Académique Documents
Professionnel Documents
Culture Documents
Irfan Ali
Network
+
(U)SIM Mobile Equipment (ME)
SIM USIM
P-GW
S6a S11
S5
MME
S1-MME
S1-U
X2
X2
eNB
eNB
LTE-Uu
Enhanced Node B Mobility Management Entity Serving Gateway Packet data network Gateway Home Subscriber System
HSS
Authenticator
P-GW
UE IP address Allocation Inter SGW Mobility Anchoring
IMS
HSS
Internet
Subscription
S6a S5
P-GW
S6a S11
MME
NAS Security
S-GW
Inter eNB Mobility Anchoring
S5
S-GW S-GW
MME
S1-MME
S1-MME
S1-U
S1-U
eNB
RB Control Radio Admission Control Inter Cell RRM Connected Mode Mobility Mgmt eNB Measurement OAM Radio Bearer Transmission (L1/L2/L3)
eNB
X2
eNB
LTE-Uu
eNB
Control-Plane Functional Entity User-Plane Functional Entity
Scheduler
S1-MME
MME
S11 S10
S6a
UE
LTE-Uu
eNB
X2
S1u
Serving GW
S5
PDN GW
SGi
Internet
Enhanced Node B Mobility Management Entity Serving Gateway Packet data network GW Home Subscriber System
IMS
HSS
Internet
P-GW
S-GW
MME
S-GW
eNB eNB
On the signaling plane, the UE communicates with two entities in the infrastructure: (a) the eNB and (b) the MME (via the eNB). Access-stratum (AS): UE <-> eNB. AS consists of both userplane and control-plane. The user-plane protocol is PDCP and control-plane protocol is RRC. Non-access Stratum (NAS): UE <-> MME. NAS is only in the controlplane. The protocol is called the NAS protocol.
UE
Access Stratum
7
GTP-C UDP IP L2 L1
GTP-C UDP IP L2 L1
S11
GTP-C UDP IP L2 L1
GTP-C UDP IP L2 L1
S5
UE
eNB
MME
S-GW
P-GW
Non-Access Stratum (NAS): The key control interface between MME and UE Radio Resource Control (RRC): The main control interface between eNB and UE Packet Data Convergence Protocol (PDCP): Duplicate detection, ROHC Radio Link Control (RLC): Segmentation/re-assembly, ARQ, acknowledge mode (AM)/ unacknowledged mode (UAM), etc Medium Access Control (MAC): Access the channel Physical Layer (PHY): Radio layer, eg modulation etc.
S1-AP SCTP GTP-C GTP-U S1 Application protocol Stream Control Transport Protocol GPRS Tunneling Protocol-Control Plane GPRS Tunneling protocol- User Plane
GTP-C UDP IP L2 L1
GTP-C UDP IP L2 L1
S11
GTP-C UDP IP L2 L1
GTP-C UDP IP L2 L1
S5
UE
eNB
MME
S-GW
P-GW
Application
Application
IP
GTP-U UDP IP L2 L1
S5
GTP-U UDP IP L2 L1
UDP IP L2 L1
UE
eNB 9
S-GW 9
P-GW
End Host
Embedded in SIM card Stored in subscription data of HLR Used to index UEs information in most network nodes Format on the next page
The mapping between IMSI and MSISDN is stored in HLR MSISDN is not required to be stored in the (U)SIM MSISDN is typically not needed in the LTE system
10 10
MCC
404
US
Turkey
India
MCC
PLMN
2-3 digits
MNC
Operator
01
02
03
Identifies an operator
Turkcell
Vodafone
Avea
9-10 digits
Subscriber
MCC
MNC
Max 15 digits
MSIN
Irfan
Alper
Erol
11
11
Operator Identity
A mobile operators network is also known as a Public Land Mobile Network (PLMN). The identity used for an operators network is called the PLMNIdentity (PLMN-ID) and consists of the Mobile Country Code and the Mobile Network Code. An operator may be identified by more than one PLMN-ID
World Country
310 286
3 digits
MCC
404
US
Turkey
India
MCC
PLMN
2-3 digits
MNC
Operator
01
02
03
Identifies an operator
Turkcell
Vodafone
Avea
MSISDN Structure
World Country
1 90 91
1-3 digits
CC
US
Turkey
India
2-3 digits
CC
NDC
Operator
533,
540,
505,
Turkcell
123 4567
Vodafone
123 4568
Avea
Turk Telecom
CC NDC
Max 15 digits +90 533
9-10 digits
Subscriber
SN
Irfan
Alper
Erol
123 4567
13 13
C-RNTI
C-RNTI
HSS
S1-MME
MME
GTPC-1
NAS
GTPC-1
Data Radio Bearer 10
GTP-U-10
GTP-U-10
UE
eNB
SRB DRB TEID GTP C-RNTI GUTI
S-GW
Signalling Radio Bearer Data Radio Beaer Tunnel Endpoint Identifier GPRS Tunneling Protocol Cell- Radio Network Temporary Identity Globally Unique Temporary Identity
P-GW
14 14
Identities in LTE IMSI (International Mobile Subscription C-RNTI (Cell Radio Network
Identity) Permanent identity of UE in SIM (MCC+MNC+MSIN), where MCC+MNC = Home PLMN of subscriber. Kept secret from eNB. Max 15 digits
Temporary Identity)
Is created by eNB and only used to identify a UE within the scope of an eNB and provided to the UE during random access process and setup of RRC connection. C-RNTI is 16 bits long.
15 15
Irfan Ali
16
HSS
P-GW
The goal of attaching to the network is to obtain an IP address to communicate with outside world. During the process of attach
S-GW S-GW
MME
The UE is authenticated and authorized to use send/receive data. Data path created beteween UE<>eNB<->S-GW<->PGW UE Context created in all the nodes in the network UE is provided an IP address
eNB
X2
eNB
SRB DRB TEID GTP C-RNTI Signalling Radio Bearer Data Radio Beaer Tunnel Endpoint Identifier GPRS Tunneling Protocol Cell- Radio Network Temporary Identity
17 17
HSS
P-GW
The goal of attaching to the network is to obtain an IP address to communicate with outside world. During the process of attach
The UE is authenticated and authorized to use send/receive data. Data path created beteween UE<>eNB<->S-GW<->PGW UE Context created in all the nodes in the network UE is provided an IP address
S-GW
MME
S1-MME
S-GW
eNB
X2
eNB
Signalling Radio Bearer Data Radio Beaer Tunnel Endpoint Identifier GPRS Tunneling Protocol Cell- Radio Network Temporary Identity
18 18
eNB
MME
SGW
HSS
o UE has synchronized to the downlink frame of the eNB and hence knows 0. PGW the DL frame boundaries. The UE has read the MIB and from there the SIB2 of the eNB and knows when the random access channel (RACH) slots are in the uplink direction. 1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since multiple UEs could have transmitted on the same subframe and same RAPID, the UE listens on the downlink shared (DL-SCH) common control channel (CC) to see if the UEs preamble has been accepted by the eNB. 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE should use. (d) scheduling grant when the UE should transmit in the next message in UL direction. UE listens for RA-RNTI in the PDCCH channel. 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to what it transmitted. If so, it knows the UL Radio Bearers to transmit the RRC connection request. The UE includes the Temporary C-RNTI.
Interne
PDCCH/PDSCH
2. Random Access Preamble RA-RNTI, RAPID, Temporary C-RNTI Temporary C-RNTI UL-SCH: SRB0 3. RRC Connection Request
RRC Setup Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
to the UE. When the UE receives its own transmitted message (unique) and C-RNTI, the contention resolution process is complete. 5. The eNB now transmits RRC Connection Setup message including the CRNTI that was received from the UE. This step resolves any contention that could have occurred due to two UEs using the same preamble sequence in RACH access step. 6. The UE now transmits a message to the MME in the time-slot allocated in the previous step. The UE also includes its IMSI in the message.
UL-SCH: SRB1
6. RRC Connection Complete NAS Msg Attach Request, IMSI NAS Msg PDN Connect Req
19 19
Radio Network Temporary Identity Random Access RNTI Cell RNTI Random Access Preamble ID
MME
SGW
HSS PGW
Interne
S1-MME
7. Initial UE Message NAS Msg: Attach Request, IMSI, .. NAS Msg PDN Connect Req
S6a
8. Auth Info Request IMSI, .. 9. Auth Info Answer Kasme, AUTN, RAND,XRES
DL-SCH:CCH SRB1
11. DL Info Xfer Authn Request: AUTN, RAND, 12. UL Info Transport Authn Response
18. Location Update Request IMSI, 19. Location Update Response Subscription Data
Authorization
20
MME
GTPC
SGW
HSS PGW
GTPC
Interne
21. Create Session Request (IMSI, TEIDs, ) 22. Create Session Response (IMSI, TEIDs)
DL-SCH:CCH SRB1
25. RRC Security Mode Command, AS Algorithm
S1-MME
24. Initial Context Setup Request (UE Context Info, TEIDs) NAS: Attach Accept NAS: Activate default bearer req
UL-SCH: SRB1
26. RRC Security Mode Complete
SRB-2
AS Security
27. Obtain UEs Radio Capability
DL-SCH:CCH SRB2
28. RRC Connection Reconfiguration NAS1
GTPC
33. Modify Bearer Req. (IMSI, TEIDs) 34. Modify Bearer Resp (IMSI,)
NAS1 SRB-0
SRB-1 SRB-2
NAS2
GTPU-10 Tunnel
21 21
eNB
MME
SGW
HSS PGW
DHCP Server
Internet
GTPC Session
DHCP Server
22 22
23 23
Roaming Concept
IMS
HSS
HPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
Internet
HSS
IMS
Internet
P-GW
S6a
P-GW
S6a S11
S5
S5 S11
S-GW S-GW
S-GW S-GW
MME
MME
S1-MME S1-U
S1-MME
S1-U
HPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
VPLMN
Domain = epc.mnc01.mcc404.pub.3gppnetwork.org
X2
X2
X2
eNB
eNB
LTE-Uu
eNB
eNB
eNB
LTE-Uu
X2
eNB
Non-Roaming
Irfan Ali Irfan Ali
Roaming
HPLMN VPLMN Home PLMN Visited PLMN
Turkey Turkcell
Turkey Turkcell
24 24
LTE/EPC Specifications
24.301 NAS
HSS
S6a
SPR
Unspecified
36.410 General 36.411 Layer 1 36.412 (Sig xport) 36.413 (S1AP) 36.133 RRM Reqds
S1-MME
MME
S10 29.274 GTPC
PCRF
S9 Gx
Rx
29.214
Operator Services
29.215
UE
LTE-Uu 36.304 Idle 36.306 Capability 36.314 Measurement 23.122 Idle-NAS 36.201,211,213,214 PHY 36.321 MAC 36.322 RLC 36.323 PDCP 36.331 RRC
eNB
X2
S1u
Serving GW
S5
PDN GW
Internet
36.410 General 36.411 Layer 1 36.414 (Data xport) 29.281 GTPU 36.420 General 36.421 Layer 1 36.422 (Sig xport) 36.424 (Data xport) 36.423 (X2AP) 29.281 GTPU
Bx 32.251
Billing Domain
Stage-1: 22.278
Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering
25 25