LTE Architecture and LTE Attach

Irfan Ali 1

LTE & EPC Architecture

LTE Attach Procedure

Version: 3.0 (March 2013)

Irfan Ali 2Irfan Ali 2

3GPP Network Architecture

Network

Radio AccessNetwork (RAN) Core Network (CN)

User Equipment (UE) orMobile Station (MS)

+

(U)SIMMobileEquipment (ME)

SIM Subscriber Identity ModuleUSIM Universal Subscriber Identity Module

Radio Resource Management Security, IP connectivity, Mobility


LTE Network Architecture

Internet

eNB eNB eNB

MME

S-GW

S-GW

P-GWHSS

S1-MME

S11

S1-U

S6a S5

X2

Evolved Universal Terrestrial Radio Access Network(E-UTRAN)

Evolved Packet Core(EPC)

X2

LTE-Uu eNB Enhanced Node BMME Mobility Management EntityS-GW Serving GatewayP-GW Packet data network GatewayHSS Home Subscriber System


LTE Network Architecture

IMS Internet

eNB eNB

MME

S-GW

S-GW

P-GWHSS

S1-MME

S11

S1-U

S6a S5

X2

RB Control

Radio AdmissionControl

Scheduler

Inter Cell RRM

Connected ModeMobility Mgmt

eNB MeasurementOAM

NAS Security

Idle ModeMobility Mgmt

EPS Bearer Control

Inter eNB MobilityAnchoring

UE IP addressAllocation

eNB

MME S-GW

P-GW

S1-US1-MME

S5

Authenticator

HSS

S6a

eNB

User-PlaneFunctional Entity

Control-PlaneFunctional Entity Radio Bearer

Transmission(L1/L2/L3)

Subscription

Inter SGW MobilityAnchoring

LTE-Uu


Block Diagram example: LTEArchitecture

UE

MME

HSS

ServingGW PDN GW

Operators IPServices

InternetInternet

S6a

S11

S1u

S1-MME

LTE-Uu

S5

SGi

eNB

S10

X2

Functional EntityLogical EntityNetwork Entity

InterfacesReference Points

SGi

eNB Enhanced Node BMME Mobility Management EntityS-GW Serving GatewayPDN GW Packet data network GWHSS Home Subscriber System


LTE Architecture Key Concepts

All radio related functions are pushed down to the eNB• There is no centralized radio resource management element

like the RNC. In the core network, there is control-plane and user-plane

separation• MME is the control-plane entity• SGW and PGW are the user-plane entity• To allow independent scaling of the control-plane and the

user-plane. LTE is a PS (Packet Switch) only system

• No CS (Circuit switch) domain support


Architecture Concept: Access Stratum vs Non-Access Stratum

• On the signaling plane, the UEcommunicates with two entitiesin the infrastructure: (a) the eNB and (b) the MME (via the eNB).

• Access-stratum (AS): UE <->eNB. AS consists of both user-

plane and control-plane.The user-plane protocol isPDCP and control-planeprotocol is RRC.

• Non-access Stratum (NAS):UE <-> MME. NAS is only in the control-

plane. The protocol iscalled the NAS protocol.

IMS Internet

eNBeNB

MME

S-GW

S-GW

P-GWHSS

eNB

Access Stratum

Non-AccessStratum

(NAS)

UE

Radio Resource Control(RRC)


Protocol Stacks: Control Plane

MME

L1

L2

IP

SCTP

S1-AP

L1

L2

IP

SCTP

S1-AP

S1-MME

PHY

MAC

RLC

PDCP

NAS

RRC

PHY

MAC

RLC

PDCP

RRC

UE eNB

NAS

LTE-Uu

Non-Access Stratum (NAS): The key control interfacebetween MME and UE

Radio Resource Control (RRC): The main controlinterface between eNB and UE

Packet Data Convergence Protocol (PDCP): Duplicatedetection, ROHC

Radio Link Control (RLC): Segmentation/re-assembly,ARQ, acknowledge mode (AM)/ un-acknowledged mode (UAM), etc

Medium Access Control (MAC): Access the channel

Physical Layer (PHY): Radio layer, eg modulation etc.

L1

L2

IP

UDP

GTP-C

S-GW

L1

L2

IP

L1

L2

IP

P-GW

UDP

GTP-C

UDP

GTP-C

S11 S5

L1

L2

IP

UDP

GTP-C

S1-AP S1 Application protocolSCTP Stream Control Transport ProtocolGTP-C GPRS Tunneling Protocol-Control PlaneGTP-U GPRS Tunneling protocol- User Plane


Protocol Stacks: Control Plane & User Plane

MME

IP

End Host

Application

TCP/UDP

L1

L2

IP

SCTP

S1-AP

L1

L2

IP

SCTP

S1-AP

S1-MME

PHY

MAC

RLC

PDCP

PHY

MAC

RLC

PDCP

IP

Application

eNBUELTE Uu

TCP/UDP

PHY

MAC

RLC

PDCP

NAS

RRC

PHY

MAC

RLC

PDCP

RRC

UE eNB

NAS

LTE-Uu

S-GW

S-GW

L1

L2

IP

UDP

GTP-U

S1-U

L1

L2

IP

UDP

GTP-U

L1

L2

IP

UDP

GTP-C

L1

L2

IP

UDP

GTP-C

S11

P-GW

L1

L2

IP

P-GW

UDP

GTP-C

L1

L2

IP

UDP

GTP-C

S5

L1

L2

IP

L1

L2

IP

IP

S5

UDP

GTP-U

UDP

GTP-U


User Identifier in the Network

• Two important identifiers International Mobile Subscriber Identifier (IMSI)

• Embedded in SIM card• Stored in subscription data of HLR• Used to index UE’s information in most network nodes• Format on the next page

Mobile Station Integrated Services Digital Network Number (MSISDN)• Your phone number• Number used to identify a subscriber when making a call or sending an SMS

• The mapping between IMSI and MSISDN is stored in HLR MSISDN is not required to be stored in the (U)SIM

• MSISDN is typically not needed in the LTE system


(International Mobile Subscriber Identifier) IMSI -Structure

World

US Turkey India

Turkcell Vodafone Avea

Irfan Alper Erol

MCC

MCC MNC

MCC MNC MSIN

MCC: Mobile Country Code3 digits

2-3 digits

MNC: Mobile Network Code

9-10 digits

MSIN: MobileSubscriberIdentification Number

310 286 404

01 02 03 Identifies an operator

Max 15 digits

Source for MCC and MNC codes:http://en.wikipedia.org/wiki/Mobile_Network_Codehttp://en.wikipedia.org/wiki/Mobile_Country_Code

Cou

ntry

Ope

rato

rSu

bscr

iber

Uniquely identifies a subscriber

PLMN


Operator Identity A mobile operator’s network is also known as a Public Land Mobile

Network (PLMN). The identity used for an operator’s network is called the PLMN-

Identity (PLMN-ID) and consists of the Mobile Country Code and theMobile Network Code.

An operator may be identified by more than one PLMN-ID

World

US Turkey India


MCC

MCC MNC

MCC: Mobile Country Code3 digits

2-3 digits

MNC: Mobile Network Code

310 286 404

01 02 03 Identifies an operator

Cou

ntry

PLMN

Ope

rato

r

PLMN ID = MCC + MNC


MSISDN – Structure

World

US Turkey India


Irfan Alper Erol

CC

CC NDC

CC NDC SN

CC: Country Code1-3 digits

2-3 digits

NDC: National Destination Code

9-10 digits

SN: SubscriberNumber

1 9190

533,…

540,… Identifies an operator

Max 15 digits

Source for MCC and MNC codes: www.wikipedia.orgList of country calling codes:http://en.wikipedia.org/wiki/List_of_country_calling_codes

123 4567 123 4568

505,…

+90 533 123 4567

Cou

ntry

Ope

rato

rSu

bscr

iber

Uniquely identifies a subscriber

TurkTelecom

212,216,


Identities and Plumbing for LTE

SRB-2

SRB-1

SRB-0

NAS

S1-MME

GTPC-1

GTP-U-10GTP-U-10

UE eNB

MME

S-GW P-GW

HSS

IMSI IMSI IMSI

C-RNTI C-RNTI

IMSI IMSI

EPS Bearer Identity

SRB Identity

Data Radio Bearer 10

GUTIGUTI

SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary IdentityGUTI Globally Unique Temporary Identity

GTPC

-1


Identities in LTE

• IMSI (International Mobile SubscriptionIdentity) Permanent identity of UE in SIM

(MCC+MNC+MSIN), whereMCC+MNC = Home PLMN ofsubscriber.

Kept secret from eNB. Max 15 digits

• GUTI (Globally unique temporaryidentity) Created by the MME for the UE. Used between MME and UE instead of

IMSI. GUTI may be seen by eNB if NAS

message is sent un-encrypted, egwhen UE has moved to a new areaand needs to be served by a newMME.

56 bits + MCC and MNC

• C-RNTI (Cell Radio NetworkTemporary Identity) Is created by eNB and only used to

identify a UE within the scope of aneNB and provided to the UE duringrandom access process and setup ofRRC connection.

C-RNTI is 16 bits long.

Irfan Ali 16

LTE Attach Procedure


Objective of UE Attach Procedure

Internet

eNB

MME

S-GW

S-GW

P-GWHSS

X2 eNB

• The goal of “attaching” to thenetwork is to obtain an IPaddress to communicate withoutside world.

• During the process of “attach” The UE is authenticated and

authorized to use send/receivedata.

Data path created beteween UE<->eNB<->S-GW<->PGW

UE Context created in all thenodes in the network

UE is provided an IP address

UE’s IP address

SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary Identity

Bearer Setup at end of the Attach Procedure


UE Context:S1 Cntxt: S1APTEID(key)…..RB Cntxt: C-RNTI(key),..

Objective of UE Attach Procedure

Internet

eNB

MME

S-GW

S-GW

P-GWHSS

S1-MME

S6a

X2 eNB

• The goal of “attaching” to thenetwork is to obtain an IPaddress to communicate withoutside world.

• During the process of “attach” The UE is authenticated and

authorized to use send/receivedata.

Data path created beteween UE<->eNB<->S-GW<->PGW

UE Context created in all thenodes in the network

UE is provided an IP address

UE’s IP address

SRB Signalling Radio BearerDRB Data Radio BeaerTEID Tunnel Endpoint IdentifierGTP GPRS Tunneling ProtocolC-RNTI Cell- Radio Network Temporary Identity

UE Context:KEY: IMSI…..



Bearer Setup at end of the Attach Procedure


UE Performs attach – Part 1 of 4

SGWHSSeNBUE

PGW Internet

MME

0. UE hasselected eNB

PDCCH/PDSCH

1. Random AccessPreamble

RACH

2. Random AccessPreamble

RandomAccessProcedure

UL-SCH: SRB03. RRC ConnectionRequest

DL-SCH: Common CCH

5. RRC Connection Setup

UL-SCH: SRB16. RRC Connection Complete

NAS Msg AttachRequest, IMSI

RRC SetupProcedure

1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. Thesubframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Sincemultiple UEs could have transmitted on the same subframe and sameRAPID, the UE listens on the downlink shared (DL-SCH) common controlchannel (CC) to see if the UE’s preamble has been accepted by the eNB.

2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UEshould use. (d) scheduling grant when the UE should transmit in the nextmessage in UL direction. UE listens for RA-RNTI in the PDCCH channel.

3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH towhat it transmitted. If so, it knows the UL Radio Bearers to transmit theRRC connection request. The UE includes the Temporary C-RNTI.

5. The eNB now transmits RRC Connection Setup message including the C-RNTI that was received from the UE. This step resolves any contentionthat could have occurred due to two UEs using the same preamblesequence in RACH access step.

6. The UE now transmits a message to the MME in the time-slot allocated inthe previous step. The UE also includes its IMSI in the message.NAS Msg PDN

Connect Req

RA-RNTI, RAPID

RA-RNTI, RAPID,Temporary C-RNTI

Temporary C-RNTI

C-RNTI4. Contention Resolution ID 4. The eNB echoes the Temporary C-RNTI and the contents of message 3

to the UE. When the UE receives its own transmitted message (unique)and C-RNTI, the contention resolution process is complete.

RNTI Radio Network Temporary IdentityRA-RNTI Random Access RNTIC-RNTI Cell RNTIRAPID Random Access Preamble ID

o UE has synchronized to the downlink frame of the eNB and hence knowsthe DL frame boundaries. The UE has read the MIB and from there theSIB2 of the eNB and knows when the random access channel (RACH)slots are in the uplink direction.

0.


UE Performs Attach – Part 2 of 4SGW

HSSeNBUE

PGW

MME

InterneteNB selectsMME

AKA: Authentication and Key Agreement

7. Initial UE Message

S1-MME

NAS Msg: AttachRequest, IMSI, ..

S6a8. Auth Info RequestIMSI, ..

9. Auth Info AnswerKasme, AUTN, RAND,XRES

10. DL NAS XportAuthn Request

UL-SCH: SRB1

11. DL Info XferAuthn Request:AUTN, RAND,

12. UL Info Transport 13. UL NAS XportAuthn Response

MME ComparesRES with XRES.If same, AKAsuccessful

DL-SCH:CCH SRB1

Authn Response:RES

UserAuthenticationProcedure

14. DL NAS Xport

UL-SCH: SRB1

15. DL Info Transport

Security ModeComplete

16. UL Info Transport 17. UL NAS XportSMC Complete

DL-SCH:CCH SRB1Security Mode Command

NAS Security

Security Mode Command NAS SecuritySetup Procedure

Encrypted Info

Integrity ProtectedInfo

18. Location Update RequestIMSI, …

19. Location Update ResponseSubscription Data

Authorization

NAS Msg PDNConnect Req



HSSeNBUE

PGW

MME

InternetNAS Security

S1-MME24. Initial Context Setup Request(UE Context Info, TEIDs)

DL-SCH:CCH SRB125. RRC Security ModeCommand, AS Algorithm

UL-SCH: SRB126. RRC Security ModeComplete

AS SecuritySRB-2

NAS: Attach AcceptNAS: Activatedefault bearer req

AS Security SetupProcedure

GTPC

23. Create SessionResponse(IMSI, TEIDs)

20. Create SessionRequest (IMSI, TEIDs,PGW IP,…)

GTPC21. Create SessionRequest (IMSI, TEIDs,…)

22. Create SessionResponse (IMSI, TEIDs)

Bearer SetupProcedure Start

GTP-U-10 Tunnel

GTPC Session GTPC-1 Session

Data Radio Bearer-10

30. Initial Context SetupComplete (S1U TEIDs)

DL-SCH:CCH SRB228. RRC ConnectionReconfiguration

UL-SCH: SRB229. RRC Reconfig Complete

NAS1NAS2

27. Obtain UE’s RadioCapability

NAS1 NAS2 NAS: Attach CompleteNAS: Activatedefault bearer acpt

Attach CompletionData Radio Bearer Setup

SRB-2

SRB-1

SRB-0

GTPC

34. Modify Bearer Resp(IMSI,…)

33. Modify Bearer Req.(IMSI, TEIDs…)

GTPU-10 Tunnel

Bearer SetupProcedure Completion

Encrypted Info

Integrity ProtectedInfo

31. UL Information Transfer32. UL NAS Xport


Data Radio Bearer-10 GTP-U-10 TunnelGTPU-10 Tunnel


HSSeNBUE

PGW

MME

Internet

Data Radio Bearer-10 GTP-U-10 TunnelGTPU-10 TunnelGTPC Session GTPC-1 SessionS1-MMESRB-2

SRB-1SRB-0

DHCPServer

DHCPClient

DHCP Messages

IP addressof the UE isrouted to thisinterface

DHCPServer

DHCPClient

DHCPServer


Architecture key Concept: Roaming

• 3GPP architecture from early days has supported a subscriber goingto a foreign network and still getting service Home PLMN: Subscriber’s home network (eg. Turkcell) Visited PLMN: Foreign/Roamed-to network (eg. Orange)

• What does roaming require: Ability from VPLMN to identify the HPLMN of the subscriber Ability to authenticate the subscriber from VPLMN Sharing of revenue between VPLMN and HPLMN (roaming charges)

PLMN Public Land Mobile NetworkVPLMN Visited PLMNHPLMN Home PLMN


HPLMN

VPLMNHPLMN

Roaming Concept

IMS Internet

eNB eNB eNB

MME

S-GW

S-GW

P-GWHSS

S1-MME

S11

S1-U

S6a S5

X2 X2

LTE-Uu

HPLMN Home PLMNVPLMN Visited PLMN

IMS Internet

eNB eNB eNB

MME

S-GW

S-GW

P-GW

HSS

S1-MME

S11

S1-U

S6a S5

X2 X2

LTE-Uu

IMSI = 286 + 01 + 1234567890TurkeyTurkcell

Domain = epc.mnc01.mcc286.pub.3gppnetwork.org


IMSI = 286 + 01 + 1234567890TurkeyTurkcell


Non-Roaming Roaming

Turkcell subscriber in Turkey Turkcell subscriber in India


LTE/EPC Specifications

UE

MME

HSS

ServingGW PDN GW

PCRF

InternetInternet

S6a

S11

S1u

S1-MME

LTE-Uu

S5

Gx

Rx

SGieNB

S10

X2

SPR

Sp

Stage-3 SpecificationStage-2 SpecificationStage-1 Specification

Stage-1: 22.278

E-UTRAN Stage-2:36.300

Evolved Packet Core Stage 2: 23.401

29.274 GTPC29.281 GTPU

29.274 GTPC

36.410 General36.411 Layer 136.412 (Sig xport)36.413 (S1AP)

29.21229.213 Sig Flow

36.201,211,213,214 PHY36.321 MAC36.322 RLC36.323 PDCP36.331 RRC

36.410 General36.411 Layer 136.414 (Data xport)29.281 GTPU

PCC Stage 2: 23.203Charging Stage 2: 32.240

36.420 General36.421 Layer 136.422 (Sig xport)36.424 (Data xport)36.423 (X2AP)29.281 GTPU

29.214

36.304 Idle36.306 Capability36.314 Measurement23.122 Idle-NAS

24.301 NAS

Unspecified

OnlineChargingFunction

OfflineChargingFunction

BillingDomain

Gy/RoGz/Rf

Bx

32.251

32.251

General:23.003 Identifiers29.303 DNS33.401 Security Stage 2&3

S929.215

29.061

29.272

36.133 RRM Reqds

OperatorServicesOperatorServices

Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latestLink to find out what a spec covers: http://www.3gpp.org/Specification-Numbering

Technology

LTE Architecture and LTE Attach