LTE & EPC Architecture

LTE Attach Procedure

Version: 3.0 (March 2013)

Irfan Ali 1
 3GPP Network Architecture

Network

+ Radio Access
Network (RAN)
Core Network (CN)
Mobile
(U)SIM Equipment (ME)
Radio Resource Management Security, IP connectivity, Mobility

User Equipment (UE) or

Mobile Station (MS)

SIM Subscriber Identity Module

USIM Universal Subscriber Identity Module

Irfan Ali
Irfan Ali 2 2
 LTE Network Architecture

Internet

HSS
P-GW

S6a
S5

S11 S-GW
Evolved Packet Core
(EPC)
S-GW
MME

S1-MME

S1-U

Evolved Universal Terrestrial Radio Access Network

(E-UTRAN)
X2 X2
eNB eNB eNB

LTE-Uu eNB Enhanced Node B

MME Mobility Management Entity
S-GW Serving Gateway
P-GW Packet data network Gateway
HSS Home Subscriber System
Irfan Ali
Irfan Ali 3 3
 HSS P-GW
LTE Network Architecture
UE IP address
Authenticator Allocation
Inter SGW Mobility
Anchoring
IMS Internet Subscription
S5
S6a

HSS MME S-GW

P-GW
NAS Security Inter eNB Mobility
S6a Anchoring
S5 Idle Mode
Mobility Mgmt
S11
S-GW EPS Bearer Control

S-GW
MME

S1-MME
S1-MME S1-U

S1-U

eNB
RB Control Inter Cell RRM
Radio Admission Connected Mode
Control Mobility Mgmt
X2
eNB eNB eNB eNB Measurement
Scheduler
OAM
LTE-Uu Control-Plane
Functional Entity Radio Bearer
Transmission
User-Plane (L1/L2/L3)
Functional Entity

Irfan Ali
Irfan Ali 4 4
 Block Diagram example: LTE
Architecture
HSS

Interfaces
Reference Points
S1-MME S6a
MME
Operators IP
S11
Services
S10

SGi
S1u Serving S5
UE eNB PDN GW SGi
Internet
GW
LTE-Uu
X2

Functional Entity
Logical Entity
Network Entity

eNB Enhanced Node B

MME Mobility Management Entity
S-GW Serving Gateway
PDN GW Packet data network GW
HSS Home Subscriber System

Irfan Ali
Irfan Ali 5 5
 LTE Architecture Key Concepts

 All radio related functions are pushed down to the eNB

• There is no centralized radio resource management element
like the RNC.
 In the core network, there is control-plane and user-plane
separation
• MME is the control-plane entity
• SGW and PGW are the user-plane entity
• To allow independent scaling of the control-plane and the
user-plane.
 LTE is a PS (Packet Switch) only system
• No CS (Circuit switch) domain support

Irfan Ali
Irfan Ali 6 6
 Architecture Concept: Access Stratum vs Non-Access Stratum
• On the signaling plane, the UE
IMS Internet communicates with two entities
in the infrastructure:
HSS
P-GW
 (a) the eNB and
 (b) the MME (via the eNB).
• Access-stratum (AS): UE <->
S-GW eNB.
 AS consists of both user-
S-GW
MME plane and control-plane.
The user-plane protocol is
Non-Access PDCP and control-plane
Stratum protocol is RRC.
(NAS)
• Non-access Stratum (NAS):
UE <-> MME.
eNB
eNB eNB
 NAS is only in the control-
Radio Resource Control plane. The protocol is
(RRC)
called the NAS protocol.
UE Access Stratum

Irfan Ali
Irfan Ali 7 7
 Protocol Stacks: Control Plane
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDCP PDCP SCTP SCTP UDP UDP UDP UDP

RLC RLC IP IP IP IP IP IP

MAC MAC L2 L2 L2 L2 L2 L2

PHY PHY L1 L1 L1 L1 L1 L1

UE LTE-Uu S1-MME S11 S5

eNB MME S-GW P-GW

Non-Access Stratum (NAS): The key control interface

between MME and UE
Radio Resource Control (RRC): The main control
interface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicate
detection, ROHC S1-AP S1 Application protocol
SCTP Stream Control Transport Protocol
Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane
ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane
acknowledged mode (UAM), etc
Medium Access Control (MAC): Access the channel
Physical Layer (PHY): Radio layer, eg modulation etc.

Irfan Ali
Irfan Ali 8 8
 Protocol Stacks: Control Plane & User Plane
NAS NAS

RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C

PDCP PDCP SCTP SCTP UDP UDP UDP UDP

RLC RLC IP IP IP IP IP IP

MAC MAC L2 L2 L2 L2 L2 L2

PHY PHY L1 L1 L1 L1 L1 L1

UE LTE-Uu S1-MME S11 S5

eNB MME S-GW P-GW

Application Application

TCP/UDP TCP/UDP

IP IP IP

GTP-U GTP-U GTP-U GTP-U

PDCP PDCP UDP UDP UDP UDP

RLC RLC IP IP IP IP

MAC MAC L2 L2 L2 L2

PHY PHY L1 L1 L1 L1
S5
LTE Uu S1-U
UE eNB S-GW P-GW End Host
Irfan Ali
Irfan Ali 9 9
 User Identifier in the Network

• Two important identifiers

 International Mobile Subscriber Identifier (IMSI)
• Embedded in SIM card
• Stored in subscription data of HLR
• Used to index UE’s information in most network nodes
• Format on the next page
 Mobile Station Integrated Services Digital Network Number (MSISDN)
• Your phone number
• Number used to identify a subscriber when making a call or sending an SMS
• The mapping between IMSI and MSISDN is stored in HLR
 MSISDN is not required to be stored in the (U)SIM

• MSISDN is typically not needed in the LTE system

Irfan Ali
Irfan Ali 10 10
 (International Mobile Subscriber Identifier) IMSI -
Structure

World 3 digits
MCC: Mobile Country Code
MCC
310
Country

286 404

US Turkey India PLMN

2-3 digits

MCC MNC MNC: Mobile Network Code

Operator

01 02 03 Identifies an operator

Turkcell Vodafone Avea

9-10 digits

MCC MNC MSIN MSIN: Mobile

Subscriber

Subscriber
Max 15 digits Identification Number
Irfan Alper Erol
Uniquely identifies a subscriber

Source for MCC and MNC codes:

http://en.wikipedia.org/wiki/Mobile_Network_Code
http://en.wikipedia.org/wiki/Mobile_Country_Code

Irfan Ali
Irfan Ali 11 11
 Operator Identity
 A mobile operator’s network is also known as a Public Land Mobile
Network (PLMN).
 The identity used for an operator’s network is called the PLMN-
Identity (PLMN-ID) and consists of the Mobile Country Code and the
Mobile Network Code.
 An operator may be identified by more than one PLMN-ID

World 3 digits
MCC: Mobile Country Code
MCC
310
Country

286 404

US Turkey India PLMN

2-3 digits

MCC MNC MNC: Mobile Network Code

Operator

01 02 03 Identifies an operator

Turkcell Vodafone Avea

PLMN ID = MCC + MNC

Irfan Ali
Irfan Ali 12 12
 MSISDN – Structure

World 1-3 digits

CC CC: Country Code

1 90 91
Country

US Turkey India
2-3 digits

CC NDC NDC: National Destination Code

533, 540, 505, 212,216,
Operator

… … … Identifies an operator
Turk
Turkcell Vodafone Avea
Telecom 9-10 digits

CC NDC SN SN: Subscriber

123 4567 123 4568
Subscriber

Number
Max 15 digits
Irfan Alper Erol
+90 533 123 4567
Uniquely identifies a subscriber

List of country calling codes:

Source for MCC and MNC codes: www.wikipedia.org
http://en.wikipedia.org/wiki/List_of_country_calling_codes

Irfan Ali
Irfan Ali 13 13
 Identities and Plumbing for LTE
IMSI IMSI IMSI

GUTI GUTI

C-RNTI C-RNTI

SRB-0 HSS

SRB-1 S1-MME
MME
SRB-2 NAS

GTPC-1
SRB Identity

GTPC-1
Data Radio Bearer 10
GTP-U-10 GTP-U-10

EPS Bearer Identity

IMSI IMSI

UE eNB S-GW P-GW

SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity
Irfan Ali
Irfan Ali
GUTI
14 14
Globally Unique Temporary Identity
 Identities in LTE

• IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network

Identity) Temporary Identity)
 Permanent identity of UE in SIM  Is created by eNB and only used to
(MCC+MNC+MSIN), where identify a UE within the scope of an
MCC+MNC = Home PLMN of eNB and provided to the UE during
subscriber. random access process and setup of
 Kept secret from eNB. RRC connection.
 Max 15 digits  C-RNTI is 16 bits long.
• GUTI (Globally unique temporary
identity)
 Created by the MME for the UE.
 Used between MME and UE instead of
IMSI.
 GUTI may be seen by eNB if NAS
message is sent un-encrypted, eg
when UE has moved to a new area
and needs to be served by a new
MME.
 56 bits + MCC and MNC

Irfan Ali
Irfan Ali 15 15
 LTE Attach Procedure

Irfan Ali 16
 Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
address to communicate with
P-GW
outside world.

• During the process of “attach”

S-GW  The UE is authenticated and
authorized to use send/receive
S-GW data.
MME

 Data path created beteween UE<-

>eNB<->S-GW<->PGW
 UE Context created in all the
nodes in the network
 UE is provided an IP address
X2
eNB eNB

SRB Signalling Radio Bearer

DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity

Bearer Setup at end of the Attach Procedure

Irfan Ali
Irfan Ali 17 17
 Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
UE Context:
KEY: IMSI
address to communicate with
UE Context: P-GW
KEY: IMSI ….. outside world.
…..
S6a
• During the process of “attach”
UE Context:
KEY: IMSI
S-GW …..  The UE is authenticated and
authorized to use send/receive
S-GW data.
MME

 Data path created beteween UE<-

S1-MME
>eNB<->S-GW<->PGW
 UE Context created in all the
UE Context:
S1 Cntxt: S1AP nodes in the network
TEID(key)…..
RB Cntxt: C-RNTI(key),..  UE is provided an IP address
X2
eNB eNB

SRB Signalling Radio Bearer

DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary Identity

Irfan Ali
Irfan Ali 18 18
 UE Performs attach – Part 1 of 4
UE HSS
eNB MME SGW
PGW
o UE has synchronized to the downlink frame of the eNB and hence
0. knows Interne
0. UE has the DL frame boundaries. The UE has read the MIB and from there the
selected eNB SIB2 of the eNB and knows when the random access channel (RACH)
slots are in the uplink direction.

1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The

RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since
1. Random Access Access multiple UEs could have transmitted on the same subframe and same
Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control
channel (CC) to see if the UE’s preamble has been accepted by the eNB.
PDCCH/PDSCH
2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step
Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE
Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the next
Temporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel.
UL-SCH: SRB0
3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to
Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the
DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI.
RRC Setup
4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
C-RNTI to the UE. When the UE receives its own transmitted message (unique)
5. RRC Connection Setup and C-RNTI, the contention resolution process is complete.

5. The eNB now transmits RRC Connection Setup message including the C-
UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention
that could have occurred due to two UEs using the same preamble
6. RRC Connection Complete sequence in RACH access step.
NAS Msg Attach
Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in
NAS Msg PDN
the previous step. The UE also includes its IMSI in the message.
Connect Req
RNTI Radio Network Temporary Identity
Irfan Ali
Irfan Ali 19 19
RA-RNTI
C-RNTI
Random Access RNTI
Cell RNTI
RAPID Random Access Preamble ID
 UE Performs Attach – Part 2 of 4
HSS
UE eNB MME SGW
eNB selects PGW
MME
Interne

S1-MME
7. Initial UE Message
S6a
8. Auth Info Request
NAS Msg: Attach
IMSI, ..
Request, IMSI, ..
NAS Msg PDN
User
9. Auth Info Answer
Connect Req Kasme, AUTN, RAND,XRES Authentication
DL-SCH:CCH SRB1 Procedure
10. DL NAS Xport
11. DL Info Xfer Authn Request
Authn Request: MME Compares
AUTN, RAND, RES with XRES.
If same, AKA
12. UL Info Transport successful
13. UL NAS Xport
Authn Response
Authn Response:
RES
UL-SCH: SRB1

DL-SCH:CCH SRB1 14. DL NAS Xport

15. DL Info Transport
Security Mode Command
Security Mode Command NAS Security
Setup Procedure
16. UL Info Transport
17. UL NAS Xport
Security Mode
SMC Complete
Complete
UL-SCH: SRB1 18. Location Update Request Authorization
IMSI, …
NAS Security 19. Location Update Response
Subscription Data Encrypted Info

Irfan Ali
Irfan Ali 20 20 Key Agreement
AKA: Authentication and
Integrity Protected
Info
 UE Performs Attach – Part 3 of 4
HSS
UE eNB MME SGW
NAS Security PGW Interne
GTPC
20. Create Session GTPC
Request (IMSI, TEIDs, 21. Create Session
PGW IP,…) Request (IMSI, TEIDs,
…)

S1-MME 22. Create Session

23. Create Session
DL-SCH:CCH SRB1 Response (IMSI, TEIDs)
24. Initial Context Setup Request Response(IMSI, TEIDs)
25. RRC Security Mode
(UE Context Info, TEIDs)
Command, AS Algorithm NAS: Attach Accept
NAS: Activate Bearer Setup
UL-SCH: SRB1 default bearer req Procedure Start
26. RRC Security Mode GTPC Session GTPC-1 Session
Complete
GTP-U-10 Tunnel
SRB-2
AS Security Setup
AS Security Procedure
27. Obtain UE’s Radio
Capability
DL-SCH:CCH SRB2
28. RRC Connection
Reconfiguration NAS1 Attach Completion
NAS2 Data Radio Bearer Setup
UL-SCH: SRB2
29. RRC Reconfig Complete 30. Initial Context Setup
Complete (S1U TEIDs)
31. UL Information Transfer GTPC
32. UL NAS Xport Bearer Setup
NAS1 NAS2 33. Modify Bearer Req.
NAS: Attach Complete Procedure Completion
SRB-0 (IMSI, TEIDs…)
NAS: Activate
SRB-1 default bearer acpt 34. Modify Bearer Resp
(IMSI,…) Encrypted Info
SRB-2

Irfan Ali
Data Radio Bearer-10 GTPU-10 Tunnel
21 21 Integrity Protected
Irfan Ali Info
 UE Performs Attach – Part 4 of 4 DHCP
HSS Server
UE eNB MME SGW
SRB-0 PGW Internet
SRB-1
SRB-2 S1-MME GTPC Session GTPC-1 Session
Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel

DHCP DHCP DHCP DHCP

Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel
Client Server Client Server

IP address
of the UE is
routed to this
interface

Irfan Ali
Irfan Ali 22 22
 Architecture key Concept: Roaming

• 3GPP architecture from early days has supported a subscriber going

to a foreign network and still getting service
 Home PLMN: Subscriber’s home network (eg. Turkcell)
 Visited PLMN: Foreign/Roamed-to network (eg. Orange)
• What does roaming require:
 Ability from VPLMN to identify the HPLMN of the subscriber
 Ability to authenticate the subscriber from VPLMN
 Sharing of revenue between VPLMN and HPLMN (roaming charges)

PLMN Public Land Mobile Network

VPLMN Visited PLMN
HPLMN Home PLMN

Irfan Ali
Irfan Ali 23 23
 Roaming Concept HPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org

HSS
IMS Internet IMS Internet

HSS
P-GW P-GW

S6a S6a
S5 S5

S11 S-GW S11 S-GW

S-GW S-GW
MME MME

S1-MME S1-MME
S1-U S1-U
HPLMN VPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
Domain = epc.mnc01.mcc404.pub.3gppnetwork.org

X2 X2 X2
X2 eNB
eNB eNB eNB eNB eNB
LTE-Uu LTE-Uu
Non-Roaming Roaming IMSI = 286 + 01 + 1234567890
IMSI = 286 + 01 + 1234567890 Turkey Turkcell
Turkey Turkcell HPLMN Home PLMN
VPLMN Visited PLMN

Irfan Ali
Irfan Ali Turkcell subscriber in Turkey 24 24 Turkcell subscriber in India
 General:
LTE/EPC Specifications 23.003 Identifiers
29.303 DNS
33.401 Security Stage 2&3

24.301 NAS HSS SPR PCC Stage 2: 23.203

Charging Stage 2: 32.240
S6a Unspecified Sp
29.214
S1-MME 29.272
PCRF Rx
36.410 General MME Operator
36.411 Layer 1
36.412 (Sig xport)
S11 29.212
S9 Services
S10 29.213 Sig Flow
36.413 (S1AP) Gx 29.215

36.133 RRM Reqds 29.274 GTPC

S1u Serving S5 SGi

UE eNB PDN GW Internet
GW
LTE-Uu 29.274 GTPC 29.061
36.304 Idle X2 36.410 General 29.281 GTPU Gz/Rf
36.306 Capability 36.411 Layer 1 Gy/Ro
36.314 Measurement 36.414 (Data xport) 32.251
23.122 Idle-NAS 29.281 GTPU Online Offline Bx Billing
36.420 General Charging Charging
Domain
36.201,211,213,214 PHY 36.421 Layer 1 Function Function
32.251
36.321 MAC 36.422 (Sig xport)
36.322 RLC 36.424 (Data xport)
36.323 PDCP 36.423 (X2AP)
36.331 RRC 29.281 GTPU

E-UTRAN Stage-2: Evolved Packet Core Stage 2: 23.401

36.300 Stage-3 Specification
Stage-2 Specification
Stage-1 Specification
Stage-1: 22.278
Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest
Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering

Irfan Ali
Irfan Ali 25 25