Irfan Ali 1
LTE & EPC Architecture
LTE Attach Procedure
Version: 3.0 (March 2013)
Irfan Ali 2Irfan Ali 2
3GPP Network Architecture
Network
Radio AccessNetwork (RAN) Core Network (CN)
User Equipment (UE) orMobile Station (MS)
+
(U)SIMMobileEquipment (ME)
SIM Subscriber Identity ModuleUSIM Universal Subscriber Identity Module
Radio Resource Management Security, IP connectivity, Mobility
Irfan Ali 3Irfan Ali 3
LTE Network Architecture
Internet
eNB eNB eNB
MME
S-GW
S-GW
P-GWHSS
S1-MME
S11
S1-U
S6a S5
X2
Evolved Universal Terrestrial Radio Access Network(E-UTRAN)
Evolved Packet Core(EPC)
X2
LTE-Uu eNB Enhanced Node BMME Mobility Management EntityS-GW Serving GatewayP-GW Packet data network GatewayHSS Home Subscriber System
Irfan Ali 4Irfan Ali 4
LTE Network Architecture
IMS Internet
eNB eNB
MME
S-GW
S-GW
P-GWHSS
S1-MME
S11
S1-U
S6a S5
X2
RB Control
Radio AdmissionControl
Scheduler
Inter Cell RRM
Connected ModeMobility Mgmt
eNB MeasurementOAM
NAS Security
Idle ModeMobility Mgmt
EPS Bearer Control
Inter eNB MobilityAnchoring
UE IP addressAllocation
eNB
MME S-GW
P-GW
S1-US1-MME
S5
Authenticator
HSS
S6a
eNB
User-PlaneFunctional Entity
Control-PlaneFunctional Entity Radio Bearer
Transmission(L1/L2/L3)
Subscription
Inter SGW MobilityAnchoring
LTE-Uu
Irfan Ali 5Irfan Ali 5
Block Diagram example: LTEArchitecture
UE
MME
HSS
ServingGW PDN GW
Operators IPServices
InternetInternet
S6a
S11
S1u
S1-MME
LTE-Uu
S5
SGi
eNB
S10
X2
Functional EntityLogical EntityNetwork Entity
InterfacesReference Points
SGi
eNB Enhanced Node BMME Mobility Management EntityS-GW Serving GatewayPDN GW Packet data network GWHSS Home Subscriber System
Irfan Ali 6Irfan Ali 6
LTE Architecture Key Concepts
All radio related functions are pushed down to the eNB• There is no centralized radio resource management element
like the RNC. In the core network, there is control-plane and user-plane
separation• MME is the control-plane entity• SGW and PGW are the user-plane entity• To allow independent scaling of the control-plane and the
user-plane. LTE is a PS (Packet Switch) only system
• No CS (Circuit switch) domain support
Irfan Ali 7Irfan Ali 7
Architecture Concept: Access Stratum vs Non-Access Stratum
• On the signaling plane, the UEcommunicates with two entitiesin the infrastructure: (a) the eNB and (b) the MME (via the eNB).
• Access-stratum (AS): UE <->eNB. AS consists of both user-
plane and control-plane.The user-plane protocol isPDCP and control-planeprotocol is RRC.
• Non-access Stratum (NAS):UE <-> MME. NAS is only in the control-
plane. The protocol iscalled the NAS protocol.
IMS Internet
eNBeNB
MME
S-GW
S-GW
P-GWHSS
eNB
Access Stratum
Non-AccessStratum
(NAS)
UE
Radio Resource Control(RRC)
Irfan Ali 8Irfan Ali 8
Protocol Stacks: Control Plane
MME
L1
L2
IP
SCTP
S1-AP
L1
L2
IP
SCTP
S1-AP
S1-MME
PHY
MAC
RLC
PDCP
NAS
RRC
PHY
MAC
RLC
PDCP
RRC
UE eNB
NAS
LTE-Uu
Non-Access Stratum (NAS): The key control interfacebetween MME and UE
Radio Resource Control (RRC): The main controlinterface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicatedetection, ROHC
Radio Link Control (RLC): Segmentation/re-assembly,ARQ, acknowledge mode (AM)/ un-acknowledged mode (UAM), etc
Medium Access Control (MAC): Access the channel
Physical Layer (PHY): Radio layer, eg modulation etc.
L1
L2
IP
UDP
GTP-C
S-GW
L1
L2
IP
L1
L2
IP
P-GW
UDP
GTP-C
UDP
GTP-C
S11 S5
L1
L2
IP
UDP
GTP-C
S1-AP S1 Application protocolSCTP Stream Control Transport ProtocolGTP-C GPRS Tunneling Protocol-Control PlaneGTP-U GPRS Tunneling protocol- User Plane
Irfan Ali 9Irfan Ali 9
Protocol Stacks: Control Plane & User Plane
MME
IP
End Host
Application
TCP/UDP
L1
L2
IP
SCTP
S1-AP
L1
L2
IP
SCTP
S1-AP
S1-MME
PHY
MAC
RLC
PDCP
PHY
MAC
RLC
PDCP
IP
Application
eNBUELTE Uu
TCP/UDP
PHY
MAC
RLC
PDCP
NAS
RRC
PHY
MAC
RLC
PDCP
RRC
UE eNB
NAS
LTE-Uu
S-GW
S-GW
L1
L2
IP
UDP
GTP-U
S1-U
L1
L2
IP
UDP
GTP-U
L1
L2
IP
UDP
GTP-C
L1
L2
IP
UDP
GTP-C
S11
P-GW
L1
L2
IP
P-GW
UDP
GTP-C
L1
L2
IP
UDP
GTP-C
S5
L1
L2
IP
L1
L2
IP
IP
S5
UDP
GTP-U
UDP
GTP-U
Irfan Ali 10Irfan Ali 10
User Identifier in the Network
• Two important identifiers International Mobile Subscriber Identifier (IMSI)
• Embedded in SIM card• Stored in subscription data of HLR• Used to index UE’s information in most network nodes• Format on the next page
Mobile Station Integrated Services Digital Network Number (MSISDN)• Your phone number• Number used to identify a subscriber when making a call or sending an SMS
• The mapping between IMSI and MSISDN is stored in HLR MSISDN is not required to be stored in the (U)SIM
• MSISDN is typically not needed in the LTE system
Irfan Ali 11Irfan Ali 11
(International Mobile Subscriber Identifier) IMSI -Structure
World
US Turkey India
Turkcell Vodafone Avea
Irfan Alper Erol
MCC
MCC MNC
MCC MNC MSIN
MCC: Mobile Country Code3 digits
2-3 digits
MNC: Mobile Network Code
9-10 digits
MSIN: MobileSubscriberIdentification Number
310 286 404
01 02 03 Identifies an operator
Max 15 digits
Source for MCC and MNC codes:http://en.wikipedia.org/wiki/Mobile_Network_Codehttp://en.wikipedia.org/wiki/Mobile_Country_Code
Cou
ntry
Ope
rato
rSu
bscr
iber
Uniquely identifies a subscriber
PLMN
Irfan Ali 12Irfan Ali 12
Operator Identity A mobile operator’s network is also known as a Public Land Mobile
Network (PLMN). The identity used for an operator’s network is called the PLMN-
Identity (PLMN-ID) and consists of the Mobile Country Code and theMobile Network Code.
An operator may be identified by more than one PLMN-ID
World
US Turkey India
Turkcell Vodafone Avea
MCC
MCC MNC
MCC: Mobile Country Code3 digits
2-3 digits
MNC: Mobile Network Code
310 286 404
01 02 03 Identifies an operator
Cou
ntry
PLMN
Ope
rato
r
PLMN ID = MCC + MNC
Irfan Ali 13Irfan Ali 13
MSISDN – Structure
World
US Turkey India
Turkcell Vodafone Avea
Irfan Alper Erol
CC
CC NDC
CC NDC SN
CC: Country Code1-3 digits
2-3 digits
NDC: National Destination Code
9-10 digits
SN: SubscriberNumber
1 9190
533,…
540,… Identifies an operator
Max 15 digits
Source for MCC and MNC codes: www.wikipedia.orgList of country calling codes:http://en.wikipedia.org/wiki/List_of_country_calling_codes
123 4567 123 4568
505,…
+90 533 123 4567
Cou
ntry
Ope
rato
rSu
bscr
iber
Uniquely identifies a subscriber
TurkTelecom
212,216,
Irfan Ali 14Irfan Ali 14
Identities and Plumbing for LTE
SRB-2
SRB-1
SRB-0
NAS
S1-MME
GTPC-1
GTP-U-10GTP-U-10
UE eNB
MME
S-GW P-GW
HSS
IMSI IMSI IMSI
C-RNTI C-RNTI
IMSI IMSI
EPS Bearer Identity
SRB Identity
Data Radio Bearer 10
GUTIGUTI
SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary IdentityGUTI Globally Unique Temporary Identity
GTPC
-1
Irfan Ali 15Irfan Ali 15
Identities in LTE
• IMSI (International Mobile SubscriptionIdentity) Permanent identity of UE in SIM
(MCC+MNC+MSIN), whereMCC+MNC = Home PLMN ofsubscriber.
Kept secret from eNB. Max 15 digits
• GUTI (Globally unique temporaryidentity) Created by the MME for the UE. Used between MME and UE instead of
IMSI. GUTI may be seen by eNB if NAS
message is sent un-encrypted, egwhen UE has moved to a new areaand needs to be served by a newMME.
56 bits + MCC and MNC
• C-RNTI (Cell Radio NetworkTemporary Identity) Is created by eNB and only used to
identify a UE within the scope of aneNB and provided to the UE duringrandom access process and setup ofRRC connection.
C-RNTI is 16 bits long.
Irfan Ali 16
LTE Attach Procedure
Irfan Ali 17Irfan Ali 17
Objective of UE Attach Procedure
Internet
eNB
MME
S-GW
S-GW
P-GWHSS
X2 eNB
• The goal of “attaching” to thenetwork is to obtain an IPaddress to communicate withoutside world.
• During the process of “attach” The UE is authenticated and
authorized to use send/receivedata.
Data path created beteween UE<->eNB<->S-GW<->PGW
UE Context created in all thenodes in the network
UE is provided an IP address
UE’s IP address
SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary Identity
Bearer Setup at end of the Attach Procedure
Irfan Ali 18Irfan Ali 18
UE Context:S1 Cntxt: S1APTEID(key)…..RB Cntxt: C-RNTI(key),..
Objective of UE Attach Procedure
Internet
eNB
MME
S-GW
S-GW
P-GWHSS
S1-MME
S6a
X2 eNB
• The goal of “attaching” to thenetwork is to obtain an IPaddress to communicate withoutside world.
• During the process of “attach” The UE is authenticated and
authorized to use send/receivedata.
Data path created beteween UE<->eNB<->S-GW<->PGW
UE Context created in all thenodes in the network
UE is provided an IP address
UE’s IP address
SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary Identity
UE Context:KEY: IMSI…..
UE Context:KEY: IMSI…..
UE Context:KEY: IMSI…..
Bearer Setup at end of the Attach Procedure
Irfan Ali 19Irfan Ali 19
UE Performs attach – Part 1 of 4
SGWHSSeNBUE
PGW Internet
MME
0. UE hasselected eNB
PDCCH/PDSCH
1. Random AccessPreamble
RACH
2. Random AccessPreamble
RandomAccessProcedure
UL-SCH: SRB03. RRC ConnectionRequest
DL-SCH: Common CCH
5. RRC Connection Setup
UL-SCH: SRB16. RRC Connection Complete
NAS Msg AttachRequest, IMSI
RRC SetupProcedure
1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. Thesubframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Sincemultiple UEs could have transmitted on the same subframe and sameRAPID, the UE listens on the downlink shared (DL-SCH) common controlchannel (CC) to see if the UE’s preamble has been accepted by the eNB.
2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UEshould use. (d) scheduling grant when the UE should transmit in the nextmessage in UL direction. UE listens for RA-RNTI in the PDCCH channel.
3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH towhat it transmitted. If so, it knows the UL Radio Bearers to transmit theRRC connection request. The UE includes the Temporary C-RNTI.
5. The eNB now transmits RRC Connection Setup message including the C-RNTI that was received from the UE. This step resolves any contentionthat could have occurred due to two UEs using the same preamblesequence in RACH access step.
6. The UE now transmits a message to the MME in the time-slot allocated inthe previous step. The UE also includes its IMSI in the message.NAS Msg PDN
Connect Req
RA-RNTI, RAPID
RA-RNTI, RAPID,Temporary C-RNTI
Temporary C-RNTI
C-RNTI4. Contention Resolution ID 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
to the UE. When the UE receives its own transmitted message (unique)and C-RNTI, the contention resolution process is complete.
RNTI Radio Network Temporary IdentityRA-RNTI Random Access RNTIC-RNTI Cell RNTIRAPID Random Access Preamble ID
o UE has synchronized to the downlink frame of the eNB and hence knowsthe DL frame boundaries. The UE has read the MIB and from there theSIB2 of the eNB and knows when the random access channel (RACH)slots are in the uplink direction.
0.
Irfan Ali 20Irfan Ali 20
UE Performs Attach – Part 2 of 4SGW
HSSeNBUE
PGW
MME
InterneteNB selectsMME
AKA: Authentication and Key Agreement
7. Initial UE Message
S1-MME
NAS Msg: AttachRequest, IMSI, ..
S6a8. Auth Info RequestIMSI, ..
9. Auth Info AnswerKasme, AUTN, RAND,XRES
10. DL NAS XportAuthn Request
UL-SCH: SRB1
11. DL Info XferAuthn Request:AUTN, RAND,
12. UL Info Transport 13. UL NAS XportAuthn Response
MME ComparesRES with XRES.If same, AKAsuccessful
DL-SCH:CCH SRB1
Authn Response:RES
UserAuthenticationProcedure
14. DL NAS Xport
UL-SCH: SRB1
15. DL Info Transport
Security ModeComplete
16. UL Info Transport 17. UL NAS XportSMC Complete
DL-SCH:CCH SRB1Security Mode Command
NAS Security
Security Mode Command NAS SecuritySetup Procedure
Encrypted Info
Integrity ProtectedInfo
18. Location Update RequestIMSI, …
19. Location Update ResponseSubscription Data
Authorization
NAS Msg PDNConnect Req
Irfan Ali 21Irfan Ali 21
UE Performs Attach – Part 3 of 4SGW
HSSeNBUE
PGW
MME
InternetNAS Security
S1-MME24. Initial Context Setup Request(UE Context Info, TEIDs)
DL-SCH:CCH SRB125. RRC Security ModeCommand, AS Algorithm
UL-SCH: SRB126. RRC Security ModeComplete
AS SecuritySRB-2
NAS: Attach AcceptNAS: Activatedefault bearer req
AS Security SetupProcedure
GTPC
23. Create SessionResponse(IMSI, TEIDs)
20. Create SessionRequest (IMSI, TEIDs,PGW IP,…)
GTPC21. Create SessionRequest (IMSI, TEIDs,…)
22. Create SessionResponse (IMSI, TEIDs)
Bearer SetupProcedure Start
GTP-U-10 Tunnel
GTPC Session GTPC-1 Session
Data Radio Bearer-10
30. Initial Context SetupComplete (S1U TEIDs)
DL-SCH:CCH SRB228. RRC ConnectionReconfiguration
UL-SCH: SRB229. RRC Reconfig Complete
NAS1NAS2
27. Obtain UE’s RadioCapability
NAS1 NAS2 NAS: Attach CompleteNAS: Activatedefault bearer acpt
Attach CompletionData Radio Bearer Setup
SRB-2
SRB-1
SRB-0
GTPC
34. Modify Bearer Resp(IMSI,…)
33. Modify Bearer Req.(IMSI, TEIDs…)
GTPU-10 Tunnel
Bearer SetupProcedure Completion
Encrypted Info
Integrity ProtectedInfo
31. UL Information Transfer32. UL NAS Xport
Irfan Ali 22Irfan Ali 22
Data Radio Bearer-10 GTP-U-10 TunnelGTPU-10 Tunnel
UE Performs Attach – Part 4 of 4SGW
HSSeNBUE
PGW
MME
Internet
Data Radio Bearer-10 GTP-U-10 TunnelGTPU-10 TunnelGTPC Session GTPC-1 SessionS1-MMESRB-2
SRB-1SRB-0
DHCPServer
DHCPClient
DHCP Messages
IP addressof the UE isrouted to thisinterface
DHCPServer
DHCPClient
DHCPServer
Irfan Ali 23Irfan Ali 23
Architecture key Concept: Roaming
• 3GPP architecture from early days has supported a subscriber goingto a foreign network and still getting service Home PLMN: Subscriber’s home network (eg. Turkcell) Visited PLMN: Foreign/Roamed-to network (eg. Orange)
• What does roaming require: Ability from VPLMN to identify the HPLMN of the subscriber Ability to authenticate the subscriber from VPLMN Sharing of revenue between VPLMN and HPLMN (roaming charges)
PLMN Public Land Mobile NetworkVPLMN Visited PLMNHPLMN Home PLMN
Irfan Ali 24Irfan Ali 24
HPLMN
VPLMNHPLMN
Roaming Concept
IMS Internet
eNB eNB eNB
MME
S-GW
S-GW
P-GWHSS
S1-MME
S11
S1-U
S6a S5
X2 X2
LTE-Uu
HPLMN Home PLMNVPLMN Visited PLMN
IMS Internet
eNB eNB eNB
MME
S-GW
S-GW
P-GW
HSS
S1-MME
S11
S1-U
S6a S5
X2 X2
LTE-Uu
IMSI = 286 + 01 + 1234567890TurkeyTurkcell
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
IMSI = 286 + 01 + 1234567890TurkeyTurkcell
Domain = epc.mnc01.mcc404.pub.3gppnetwork.org
Non-Roaming Roaming
Turkcell subscriber in Turkey Turkcell subscriber in India
Irfan Ali 25Irfan Ali 25
LTE/EPC Specifications
UE
MME
HSS
ServingGW PDN GW
PCRF
InternetInternet
S6a
S11
S1u
S1-MME
LTE-Uu
S5
Gx
Rx
SGieNB
S10
X2
SPR
Sp
Stage-3 SpecificationStage-2 SpecificationStage-1 Specification
Stage-1: 22.278
E-UTRAN Stage-2:36.300
Evolved Packet Core Stage 2: 23.401
29.274 GTPC29.281 GTPU
29.274 GTPC
36.410 General36.411 Layer 136.412 (Sig xport)36.413 (S1AP)
29.21229.213 Sig Flow
36.201,211,213,214 PHY36.321 MAC36.322 RLC36.323 PDCP36.331 RRC
36.410 General36.411 Layer 136.414 (Data xport)29.281 GTPU
PCC Stage 2: 23.203Charging Stage 2: 32.240
36.420 General36.421 Layer 136.422 (Sig xport)36.424 (Data xport)36.423 (X2AP)29.281 GTPU
29.214
36.304 Idle36.306 Capability36.314 Measurement23.122 Idle-NAS
24.301 NAS
Unspecified
OnlineChargingFunction
OfflineChargingFunction
BillingDomain
Gy/RoGz/Rf
Bx
32.251
32.251
General:23.003 Identifiers29.303 DNS33.401 Security Stage 2&3
S929.215
29.061
29.272
36.133 RRM Reqds
OperatorServicesOperatorServices
Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latestLink to find out what a spec covers: http://www.3gpp.org/Specification-Numbering