View
234
Download
13
Category
Preview:
Citation preview
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
1/159
7/2/2
. . . . . . . . . . !
LTE/EPC Signaling CoursePresented Onsite at Nextel de Mexico
DCN NTDR-Jnz-f
!
!
Why Eogogics?Unmatched Expertise: Industry-leading 500-course curriculum based on our first-hand technology experience.Industry Recognized: Preferred or sole-source provider for Fortune 500 companies, R&D organizations, US government agencies, and trade groups.High Client Satisfaction: 100% of our classes rate good-to -excellent, 98% client retention, 85% of bu siness from client referrals.World-class Instructors: With advanced degrees, 15-40 years in the real world, publications, patents, awards/honors. They mix teaching, R&D, andconsulting to keep their technical edge razor sharp. Th eir instruction is clear, dynamic, and entertaining!Customized, Practical Courses: Partner with the instructor to design a course focused on your mission critical needs. Classes onsite or on the Web.Buy Coach, Travel First Class: Using technology to dr ive down our costs, we offer top-tier instructors and tailored courses for 15% below market.Knowledge That Can Power Your Organization: Avoid the cost and delay of trial-and-error! Benefit from our 20+ year experience, knowledge ofindustry best practices, and unbiased advice. We have been engaged in ground-breaking technology implementation projects worldwide for 20+ years.
Disney, Lockheed Martin, UBS, Boeing, Raytheon, Dell, AT&T, ABC News, Sprint Nextel, Comcast,SkyTerra, TruePosition, DIRECTV, L-3 Communications, ITT, SAIC, URS, Shaw, NII, Intelsat, Crown Castle, Harris, Booz Allen Hamilton, SpectraEnergy, Cooper, Bain & Company, DoD, HLS, DoE, DoC, DoJ, national labs, and NASA. Call or email today!
Our Skill SetEngineering: Systems Eng. (Methodol ogy, Best Practi ces, Management), Design Creativity, Out- of-t he-Box Thinking, GD&T, Statisti cal Tolerance Analysis, Po kaYoke, Materials and Processes (Metals, Plastics), Industrial Statistics, Design of Experiments, Statistical Process Control, Root Cause Fail ure Analysis, Failure Modesand Effects Analysis, Pro ject and People Management, Delivery Perfo rmance Improvement, Qualit y Management, Cost Reduction, Engineering Economi csSof tware Engineering: Principles, Writing Requirements, Configuration Management, Testing, Project Management, P roject Estimation, Quality AssuranceTelecom: Network Design/Implementation, Traffic Engineering, Security, Management (SNMP, Ethernet OAM), Cloud Computing, Cyber Security, Carrier Ethernet,ATM, BGP, IP Geo-location, IPv6, MoIP, IP Sec, MPLS, IMS, SIP, SIP Sec, VoIP, VoIP Sec, EoIP, IP TV, CAMEL, SS7, IMS, SIP, Optical Networks (SONET/SDH,DWDM, CWDM), Mobile Backhaul, OSS/BSS (eTOM, SID, TAM), Unified CommunicationsWireless and RF: 5G (Cognizant Radio, SDR, DSA), 4G (LTE, WiMAX), OFDM/MIMO, 3 G (UMTS, HSPA), GSM, GPRS/EDGE, CDMA,1xRTT, EVDO ,iDEN, TETRA, MPBN, MVNO, WiFi, Bluetooth, Mobile TV, Positioning/Location, LBS, RF, RF Safety, HF/VHF, Propagation/Fading, Antennas, Microwaves,SATCOM, Spectrum Engineering, Signal Processing, IEEE WCET ExamDefense, Public Safety and Security: 5G, 4G, 3G, and NextGen Technologies, Cyber Security/Warfare, Info. Security, E911, 911 (Voice, VoIP), CALEAAlso, Technical Management and Communications, Soft Skills, and Management/Leadership Development
www.eogogics.com , www.gogics.com , sales@eogogics.com , +1 703 281-3525, 1 (888) 364-6442
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
2/159
7/2/2
NoticesIntellectual Property Rights
Copyright 2014, Eogogics Inc.The contents of this document are the proprietary and copyrighted intellectual property
of Eogogics Inc. They may not be recorded, stored, reproduced, or transmitted byany means whatsoever without the express, written permission of Eogogics Inc.
Eogogics and Gogics are, respectively, a registered US trade mark and a servicemark of Eogogics Inc. Any other service or trade marks used in this document arethe property of their respective owners.
Contact Information
Eogogics Inc.Web: www.eogogics.com or www.gogics.comEmail: sales@eogogics.comMail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USAPhone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
NoticesThis Course Builds on the Following Eogogics Courses
(see www.eogogics.com for details):
LTE Advanced System Techniques LTE ADV 4 days LTE Air Interface Techniques LTE AI 3 days LTE Signaling and Functionality LTESIG 3 days
Contact Information
Eogogics Inc.Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.comMail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USAPhone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
3/159
7/2/2
LTE/EPC Overview
LTE/EPC 3GPP Standards
Evolution Path
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
4/159
7/2/2
Mobile Systems Evolution
TDMA
GSM
PDC
GPRS
EDGE EdgeEvolution
WCDMA HSDPA/ HSUPA
HSPA+
cdmaOne CDMA2000 CDMA20001xEV/DO
EV/DORevA
EV/DORevB
2G Evolved 3G3G
Source:gsacom.com
4G
LTE/EPC
Market TrendsDramatic uptake in broadband dataMigration to LTE:
From existing WCDMA/GSM networks From existing CDMA networks
High interest in service convergence Fixed and wireless
Broadband triple-play with mobility
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
5/159
7/2/2
Market TrendsWLAN access integration
Increased expectations for value-addedservices
DPI, policy, charging (subscriber management)
Focus on total cost of ownership Network simplification, shared resources
Driving forces for LTE/EPC
Efficiency Fewer payload carrying nodes between
subscriber and service Shorter latency (service access response,
mobility)
Lowering costs Lower cost per transmitted bit
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
6/159
7/2/2
Driving forces for LTE/EPC
Improving services High throughput to enable advanced services Common user service provision for all of
access technologies
Making use of new/refarmed spectrum More efficient radio utilization (new modulation
concept, increased spectrum flexibility)
Driving Forces for LTE/EPC
Better integration with other openstandards
Efficient mobility between 3GPP and non-3GPP using the same user service provision(GSM, WCDMA, LTE, CDMA2000, WLAN ...)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
7/159
7/2/2
Network Evolution
2009/10
3GPP Rel-8
eNodeB
MME
P+S-GW
User plane directlybetween RAN and
GW!
PDN
2007
3GPP Rel-7
NodeB
RNC
SGSN
GGSN
User planeessentially
outside SGSN!
PDN
2000
3GPP Rel-99
NodeB
RNC
SGSN
GGSN
User planetraffic t hrough
all nodes
PDN
SAE/LTE Releases: Evolution Steps-EPS backbone network, EPC: interconnects the following hosts:
- Mobile Management Entity (MME)
- Home Subscriber Server (HSS)
- Policy and Charging Rules Function (PCRF)
- Serving Gateway (SGW)
- Packet Data Network Gateway (PGW)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
8/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
9/159
7/2/2
3GPP LTE and SAE Work Items
SAEEPC Specifications(From Rel 8 onwards)
TSG SASpecification Group Work I tem
Result
SAE: System Architecture Evolution
EPC: Evolved Packet Core
LTEEUTRAN Specifications(36 series)
TSG RANSpecification Group Work I tem Result
LTE: Long Term Evolution
EUTRAN: Evolved UMTS Terrestrial Radio Access Network
LTE Specifications36.201 Physical layer general description36.211 Physical channels and modulation36.212 Multiplexing and channel coding36.213 Physical layer procedures36.214 Physical layer measurements
36.300 E-UTRA overall description36.302 Services provided by the physical layer36.304 UE Functions related to idle mode36.306 UE radio access capabilities36.321 Medium Access Control (MAC)
Protocol Specification36.322 Radio Link Control (RLC)
Protocol Specification36.323 Packet Data convergence Protocol (PDCP)
Protocol Specification36.331 Radio Resource Control (RRC)
Protocol Specification
36.101 UE radio transmission and reception (FDD)36.104 BTS radio transmission and reception (FDD)36.113 Base station EMC36.133 Requirements for support of Radio Resource
Management (FDD)36.141 Base station conformance testing (FDD)
36.401 E-UTRA Architecture Description36.410 S1 interface general aspects & principle36.411 S1 interface Layer 136.412 S1 interface signalling transport36.413 S1 application protocol S1AP36.414 S1 interface data transport36.420 X2 interface general aspects and principles36.421 X2 interface layer136.422 X2 interface signalling transport36.423 X2 interface application part X2AP36.442 UTRAN Implementation Specific O&M Transport29.274 GTP-C29.281 GTP-U
All specifications can be found on theweb site www.3gpp.org
23.002 Network Architecture23.003 Numbering, addressing and identification23.009 Handover Procedures23.048 Security mechanisms for USIM application23.401 GPRS enhancements for eUTRA23.203 QoS Concept
23.272 CS Fallback in EPS
24.301 NAS Protocol for Evolved Packet System (EPS)24.302 Access to the EPC via non 3GPP networks
33.401 System Architecture Evolution (SAE);Security Architecture
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
10/159
7/2/2
LTE/EPCArchitecture & Protocols
What Is LTE/EPC?Nodes in EPC& LTE
Functionality
Interfaces to other
systems between nodes
EPC(Core Network)
LTE(RadioAccess
Network)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
11/159
7/2/2
EPS Overview Architecture
eNB eNB
eNB
MME
S1
X2
X2
X2
SAE(System ArchitectureEvolution)
LTE(Long Term Evolution)
EPC(EvolvedPacket Core)
E-UTRAN
EPS(EvolvedPacketSystem)
UE
P/S-GW
3GPP Work Items
LTE/EPC Architecture
EvolvedPacketCore
S1-CP
E-UTRAN
eNodeBeNodeB
LTE
S1-UP
SAE
MME
S-GW
P-GW
S5/S8
X2-UP
X2-CP
MME
S11
S10HSS
PCRF
S6
Gx
Radio Bearer control,Connection Mobility Control
Scheduling for both UL and DL.
- terminates userplane packets
- switches the userplane to support UE
mobility
handles the chargingfor the service.
IP Point of Presence(PoP)
idle mode moblityand security
Quality of serviceand charging foreach data flow
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
12/159
7/2/2
Evolved Packet System (EPS) &WCDMA/GPRS
S1-MME S1-U
SGSN S3
S11
S6a
SGi
X2
S5/S8 EPC
EUTRAN
HSSGx
PGW
eNodeBeNodeB
SGW
MSC/VLR
PCRF
GPRS Network
UE
UE: User Equipment
HSS: Home Subscriber Server
PGW: Packet Data Network Gateway
SGW: Serving Gateway
MME: Mobility Management Entity
eNodeB: Enhanced Node B
PCRF: Policy and Charging Rules Function
SGSN: Serving GPRS Support Node
MSC: Mobile Switching Centre
VLR: Visitor Location Register
EPC: Evolved Packet Core
EUTRAN: Evolved UTRAN
LTE Uu LTE Uu: LTE UTRAN UE Interface
MME
S10
IP Networks
Only most importantinterfaces shown here
S4
User Plane
Control Plane
GSM/WCDMA/LTE Architecture - 3GPP
MME
S1-MME S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2 Iur
ServingGW
S5
PDN GW
Rx
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
13/159
7/2/2
EPC/LTE Architecture for Non- 3GPP
AAA
ePDGPDN GW
Serv GWMME
PCRF
SWx
S10
S11
S5/S8
SGi
S6b
Gx Gxc
Gxa Gxb
SWa
S2a
S2b
S2c
STa
SWn
SWm
ExternalIP networks
S9
S6a
S101S102
S103
Rx
SWu
HSS
ANDSFS14
Trustednon-3GPP
Non-trustednon-3GPP
IMS
Overall Architecture IMS Platform & Non-3GPP
PCRF
X2-UP
S1-UP
EPC
S1-CP
E-UTRAN
eNodeBeNodeB
S11
MME
S-GW
P-GW
S5/S8
X2-CP
P-CSCF
Gx
Network & Servicemanagement
OSS-RC EMA
MM DNS/ENUM
HSS
S-CSCF
I-CSCFIMS Controllayer
Platforms / Concepts
TSP/NSP orTSP/IS
DNS/ENUM
MGC
MGW
SUN
IS
A-SBG
CPP / RBS6000
Juniper/ Redback
WPP
GERAN UTRAN
BroadbandWired Access
GPRSPacketCore
SGSN
GGSN
CDMA2000HRPD
(EV-DO)
WLAN
N-SBG
Internet
S6a
CS Core
MSC
GWMSC
PSTN
PDSN
S1-AP, X2-AP
H.248
ISUP
Diameter
S3
S4
GTP-C
Gxa
S103
S2a
RNCOther
SIP/UDP or SIP/TCP
Rx+
User dataRTP/UDP GTP/UDP
S101
IMS Connectivitylayer
Service LayerAS AS ASApplication Servers MTAS
S6d
Uu
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
14/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
15/159
7/2/2
EPS Protocol Categories
L3 Signalling L2 Transport Non Access Stratum (NAS)
Communication between UE and MME
Radio Resource Control (RRC)Communication between UE and eNodeB
Packet Data Convergence Protocol (PDCP)- Ciphering and integrity protection for RRC messages- IP header compression/decompression for user plane
Radio Link Control (RLC)- Transfer of RRC messages and user data using:* Acknowledged Mode (AM)* Transparent Mode (TM) or* Unacknow ledged Mode (UM)- Error Correction (ARQ)
Medium Access Control (MAC)- Error Correction (HARQ)- Transfer of RRC mes sages and user data using:- Priority handling (scheduling)- Transport Format selection GPRS Tunneling Protocol Control (GTP-C)
- Communication between MME and SGW- Communication between SGW and PGW- Communication between MME and MME
S1 Application Protocol (S1AP)Communication between eNodeB and MME
X2 Application Protocol (X2AP)Communication between eNodeB and eNodeB
GPRS Tunneling Protocol User (GTP-U)Transfers data between GPRS tunneli ng endpoints
Logical Channels ControlBroadcast Control Channel (BCCH)
DL broadcast of system control information.Paging Control Channel (PCCH)
DL paging information. UE position not known on celllevel
Common Control Channel (CCCH) UL/DL. When no RRC connection exists.
Multicast Control Channel (MCCH) DL point-to-multipoint for MBMS scheduling and control,for one or several MTCHs.
Dedicated Control Channel (DCCH) UL/DL dedicated control information. Used by UEs
having an RRC connection.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
16/159
7/2/2
Logical Channels - Traffic
Dedicated Traffic Channel (DTCH) UL/DL Dedicated Traffic to one UE, user
information.Multicast Traffic Channel (MTCH)
DL point-to-multipoint. MBMS user data.
Channel Mapping
UL-SCHPCH DL-SCH
PCCH Logical Channelstype of information(traffic/control)
Transport Channelshow and with whatcharacteristics(common/shared/mc/bc)
Downlink Uplink
PDSCH
Physical Channelsbits, symbols,modulation, radioframes etc
MTCH MCCH BCCH DTCH DCCH DTCH DCCH CCCH
PRACH
RACH
CCCH
MCH BCH
PUSCHPBCH PCFICH PUCCH
-CQI
-ACK/NACK-Sched req.
-Sched TF DL-Sched grant UL-Pwr Ctrl cmd-HARQ info
MIB SIB
PMCH PHICHPDCCH
ACK/NACKPDCCH
info
Physical Signalsonly L1 info
RS SRSP-SCH S-SCH RS
-meas for DL sched-meas for mobility-coherent demod
-half frame sync-cell id
-frame sync-cell id group -coherent demod
-measurements forUL scheduling
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
17/159
7/2/2
Transport Channels - DL
Broadcast Channel (BCH) System Information broadcasted in the entire coverage
area of the cell. Beamforming is not applied.Downlink Shared Channel (DL-SCH)
User data, control signaling and System Info. HARQ andlink adaptation. Broadcast in the entire cell orbeamforming. DRX and MBMS supported.
Paging Channel (PCH) Paging Info broadcasted in the entire cell. DRX
Multicast Channel (MCH) MBMS traffic broadcasted in entire cell. MBSFN is
supported.
Transport Channels - UL
Uplink Shared channel (UL-SCH) User data and control signaling. HARQ and link
adaptation. Beamforming may be applied.Random Access Channel (RACH)
Random Access transmissions (asynchronous andsynchronous). The transmission is typically contention
based. For UEs having an RRC connection there is somelimited support for contention free access.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
18/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
19/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
20/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
21/159
7/2/2
NAS Signaling - MME
3GPP TS 24.301
UE Protocol Stack
ROHC/Ciphering
TM AM UM/AM
Physical Layer
L2
PDCP
RLC
MAC
RRC
NAS
Integrity/Ciphering
System InfoAquisition
CellSelection
PagingReception
MobilityManagement
SessionManagement
ConnectedMode
Mobility
NAS Security
IP
Application
AS Security RRCConnectionRB
ManagementvMeasurement
Reporting
C o
n t r o
l / R e p o r t
S A P s
RA Control HARQControl
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
22/159
7/2/2
NAS Elementary Procedures
EPS ElementaryProcedures
EPS Session Management EPS Mobility Management
"ready-to-use" IP connectivity and an "always-on" experience
EPS Mobility Management - EMM
3GPP TS 24.301
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
23/159
7/2/2
LTE States
LTE_DETACHED LTE_ACTIVE LTE_IDLE
IP address assigned
Position partially known
DL DRX period
No IP address
Position not known
IP address assigned
Connected to known cell
OUT_OF_SYNC IN_SYNC DL reception possible
No UL transmission
DL reception possible
UL transmission possible
Power-up
EMM Protocol States - Mobility
ECM-IDLE
EMM-DEREGISTERED
MME
Tracking Area (TA)
UEpositionnot knownin network
Signalingconnectionestablishment
Signalingconnectionrelease
Attach accept,TAU accept
Detach, Attach reject,TAU reject
EMM-REGISTERED
ECM-CONNECTED
Tracking Area Update(TAU)
Handover
PLMNselection
UE position known on Celllevel in eNodeBUE pos known on TA level in MME
eNB
RRC_IDLE RRC_IDLE RRC_CONNECTED
ECM: EPS ConnectionManagement
EMM: EPS MobilityManagement
RRC: Radio ResourceManagement
ECM connected =
S1 bearer+
RRC connection(SRB)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
24/159
7/2/2
EPS Network Operational Modes
EPS Session Management - ESM3GPP TS 24.301
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
25/159
7/2/2
EPS Protocol States - Bearers
3GPP TS 24.301
RRC Signaling
UE-MME
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
26/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
27/159
7/2/2
RRC States
ECM-IDLE
EMM-DEREGISTERED
UE positionnot knownin network
Signalingconnectionestablishment
Signalingconnectionrelease
Attach accept, TAUaccept
Detach, Attach reject, TAUreject
EMM-REGISTERED
ECM-CONNECTED
PLMNselection
RRC_IDLE RRC_IDLE RRC_CONNECTED
RRC Signaling3GPP TS 25.813
3GPP TS 36.300
3GPP TS 36.331
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
28/159
7/2/2
RRC Messages
CounterCheck CounterCheckResponse CSFBParametersRequest CSFBParametersResponse DLInformationTransfer HandoverFromEUTRAPreparationRequestMasterInformationBlock MeasurementReport MobilityFromEUTRACommand Paging RRCConnectionReconfiguration RRCConnectionReconfigurationComplete RRCConnectionReestablishment RRCConnectionReestablishmentComplete RRCConnectionReestablishmentReject RRCConnectionRelease RRCConnectionRequest RRCConnectionSetup RRCConnectionSetupComplete
SecurityModeCommand SecurityModeComplete SecurityModeFailure SystemInformation SystemInformationBlockType1UECapabilityEnquiry UECapabilityInformation ULHandoverPreparationTransfer ULInformationTransfer
CSFBParametersRequestCDMA2000 CSFBParametersResponseCDMA2000 HandoverFromEUTRAPreparationRequest (CDMA2000)ULHandoverPreparationTransfer (CDMA2000)
RRC SignalingIdle Mode
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
29/159
7/2/2
System Information Mapping
PCCH/PCH Paging: System Info Modification
MIB SIB1 SIB2 SIB3 SIB4
SI-2SI-1
SIB5
BCCH
BCH
PBCH PDSCH
BCCH
DL-SCH
PDSCH
DL-SCH
BCCH
TTI=80 TTI= 160 TTI= 320TTI= 40
System Information Blocks (SIBs)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
30/159
7/2/2
Idle Mode Cell Selection - Reselection
PLMN Selection
LocationRegistration
PLMNsavailable
PLMNselected
LocationRegistration
response
RegistrationArea
changes
Indicationto user
Manual Mode Automatic mode
Service requests
NAS Control
Radio measurements
Cell Selectionand Reselection
Support for manualCSG ID selection
AvailableCSG IDsto NAS
CSG IDselected
Core Network Initiated Paging
TAC 1
S1AP Paging message
RRC Paging message
TAC 2
The MME sends the PAGING mes sage to each eNode Bwith cells belonging to the tracking area(s) in which the UEis registered.
Each eNode B can c ontain cells belonging to differenttracking areas, whereas each cell can only belong to oneTA.
UEs use DRx when in idle mode in order to wak e at regularintervals to check for paging messages.
The paging response back to the MME is initiated on NASlayer and is sent by the eNB based on NAS-level routinginformation.
MME
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
31/159
7/2/2
Paging SignalingThe MME initiates a paging message which issent to all eNodeBs in a tracking area(s)
UEs use the RandomAccess procedure toinitiate access to theserving cell
NAS messagingcontinues in order toset up the call
S1-AP: INITIAL UE MESSAGE (FFS)+ NAS: Service Request+ eNB UE signalling connection ID
Random Access Procedure
NAS: Service Request
RRC PAGINGS1AP:Paging
MME
RRC Signaling Connected Mode
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
32/159
7/2/2
Signaling Radio Bearer (SRB) Establishment
RRC Connection SRB Establishment
LTE
RRC_ CONNECTED
MME
SIGNALLING RADIO BEARER 1 S1 BEARER
SIGNALLING RADIO BEARER 2
SIGNALLING RADIO BEARER 0
RRCConnection
Signalling Connection
+
"Signalling Radio Bearers " (SRBs) are defined as Radio Bearers (RB)that are used only for the transmission of RRC and NAS messages
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
33/159
7/2/2
Signalling Radio Bearers (SRBs)
Signalling Radio Bearers (SRBs) are offered by the PDCP layer to theRRC layer for transport of RRC (and NAS) messages
SRB0: Used for RRC messages on the CCCH SRB1: Used for RRC and NAS messages on the DCCH SRB2: Used for NAS messages, SRB2 has a lower-priority than
SRB1 and is always configured by E-UTRAN after securityactivation.
PDCP
RRCSRB0 SRB1 SRB2
RRC Connection Establishment
RRC Connection Request is initiated bythe higher layers in the UE
RRC Connection Setup(C-RNTI is allocated)
RRC connection establishmentprocedure creates the signaling radiobearer SRB#1,
RRC Connection Request CCCH/ULSCH
DLSCH RRC Connection Setup
RRC Connection Setup Complete DCCH/ULSCH
RRC IDLE
RRCCONNECTED NAS information for authentication
request is piggybacked to the RRCConnection Setup Complete message
IE/Group Name IE type and reference
RRC Establishment Cause: Emergency Call,High Priority Access,MT-Access,MO-Signalling,MO-Data
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
34/159
7/2/2
Security Related ProceduresMME
INITIAL CONTEXT SETUP REQUEST(Integrity Protection Algorithm EIA;
Ciphering Algorithm EEA;Security Key)
SECURITY MODE COMMAND(EEA;EIA)
SECURITY MODE COMPLETE
2. Decide Algorithms,Derive KeysActivate Security for SRB
INITIAL CONTEXT SETUP RESPONSE
RRC Security Mode Command is triggered by the EPC (MME) at S1 signaling message InitialContext Setup Request includes all security setting needed to start Integrity Protection ofthe control plane signaling and Encryption of the both user plane and control plane signaling(PDCP protocol).
Security setting includes Integrity Algorithm (EIA) Ciphering Algorithm (EEA) and Security key.
Counter Check Function
Used by UTRAN to request fromthe UE to verify the amount of datasent/received for each DRB
RRC COUNTER CHECK
RRC COUNTER CHECK RESPONSE
Additional security measures are added to LTE/SAE by adding Countercheck function UE is requested to check if, for each DRB, the mostsignificant bits of the COUNT match with the values indicated by E-UTRAN.
When RRC Counter Check is transmitted? Whenever eNB findsthe particular COUNT is exceeded than specific value eNB sends thismessage if it suspects that new data is introduced by an intruder in anyDRB which are used for data transfer between UE and eNB.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
35/159
7/2/2
Counter Check Function
Used by UTRAN to request fromthe UE to verify the amount of datasent/received for each DRB
RRC COUNTER CHECK
RRC COUNTER CHECK RESPONSE
Action UE will send Counter Check Response to eNB including:
- drb-CountInfoList,- drb-Identity,- counte-Uplick,- count-Downlink
All IE's correspond to that specific COUNT value.
procedure enables E-UTRAN to detect packet insertion by an intruder
Counter Check Function
Used by UTRAN to request fromthe UE to verify the amount of datasent/received for each DRB
RRC COUNTER CHECK
RRC COUNTER CHECK RESPONSE
procedure enables E-UTRAN to detect packet insertion by an intruder
Question Why needed to include an extra protection for intruderdetection? Isnt enough Integrity protection on security mode command?
Answer RRC Counter Check Procedure is part of Periodic localauthentication procedure in LTE in many countries regulations cipheringthe data over the Radio Interface is forbidden for National Security thereis a probability of the data connection being compromised by MAN inMIDDLE attack.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
36/159
7/2/2
RRC UL/DL Transparent MessagesInformation Transfer
RRC UL INFORMATION TRANSFER (NAS message)
RRC DL INFORMATION TRANSFER (NAS message)
purpose of this procedure transfer NAS or (tunneled) non-3GPPdedicated information from the UE to E-UTRAN
UE Capability Transfer
RRC UE CAPABILITY ENQUIRY
RRC UE CAPABILITY INFORMATION
S1AP: UE Capability Info Indication
UE Capability Retreival - This procedure retreives UE Radio Capability from UE and providesit the the MME.
Step 1 eNodeB requests the UE Radio Capability by sending RRC UE Capability Enquirymessage.
Step 2 UE responds to the eNodeB with requested UE Capability in teh UE CapabilityInformation message
Step 3 eNodeB forwards the received UE Radio Capabilities to teh MME in teh UECapability Info Indication
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
37/159
7/2/2
Radio Link Failure RCS Algorithm
RCS Algorithm procedure
Step 1 Upon "radio link problems detected, UE starts timer T310 - In case radio linkrecovery happens before T310 expires the UE stops the timer T310 and continues in stateRRC Connected.
Step 2 T310 expires and no recovery takes place UE starts timer T311 and starts searchingfor a new cell.-If the UE finds a cell before T311 expires RRC Connection re-establishment procedure istriggered.- In case T311 expiries before UE finds a cell than the UE enters idle mode.
Normal operationRadio
problemdetection
no recovery duringT310
no recovery duringT311 Return to idle
radio link failure
First Phase Second Phase
RRC_IDLERRC_Connected
-> RRC Connection Re- establishment Request
-> New RRConnection
Request
Maximum number (counterN310) of RLCretransimssions is reached
Radio Link Failure RRC Signaling
RRC CONNECTION RE-ESTABLISHMENT COMPLETE
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT
Procedure:
A waiting timer is started in eNodeB when- maximum number of RLC retransmissions has been reached, or
- maximum number of PDCCH Ordered Re-synchronization failure aredetected.
During this waiting timer, eNodeB expects from UE to trigger RRCConnection Re-establishment Request message If no RRCConnection Re-establishment Request is received during this time, UE isreleased back to idle mode.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
38/159
7/2/2
Radio Link Failure
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT REJECT
What if eNodeB cannot handle the incoming RRC Connection Re-establishment Request ?
eNodeB will respond with RRC Connection Re-establishment Reject message to the UE and initiate a UE release procedure towards MME.
RRC Signaling - RRC Mobility
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
39/159
7/2/2
Measurement Configuration Message
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
E-UTRAN provides the measurement configuration (events to trigger,thresholds, time to trigger, neighbors etc) applicable for a UE inRRC_CONNECTED mode
This is accomplished by dedicated signaling message
RRC Connection Reconfiguration
Measurement Configuration Type ofMeasurements
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
UE receives RRC Connection Reconfiguration message followingtypes of measurements might be requested:
- Intra-frequency measurements: (serving cell carrier frequency).- Inter-frequency measurements: (neighbor cell measurements at differentcarrier frequencies).- Inter-RAT measurements of UTRA frequencies.- Inter-RAT measurements of GERAN frequencies.- Inter-RAT measurements of CDMA2000 HRPD or CDMA2000 1xRTTfrequencies.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
40/159
7/2/2
Measurement ConfigurationParameters (1)
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Measurement objects :- For intra-frequency and inter-frequency measurements: object is asingle E-UTRA carrier frequency. Associated with this carrier frequency, E-UTRAN can configure a list of cell specific offsets and a list of blacklistedcells.- For inter-RAT UTRA measurements : object is a set of cells on a singleUTRA carrier frequency.- For inter-RAT GERAN measurements: object is a set of GERAN
carrier frequencies.- For inter-RAT CDMA2000 measurements: object is a set of cells on asingle (HRPD or 1xRTT) carrier frequency.
Measurement ConfigurationParameters (2)
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Reporting configurations: - Reporting criteria: The criteria that trigger the UE to send ameasurement report. This can either be periodical or a single eventdescription.- Reporting format: The quantities that the UE includes in themeasurement report and associated information (e.g. number of cells toreport).
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
41/159
7/2/2
Measurement ConfigurationParameters (3)
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Measurement identities: A reference number
A list of measurement identities each measurement identity links onemeasurement object with one reporting configuration .
Measurement identity is used as a reference number in the measurement
report.
Measurement ConfigurationParameters (4)
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Quantity configurations: defines the measurement quantities andassociated f iltering used for all event evaluation and related reporting ofthat measurement type. E.g. RSRP (Reference Signal Received Power) ,RSRQ (Reference Signal Received Quality).
- quantity configuration for intra-frequency measurements,- quantity configuration for inter-frequency measurements- quantity configuration for RAT type.
One filter can be configured per measurement quantity
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
42/159
7/2/2
Measurement ConfigurationParameters (5)
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Measurement gaps: Periods that UE may perform measurements, i.e. no(UL, DL) transmissions are scheduled.
The measurement procedures for different types of cells:
-The serving cell.
-Listed cells - these are cells listed within the measurement object(s).
- Detected cells - these are cells that are not listed within themeasurement object(s) but are detected by the UE on the carrierfrequency(ies) indicated by the measurement object(s).
Measurement Reporting
UE performs measurements and reports back only when event criteria are met!
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
LTELTE
Best CellEvaluation
LTE
LTE
Examples:
-Event A3 A neighbour cellbecomes offset better thanserving cell
- Event A2 Serving cellbecomes worse than anabsolute threshold
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
43/159
7/2/2
Measurement Reporting Triggering events
LTE LTE
Best CellEvaluation
LTE
LTE
Examples:
-Event A3 A neighbour cellbecomes offset better thanserving cell
- Event A2 Serving cellbecomes worse than anabsolute threshold
Measurement Reporting Criteria
RRC CONNECTION RECONFIGURATION(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
Reporting criteria Reporting threshold Hysteresis Time-to-trigger Reporting interval
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
44/159
7/2/2
Example
RRC Signaling Flow Attach Request
To be discussed in class ..
RRC Signaling Flow Example Attach RequestMME
7. INITIAL UE MESSAGE(Attach Request)
14. INITIAL CONTEXT SETUP REQUEST(EPS bearers, AttachAccept, Security)
22. INITIAL CONTEXT SETUP RESPONSE(EPS bearers)
1. System Information*
4. RRC CONNECTION REQUEST
5. RRC CONNECTION SETUP
15. RRC SECURITY MODE COMMAND16.RRC SECURITY MODE COMPLETE
6. RRC CONNECTION SETUP COMPLETE(Attach Request)
2. RandomAccess Preamble3. Random Access Response
20. RRC CONNECTION RECONFIGURATION(Attach Accept, Bearer Setup)
21. RRC CONNECTION RECONFIGURATION COMPLETE
10.RRC DL INFORMATION TRANSFER(Authentication Request)
11. RRC UL INFORMATION TRANSFER(Authentication Response)DL NAS TRANSPORT(Authentication)
UL NAS TRANSPORT(Auth. Response)
12. RRC DL INFORMATION TRANSFER(Security Mode Command)
13. RRC UL INFORMATION TRANSFER(Security Mode Complete)
DL NAS TRANSPORT(NAS SMC)UL NAS TRANSPORT(NAS SMC)
CellSelect*
23. RRC UL INFORMATION TRANSFER(AttachComplete)) UL NAS TRANSPORT(AttachComplete)
RRC IDLE
RRC IDLE
8.RRC DL INFORMATION TRANSFER(UE Identity Request)
9. RRC UL INFORMATION TRANSFER(UE Identity Response)
DL NAS TRANSPORT(UE IdentityReq)UL NAS TRANSPORT(UEidResponse)
17. RRC UE CAPABILITY ENQUIRY
18. RRC UE CAPABILITY iNFORMATION19. UE CAPABILITY INFO I NDICATION
(UE Radio Capability)
24. UE CONTEXT RELEASE COMMAND
26. RRC CONNECTION RELEASE 25. UE CONTEXT RELEASE COMPLETE
RRCCONNECTED
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
45/159
7/2/2
PDCP Protocol
PDCP Functions
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
46/159
7/2/2
PDCP Architecture
Radio Bearers
UE/E-UTRAN
PDCP...
RLC
PDCP - PDU
RLC- SDU
PDCP-SAP
RLC UM-SAP RLC AM-SAP
PDCP entity PDCP entity
PDCP-SAP
...
TS 36.323
PDCP Entity Architecture
Radio Interface (Uu)
UE/E-UTRAN E -UTRAN / UETransmittingPDCP entity
Ciphering
Header Compression(user plane only)
ReceivingPDCP entity
Sequence numbering
Integrity Protection(control plane only)
Add PDCP header
Deciphering
Remove PDCP Header
In order delivery and duplicateDetection (U plane)
Integrity Verification(control plane only)
Packets associatedto a PDCP SDU
Header Compression(user plane only)
Packets associatedto a PDCP SDU
P a c k e
t s N
OT
a s s o c i a t e d
t o aP D
C P
S D
U
P a c k e
t s N
OT
a s s o c i a
t e d
t o aP D
C P
S D
U
TS 36.323
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
47/159
7/2/2
Sequence Numbering
Sequence numbering is used by several functions:
- Reordering of the PDCP PDUs at the receiver side
- Duplicate detection in case of packet forwarding at handover
-Calculation of COUNT, used for integrity protection and ciphering.
Sequence NumberingWHY: * Reordering
* Duplicate detection* Integrity protection* Ciphering
HOW:PDCP SN:
Next_PDCP_TX_SN
TX_HFN
COUNT
eNB
UECtx
SRB1_UL
DRB_UL
COUNT
COUNT
COUNT
SRB1_DL
DRB_DL
COUNT
UE
COUNT SRB1_DL
SRB1_UL
DRB_DL
DRB_UL
HFN PDCP SN
COUNT
COUNT
COUNT
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
48/159
7/2/2
Header CompressionWHY: Saving the bandwith byHOW: *removing redundant info
*Encoding important info*Hop by Hop*Unidirectional
RB_ULRB_ULHeader PDCP PDU PDCP PDUHeaderPDCP PDU
CRCchecksum covering the header beforecompression is included in the compressed header
CompressedHeaderContainsencoded data
UE/UE Context
UE/UE Context
For Voice over IP, interactive games,messaging etc, the payload of the IP
packet is sometimes even smaller thanthe header.
Based on the RobustHeader Compression
(ROHC) frameworkIETF RFC 3095
Security Handling Integrity &CipheringIntegrity protection:- is implemented in the PDCP layer in order to ensure that the data originof the signaling data is indeed the one claimed.- check also that received data has not been modified in an unauthorizedway.
Data encryption (ciphering): is to ensure that the user data cannot beeavesdropped on the radio.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
49/159
7/2/2
Integrity Protection
integrity protection key K_ eNB _ RRC Int
-generated from K ASME procedure during EPS Authentication and Key Agreement(AKA) procedure.- UE computes K ASME based on Authentication Request message parameters.
EIACOUNTDirectionK_ eNB_RRCInt
PDCP PDUPDCP PDUHeader PDCP SDU
Bearer Id
MAC-I
Transmitter
WHY: To ensure data origin
3GPP TS 33.401
Which algorithm to use is decided by eNodeB byduring RRC security activation
Upper layer parameters (required by PDCP):
- BEARER , defined as the radio bearer identifier,(SRB1 will use the value RB identity 1)
- KEY (KRRC int).
Integrity Protection
EIACOUNTDirectionK_ eNB_RRCInt
PDCP PDUPDCP PDUHeader PDCP SDU
Bearer Id
MAC-I
P D
C P P D
U
H e a d er
P D
C P
S D
U
EIACOUNT
DirectionK_ eNB_RRCInt
PDCP PDUPDCP PDUHeaderPDCP SDU
Bearer Id
XMAC-I
XMAC-IMAC-I =
Transmitter Receiver
WHY: To ensure data origin
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
50/159
7/2/2
Ciphering
PLAINTEXTBLOCK
EEA
COUNT DIRECTION
BEARER LENGTH
KEY UPenc
KEYSTREAMBLOCK
CIPHERTEXTBLOCK
Sender
WHY: To protect the data over radio
3GPP TS 36.331
integrity protection key K_ UP enc-generated from K ASME procedure during EPS Authentication and Key Agreement(AKA) procedure.- UE computes K ASME based on Authentication Request message parameters.
Required parameters by PDCP forciphering (3GPP TS 33.401):
- COUNT
- DIRECTION (DL or UL)
- BEARER (defined as the radio beareridentifier )
- KEY (the ciphering keys for the controlplane and for the user plane are KRRCencand KUPenc, respectively).
Ciphering
PLAINTEXTBLOCK
EEA
COUNT DIRECTION
BEARER LENGTH
KEY UPenc
KEYSTREAM
BLOCK
CIPHERTEXTBLOCK
EEA
DIRECTION
BEARER LENGTH
KEYSTREAM
BLOCK
PLAINTEXTBLOCK
Sender Receiver
EEA0EEA1EEA2
COUNT
WHY: To protect the data over radio
KEY UPenc
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
51/159
7/2/2
RLC Protocol
RLC Functions3GPP TS 36.322
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
52/159
7/2/2
RLC Sublayers3GPP TS 36.322
RLC Logical Channels3GPP TS 36.322
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
53/159
7/2/2
RLC Modes3GPP TS 36.322
RLC TM Entity
Transmissionbuffer
TransmittingTM-RLCentity
TM-SAP
radio interface
ReceivingTM-RLC
entity
TM-SAP
UE/ENB ENB/UE
BCCH/PCCH/CCCH BCCH/PCCH/CCCH
- BCCH Broadcast Control Channel (System Information transfer)- DL/UL CCCH Common Control Channel ( example: RRC Connection Request )- PCCH Paging Control Channel (Paging)
No Header
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
54/159
7/2/2
RLC Transparent Mode PDU
The RLC TM PDU introduces no overhead
TM is used for signaling on BCCH and
PCCH.
RLC UM Entity
UM RLC entity is supposed to carry user data payload for the time critical servicesthat tolerate a higher packet loss rate. Eg. Voice over IP.RLC in Unacknowledged Mode is a licensed feature
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
55/159
7/2/2
RLC Unacknowledged Mode PDU,5 Bits SN
UMD PDU with 5 bit SN(Odd number of LIs, i.e. K = 1, 3, 5, )
PDU with 5 bit SN(Even number of LIs, i.e. K = 2, 4, 6, )
E Extension FieldFI Framing InformationSN Sequence Number
RLC Unacknowledged Mode PDU,10 Bits SN, cont
UMD PDU with 10 bit SN(Odd number of LIs, i.e. K = 1, 3, 5, )
UMD PDU with 10 bit SN(Even number of LIs, i.e. K = 2, 4, 6, )
E Extension FieldFI Framing InformationSN Sequence Number
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
56/159
7/2/2
RLC AM Entity
Transmissionbuffer
Segmentation &Concatenation
Add RLC header
Retransmissionbuffer
RLC control
Routing
Receptionbuffer & HARQ
reordering
SDU reassembly
DCCH /DTCH DCCH /DTCH
AM -SAP
Remove RLC header
RLC Acknowledged Mode PDU
SOSOLSF Oct 3
Oct 4
LI2
E LI2 (if K>=3)E LI1
LI1
D/C RF P FI E SNSN
Data
Oct N
Oct 1Oct 2
Oct 5Oct 6Oct 7
LIK-1
E LIK-1
E LIK-2LIK-2
PaddingE LIK
LIK Oct [4.5+1.5*K]Oct [4.5+1.5*K-1]Oct [4.5+1.5*K-2]Oct [4.5+1.5*K-3]Oct [4.5+1.5*K-4]
Oct [4.5+1.5*K+1]
Present ifK >= 3
D/C Data/ControlE Extension FieldFI Framing InfoLSF Last Segment FlagP Poll BitRF Resegmentation FlagSN Sequence NumberSO Segment Offset
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
57/159
7/2/2
RLC Acknowledged Mode PDUPositive Acknowledgment
RLC Acknowledged Mode PDUNegative Acknowledgment
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
58/159
7/2/2
Information Element: E Bit
Extension bit indicates whether Data field follows or a set of Efield and LI field follows
Information Element: Length Indicator LI
Length Indicator (LI) fieldThe LI field indicates the length in bytes ofthe corresponding data field element presentin the RLC data PDU delivered/received byan UM or an AM RLC entity.
The value 0 is reserved.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
59/159
7/2/2
Information Element:FI Framing Information Field
Information Element:Segment Offset SO
The Segment Offset field indicates theposition of the AMD PDU segment in byteswithin the original AMD PDU.
The first byte in the Data field of the originalAMD PDU is referred by the SO field value"000000000000000"
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
60/159
7/2/2
Information Element:Last Segment Flag LSF
Information Element:Resegmentation Flag RF
Value Description0 AMD PDU
1 AMD PDU segment
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
61/159
7/2/2
Information Element: Poll P
Value Description
0 Status report not requested
1 Status report is requested
Polling bit field
Information Element:Control Pdu Type CPT
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
62/159
7/2/2
STATUS PDU
NACK_SN
D/C CPTE1
ACK_SNACK_SN
Oct 1Oct 2
NACK_SNE1 E2 NACK_SN
NACK_SNSOstart
SOstart
SOendSOend
E1 E2
SOend
Oct 3Oct 4Oct 5Oct 6Oct 7Oct 8Oct 9
D/C Data/ControlCPT Control PDU TypeE Extension FieldSO Segment Offset
STATUS PDU Fields
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
63/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
64/159
7/2/2
MAC Sublayers3GPP TS 36.321
MAC Functions - UE Side
RandomAccess Control
PCCH BCCH CCCH DCCH DTCH MAC-control
Upper layers
PCH BCH DL-SCH UL-SCH RACH
Lower layer
(De-) Multiplexing
Logical Channel Prioritization (UL only)
HARQ
Control
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
65/159
7/2/2
MAC Functions eNodeb Side
Scheduling / Priority Handling
Multiplexing
DCCH DTCHCCCH
HARQ
DL-SCH HARQFeedback
Control
HARQ
Demultiplexing
DCCH DTCH
UL-SCH
CCCH
MAC Control
BCCHPCCH
Scheduling / PriorityHandling
HARQ
HARQFeedback P
D C C H
P U C C H
S R
S c
h e
d u
l e r
BCHPCH DL-SCH
MAC Function Location
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
66/159
7/2/2
MAC Transport Channels3GPP TS 36.321
MAC DL-SCH Transport Channel3GPP TS 36.321
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
67/159
7/2/2
Physical Channels
MAC MultiplexingIPvia S1 or fromUEs stack
Payloade.g. 1460 Byte
IP20B
L1Coding,Interleaving,Modulation
CRC3B
Transport Bloc k
TCP20B
Payloade.g. 50 Byte
IP20B
TCP20B
PDCPHeader Compression& Ciphering PDCP SDU
H~3B
PDCP2B
H~3B
PDCP2B
PDCPPDU
RLCSegmentationconcatenation
RLC4B
RLC SDU
Concatenation
Segmentation
RLC SDU RLCPDURLC
2B
MACMultiplexing MAC SDU (e.g. 927 Byte)MAC4B
Multiplexing (Padding)MAC1B MAC SDU (e.g. 599 Byte)
MACPDU
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
68/159
7/2/2
MAC PDU Structure
A MAC PDU header consists of one or more MAC PDU subheaders
Each subheader corresponds to either a MAC SDU (RLC PDU), a MACcontrol element or padding.
LCID Logical Channel IDE Extension BitR ReservedF Length FlagL Length
MAC Controlelement 1 ...MAC header
MAC payload
MAC Controlelement 2 MAC SDU MAC SDU
Padding(opt)
...R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID paddingsub-header
MAC PDU
MAC PDU Structure
LCID Logical Channel IDE Extension BitR ReservedF Length Flag
L Length
MAC Controlelement 1 ...MAC header
MAC payload
MAC Controlelement 2 MAC SDU MAC SDU
Padding(opt)
...R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID paddingsub-header
A MAC PDU subheader consists of the six header f ields R/R/E/LCID/F/L except for the lastsubheader in the MAC PDU and for fixed sized MAC control elements.
R/R/E/LCID sub-header
LCIDR R E Oct 1
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
69/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
70/159
7/2/2
MAC PDU Structure MAC SDUsLCID Logical Channel IDE Extension BitR ReservedF Length FlagL Length
MAC Controlelement 1 ...MAC header
MAC payload
MAC Controlelement 2 MAC SDU MAC SDU
Padding(opt)
...R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID/F/Lsub-header
R/R/E/LCID paddingsub-header
MAC Signaling Procedures
RANDOM ACCESS
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
71/159
7/2/2
Channel Mapping
UL-SCHPCH DL-SCH
PCCHLogical Channelstype of information(traffic/control)
Transport Channelshow and with whatcharacteristics(common/shared/mc/bc)
Downlink Uplink
PDSCH
Physical Channelsbits, symbols,modulation, radioframes etc
MTCH MCCH BCCH DTCH DCCH DTCH DCCH CCCH
PRACH
RACH
CCCH
MCH BCH
PUSCHPBCH PCFICH PUCCH
-CQI-ACK/NACK-Sched req.
-Sched TF DL-Sched grant UL-Pwr Ctrl cmd-HARQ info
MIB SIB
PMCH PHICHPDCCH
ACK/NACKPDCCH
info
Physical Signalsonly L1 info
RS SRSP-SCH S-SCH RS
-meas for DL sched-meas for mobility-coherent demod
-half frame sync-cell id
-frame sync-cell id group -coherent demod
-measurements forUL scheduling
MAC Signaling Procedures -RANDOM ACCESS PROCEDURESWhen???
- enable initial access - UE to E-UTRAN (CBRA)
- enable Handover access - UE to E-UTRAN (CFRA)
- establish UL synchronization (CFRA)
- Indicate presence of UL data (when not scheduled for long time) (CFRA)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
72/159
7/2/2
Random Access CBRA (ContentionBased Random Access)
When???
- used at initial access (initialcall setup)
- subject to collision (ALOHA Protocol)
CBRA
Random Access Preamble(Randomly selected Preamble Id)
Random Access Response
RRC Connection Request
UE eNB
1.
2.
3.
4.RRC Connection Setup
CBRA RANDOM ACCESS Initial Access for RRC Connection Establishment
Example
CBRA RANDOM ACCESS Initial Access for RRC Connection Establishment
To be discussed in class
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
73/159
7/2/2
CBRA RANDOM ACCESS Initial Access for RRC Connection Establishment
BCCH: System Information
CCCH: RRC Connection Request (Initial UE identity, Cause)
CCCH: RRC Connection Setup (SRB1 parameters)
DCCH : RRC Connection Setup Complete (Selected PLMN id, NAS: Attach Request *)
PRACH: RACH preamble
DL-SCH: RACH response(RAPID; TC-RNTI);
RRC RRC
RRC RRC
RRC RRC
RRC RRC
e N o
d e
B
rach-Configuration {preambleInformation { numberOfRA-Preambles n64 },powerRampingParameters { powerRampingStep dB2,preambleInitialReceivedTargetPower dBm-104 },ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf 4,mac-ContentionResolutionTimer sf 48 },maxHARQ-Msg3Tx 1 },
UE randomly selectsone of the 64 preambles and send it based onpreambleInitialReceivedTargetPower
PRACH: RACH preamble
If no answer is received withinra-ResponseWindowSize preamble issent again based onpreambleInitialReceivedTargetPower + powerRampingStep
PDCCH: RA-RNTI; Scheduling Grant;TA
RA-RNTI = 1+ t_id + 10f_idMAC allocate TC-RNTI
PUSCH: TC-RNTIUL SCH: RA message3
PDCCH: TC-RNTI; Scheduling GrantDL-SCH: C-RNTI; Contention Resolution
UL-SCH: C-RNTI; BSR
Use TC-RNTI to decode DL SCH. If the UE contentionresolutionidentity MAC control element matches the RRC connectionrequestmessage promote TC-RNTI to C_RNTI.
The TC-RNTI is "promoted" to a C-RNTI,i.e. the same 16-bit valueallocated for TC-RNTIwill continue to be used as C-RNTIafter the random access procedureis succes sfully concluded.
The 40-bit MAC "UE contention resolutionidentity" is identical to the RRC ConnectionRequest sent in RA message 3.
If the UE sees its preamble, itwill respond with RRCConnectionReqIncluding its 40 bit UE-id and Est.Cause)
MACMAC
MAC MAC
MACMAC
MAC MAC
MACMAC
Random Access CFRA (ContentionFree Random Access)
When???
- is used for UEs in handover
- a special preamble is reserved
CFRA
Random Access Preamble(Pre-allocated Preamble Id)
Random Access Response
RRC Connection Request
UE eNB
1.
2.
3.
4.RRC Connection Setup
CFRA RANDOM ACCESS Handover Access
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
74/159
7/2/2
UE1 is assigned preamble pUE1 by means of RRCsignalling via cell 1 which is the serving cell of UE1
CFRA RANDOM ACCESS Handover Access
p UE1
RRC: RACH - ConfigDedicated
Cell 1 Cel l 2
p UE1
R RC : R ACH - ConfigDedicated
p UE1
R RC : R ACH - ConfigDedicated
Cell 1 Cel l 2
p UE1
R RC : R ACH - ConfigDedicated
Random Access CFRA (ContentionFree Random Access)
When???
- is used for UEs in re-synchronizationprocedure when non scheduled.
- a special preamble is reserved
CFRA
Random Access Preamble(Pre-allocated Preamble Id)
Random Access Response
RRC Connection Request
UE eNB
1.
2.
3.
4.RRC Connection Setup
CFRA RANDOM ACCESS UE out_of_sync resynchronization process
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
75/159
7/2/2
CFRA RANDOM ACCESS Uplink re-synchronization
- UE is scheduled for downlink data from eNodeB uplink Scheduler
- UE is out_of_sync (unsynchonized) due to following event:non scheduled time period > timeAlignmentTimer
and alignment expiration has occurred (UL timing adjustment process)- eNodeB through PDCCH physical channel on downlink transmissionassigns a reserved preample to UE- UE uses preample and starts CFRA process to get back synchronization.
PDCCH for DL
data arrival
PDCCH for DL
data arrival
PDCCH for DL
data arrival
PDCCH for DL
data arrival e
N o
d e
B
Random Access CFRA (ContentionFree Random Access)
When???
- UE has data (overflowing) into buffer
- eNodeB has not scheduled UE sincelong time
- UE requests scheduling using CFRArandom access procedure since it hasbeen UL out_of_sync
- a special preamble is reserved fromeNodeb and signaled through PDCCH
CFRA
Random Access Preamble(Pre-allocated Preamble Id)
Random Access Response
RRC Connection Request
UE eNB
1.
2.
3.
4.RRC Connection Setup
CFRA RANDOM ACCESS UE UL_Scheduling Request to eNodeb UL scheduler
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
76/159
7/2/2
Example
CFRA RANDOM ACCESS UE UL_Scheduling Request to eNodeb UL scheduler
To be discussed in class ...
CFRA RANDOM ACCESS UE UL_Scheduling Request to eNodeb UL scheduler
no PUCCH resources
no UL Synch (TAT is not running)
has repeated SR on PUCCH max no of times
BCCH: System Information
PRACH: RACH preamble
DL-SCH: RACH response(RAPID; TC-RNTI);
RRC RRC
e N o
d e
Brach-Configuration {preambleInformation { numberOfRA-Preambles n64 },powerRampingParameters { powerRampingStep dB2,preambleInitialReceivedTargetPower dBm-104 },ra-SupervisionInformation { preambleTransMax n10,ra-ResponseWindowSize sf 4,mac-ContentionResolutionTimer s f48 },maxHARQ-Msg3Tx 1 },
UE randomly selectsone of the 64 preambles and send it based onpreambleInitialReceivedTargetPower
PRACH: RACH preamble
If no answer is received withinra-ResponseWindowSize preamble issent again based onpreambleInitialReceivedTargetPower + powerRampingStep
PDCCH: RA-RNTI; Sc heduling Grant;TA
RA-RNTI = 1+ t_id + 10f_idMAC allocate TC-RNTI
PUSCH: C-RNTIUL SCH: msg3 (BSR,
PHR)
PDCCH: C-RNTI; Scheduling Grant
UL-SCH: C-RNTI; BSRUse C-RNTI to dec ode DL SCH..
MAC
C-RNTI provides co ntention resolution
If the UE sees its preamable, itwill respond with Scheduling Requestby sending msg3 containing MACcontrol elements( BSR and/or PHR)and identified by C-RNTI
RLCRLCDTCH/DCCH:
Scheduled Unicast Transmission
MAC
MACMAC
MAC MAC
MACMAC
MAC
MAC MAC
MAC
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
77/159
7/2/2
MAC Signaling Procedures
UL Time Alignment
MAC Signaling ProceduresUL Time AlignmentProblem statement :
Different UEs within a cell will experience different propagation delayto/from the cell site, depending on their exact position within the cellcoverage area.
UE 2
UE 1
Normally transmit timing is basedonly on the timing of the receiveddownlink timing as a result theircorresponding uplink transmissions
will thus arrive at the cell site withpotentially very different timing.
Receive-timing differences might be too large orthogonality betweenuplink transmissions of different UEs will not be retained subcarriers willbe out_of_sync OFDM orthogonality is lost !!! .
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
78/159
7/2/2
MAC Signaling ProceduresUL Time Alignment
Solution :A mechanism with an active uplink transmit-timing control is needed toensure that uplink transmissions from different UEs are received withapproximately the same timing at the cell site
transmit-timing control mechanism:
- network measures received uplink timingof the different UEs.
- adjusts (advance (+) command or retard() command) transmit timing on a certainamount.
- timing-control commands are transmittedas higher-layer signaling (MAC) to theUEs. UE 2
UE 1
Timing Advance CommandR R Oct 1
MAC Signaling ProceduresUL Time AlignmentSolution :A mechanism with an active uplink transmit-timing control is needed toensure that uplink transmissions from different UEs are received withapproximately the same timing at the cell site
transmit-timing control mechanism:
- UE has a configurable timer,
timeAlignmentTimer ,
- used to control how long the UE is considereduplink time aligned .- When timer expires and no timing controlcommand is received (non scheduled UE)CFRA Random Access process is needed
- timeAlignmentTimer is valid only in the cellfor which it was configured and started .
UE 2
UE 1
Timing Advance CommandR R Oct 1
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
79/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
80/159
7/2/2
MAC Signaling ProceduresMAC Scheduler Blocks
MAC Signaling ProceduresMAC Schedulerdata1data2data3data4
User #1 scheduled
User #2 scheduled
Time-frequenc yfading, user #1
Time-frequencyfading, user #2
Channel dependant scheduler- Adapts UE rate to channel conditions
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
81/159
7/2/2
UL-SCHPCH DL-SCH
PCCHLogical Channelstype of information(traffic/control)
Transport Channelshow and with whatcharacteristics(common/shared/mc/bc)
Downlink Uplink
PDSCH
Physical Channelsbits, symbols,modulation, radioframes etc
BCCH DTCH DCCH DTCH DCCH CCCH
PRACH
RACH
CCCH
BCH
PUSCHPBCH PCFICH PUCCH
-CQI-(N)ACK-Sched req.
-Sched TF DL-Sched grant UL-Pwr Ctrl cmd-HARQ info
MIB SIB
PHICHPDCCH
ACK/NACKPDCCH
info
Physical Signalsonly L1 info
DL Scheduling UL Scheduling
RS P-SCH S-SCH RS SRS
MAC Signaling ProceduresScheduled Channels
MAC Signaling ProceduresScheduled DL Resources
f
t
Two RBs
0.5ms0.5ms
One Scheduling Block
180 kHz
1 ms
Scheduler
Link AdaptationSBs
f
SINR
MIMO
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
82/159
7/2/2
MAC Signaling ProceduresUL Scheduler
Modulation, coding
Buffer
MultiplexingScheduler
Buffer
Uplink channel qualityScheduler
Multiplexing
Buffer
Modulation, coding
Priority handling
Buffer
eNodeB eNodeB
UE UE
C Q I
S t a t u s
T F s e
l e c
t i o n
Downlink Uplink
Downlinkchannel quality
MAC Signaling ProceduresMAC Scheduler
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
83/159
7/2/2
MAC Signaling Procedures
HARQ
MAC Signaling ProceduresHARQLTE protocols over IP/ethernet transmission ( Link Layer (ethernet), Networklayer (IP) and transport network protocols (TCP, UDP) ) are not prepared torecover from packet header bit errors and packet payload errors.
Although channel dependant MAC Scheduler adjusts scheduling to UEchannel conditions, BER unrecovery conditions might still be a problem thatmight introduce large amount of retransmissions over the air interface
One potential solution might be the propagation of BER recovery functions tohigher layer protocols however it might introduce unaccepted delays
Another potential solution might be the choice to discard and fast retransmitthe entire data unit containing bit errors Physical layer Turbo coding correcterrors on receiver and CRC check BER to decide.....
LTE 3GPP standards define two layers of retransmission protection. HARQ onMAC and ARQ on RLC
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
84/159
7/2/2
HARQ (MAC) and ARQ (RLC)
UL ARQTransmitter
UL ARQReceiver
UL HARQTransmitter
DL HARQReceiver DL HARQTransmitter
UL HARQReceiver
Sliding Window ARQ
Stop and Wait HARQ
Uplink L1
Downlink L1
RLC Status(DL HARQ data)
RLC Status RLC PDUs RLC PDUs
Transport Block +CRCBLER ~10 -1
RLC
MAC
BLER ~10 -4 to 10 -3 BLER ~10 -4 to 10 -3
RLC PDUs
BLER ~10 -4 to 10 -3
RLC SDUs
BLER ~10-6
BLER ~10 -1
MAC Signaling Procedures
Accessibility Preamples
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
85/159
7/2/2
Random Access Procedure
RA Preamble Assignment
Random Access Preamble
Random Access Response
Scheduled Transmission (MSG3)
Contention Resolution (MSG4)
CFRAContention Free Random Access Process Steps
0
1
2
3
4
CBRAContention Based
Random Access Process Steps
HARQ
HARQ
Uplink Open Loop Power Control1) UE measures RS
UE
RBS
3) The power is ramped up until a response is heardor maximum number of re-attempts is reached
Downlink(PDCCH) ...
RACH Preamble RACH Response No Response
RA-RNTI
Downlink(PDSCH)
subframe1 ms
RA response window
......
RAPID
Timing (UL timing)
Scheduling Grant
Indicates RA Response on PDSCH(Not UE specific)
Uplink
(PRACH) RA msg 3preamble0.8 ms
Power step
preambleInitial power
......
Data
... ...
Max uplink cell power
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
86/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
87/159
7/2/2
Mobility Case Studies
Signaling on E-Utran
To be discussed in class
LTE Node B
LTE NodeB
LTE Node B
X2X2
Mobility Case X2 Handover
Simplified mobilityscheme to handle themost commonscenarioForwarding of userdata on X2 interface(SelectiveForwarding)After handover iscompleted, EPC isinformed and theroute is optimized
SGWMME
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
88/159
7/2/2
X2 HandoverMME
RRCCONNECTED
S-GW
Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION(Bearer Setup,Measurement conf))
2. RRC Measurement Report(Event A3)
3. HODecision
4. X2 HANDOVER REQUEST
5.AdmissionControl
6. X2 HANDOVER REQUESTACKNOWLEDGE
10. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)
7. X2 SN STATUS TRANSFER8. Start Data
forwarding
9. BufferForwarded
Data11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
13. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Complete)
15. S1 PATH SWITCH REQUEST16. S5 USER PLANE
UPDATE REQ18. S5 USER PLANEUPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASERRCCONNECTED
14.Data Transfer in Target
21. Forward if anyData in transition
and release
T304
TRELOCprep
RegenerateSecurity Keys
17.Data Transfer in Target
Handover Flow1. Measurement Command message is included in RRC Connection
Reconfiguration message.
2. criteria event A3 is fulfilled UE will inform the source eNB bysending Measurement Report .
3. Source eNB makes a handover decision based on MeasurementReport and RRM
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
89/159
7/2/2
4. Source eNB issues a X2 - Handover Request message to the targeteNB passing necessary information to prepare the HO
- UE X2 signaling context reference at source eNB,- UE S1 EPC signaling context reference,- target cell ID,- KeNB,- RRC context including the C-RNTI of the UE in the source eNB,- AS-configuration,- E-RAB context and physical layer ID of the source cell + MAC for
possible RLF recovery).
UE X2 / UE S1 signaling references enable the target eNB to address thesource eNB and the EPC.
E-RAB context includes also necessary RNL and TNL addressinginformation, and QoS profiles of the E-RABs.
Handover Flow
X2- Handover Request
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
90/159
7/2/2
X2 HandoverMME
RRCCONNECTED
S-GW
Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION(Bearer Setup,Measurement conf))
2. RRC Measurement Report(Event A3)
3. HODecision
4. X2 HANDOVER REQUEST
5.AdmissionControl
6. X2 HANDOVER REQUESTACKNOWLEDGE
10. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)
7. X2 SN STATUS TRANSFER8. Start Data
forwarding
9. BufferForwarded
Data11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
13. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Complete)
15. S1 PATH SWITCH REQUEST16. S5 USER PLANE
UPDATE REQ18. S5 USER PLANEUPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASERRCCONNECTED
14.Data Transfer in Target
21. Forward if anyData in transition
and release
T304
TRELOCprep
RegenerateSecurity Keys
17.Data Transfer in Target
5. AC (Admission Control) is performed by the target eNB
AC dependents on the received E-RAB QoS information
Target eNB configures the required resources according to the received E-RAB QoS information - reserves a C-RNTI and optionally a RACHpreamble.
Handover Flow
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
91/159
7/2/2
6. Target eNB prepares HO with L1/L2 and sends X2 - HandoverRequest Acknowledge to the source eNB.
Message includes transparent container to be sent to the UE as an RRCmessage ( RRC Connection reconfiguration ) to perform the handover.
Container includes:- new C-RNTI,- target eNB security algorithm identifiers for the selected security
algorithms,- dedicated RACH preamble.
Handover Flow
X2 Handover Request Ack
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
92/159
7/2/2
7. Source eNB sends SN STATUS TRANSFER message to the targeteNB
Reason: Inform RLC AM about uplink PDCP SN receiver status -includes at least the PDCP SN of the first missing UL SDU and mayinclude a bit map of the receive status of the out of sequence UL SDUsthat the UE needs to retransmit in the target cell if there are any suchSDUs
Reason: Inform RLC AM about downlink PDCP SN transmitter status ofE-RABs includes next PDCP SN that the target eNB shall assign tonew SDUs, not having a PDCP SN yet.
Handover Flow
X2 HandoverMME
RRCCONNECTED
S-GW
Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION
(Bearer Setup,Measurement conf))
2. RRC Measurement Report(Event A3)
3. HODecision
4. X2 HANDOVER REQUEST
5.AdmissionControl
6. X2 HANDOVER REQUESTACKNOWLEDGE
10. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)
7. X2 SN STATUS TRANSFER8. Start Data
forwarding
9. BufferForwarded
Data11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
13. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Complete)
15. S1 PATH SWITCH REQUEST16. S5 USER PLANE
UPDATE REQ18. S5 USER PLANEUPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASERRCCONNECTED
14.Data Transfer in Target
21. Forward if anyData in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
17.Data Transfer in Target
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
93/159
7/2/2
8. Data forwarding is initiated
9. Target eNB buffers received DL data until the UE access the new cell.
10. Source eNB forwards RRC message RRC ConnectionReconfiguration included on X2 - message Handover Request Acknowledge (includes mobilityControlInformation to the UE).
- source eNB performs necessary integrity protection and ciphering of themessage UE receives RRC Connection Reconfiguration message with necessary parameters.
Handover Flow
RRC Container, ExtractRRCConnectionReconfiguration messageRRCConnectionReconfiguration-r8-IEs {
measConfigmobilityControlInforadioResourceConfigDedicatedsecurityConfigHO
MobilityControlInfo ::=targetPhysCellIdcarrierFreq OcarrierBandwidth OadditionalSpectrumEmission Ot304 ENUMERATED { ms50, ms100, ms150, ms200, ms500, ms1000,
ms2000, spare1},newUE-Identity C-RNTI ,radioResourceConfigCommonrach-ConfigDedicated ra-PreambleIndex INTEGER (0..63),
r a- PRAC H- Ma skI nde x I NTE GE R ( 0. .1 5)
CarrierBandwidthEUTRA ::= SEQUENCE {dl-Bandwidth ENUMERATED { n6, n15, n25, n50, n75, n100}ul-Bandwidth ENUMERATED {n6, n15, n25, n50, n75, n100}
CarrierFreqEUTRA ::=dl-CarrierFrequl-CarrierFreq O
SecurityConfigHO ::=handoverType CHOICE {intraLTE {
sec ur it yAlgor it hmCo nf ig OkeyChangeIndicator BOOLEAN,nextHopChainingCount
},interRAT {
securityAlgorithmConfignas-SecurityParamToEUTRA
5 MHz
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
94/159
7/2/2
11. UE synchronizes to target eNB (Check MAC protocol slides, CFRA
Handover Access ) and accesses the target cell via RACH- following a contention-free procedure (dedicated RACH preamble wasindicated in the mobility Control Information content of RRCConnection Reconfiguration message )
- following a contention-based procedure if no dedicated preamble wasindicated. UE derives target eNB specific keys and configures theselected security algorithms to be used in the target cell.
12. The target eNB responds with UL allocation and timing advance .
13. UE successfully accessed target cell UE confirms handoversending
- RRC Connection Reconfiguration Complete message- C-RNTI- uplink Buffer Status Report (BSR), whenever possible
Handover Flow
X2 HandoverMME
RRCCONNECTED
S-GW
Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION
(Bearer Setup,Measurement conf))
2. RRC Measurement Report(Event A3)
3. HODecision
4. X2 HANDOVER REQUEST
5.AdmissionControl
6. X2 HANDOVER REQUESTACKNOWLEDGE
10. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)
7. X2 SN STATUS TRANSFER8. Start Data
forwarding
9. BufferForwarded
Data11 MAC: CFRA Random Access Preamble
12. MAC Random Access Response (UL allocation + TA)
13. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Complete)
15. S1 PATH SWITCH REQUEST16. S5 USER PLANE
UPDATE REQ18. S5 USER PLANEUPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASERRCCONNECTED
14.Data Transfer in Target
21. Forward if anyData in transition
and release
T304
TRELOCprep
Regenerate
Security Keys
17.Data Transfer in Target
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
95/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
96/159
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
97/159
7/2/2
20. Target eNB informs successful handover accomplishment of HO tosource eNB (sending UE CONTEXT RELEASE ) this messagetriggers the release of resources by the source eNB.
21. source eNB can release radio and C-plane related resourcesassociated to the UE context
Handover Flow
LTE NodeB
Mobility Case S1 Handover
S1 handover: Relocation of MME or
SGW Handover to UTRAN or
GSM Change of MME pool
areaSignalling is done via EPCand does not assume theexistance of an X2interface.Similar to inter-RAThandoverForwarding of user dataeither directly betweeneNodeB or in-direct via S-GW (Selective Forwarding)
MMESGW SGWMME
To be discussed in class ...
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
98/159
7/2/2
Handover Events
S1 Handover
RRCCONNECTED
S-GW
Source eNB Targe t eNB1. RRC CONNECTION RECONFIGURATION
(Bearer Setup,Measurement conf))
2. RRC Measurement Report(Event A3)
3. HODecision
4. S1 HANDOVER REQIRED(Source to Targe t Transparent Container )
8. AdmissionControl 9. S1 HANDOVER REQUEST ACKNOWLEDGE
13. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)
14 MAC: CFRA Random Access Preamble15. MAC Random Access Response (UL allocation + TA)
16. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Confirm)
RRCCONNECTED
T304
TS1RELOCprep
RegenerateSecurity Keys
18.Data Transfer in Target
MME MMES-GW
TargetTarget
5. S10 FORWARD RELOCATIONREQUEST
6. S11 CREATE SESSION REQ/RES7. S1 HANDOVER REQUEST
10. S10 FORWARD RELOCATIONRESPONSE
12. S1 HANDOVER COMMAND
19. S10 FORWARD RELOCATIONCOMPLETE/ ACK
Source Source
20. S1 UE CONTEXT RELEASECOMMAND
(Cause: Successful Handover)
UP Forwarding
Source eNB Targe t eNB SourceSource eNB Targe t eNB TargetSourceSource eNB Targe t eNB SourceTargetSourceSource eNB Targe t eNB TargetSourceTargetSourceSource eNB Targe t eNB
11. S11 CREATE BEARER REQ/RES
17. S1 HANDOVER NOTIFY
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
99/159
7/2/2
Exercises
Mobility Scenarios
To be discussed in class ...
Evolved Packet Core (EPC)
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
100/159
7/2/2
EPS Interfaces3GPP TS 23.401
EPC/LTE Architecture - 3GPP
MME
S1-MME S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2 Iur
ServingGW
S5
PDN GW
Rx
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
101/159
7/2/2
LTE/EPC Interfaces
S1: interface between an eNodeB and an EPC provides aninterconnection point between the EUTRAN and the EPC. It is alsoconsidered as a reference point.- S1-MME : Reference point for the control plane protocol between E-UTRANand MME.- S1-UP : Reference point for the transport for data streams on the S1interface between E-UTRAN and SGW using the GTP-U protocol
Interface between eNodeB ( X2) provides capability to support radiointerface mobility between eNodeBs, of UEs having a connection with E-UTRAN.X2 interface enables inter-connection of eNodeBs and support ofcontinuation between eNodeBs of the E-UTRAN services offered via the S1
interface
EPC/LTE Architecture - 3GPP
MME
S1-MME S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2 Iur
ServingGW
S5
PDN GW
Rx
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
102/159
7/2/2
LTE/EPC Interfaces
Interface between MME and HSS (S6a-interface) used to exchange datarelated to the location of the mobile station and to the management of thesubscriber (capability to transfer packet data within the whole LTE servicearea), using Diameter S6a/S6d Application signaling.
1. MME informs HSS about location of a mobile station managed by the latter.
2. HSS sends to the MME all the data needed to support the service to themobile subscriber.
Exchanges of data may occur when- mobile subscriber requires a particular service,- mobile subscriber wants to change some data attached to his subscription- some parameters of the subscription are modified by administrative means.
EPC/LTE Architecture - 3GPP
MME
S1-MME S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2 Iur
ServingGW
S5
PDN GW
Rx
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
103/159
7/2/2
LTE/EPC Interfaces
Interface between MME and S-GW (S11-interface) used to supportmobility and bearer management between the MME and S-GW
Interface between MME and MME (S10-interface) used to support userinformation transfer and MME relocation support between the MMEs
Interface between S-GW and PDN-GW (S5 and S8-interface)interfaces between S-GW and PDN-GW, provides support for functions forpacket data services towards end users during roaming and non-roamingcases (i.e. S8 is the inter PLMN variant of S5).
EPC/LTE Architecture - 3GPP
MME
S1-MME S1-U
LTE
IP networks
eNodeB
SGSN
Iu CP Gb
2G 3G
S3
BSC
BTS
RNC
Node B
HLR/HSS
PCRF
Iu UP
S11
Gr
Gx
S10
S4
S6a
SGi
X2 Iur
ServingGW
S5
PDN GW
Rx
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
104/159
7/2/2
LTE/EPC Interfaces
Interface between MME and SGSN (S3-interface) enables user andbearer (DRB) information exchange for inter 3GPP access network mobility inidle and/or active state
Interface between S-GW and SGSN (S4-interface) provides relatedcontrol and mobility support between GPRS Core and the 3GPP Anchorfunction of Serving GW. In addition, if Direct Tunnel is not established, itprovides the user plane tunnelling
Interface between PCEF - PCRF/H-PCRF/V-PCRF (Gx Reference Point)provides transfer of policy and charging rules from PCRF to Policy andCharging Enforcement Function Point (PCEF) in the GW
Interface from PDN-GW to packet data networks (SGi reference point)reference point between the PDN-GW and a packet data network. It may
be:- operator external public or private packet data network or- an intra operator packet data network, e.g. for provision of IMS services
Basic EPC Architecture
PDN GW
Serv GW
MME
PCRF
LTE
S1-MME S1-U
S10
S11
S5/S8
SGi
Gx Gxc
ExternalIP networks
S9
S6a
Rx OCSOFCS
X2 eNB
Gz Gy
HSS
IMS
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
105/159
7/2/2
Basic EPC Architecture
eNodeB LTE Radio Base Station. Provide Wireless access to theUE
MME Mobility Management Entity. Management of subscription-related data for each UE accessing over the LTE-RAN
HSS Home Subscriber Server. User data repository for UEsaccessing over the LTE-RAN
Ser GW Serving Gateway. In charge of user data traffic commingfrom the UEs. Interfaces the eNodeBs
PDN GW Packet Data Network Gateway. Anchor point tointerconnect external IP networks
Basic EPC Architecture
PCRF Policy and Charging Rules Function. Containspolicy control decision and flow-based charging controlfunctionalities.
OFCS Offline Charging System. Post-processing ofCDRs.
OCS Online Charging System. Real time charging.
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
106/159
7/2/2
The EPC (SAE) Interfaces S3
S3 Interface
enables user and bearerinformation exchange for inter3GPP access network mobilityin idle and/or active state.
Based on Gn reference pointas defined between SGSNs.
Protocol: GTP-C
HSS
HLR
MMESGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U
S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
The EPC (SAE) Interfaces S4
S4 Interface
Provides related control andmobility support betweenGPRS Core and the 3GPPAnchor function of Serving GW
Is based on Gn referencepoint as defined betweenSGSN and GGSN.
In addition, if Direct Tunnel isnot established, it provides theuser plane tunnelling.
Protocol: GTP-C / -U
HSS
HLR
MMESGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5
SAE GW
8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics
107/159
7/2/2
The EPC (SAE) Interfaces S5/S8
S5/S8 Interface
Provides user plane tunnelling and tunnelmanagement between Serving GW andPDN GW.
Used for Serving GW relocation due to UEmobility and if the Serving GW needs toconnect to a non-colloc ated PDN GW forthe required PDN connecti vity.
Protocol: GTP (or PMIPv6)
S5 is used in non-roaming scenario (i.e.Serving GW and PDN GW in visitednetwork)
S8 is used in roaming scenario (i.e.Serving GW in visited netw ork and PDNGW in home network).
HSS
HLR
MMESGSN
PCRF
2G 3G
Gb Iu-C
S3
S4
S1-C S1-U S12
S11
S10
SGi
Gx
IP networks
S6a
Gr
LTE
PDN GW
Serv GW
S5/S8
SAE GW
Recommended