane protocol
protocol
UDP
SCTP UDP between
between E-UTRAN
E-UTRAN
X2
X2 eNB
X2Interface
Interface
Interface and
and MME
MME IP
IP
Connects
Connects
Connects
L2 neigboring
neigboring
neigboring X2 LTE L2
eNodeBs
eNodeBs
eNodeBs L1
L1
LTE/EPC Interfaces
Diameter IMS
S6a Interface
S6aInterface
SCTP AAAinterface
AAA interfacebetween
between
HSS External
MMEand
MME andHSS
HSSthat
that
IP
enablesuser
enables useraccess
accesstoto IP networks Rx
L2
theEPS
the EPS
GTPv2-C
GTP-C
L1 PCRF
UDP
S6a SGi
IP
GTPv2-C L2 SASN
S10 Interface Gx
UDP AAAInterface
S10 interface between L1

IP MME and between

Interface HSS that
S11 Interface
enables user access to
MMEs
L2 Control plane for creating,
the EPS PDN GW
modifying and deleting
L1
S10 EPS bearers.
S5/S8
S11

S1-AP MME Serv

Serv GW
GW
SCTP
S1-MME Interface
IP Reference point for
control plane protocol S1-MME S1-U
L2
between E-UTRAN
L1 and MME
S1-U
S1-U Interface
Interface
Reference
Reference point
point for
for GTP-U
X2-AP GTP-U
user
user plane
plane protocol
protocol
UDP
SCTP UDP between
between E-UTRAN
E-UTRAN
X2
X2 eNB
X2Interface
Interface
Interface and
and MME
MME IP
IP
Connects
Connects
Connects
L2 neigboring
neigboring
neigboring X2 LTE L2
eNodeBs
eNodeBs
eNodeBs L1
L1
LTE/EPC Interfaces
Diameter IMS
S6a Interface
S6aInterface
SCTP AAAinterface
AAA interfacebetween
between
HSS External
MMEand
MME andHSS
HSSthat
that
IP
enablesuser
enables useraccess
accesstoto IP networks Rx
L2
theEPS
the EPS
GTPv2-C
GTP-C
L1 PCRF
UDP
S6a SGi
IP
GTPv2-C L2 SASN
S10 Interface Gx
UDP AAA interface between L1

IP MME and HSS that

S11 Interface
enables user access to
L2 Control plane for creating,
the EPS PDN GW
modifying and deleting
L1
S10 EPS bearers.
S5/S8
S11

S1-AP MME Serv GW

SCTP S5/S8 Interface
S1-MME Interface Control and user
IP Reference point for plane
control plane protocol S1-MME S1-U tunneling between
L2 GTP-C/GTP-U
between E-UTRAN Serving GW and
L1 UDP
and MME PDN GW
S1-U
S1-U Interface
Interface IP
Reference
Reference point
point for
for GTP-U L2
X2-AP GTP-U
user
user plane
plane protocol
protocol
UDP L1
SCTP UDP between
between E-UTRAN
E-UTRAN
X2
X2 eNB
X2Interface
Interface
Interface and
and MME
MME IP
IP
Connects
Connects
Connects
L2 neigboring
neigboring
neigboring X2 LTE L2
eNodeBs
eNodeBs
eNodeBs L1
L1
LTE/EPC Interfaces
Diameter IMS SGi Interface
S6a Interface Comunicates CPG IP
SCTP AAA interface between
HSS External with external L2
MME and HSS that networks.
IP
enables user access to IP networks Rx L1
L2
the EPS
GTPv2-C
L1 PCRF Diameter
UDP
S6a SGi
TCP
IP Rx Interface
Transport policy IP
GTPv2-C L2 SASN
S10 Interface Gx control, charging and L2
UDP AAA interface between L1 QoS control.
MME and HSS that L1
IP
S11 Interface
enables user access to
L2 Control plane for creating, Gx Interface
the EPS PDN GW
modifying and deleting Provides transfer of
L1
S10 EPS bearers. policy and charging Diameter
S5/S8 Rules from PCRF to TCP
S11
PDN Gw.
IP
S1-AP MME Serv GW
L2
SCTP S5/S8 Interface
S1-MME Interface Control and user L1
IP Reference point for plane
control plane protocol S1-MME S1-U tunneling between
L2 GTP-C/GTP-U
between E-UTRAN Serving GW and
L1 UDP
and MME PDN GW
S1-U Interface IP
Reference point for GTP-U L2
X2-AP GTP-U
user plane protocol
UDP L1
SCTP UDP between E-UTRAN
X2 Interface eNB
and MME IP
IP
Connects
L2 neigboring X2 LTE L2
eNodeBs L1
L1
4G Call Flows
 INITIAL ATTACH – PART 1
UE eNodeB MME HSS DNS SGW PGW PCRF
1. RRC: Connection Establishment
NAS: Attach Request:
IMSI; PDN type
1. S1AP: Initial UE Message
TAI
NAS: Attach Request:
IMSI; PDN type
Authentication and
NAS Security 2. Dia: Authentication-Information- Request
Activation IMSI; Visited-
PLMN-Id
3. Dia: Authentication-Information-Request Answer
Authentication Information (EUTRAN-Vectors: RAND, AUTH, XRES, Kasme)
4. S1AP: Downlink NAS Transport
NAS: Authentication Request
RAND, AUTN
4. RRC: Downlink Information Transfer
NAS: Authentication Request
RAND, AUTN
5. RRC: Uplink Information Transfer
NAS: Authentication Response
RES
5. S1AP: Uplink NAS Transport
NAS: Authentication Response
RES
6. S1AP: Downlink NAS Transport
NAS: Security Mode Command

6. RRC: Downlink Information Transfer

NAS: Security Mode Command
7. RRC: Uplink Information Transfer
NAS: Security Mode Complete
7. S1AP: Uplink NAS Transport
NAS: Security Mode Complete
8. Dia: Update Location
MME Id; IMSI
9. Dia: Update Location Answer
APN; QoS; Charging Characteristics

10. DNS Query for GW Selection

INITIAL ATTACH – PART 2
UE eNodeB MME HSS DNS SGW PGW PCRF

11. GTPCv2: Create Session Request

MME F-TEID (S11); PGW IP-addr (S5-C); 12. GTPCv2: Create
PDN type; IMSI; bearer QoS; EBI Session Request
SGW F-TEID (S5-
C); SGW F-TEID (S5-U); 13. Dia: Control Credit Request
PDN type; IMSI; bearer
QoS; EBI Initial_Request; Called-Station-
Id (APN); Subscription-ID
(IMSI); Default-EPS-Bearer-QoS
(QCI&ARP) ; QoS Information
(APN-AMBR)
14. Dia: Control Credit Answer
15. GTPCv2: Create Initial_Request;
Session Response Default-EPS-Bearer-QoS
Cause (req acc); (QCI&ARP) ; QoS Information
16. GTPCv2: Create Session Response PGW F-TEID (S5-C); (APN-AMBR); Event-Trigger
Cause (req acc); SGW F-TEID (S11); SGW F-TEID (S1-U); UE PGW F-TEID (S5-U); UE
IP-add; bearer QoS; PDN F-TEID (S5-C); PGW F-TEID (S5-U); EBI IP-add; bearer QoS; EBI
17. S1AP: Initial Context Setup Req.
Bearer QoS; E-RABToBeSetup: QCI;
SGW S1-U IP+TEID;
NAS: Attach Accept
New GUTI; TA List, T3412 APN;
Bearer QoS; UE-IP-address;
17. RRC: Downlink Information Transfer
NAS: Attach Accept
New GUTI; TA List, T3412 APN; Bearer
QoS; UE-IP-address;
18. S1AP: Initial Context Setup Response
eNodeB S1-U
IP+TEID
19. RRC: Uplink Information Transfer
NAS: Attach Complete
19. S1AP: Uplink NAS Transport
NAS: Attach Complete
20. GTPCv2: Modify Bearer Request
eNodeB F-TEID (S1-U); EBI
21. GTPCv2: Modify Bearer Response
Cause; EBI;
ınterconnectıvıty

*Simultaneously attached users