LTE MRBTS Signalling

RA41545EN03GLA0 1
LTE MRBTS Signalling

RA41545EN03GLA0 2
LTE MRBTS Signalling

RA41545EN03GLA0 3
LTE MRBTS Signalling

RA41545EN03GLA0 4
LTE MRBTS Signalling

RA41545EN03GLA0 5
LTE MRBTS Signalling

Typical cause values that can be expected are found in the protocol cause group and
miscellaneous cause group of S1 AP:
• Semantic error.
• Abstract syntax error.
• Control processing overload.
• Hardware failure.
• Unspecified.
• Unknown PLMN.

RA41545EN03GLA0 6
LTE MRBTS Signalling

RA41545EN03GLA0 7
LTE MRBTS Signalling

RA41545EN03GLA0 8
LTE MRBTS Signalling

If the eNB initiates the procedure by sending a S1 SETUP REQUEST message including the
PLMN Identity IEs and the MME is not able to identify at least one of the PLMNs provided by
the eNB, then the MME shall reject the eNB S1 Setup Request procedure with the appropriate
cause value e.g "Unknown PLMN".

RA41545EN03GLA0 9
LTE MRBTS Signalling

RA41545EN03GLA0 10
LTE MRBTS Signalling

RA41545EN03GLA0 11
LTE MRBTS Signalling

RA41545EN03GLA0 12
LTE MRBTS Signalling

RA41545EN03GLA0 13
LTE MRBTS Signalling

•USIM card can be used to access 2G networks (besides 3G and LTE Networks)
•SIM card (original 2G SIM card) can not be used to access LTE Networks

RA41545EN03GLA0 14
LTE MRBTS Signalling

Further Reading:
The GUMMEI in turn consists of the following:
− PLMN Id: MCC, MNC
− MME Identifier (MMEI): MME Group Id (MMEGI) and MME Code (MMEC)
The MMEC provides a unique identity to an MME within the MME pool, while the MMEGI
is used to distinguish between different MME pools.
More details about these identifiers can be found in TS 23.003.
GUTI reallocation is further described in TS 23.401 and TS 24.301.

RA41545EN03GLA0 15
LTE MRBTS Signalling

Because MME pool areas can overlap, care must be taken to ensure that MMEs serving
the overlapping areas are
not allocated the same MMECs

RA41545EN03GLA0 16
LTE MRBTS Signalling

RA41545EN03GLA0 17
LTE MRBTS Signalling

RA41545EN03GLA0 18
LTE MRBTS Signalling

RA41545EN03GLA0 19
LTE MRBTS Signalling

RA41545EN03GLA0 20
LTE MRBTS Signalling

RA41545EN03GLA0 21
LTE MRBTS Signalling

ESM = EPS Session Management

RA41545EN03GLA0 22
LTE MRBTS Signalling

C-RNTI: Cell Radio Network Temporary Identifier. Uniquely identifies a UE within a cell. Only
exists if UE is connected. Assigned by the eNodeB.
S-TMSI: SAE- Temporary Mobile Subscriber Identifier: uniquely identifies the UE within a
tracking area. Assigned by the MME.
TA Update: Tracking Area Update

RA41545EN03GLA0 23
LTE MRBTS Signalling

RA41545EN03GLA0 24
LTE MRBTS Signalling

1. Upon E-UTRAN initial attach procedure, UE performs (contention-based) Random Access

procedure as described in earlier topic.
2. UE sends RRC CONNECTION SETUP COMPLETE message conveying NAS PDU (EMM:
Attach Request, ESM: PDN Connectivity Request)
3. eNB forwards the request and puts across the NAS PDU into INITIAL UE MESSAGE.
4. If the UE is unknown in the MME, ME identity check procedure is performed. Optionally,
authentication and security procedures are performed in order to secure communication
between UE and the EPS network.
5. If there is no valid subscription context for the UE in the MME, the MME updates the UE
location in the HSS.
6. MME sends a CREATE SESSION REQUEST containing e.g. IMSI, Default EPS Bearer
QoS, EPS Bearer Identity etc. to the selected SGW.
7. The SGW creates a new entry in its EPS Bearer table and sends a CREATE SESSION
REQUEST message to the PGW. This procedure depends on the S5/S8 option used.
8. The SGW returns a CREATE SESSION RESPONSE message to the MME.

RA41545EN03GLA0 25
LTE MRBTS Signalling

9. The MME sends an Attach Accept as well as Default EPS Bearer Context Request
messages to the eNB within INITIAL CONTEXT SETUP REQUEST message.
10. The eNB forwards NAS messages above within the RRC CONNECTION
RECONFIGURATION message.
11. The UE sends the RRC CONNECTION RECONFIGURATION COMPLETE message to the
eNB.
12. The eNB sends the INITIAL CONTEXT SETUP RESPONSE message to the MME.
13. The UE sends a UL INFORMATION TRANSFER message to the eNB, which includes the
Attach Complete and Default EPS Bearer Context Complete.
14. The eNB forwards these NAS message to the MME.
15. Upon reception of both, the INITIAL CONTEXT SETUP RESPONSE message the Attach
Complete message, the MME sends a MODIFY BEARER REQUEST message to the SGW.
16. The SGW acknowledges by sending MODIFY BEARER RESPONSE message to the MME.
The SGW can then send its buffered downlink packets.

RA41545EN03GLA0 26
LTE MRBTS Signalling

RA41545EN03GLA0 27
LTE MRBTS Signalling

1. Random Access Preamble on RACH in uplink.

• UE picks a RA preamble from available preamble group and send it to eNB. The
preamble group information along with the necessary thresholds are broadcast on
System Information Broadcast Type 3.
2. Random Access Response generated by MAC on DL-SCH.
• Addressed to RA-RNTI on PDCCH.
• Conveys at least RA-preamble identifier, Timing Alignment information, initial UL grant
and assignment of Temporary C-RNTI
• Intended for a variable number of UEs in one DL-SCH message.
3. First scheduled UL transmission on UL-SCH.
• For initial access:
- Conveys the RRC Connection Request generated by the RRC layer
- Conveys at least NAS UE identifier but no NAS message.
• For RRC Connection Re-establishment procedure:
- Conveys the RRC Connection Re-establishment Request generated by the RRC
layer
- Does not contain any NAS message.
• After handover, in the target cell:
- Conveys the ciphered and integrity protected RRC Handover Confirm generated by
the RRC layer
- Conveys the C-RNTI of the UE (which was allocated via the Handover Command).
- Includes an uplink Buffer Status Report when possible.
• For other events:
- Conveys at least the C-RNTI of the UE.
4. Contention Resolution on DL.
• Early contention resolution shall be used i.e. eNB does not wait for NAS reply before
resolving contention.
• Addressed to:
- The Temporary C-RNTI on PDCCH for initial access and after radio link failure.
- The C-RNTI on PDCCH for UE in RRC_CONNECTED.
• The Temporary C-RNTI is promoted to C-RNTI for a UE which detects RA success and
does not already have a C-RNTI.

RA41545EN03GLA0 28
LTE MRBTS Signalling

RRC connection establishment involves the establishment of SRB1. E-UTRAN completes RRC
connection establishment prior to completing the establishment of the S1 connection, i.e. prior
to receiving the UE context information from the EPC. Consequently, AS security is not
activated during the initial phase of the RRC connection. During this initial phase of the RRC
connection, the E-UTRAN may configure the UE to perform measurement reporting. However,
the UE only accepts a handover message when security has been activated.
Upon receiving the UE context from the EPC, E-UTRAN activates security (both ciphering and
integrity protection) using the initial security activation procedure. The RRC messages to
activate security (command and successful response) are integrity protected, while ciphering is
started only after completion of the procedure. That is, the response to the message used to
activate security is not ciphered, while the subsequent messages (e.g. used to establish SRB2
and DRBs) are both integrity protected and ciphered.
After having initiated the initial security activation procedure, E-UTRAN initiates the
establishment of SRB2 and DRBs, i.e. E-UTRAN may do this prior to receiving the confirmation
of the initial security activation from the UE. In any case, E-UTRAN will apply both ciphering
and integrity protection for the RRC connection reconfiguration messages used to establish
SRB2 and DRBs. E-UTRAN should release the RRC connection if the initial security activation
and/ or the radio bearer establishment fails (i.e. security activation and DRB establishment are
triggered by a joint S1-procedure, which does not support partial success).
For SRB2 and DRBs, security is always activated from the start, i.e. the E-UTRAN does not
establish these bearers prior to activating security.

RA41545EN03GLA0 29
LTE MRBTS Signalling

RA41545EN03GLA0 30
LTE MRBTS Signalling

RA41545EN03GLA0 31
LTE MRBTS Signalling

RA41545EN03GLA0 32
LTE MRBTS Signalling

RA41545EN03GLA0 33
LTE MRBTS Signalling

RA41545EN03GLA0 34
LTE MRBTS Signalling

RA41545EN03GLA0 35
LTE MRBTS Signalling

RA41545EN03GLA0 36
LTE MRBTS Signalling

•EMM: Attach request

•ESM: PDN connectivity request

RA41545EN03GLA0 37
LTE MRBTS Signalling

RA41545EN03GLA0 38
LTE MRBTS Signalling

RA41545EN03GLA0 39
LTE MRBTS Signalling

1.UE sends its IMSI and UE network capability (contains UE capability to support encryption
and integrity protection algorithms) within Attach Request message.
2.MME sends AUTHENTICATION INFORMATION REQUEST message to HSS. MME uses
IMSI as username to request authentication parameters from HSS, and it gives PLMN
information in which the UE tries to attach.
3.HSS checks the user security parameters within its database and returns authentication
parameters (RAND, XRES, AUTN and KASME) to the MME.
4.MME forwards RAND and AUTN parameters to the UE within the Authentication Request
message. The MME also indicates the use of KASME, so that the UE can derive NAS
Ciphering Key (CK) and Integrity Protection Key (IK) from it. MME keeps the XRES for
authentication challenge later.
5.UE uses RAND to compute the RES then sends it back to the MME to be compared with
XRES in the MME. If they are equal, the authentication is successfully performed. The UE may
also reject the authentication based on the AUTN parameters.

RA41545EN03GLA0 40
LTE MRBTS Signalling

AVP = Attribute Value Pair.

RA41545EN03GLA0 41
LTE MRBTS Signalling

AUTN = (SQN xor AK) + AMF + MAC.

Where,
•SQN = Sequence Number
•AK = Authentication Key
•AMF = Authentication Management Field
•MAC = Message Authentication Code.

RA41545EN03GLA0 42
LTE MRBTS Signalling

RA41545EN03GLA0 43
LTE MRBTS Signalling

RA41545EN03GLA0 44
LTE MRBTS Signalling

RA41545EN03GLA0 45
LTE MRBTS Signalling

Currently:
•GTPv1 for UP
•GTPv2 for CP

RA41545EN03GLA0 46
LTE MRBTS Signalling

RA41545EN03GLA0 47
LTE MRBTS Signalling

RA41545EN03GLA0 48
LTE MRBTS Signalling

RA41545EN03GLA0 49
LTE MRBTS Signalling

RA41545EN03GLA0 50
LTE MRBTS Signalling

RA41545EN03GLA0 51
LTE MRBTS Signalling

RA41545EN03GLA0 52
LTE MRBTS Signalling

•SGW and PGW had same IP because they are in same Unit.

RA41545EN03GLA0 53
LTE MRBTS Signalling

RA41545EN03GLA0 54
LTE MRBTS Signalling

RA41545EN03GLA0 55
LTE MRBTS Signalling

RA41545EN03GLA0 56
LTE MRBTS Signalling

RA41545EN03GLA0 57
LTE MRBTS Signalling

RA41545EN03GLA0 58
LTE MRBTS Signalling

RA41545EN03GLA0 59
LTE MRBTS Signalling

RA41545EN03GLA0 60
LTE MRBTS Signalling

RA41545EN03GLA0 61
LTE MRBTS Signalling

RA41545EN03GLA0 62
LTE MRBTS Signalling

RA41545EN03GLA0 63
LTE MRBTS Signalling

RA41545EN03GLA0 64
LTE MRBTS Signalling

RA41545EN03GLA0 65
LTE MRBTS Signalling

RA41545EN03GLA0 66
LTE MRBTS Signalling

RA41545EN03GLA0 67
LTE MRBTS Signalling

RA41545EN03GLA0 68
LTE MRBTS Signalling

RA41545EN03GLA0 69
LTE MRBTS Signalling

RA41545EN03GLA0 70
LTE MRBTS Signalling

RA41545EN03GLA0 71
LTE MRBTS Signalling

RA41545EN03GLA0 72
LTE MRBTS Signalling

RA41545EN03GLA0 73
LTE MRBTS Signalling

RA41545EN03GLA0 74
LTE MRBTS Signalling

The MME shall initiate the dedicated bearer context activation procedure by sending an
ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message.
The MME allocates the EPS bearer identity and includes it in the ACTIVATE DEDICATED EPS
BEARER CONTEXT REQUEST message. The MME shall include the EPS bearer identity of
the associated default bearer as the linked EPS bearer identity in the ACTIVATE DEDICATED
EPS BEARER CONTEXT REQUEST message. The ACTIVATE DEDICATED EPS BEARER
CONTEXT REQUEST message shall also include a procedure transaction identity (PTI), if this
procedure was initiated by a UE requested bearer resource allocation procedure or a UE
requested bearer resource modification procedure.

RA41545EN03GLA0 75
LTE MRBTS Signalling

RA41545EN03GLA0 76
LTE MRBTS Signalling

Handover preparation
Once the source eNB makes handover decision, it establishes X2 connection to the target eNB
in order to request resources and forward necessary information. After the source eNB receives
resources information from the target eNB, the handover process is ready to be executed.
Handover Execution
Handover execution is started with handover command from the source eNB. During the
execution, the source eNB forward the DL packet to the target eNB while the UE accessing the
target eNB. The execution phase is finished when the UE is successfully access the target eNB.
It sends handover confirmation and starts sending UL packet.
Handover Completion
The handover process is completed when there is no more forwarded data from the source
eNB and the user data path (UL and DL) is completely switched to the target eNB.

RA41545EN03GLA0 77
LTE MRBTS Signalling

Based on UE measurement and RRM information, the source eNB decides that a handover to
the target eNB is necessary.
The source eNB sends a HANDOVER REQUEST message over the X2 interface to the target
eNB. The message contains necessary information to prepare the handover at the target side.
The target eNB allocates resources for the target cell. The UE is allocated a new C-RNTI for
identification in the target cell.
The target eNB sends a HANDOVER REQUEST ACKNOWLEDGE message to the source
eNB, which in turn sends handover command over the air interface to the UE, including
necessary information (e.g. the new C-RNTI) so that the UE can perform the handover.

RA41545EN03GLA0 78
LTE MRBTS Signalling

The source eNB sends Packet Data Convergence Protocol (PDCP) sequence number (SN)
information to the target eNB in an SN STATUS TRANSFER message. This information is
necessary to avoid missing or duplicating PDCP packets when the uplink and downlink user
data paths are switched from the source eNB to the target eNB. Also, the source eNB now
forwards the received downlink user data packets to the target eNB instead of sending them to
the UE. The downlink user data packets are buffered in the target eNB until the handover is
completed.
As soon as the handover command (RRC CONNECTION RECONFIGURATION) message is
received, the UE buffers the uplink user data until the handover has been completed, detaches
from the source cell, and synchronises with the target cell using the non-contention based
random access procedure.
Next, the UE sends a handover confirmation (RRC CONNECTION RECONFIGURATION
COMPLETE) message to the target eNB to indicate that the handover procedure is completed
as far as the UE is concerned.
Now the UE can start sending the buffered uplink user data and the target eNB can forward the
downlink user data to the UE. The uplink user data is sent via the target eNB directly to the
Serving Gateway. This is possible, since the uplink tunnel endpoint identifier (TEID) in the S-
GW was conveyed to the target eNB already.

RA41545EN03GLA0 79
LTE MRBTS Signalling

The target eNB sends PATH SWITCH message to MME to inform that the UE has changed cell
including its downlink tunnel endpoint identifier (TEID). MME forwards it to the S-GW so that the
S-GW can send the downlink user data directly to the target eNB.
Before the S-GW can release any user plane resources towards the source eNB, it sends one
or more ”end marker” packets to the source eNB as an indication that the downlink data path
has been switched. It should be noted that these packets do not contain any user data, and are
transparently forwarded by the source eNB to the target eNB to help it decide when the last
forwarded packet was received.
After receiving an acknowledgement message the target eNB informs the source eNB about the
success of the handover. As a final step, the source eNB releases all air interface and control
plane resources associated with the UE context. Now the handover is completed.

RA41545EN03GLA0 80