LTE:

A feature based approach

LTE Core Features

LTE Attach

İki Teknoloji 1
 Overview

• Process of a mobile obtaining an IP address

Ø Identity
Ø Attach Call flow
Ø Access Stratum and Non Access Stratum
Ø Mobility Management and Session Management
Ø Protocol Stacks
• Annex: GTP Primer
• Annex: S1-MME (S1AP) Primer

İki Teknoloji
Irfan Ali 2 2
 LTE Network Architecture

Internet

HSS
P-GW

S6a
S5

S11 S-GW
Evolved Packet Core
(EPC)
MME Evolved Packet System
(EPS)
S1-U
S1-MME

Evolved Universal Terrestrial

Radio Access Network
X2 X2
eNB (E-UTRAN)
eNB eNB
LTE-Uu
eNB Enhanced Node Base Station
MME Mobility Management Entity
S-GW Serving Gateway
UE P-GW Packet data network Gateway
HSS Home Subscriber System
İki Teknoloji
Irfan Ali 3 3
UE User Equipment
 Objective of UE Attach Procedure
Mehmet’s IP address Internet
46.1.78.189 -> Ayse
10.40.40.12

IP_a ->
HSS Hi
P-GW IP_m

GTP C
S6a

P U S5
GTP C GT IP_pgw -> UDP_
IP_a ->
dst= TEID_k Hi
S-GW IP_sgw 2152 IP_m
S11 IP UDP GTP-U
header

MME

UDP_
IP_sgw -> IP_a ->
dst= TEID_x Hi
S1-MME IP_enb 2152 IP_m
S1-U
GTP U

S1AP

eNB eNB
SR B-0
SR B-1
SR

DR B-2

IP_a ->
Hi
B

IP_m

Mehmet DRB Data Radio Bearer

SRB Signaling Radio Bearer
Network plumbing end of the Attach Procedure GTP GPRS Tunneling Protocol
S1AP S1 Application Protocol
İki Teknoloji
Irfan Ali 4 4
TEID Tunnel Endpoınt Identıfıer
 User Identifier in the Network

• Who are you not:

Ø Your Phone Number

• Mobile Station Integrated Services Digital Network Number (MSISDN)

Ø Your Mobile Identity

• International Mobile Equipment Identity (IMEI)

• Who are you:

Ø International Mobile Subscriber Identifier (IMSI)

• Embedded in SIM card
• Stored in subscription data of HSS (Home Subscriber System)

İki Teknoloji
Irfan Ali 5 5
 (International Mobile Subscriber Identifier) IMSI - Structure

World 3 digits
MCC: Mobile Country Code
MCC
310 286
Country

404

US Turkey India PLMN ID

2-3 digits

MCC MNC MNC: Mobile Network Code

Operator

01 02 03 Operator

Turkcell Vodafone Avea

9-10 digits

MCC MNC MSIN MSIN: Mobile

Subscriber

Subscriber
Mehmet Alper Ayse Max 15 digits Identification Number
Uniquely identifies a subscriber

Source for MCC and MNC codes:

http://en.wikipedia.org/wiki/Mobile_Network_Code
http://en.wikipedia.org/wiki/Mobile_Country_Code

PLMN Public Land Mobile Network (Operator)

İki Teknoloji
Irfan Ali 6 6
 Identities and Plumbing for LTE
IMSI IMSI IMSI
S1: (eNB1, 4)
GUTI GUTI S11: (SGW1, 44)

C-RNTI C-RNTI
S1-MME, SCTP
S1: (MME1, 14)
SRB-0
S1U EBID5: (SGW1,54)
14->4 HSS
Att Acpt
eNBCRNTI,
UE S1AP ID Initial MME UE S1AP ID
Att Acpt PDN Con
Attach RRC 4->14, Init UE Cntxt Cntxt
SRB-1 4 Attach Req (IMSI) 14->4Acpt(EBID5)
CRNTI SMC
PDN Con
Request(IMSI) ConnAcpt (EBID5:
PDN
64)
Conn Req
Setup SMC MME
PDN Conn Req Reconfig Acpt(EBID5) (ERAB5: (SGW1, 54) IPMME1
MME S11 TEID
SRB-2 (EBID5,DRBID5,LCID3)
C.S. Req (IMSI, MME
24->44,
S11 Mod Bearer
TEID,PGW,EBID5)
Req (EBID5:eNB1,64)

GTP C
C.S. Rsp (SGW S11 TEID,
C.S. Req(IMSI, SGW S5C C.S. Rsp (PGW S5C
TEID, EBID5:S5U TEID) EBID5: S1U TEID) TEID, EBID5:S5U TEID)
SGW S11 TEID
SGW S5C TEID PGW S5C TEID
GTPC
SGW S5U TEID
PGW S5U TEID
DRBID5
DRBID5 DRBID5 GTP-U, EBID5 GTP-U, EBID5
LCID3 LCID3
eNB S1U TEID SGW S1U TEID
S1U: (eNB1, 64)
S5U EBID5: (PGW1,34)
S5C: (PGW1, 34)
S5U EBID5: (SGW1,24)
S11: (MME1, 24) S5C: (SGW1, 24)

IMSI IMSI

UE eNB S-GW P-GW

IPeNB IPSGW1 IPPGW1

SRB Signalling Radio Bearer

DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
İki Teknoloji
Irfan Ali 7 7
C-RNTI
GUTI
Cell- Radio Network Temporary Identity
Globally Unique Temporary Identity
 UE Performs attach – Part 1 of 4
UE HSS
eNB MME SGW

0. UE has
PGW In
selected eNB

RACH Random Access

1. Random Access Procedure
Preamble

2. Random Access
Response(Temp CRNTI)

SRB0

3. RRC Connection
Request (Temp CRNTI)
RRC Setup
Procedure
4. RRC Connection Setup
(CRNTI)

SRB1

5. RRC Connection Complete

Attach Request, IMSI

PDN Connect Req

İki Teknoloji
Irfan Ali 8 8
 UE Performs Attach – Part 2 of 4
HSS
UE eNB MME SGW
eNB selects PGW
MME
In

S1-MME
6. Initial UE Message
S6a
7. Auth Info Request
NAS Msg: Attach
IMSI, ..
Request, IMSI, ..
NAS Msg PDN
User
8. Auth Info Answer
Connect Req Kasme, AUTN, RAND,XRES Authentication
Procedure
9. DL NAS Xport
10. DL Info Xfer Authn Request
Authn Request: MME Compares
AUTN, RAND, RES with XRES.
If same, AKA
11. UL Info Transport successful
12. UL NAS Xport
Authn Response
Authn Response:
RES

13. DL NAS Xport

14. DL Info Xfer
Security Mode Command
Security Mode Command NAS Security
Setup Procedure
15. UL Info Transport
16. UL NAS Xport
Security Mode
SMC Complete
Complete
17. Location Update Request Authorization
IMSI, …
NAS Security 18. Location Update Response
Subscription Data Encrypted Info

İki Teknoloji
Irfan Ali 9 9 Key Agreement
Integrity Protected
AKA: Authentication and Info
 UE Performs Attach – Part 3 of 4
HSS
UE eNB MME SGW
NAS Security GTP C
PGW In
19, Create Session GTP C
Request (IMSI, TEID, 20,. Create Session
PGW IP,…) Request (TEIDs, …)

S1-MME 21. Create Session

22. Create Session
Response (TEIDs)
23. Initial Context Setup Request Response(TEIDs)
24. RRC Security Mode
(UE Context Info, TEID)
Command, AS Algorithm NAS: Attach Accept
NAS: Activate S5 Bearer Setup
default bearer req Procedure
25. RRC Security Mode GTP C Tunnel GTP C Tunnel
Complete
GTP U Tunnel
SRB-2
AS Security Setup
AS Security Procedure
26. Obtain UE’s Radio
Capability

27. RRC Connection

Reconfiguration NAS1 Data Radio Bearer Setup
NAS2

28. RRC Reconfig Complete 29. Initial Context Setup

Complete (S1U TEID)
30. UL Information Transfer GTPC S1 U Bearer Setup
NAS1 31. UL NAS Xport
NAS2 NAS: Attach Complete
32. Modify Bearer Req.
Procedure
SRB-0 (S1U TEID…)
NAS: Activate
SRB-1 default bearer acpt 33. Modify Bearer Resp
SRB-2 Encrypted Info

Data Radio Bearer GTP U Tunnel

İki Teknoloji
Irfan Ali 10 10 Integrity Protected
Info
 UE Performs Attach – Part 4 of 4 DHCP
HSS Server
UE eNB MME SGW
SRB-0 PGW In
SRB-1
SRB-2 S1-MME GTPC Tunnel GTP C Tunnel
Data Radio Bearer GTP U Tunnel GTP U Tunnel

DHCP GTPU-10 Tunnel DHCP DHCP DHCP

Data Radio Bearer-10 DHCP Messages GTP-U-10 Tunnel
Client Server Client Server

IP address
of the UE is
routed to this
interface

İki Teknoloji
Irfan Ali 11 11
 Architecture Concept 1: Access Stratum and Non-Access Stratum

Internet

HSS
P-GW

S-GW

MME

Non-Access
Stratum
(NAS)

eNB
eNB eNB
DR B

Radio Resource Control

SR

(RRC)
B

UE Access Stratum

İki Teknoloji
Irfan Ali 12 12
 Architecture Concept 2: Mobility Management (MM)
• What is Mobility Management in LTE?
Ø It is concerned about the UE’s registration state at the NAS layer.
Ø There is an MM state-machine that runs in both the MME and UE. They key states
are:
• EMM-DEREGISTERED
• EMM-REGISTERED
Ø Examples of EMM Procedures
• Attach
• Authentication
• Security Mode Command
• GUTI reallocation
• Tracking Area Update
• Paging
• Service Request
• …
Ø For each UE there is a MM context. The MM context consists of UE’s security related
parameters (keys, counters)

İki Teknoloji
Irfan Ali 13 13 For details, please refer to section 5.1.3 in TS 24.301
 Architecture Concept 2: Session Management (SM)
• What is Session Management in LTE?
Ø It is related to UE’s connectivity (EPS bearers) at the NAS layer.
• There is an ESM state-machine that runs in both the MME and UE for each EPS bearer.
They key states are:
• Bearer Context In-active
• Bearer Context Active

• Examples of ESM procedures are:

Ø PDN Connectivity Request/ Activate Default EPS bearer
Ø PDN Disconnect Request/ Deactivate Default EPS bearer
Ø Activate dedicated EPS bearer
Ø Modify default/dedicated EPS bearer
Ø …

• For each UE there is a ESM context that includes context for all active bearers and
includes parameters applicable to the bearers (Bearer ID, QoS parameters,…).

İki Teknoloji
For details, please refer to section 6.1.3 in TS 24.301
Irfan Ali 14 14
 Architecture Concept 2: Mobility Management (MM)
and Session Management (SM) Relation
• There are separate NAS messages for EMM and ESM.
• EMM Context and ESM context are stored separately in the MME.
• LTE has the concept of “Always ON” IP connectivity.
Ø The moment the UE attaches, a default bearer is setup for the UE to have
connectivity. For UE to be in EMM-REGISTERED state, the UE MUST have at
least one bearer context.
Ø If the last default bearer is removed, UE is moved to detached state. If the
last default bearer is removed, the UE automatically enters EMM-
DEREGISTERED state.
• ESM procedures can be performed only if an EMM context has been established
between the UE and the MME.
• Hence, there is coupling between EMM and ESM state in LTE.

İki Teknoloji
Irfan Ali 15 15
 NAS EMM and ESM Message Formats
Non-secured NAS Messages Secured NAS Messages
Bits
Octets 8 7 6 5 4 3 2 1
1 Security Type Protocol Discriminator
0x0000 0x0111 (EMM) Bits
Octets 8 7 6 5 4 3 2 1
2 Message Type
1 Security Type Protocol Discriminator
3 0x0010 0x0111 (EMM)
2
Rest of EMM Message 3 Message Authentication
4 Code (MAC)
5
Integrity
6 Sequence Number (SN) Protected
Bits
Octets 8 7 6 5 4 3 2 1 7
Protocol Discriminator
1 EPS Bearer ID
0x0010 (ESM) EMM or ESM
2 Procedure Transaction ID NAS Message
3 Message Type

Rest of NAS ESM Message

İki Teknoloji
Irfan Ali 16 16
 Protocol Stacks: Control Plane between UE, eNB and MME

NAS NAS

RRC RRC S1AP S1AP

PDCP PDCP SCTP SCTP

RLC RLC IP IP

MAC MAC L2 L2

PHY PHY L1 L1

UE LTE-Uu eNB S1-MME

MME

Non-Access Stratum (NAS): The key control interface

between MME and UE
Radio Resource Control (RRC): The main control
interface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicate
detection, ROHC S1-AP S1 Application protocol

Radio Link Control (RLC): Segmentation/re-assembly,

ARQ, acknowledge mode (AM)/ un-
acknowledged mode (UAM)
Medium Access Control (MAC): Access the channel,
scheduling
Physical Layer (PHY): Radio layer, eg. modulation,
MIMO

İki Teknoloji
Irfan Ali 17 17
 The GTP-C and GTP-U Protocols

GTP-C GTP-C GTP-C GTP-C

UDP UDP UDP UDP

IP IP IP IP

L2 L2 L2 L2

L1 L1 L1 L1

UE S11 S5
eNB MME S-GW P-GW
Application Application

TCP/UDP TCP/UDP

IP IP IP

GTP-U GTP-U GTP-U GTP-U

PDCP PDCP UDP UDP UDP UDP

RLC RLC IP IP IP IP

MAC MAC L2 L2 L2 L2

PHY PHY L1 L1 L1 L1
S5
LTE Uu S1-U
UE eNB S-GW P-GW End Host

İki Teknoloji
Irfan Ali 18 18 GTP-C GPRS Tunneling Protocol Control
 References

• LTE Attach Procedure

Ø TS 23.401, Section 5.3.2.1
• Random Access Procedure
Ø TS 36.300, Section 10.1.5.2
• NAS
Ø EMM State: TS 24.301, Section 5.1.3
Ø ESM State: TS 24.301, Section 6.1.3

İki Teknoloji
Irfan Ali 19 19
 Next Video

• Protocol Details
Ø GTP Primer
Ø S1-MME (S1AP) Primer

• LTE Radio Primer

Ø How are data and signaling messages transmitted between the
mobile and eNB?

İki Teknoloji
Irfan Ali 20 20