LTE & EPC Architecture

LTE Attach Procedure

Version: 3.0 (March 2013)

Irfan Ali

3GPP Network Architecture

Network

Radio Access
Network (RAN)

+
(U)SIM

Mobile
Equipment (ME)

Core Network (CN)

Radio Resource Management

Security, IP connectivity, Mobility

User Equipment (UE) or

Mobile Station (MS)

SIM
USIM

Irfan
Ali
Irfan Ali

Subscriber Identity Module

Universal Subscriber Identity Module

LTE Network Architecture

Internet
HSS

P-GW

S6a

S5
S11

S-GW
Evolved Packet Core
(EPC)

S-GW

MME
S1-MME

S1-U

X2

eNB

Evolved Universal Terrestrial Radio Access Network

(E-UTRAN)

X2

eNB

eNB

eNB
MME
S-GW
P-GW
HSS

LTE-Uu

Irfan
Ali
Irfan Ali

Enhanced Node B
Mobility Management Entity
Serving Gateway
Packet data network Gateway
Home Subscriber System

HSS

LTE Network Architecture

P-GW
UE IP address
Allocation

Authenticator

Inter SGW Mobility

Anchoring

Internet

IMS

Subscription
S5

S6a

HSS

MME

P-GW

S-GW

NAS Security
S6a

Idle Mode
Mobility Mgmt

S5
S11

Inter eNB Mobility

Anchoring

EPS Bearer Control

S-GW
S-GW

MME

S1-MME

S1-MME

S1-U

S1-U

eNB

eNB

X2

eNB
LTE-Uu

eNB

Inter Cell RRM

Radio Admission
Control

Connected Mode
Mobility Mgmt

Scheduler

Control-Plane
Functional Entity
User-Plane
Functional Entity

Irfan
Ali
Irfan Ali

RB Control

eNB Measurement
OAM
Radio Bearer
Transmission
(L1/L2/L3)

Block Diagram example: LTE

Architecture
HSS

S1-MME

Interfaces
Reference Points

S6a

MME

Operators IP
Services

S11
S10
SGi

UE

eNB

S1u

Serving
GW

S5

PDN GW

SGi

LTE-Uu
X2

Functional Entity
Logical Entity
Network Entity

eNB
MME
S-GW
PDN GW
HSS

Irfan
Ali
Irfan Ali

Enhanced Node B
Mobility Management Entity
Serving Gateway
Packet data network GW
Home Subscriber System

Internet

LTE Architecture Key Concepts

All radio related functions are pushed down to the eNB

There is no centralized radio resource management element
like the RNC.

In the core network, there is control-plane and user-plane

separation
MME is the control-plane entity
SGW and PGW are the user-plane entity
To allow independent scaling of the control-plane and the
user-plane.

LTE is a PS (Packet Switch) only system

No CS (Circuit switch) domain support

Irfan
Ali
Irfan Ali

Architecture Concept: Access Stratum vs Non-Access Stratum

Internet

IMS
HSS

P-GW

S-GW

S-GW

MME

Non-Access
Stratum
(NAS)

eNB
eNB

eNB

Radio Resource Control

(RRC)

UE

Irfan
Ali
Irfan Ali

Access Stratum
7

On the signaling plane, the UE

communicates with two entities
in the infrastructure:
(a) the eNB and
(b) the MME (via the eNB).
Access-stratum (AS): UE <->
eNB.
AS consists of both userplane and control-plane.
The user-plane protocol is
PDCP and control-plane
protocol is RRC.
Non-access Stratum (NAS):
UE <-> MME.
NAS is only in the controlplane. The protocol is
called the NAS protocol.

Protocol Stacks: Control Plane

NAS

NAS

RRC

RRC

S1-AP

S1-AP

GTP-C

GTP-C

GTP-C

GTP-C

PDCP

PDCP

SCTP

SCTP

UDP

UDP

UDP

UDP

RLC

RLC

IP

IP

IP

IP

IP

IP

MAC

MAC

L2

L2

L2

L2

L2

L2

PHY

PHY

L1

L1

L1

L1

L1

L1

UE

LTE-Uu

eNB

S1-MME

S11

MME

S-GW

S5

P-GW

Non-Access Stratum (NAS): The key control interface

between MME and UE
Radio Resource Control (RRC): The main control
interface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicate
detection, ROHC

S1-AP
SCTP
GTP-C
GTP-U

Radio Link Control (RLC): Segmentation/re-assembly,

ARQ, acknowledge mode (AM)/ unacknowledged mode (UAM), etc
Medium Access Control (MAC): Access the channel
Physical Layer (PHY): Radio layer, eg modulation etc.

Irfan
Ali
Irfan Ali

S1 Application protocol
Stream Control Transport Protocol
GPRS Tunneling Protocol-Control Plane
GPRS Tunneling protocol- User Plane

Protocol Stacks: Control Plane & User Plane

NAS

NAS

RRC

RRC

S1-AP

S1-AP

GTP-C

GTP-C

GTP-C

GTP-C

PDCP

PDCP

SCTP

SCTP

UDP

UDP

UDP

UDP

RLC

RLC

IP

IP

IP

IP

IP

IP

MAC

MAC

L2

L2

L2

L2

L2

L2

PHY

PHY

L1

L1

L1

L1

L1

L1

UE

LTE-Uu

eNB

S1-MME

S11

MME

S-GW

S5

P-GW

Application

Application

TCP/UDP

TCP/UDP

IP

IP
GTP-U

GTP-U

GTP-U

GTP-U

PDCP

PDCP

UDP

UDP

UDP

UDP

RLC

RLC

IP

IP

IP

IP

MAC

MAC

L2

L2

L2

L2

PHY

PHY

L1

L1

L1

L1

LTE Uu

UE

Irfan
Ali
Irfan Ali

IP

S5

S1-U

eNB

S-GW
9

P-GW

End Host

User Identifier in the Network

Two important identifiers
International Mobile Subscriber Identifier (IMSI)

Embedded in SIM card

Stored in subscription data of HLR
Used to index UEs information in most network nodes
Format on the next page

Mobile Station Integrated Services Digital Network Number (MSISDN)

Your phone number
Number used to identify a subscriber when making a call or sending an SMS

The mapping between IMSI and MSISDN is stored in HLR

MSISDN is not required to be stored in the (U)SIM
MSISDN is typically not needed in the LTE system

Irfan
Ali
Irfan Ali

10 10

(International Mobile Subscriber Identifier) IMSI Structure

World

3 digits

MCC: Mobile Country Code

Country

MCC
310

US

286

404

Turkey

PLMN

India

2-3 digits

Subscriber

Operator

MCC
01

Turkcell

02

Vodafone

03

MNC

MNC: Mobile Network Code

Identifies an operator

Avea
9-10 digits

MCC

Irfan

Alper

MNC

MSIN

Max 15 digits

Erol

MSIN: Mobile
Subscriber
Identification Number

Uniquely identifies a subscriber

Source for MCC and MNC codes:

http://en.wikipedia.org/wiki/Mobile_Network_Code
http://en.wikipedia.org/wiki/Mobile_Country_Code

Irfan
Ali
Irfan Ali

11

11

Operator Identity

A mobile operators network is also known as a Public Land Mobile

Network (PLMN).
The identity used for an operators network is called the PLMNIdentity (PLMN-ID) and consists of the Mobile Country Code and the
Mobile Network Code.
An operator may be identified by more than one PLMN-ID

World

3 digits

MCC: Mobile Country Code

Country

MCC
310

US

286

404

Turkey

PLMN

India

2-3 digits

Operator

MCC
01

Turkcell

02

Vodafone

03

MNC

MNC: Mobile Network Code

Identifies an operator

Avea

PLMN ID = MCC + MNC

Irfan
Ali
Irfan Ali

12 12

MSISDN Structure

World

1-3 digits

CC: Country Code

Country

CC
1

90

US

91

Turkey

India
2-3 digits

Subscriber

Operator

CC
533,

Turkcell
123 4567

Irfan

540,

505,

Vodafone

212,216,
Identifies an operator

Avea

Turk
Telecom
NDC

SN

SN: Subscriber
Number

Max 15 digits

Erol
+90

533

123 4567

Uniquely identifies a subscriber

List of country calling codes:

http://en.wikipedia.org/wiki/List_of_country_calling_codes

Irfan
Ali
Irfan Ali

9-10 digits

CC

123 4568

Alper

NDC: National Destination Code

NDC

Source for MCC and MNC codes: www.wikipedia.org

13 13

Identities and Plumbing for LTE

IMSI

IMSI
GUTI

IMSI

GUTI

C-RNTI

C-RNTI

HSS

SRB-0
SRB-1
SRB-2

S1-MME

MME

NAS
GTPC-1

SRB Identity

GTPC-1
Data Radio Bearer 10

GTP-U-10

GTP-U-10

EPS Bearer Identity

IMSI

UE

Irfan
Ali
Irfan Ali

eNB

S-GW
SRB
DRB
TEID
GTP
C-RNTI
GUTI

14 14

Signalling Radio Bearer

Data Radio Beaer
Tunnel Endpoint Identifier
GPRS Tunneling Protocol
Cell- Radio Network Temporary Identity
Globally Unique Temporary Identity

IMSI

P-GW

Identities in LTE
IMSI (International Mobile Subscription C-RNTI (Cell Radio Network
Identity)
Permanent identity of UE in SIM
(MCC+MNC+MSIN), where
MCC+MNC = Home PLMN of
subscriber.
Kept secret from eNB.
Max 15 digits

Temporary Identity)

GUTI (Globally unique temporary

identity)
Created by the MME for the UE.
Used between MME and UE instead of
IMSI.
GUTI may be seen by eNB if NAS
message is sent un-encrypted, eg
when UE has moved to a new area
and needs to be served by a new
MME.
56 bits + MCC and MNC

Irfan
Ali
Irfan Ali

15 15

Is created by eNB and only used to

identify a UE within the scope of an
eNB and provided to the UE during
random access process and setup of
RRC connection.
C-RNTI is 16 bits long.

LTE Attach Procedure

Irfan Ali

16

Objective of UE Attach Procedure

Internet
UEs IP address

HSS

P-GW

The goal of attaching to the

network is to obtain an IP
address to communicate with
outside world.
During the process of attach
The UE is authenticated and
authorized to use send/receive
data.

S-GW
S-GW

MME

Data path created beteween UE<>eNB<->S-GW<->PGW

UE Context created in all the
nodes in the network
UE is provided an IP address
eNB

X2

eNB
SRB
DRB
TEID
GTP
C-RNTI

Bearer Setup at end of the Attach Procedure

Irfan
Ali
Irfan Ali

17 17

Signalling Radio Bearer

Data Radio Beaer
Tunnel Endpoint Identifier
GPRS Tunneling Protocol
Cell- Radio Network Temporary Identity

Objective of UE Attach Procedure

Internet
UEs IP address

HSS

UE Context:
KEY: IMSI
..

P-GW

UE Context:
KEY: IMSI
..

S6a

During the process of attach

UE Context:
KEY: IMSI
..

S-GW

The UE is authenticated and

authorized to use send/receive
data.

S-GW

MME

Data path created beteween UE<>eNB<->S-GW<->PGW

S1-MME

UE Context created in all the

nodes in the network

UE Context:
S1 Cntxt: S1AP
TEID(key)..
RB Cntxt: C-RNTI(key),..

eNB

UE is provided an IP address
X2

eNB

Bearer Setup at end of the Attach Procedure

Irfan
Ali
Irfan Ali

The goal of attaching to the

network is to obtain an IP
address to communicate with
outside world.

SRB
DRB
TEID
GTP
C-RNTI

18 18

Signalling Radio Bearer

Data Radio Beaer
Tunnel Endpoint Identifier
GPRS Tunneling Protocol
Cell- Radio Network Temporary Identity

UE Performs attach Part 1 of 4

UE

eNB

MME

PDCCH/PDSCH
2. Random Access
Preamble RA-RNTI, RAPID,
Temporary C-RNTI
Temporary C-RNTI
UL-SCH: SRB0
3. RRC Connection
Request

DL-SCH: Common CCH

4. Contention Resolution ID
C-RNTI
5. RRC Connection Setup

UL-SCH: SRB1
6. RRC Connection Complete
NAS Msg Attach
Request, IMSI
NAS Msg PDN
Connect Req

Irfan
Ali
Irfan Ali

HSS

o UE has synchronized to the downlink frame of the eNB and hence

knows
0.
PGW
the DL frame boundaries. The UE has read the MIB and from there the
SIB2 of the eNB and knows when the random access channel (RACH)
slots are in the uplink direction.

0. UE has
selected eNB

RACH
1. Random Access
Preamble RA-RNTI, RAPID

SGW

Random
Access
Procedure

1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The

subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since
multiple UEs could have transmitted on the same subframe and same
RAPID, the UE listens on the downlink shared (DL-SCH) common control
channel (CC) to see if the UEs preamble has been accepted by the eNB.
2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step
1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE
should use. (d) scheduling grant when the UE should transmit in the next
message in UL direction. UE listens for RA-RNTI in the PDCCH channel.
3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to
what it transmitted. If so, it knows the UL Radio Bearers to transmit the
RRC connection request. The UE includes the Temporary C-RNTI.

RRC Setup
Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
to the UE. When the UE receives its own transmitted message (unique)
and C-RNTI, the contention resolution process is complete.
5. The eNB now transmits RRC Connection Setup message including the CRNTI that was received from the UE. This step resolves any contention
that could have occurred due to two UEs using the same preamble
sequence in RACH access step.
6. The UE now transmits a message to the MME in the time-slot allocated in
the previous step. The UE also includes its IMSI in the message.

19 19

RNTI
RA-RNTI
C-RNTI
RAPID

Radio Network Temporary Identity

Random Access RNTI
Cell RNTI
Random Access Preamble ID

Interne

UE Performs Attach Part 2 of 4

UE

eNB

MME

SGW

eNB selects
MME

HSS
PGW

Interne

S1-MME
S6a

7. Initial UE Message
NAS Msg: Attach
Request, IMSI, ..
NAS Msg PDN
Connect Req

DL-SCH:CCH SRB1
11. DL Info Xfer
Authn Request:
AUTN, RAND,
12. UL Info Transport
Authn Response

UL-SCH: SRB1

Authn Response:
RES

14. DL NAS Xport

Security Mode Command

NAS Security
Setup Procedure

17. UL NAS Xport

SMC Complete

18. Location Update Request

IMSI,

UL-SCH: SRB1

19. Location Update Response

Subscription Data

NAS Security

Irfan
Ali
Irfan Ali

User
Authentication
Procedure

MME Compares
RES with XRES.
If same, AKA
successful

13. UL NAS Xport

15. DL Info Transport

Security Mode Command

Security Mode
Complete

9. Auth Info Answer

Kasme, AUTN, RAND,XRES

10. DL NAS Xport

Authn Request

DL-SCH:CCH SRB1

16. UL Info Transport

8. Auth Info Request

IMSI, ..

20

20 Key Agreement
AKA: Authentication and

Authorization

Encrypted Info
Integrity Protected
Info

UE Performs Attach Part 3 of 4

UE

eNB

MME

NAS Security

DL-SCH:CCH SRB1

UL-SCH: SRB1

PGW

GTPC
20. Create Session
Request (IMSI, TEIDs,
PGW IP,)

25. RRC Security Mode

Command, AS Algorithm

HSS

SGW

S1-MME
24. Initial Context Setup Request
(UE Context Info, TEIDs)
NAS: Attach Accept
NAS: Activate
default bearer req

26. RRC Security Mode

Complete

23. Create Session

Response(IMSI, TEIDs)

Interne

GTPC
21. Create Session
Request (IMSI, TEIDs,
)
22. Create Session
Response (IMSI, TEIDs)

Bearer Setup
Procedure Start
GTPC Session

GTPC-1 Session
GTP-U-10 Tunnel

SRB-2

AS Security Setup
Procedure

AS Security
27. Obtain UEs Radio
Capability

DL-SCH:CCH SRB2
28. RRC Connection
Reconfiguration NAS1

Attach Completion
Data Radio Bearer Setup

NAS2
UL-SCH: SRB2

29. RRC Reconfig Complete

31. UL Information Transfer

NAS1
SRB-0

NAS2

SRB-1

30. Initial Context Setup

Complete (S1U TEIDs)
32. UL NAS Xport
NAS: Attach Complete
NAS: Activate
default bearer acpt

SRB-2

Irfan
Ali
Irfan Ali

Data Radio Bearer-10

GTPU-10 Tunnel

GTPC
33. Modify Bearer Req.
(IMSI, TEIDs)
34. Modify Bearer Resp
(IMSI,)

21 21

Bearer Setup
Procedure Completion

Encrypted Info
Integrity Protected
Info

UE Performs Attach Part 4 of 4

UE

eNB

MME

SGW

DHCP
Server

HSS
PGW

SRB-0

Internet

SRB-1
SRB-2

S1-MME

Data Radio Bearer-10

GTPU-10 Tunnel

DHCP
Data Radio Bearer-10
Client

GTPU-10 Tunnel

GTPC Session

GTPC-1 Session
GTP-U-10 Tunnel

DHCP Messages

GTP-U-10 Tunnel

DHCP DHCP
Server Client

DHCP
Server

IP address
of the UE is
routed to this
interface

Irfan
Ali
Irfan Ali

22 22

Architecture key Concept: Roaming

3GPP architecture from early days has supported a subscriber going
to a foreign network and still getting service
Home PLMN: Subscribers home network (eg. Turkcell)
Visited PLMN: Foreign/Roamed-to network (eg. Orange)
What does roaming require:
Ability from VPLMN to identify the HPLMN of the subscriber
Ability to authenticate the subscriber from VPLMN
Sharing of revenue between VPLMN and HPLMN (roaming charges)

PLMN
VPLMN
HPLMN

Irfan
Ali
Irfan Ali

23 23

Public Land Mobile Network

Visited PLMN
Home PLMN

HPLMN

Roaming Concept

Domain = epc.mnc01.mcc286.pub.3gppnetwork.org

HSS

Internet

IMS
HSS

Internet

IMS

P-GW

P-GW

S6a

S6a

S5

S5

S-GW

S11

S-GW

S11

S-GW

MME

S-GW

MME

S1-MME

S1-MME

S1-U

S1-U

HPLMN

VPLMN

Domain = epc.mnc01.mcc286.pub.3gppnetwork.org

X2

eNB

Non-Roaming

X2

eNB

X2

eNB

LTE-Uu

IMSI = 286 + 01 + 1234567890

Turkey Turkcell

Irfan
Ali
Irfan Ali

Domain = epc.mnc01.mcc404.pub.3gppnetwork.org

Turkcell subscriber in Turkey

eNB

eNB

X2

eNB

LTE-Uu

Roaming
HPLMN
VPLMN

24 24

IMSI = 286 + 01 + 1234567890

Home PLMN
Visited PLMN

Turkey Turkcell

Turkcell subscriber in India

General:
23.003 Identifiers
29.303 DNS
33.401 Security Stage 2&3

LTE/EPC Specifications
HSS

24.301 NAS

S6a

36.410 General
36.411 Layer 1
36.412 (Sig xport)
36.413 (S1AP)

S1-MME

UE
LTE-Uu
36.304 Idle
36.306 Capability
36.314 Measurement
23.122 Idle-NAS
36.201,211,213,214 PHY
36.321 MAC
36.322 RLC
36.323 PDCP
36.331 RRC

Sp

Unspecified

PCRF

29.272

MME

S11

29.212
29.213 Sig Flow

S10

36.133 RRM Reqds

PCC Stage 2:
23.203
Charging Stage 2: 32.240

SPR

Rx

29.214

Operator
Services

S9
Gx

29.215

29.274 GTPC
S1u

eNB

Serving
GW

36.410 General
36.411 Layer 1
36.414 (Data xport)
29.281 GTPU
36.420 General
36.421 Layer 1
36.422 (Sig xport)
36.424 (Data xport)
36.423 (X2AP)
29.281 GTPU

E-UTRAN Stage-2:
36.300

X2

S5

PDN GW

29.274 GTPC
29.281 GTPU
Gy/Ro

32.251
Online
Charging
Function

Evolved Packet Core Stage 2: 23.401

Stage-1: 22.278

SGi

Internet

29.061
Gz/Rf
Offline
Charging
Function

Bx

Billing
Domain

32.251

Stage-3 Specification
Stage-2 Specification
Stage-1 Specification

Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest

Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering

Irfan
Ali
Irfan Ali

25 25