Describes key network elements and interfaces of LTE architecture. The steps of LTE/EPC Attach procedure are also illustrated.
Video at: https://www.youtube.com/playlist?list=PLgQvzsPaZX_bimBc5Wu4m6-cVD4bZDav9
2. 3GPP Network Architecture
Network
+ Radio Access
Network (RAN)
Core Network (CN)
Mobile
(U)SIM Equipment (ME)
Radio Resource Management Security, IP connectivity, Mobility
User Equipment (UE) or
Mobile Station (MS)
SIM Subscriber Identity Module
USIM Universal Subscriber Identity Module
Irfan Ali
Irfan Ali 2 2
3. LTE Network Architecture
Internet
HSS
P-GW
S6a
S5
S11 S-GW
Evolved Packet Core
(EPC)
S-GW
MME
S1-MME
S1-U
Evolved Universal Terrestrial Radio Access Network
(E-UTRAN)
X2 X2
eNB eNB eNB
LTE-Uu eNB Enhanced Node B
MME Mobility Management Entity
S-GW Serving Gateway
P-GW Packet data network Gateway
HSS Home Subscriber System
Irfan Ali
Irfan Ali 3 3
4. HSS P-GW
LTE Network Architecture
UE IP address
Authenticator Allocation
Inter SGW Mobility
Anchoring
IMS Internet Subscription
S5
S6a
HSS MME S-GW
P-GW
NAS Security Inter eNB Mobility
S6a Anchoring
S5 Idle Mode
Mobility Mgmt
S11
S-GW EPS Bearer Control
S-GW
MME
S1-MME
S1-MME S1-U
S1-U
eNB
RB Control Inter Cell RRM
Radio Admission Connected Mode
Control Mobility Mgmt
X2
eNB eNB eNB eNB Measurement
Scheduler
OAM
LTE-Uu Control-Plane
Functional Entity Radio Bearer
Transmission
User-Plane (L1/L2/L3)
Functional Entity
Irfan Ali
Irfan Ali 4 4
5. Block Diagram example: LTE
Architecture
HSS
Interfaces
Reference Points
S1-MME S6a
MME
Operators IP
S11
Services
S10
SGi
S1u Serving S5
UE eNB PDN GW SGi
Internet
GW
LTE-Uu
X2
Functional Entity
Logical Entity
Network Entity
eNB Enhanced Node B
MME Mobility Management Entity
S-GW Serving Gateway
PDN GW Packet data network GW
HSS Home Subscriber System
Irfan Ali
Irfan Ali 5 5
6. LTE Architecture Key Concepts
All radio related functions are pushed down to the eNB
• There is no centralized radio resource management element
like the RNC.
In the core network, there is control-plane and user-plane
separation
• MME is the control-plane entity
• SGW and PGW are the user-plane entity
• To allow independent scaling of the control-plane and the
user-plane.
LTE is a PS (Packet Switch) only system
• No CS (Circuit switch) domain support
Irfan Ali
Irfan Ali 6 6
7. Architecture Concept: Access Stratum vs Non-Access Stratum
• On the signaling plane, the UE
IMS Internet communicates with two entities
in the infrastructure:
HSS
P-GW
(a) the eNB and
(b) the MME (via the eNB).
• Access-stratum (AS): UE <->
S-GW eNB.
AS consists of both user-
S-GW
MME plane and control-plane.
The user-plane protocol is
Non-Access PDCP and control-plane
Stratum protocol is RRC.
(NAS)
• Non-access Stratum (NAS):
UE <-> MME.
eNB
eNB eNB
NAS is only in the control-
Radio Resource Control plane. The protocol is
(RRC)
called the NAS protocol.
UE Access Stratum
Irfan Ali
Irfan Ali 7 7
8. Protocol Stacks: Control Plane
NAS NAS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
PDCP PDCP SCTP SCTP UDP UDP UDP UDP
RLC RLC IP IP IP IP IP IP
MAC MAC L2 L2 L2 L2 L2 L2
PHY PHY L1 L1 L1 L1 L1 L1
UE LTE-Uu S1-MME S11 S5
eNB MME S-GW P-GW
Non-Access Stratum (NAS): The key control interface
between MME and UE
Radio Resource Control (RRC): The main control
interface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicate
detection, ROHC S1-AP S1 Application protocol
SCTP Stream Control Transport Protocol
Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane
ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane
acknowledged mode (UAM), etc
Medium Access Control (MAC): Access the channel
Physical Layer (PHY): Radio layer, eg modulation etc.
Irfan Ali
Irfan Ali 8 8
9. Protocol Stacks: Control Plane & User Plane
NAS NAS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
PDCP PDCP SCTP SCTP UDP UDP UDP UDP
RLC RLC IP IP IP IP IP IP
MAC MAC L2 L2 L2 L2 L2 L2
PHY PHY L1 L1 L1 L1 L1 L1
UE LTE-Uu S1-MME S11 S5
eNB MME S-GW P-GW
Application Application
TCP/UDP TCP/UDP
IP IP IP
GTP-U GTP-U GTP-U GTP-U
PDCP PDCP UDP UDP UDP UDP
RLC RLC IP IP IP IP
MAC MAC L2 L2 L2 L2
PHY PHY L1 L1 L1 L1
S5
LTE Uu S1-U
UE eNB S-GW P-GW End Host
Irfan Ali
Irfan Ali 9 9
10. User Identifier in the Network
• Two important identifiers
International Mobile Subscriber Identifier (IMSI)
• Embedded in SIM card
• Stored in subscription data of HLR
• Used to index UE’s information in most network nodes
• Format on the next page
Mobile Station Integrated Services Digital Network Number (MSISDN)
• Your phone number
• Number used to identify a subscriber when making a call or sending an SMS
• The mapping between IMSI and MSISDN is stored in HLR
MSISDN is not required to be stored in the (U)SIM
• MSISDN is typically not needed in the LTE system
Irfan Ali
Irfan Ali 10 10
11. (International Mobile Subscriber Identifier) IMSI -
Structure
World 3 digits
MCC: Mobile Country Code
MCC
310
Country
286 404
US Turkey India PLMN
2-3 digits
MCC MNC MNC: Mobile Network Code
Operator
01 02 03 Identifies an operator
Turkcell Vodafone Avea
9-10 digits
MCC MNC MSIN MSIN: Mobile
Subscriber
Subscriber
Max 15 digits Identification Number
Irfan Alper Erol
Uniquely identifies a subscriber
Source for MCC and MNC codes:
http://en.wikipedia.org/wiki/Mobile_Network_Code
http://en.wikipedia.org/wiki/Mobile_Country_Code
Irfan Ali
Irfan Ali 11 11
12. Operator Identity
A mobile operator’s network is also known as a Public Land Mobile
Network (PLMN).
The identity used for an operator’s network is called the PLMN-
Identity (PLMN-ID) and consists of the Mobile Country Code and the
Mobile Network Code.
An operator may be identified by more than one PLMN-ID
World 3 digits
MCC: Mobile Country Code
MCC
310
Country
286 404
US Turkey India PLMN
2-3 digits
MCC MNC MNC: Mobile Network Code
Operator
01 02 03 Identifies an operator
Turkcell Vodafone Avea
PLMN ID = MCC + MNC
Irfan Ali
Irfan Ali 12 12
13. MSISDN – Structure
World 1-3 digits
CC CC: Country Code
1 90 91
Country
US Turkey India
2-3 digits
CC NDC NDC: National Destination Code
533, 540, 505, 212,216,
Operator
… … … Identifies an operator
Turk
Turkcell Vodafone Avea
Telecom 9-10 digits
CC NDC SN SN: Subscriber
123 4567 123 4568
Subscriber
Number
Max 15 digits
Irfan Alper Erol
+90 533 123 4567
Uniquely identifies a subscriber
List of country calling codes:
Source for MCC and MNC codes: www.wikipedia.org
http://en.wikipedia.org/wiki/List_of_country_calling_codes
Irfan Ali
Irfan Ali 13 13
14. Identities and Plumbing for LTE
IMSI IMSI IMSI
GUTI GUTI
C-RNTI C-RNTI
SRB-0 HSS
SRB-1 S1-MME
MME
SRB-2 NAS
GTPC-1
SRB Identity
GTPC-1
Data Radio Bearer 10
GTP-U-10 GTP-U-10
EPS Bearer Identity
IMSI IMSI
UE eNB S-GW P-GW
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity
Irfan Ali
Irfan Ali
GUTI
14 14
Globally Unique Temporary Identity
15. Identities in LTE
• IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network
Identity) Temporary Identity)
Permanent identity of UE in SIM Is created by eNB and only used to
(MCC+MNC+MSIN), where identify a UE within the scope of an
MCC+MNC = Home PLMN of eNB and provided to the UE during
subscriber. random access process and setup of
Kept secret from eNB. RRC connection.
Max 15 digits C-RNTI is 16 bits long.
• GUTI (Globally unique temporary
identity)
Created by the MME for the UE.
Used between MME and UE instead of
IMSI.
GUTI may be seen by eNB if NAS
message is sent un-encrypted, eg
when UE has moved to a new area
and needs to be served by a new
MME.
56 bits + MCC and MNC
Irfan Ali
Irfan Ali 15 15
17. Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
address to communicate with
P-GW
outside world.
• During the process of “attach”
S-GW The UE is authenticated and
authorized to use send/receive
S-GW data.
MME
Data path created beteween UE<-
>eNB<->S-GW<->PGW
UE Context created in all the
nodes in the network
UE is provided an IP address
X2
eNB eNB
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity
Bearer Setup at end of the Attach Procedure
Irfan Ali
Irfan Ali 17 17
18. Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
UE Context:
KEY: IMSI
address to communicate with
UE Context: P-GW
KEY: IMSI ….. outside world.
…..
S6a
• During the process of “attach”
UE Context:
KEY: IMSI
S-GW ….. The UE is authenticated and
authorized to use send/receive
S-GW data.
MME
Data path created beteween UE<-
S1-MME
>eNB<->S-GW<->PGW
UE Context created in all the
UE Context:
S1 Cntxt: S1AP nodes in the network
TEID(key)…..
RB Cntxt: C-RNTI(key),.. UE is provided an IP address
X2
eNB eNB
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary Identity
Irfan Ali
Irfan Ali 18 18
19. UE Performs attach – Part 1 of 4
UE HSS
eNB MME SGW
PGW
0. UE has synchronized to the downlink frame of the eNB and hence knows
o Interne
0. UE has the DL frame boundaries. The UE has read the MIB and from there the
selected eNB SIB2 of the eNB and knows when the random access channel (RACH)
slots are in the uplink direction.
1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The
RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since
1. Random Access Access multiple UEs could have transmitted on the same subframe and same
Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control
channel (CC) to see if the UE’s preamble has been accepted by the eNB.
PDCCH/PDSCH
2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step
Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE
Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the next
Temporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel.
UL-SCH: SRB0
3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to
Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the
DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI.
RRC Setup
4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
C-RNTI to the UE. When the UE receives its own transmitted message (unique)
5. RRC Connection Setup and C-RNTI, the contention resolution process is complete.
5. The eNB now transmits RRC Connection Setup message including the C-
UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention
that could have occurred due to two UEs using the same preamble
6. RRC Connection Complete sequence in RACH access step.
NAS Msg Attach
Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in
NAS Msg PDN
the previous step. The UE also includes its IMSI in the message.
Connect Req
RNTI Radio Network Temporary Identity
Irfan Ali
Irfan Ali 19 19
RA-RNTI
C-RNTI
Random Access RNTI
Cell RNTI
RAPID Random Access Preamble ID
20. UE Performs Attach – Part 2 of 4
HSS
UE eNB MME SGW
eNB selects PGW
MME
Interne
S1-MME
7. Initial UE Message
S6a
8. Auth Info Request
NAS Msg: Attach
IMSI, ..
Request, IMSI, ..
NAS Msg PDN
User
9. Auth Info Answer
Connect Req Kasme, AUTN, RAND,XRES Authentication
DL-SCH:CCH SRB1 Procedure
10. DL NAS Xport
11. DL Info Xfer Authn Request
Authn Request: MME Compares
AUTN, RAND, RES with XRES.
If same, AKA
12. UL Info Transport successful
13. UL NAS Xport
Authn Response
Authn Response:
RES
UL-SCH: SRB1
DL-SCH:CCH SRB1 14. DL NAS Xport
15. DL Info Transport
Security Mode Command
Security Mode Command NAS Security
Setup Procedure
16. UL Info Transport
17. UL NAS Xport
Security Mode
SMC Complete
Complete
UL-SCH: SRB1 18. Location Update Request Authorization
IMSI, …
NAS Security 19. Location Update Response
Subscription Data Encrypted Info
Irfan Ali
Irfan Ali 20 20
AKA: Authentication and Key Agreement
Integrity Protected
Info
21. UE Performs Attach – Part 3 of 4
HSS
UE eNB MME SGW
NAS Security PGW Interne
GTPC
20. Create Session GTPC
Request (IMSI, TEIDs, 21. Create Session
PGW IP,…) Request (IMSI, TEIDs,
…)
S1-MME 22. Create Session
23. Create Session
DL-SCH:CCH SRB1 Response (IMSI, TEIDs)
24. Initial Context Setup Request Response(IMSI, TEIDs)
25. RRC Security Mode
(UE Context Info, TEIDs)
Command, AS Algorithm NAS: Attach Accept
NAS: Activate Bearer Setup
UL-SCH: SRB1 default bearer req Procedure Start
26. RRC Security Mode GTPC Session GTPC-1 Session
Complete
GTP-U-10 Tunnel
SRB-2
AS Security Setup
AS Security Procedure
27. Obtain UE’s Radio
Capability
DL-SCH:CCH SRB2
28. RRC Connection
Reconfiguration NAS1 Attach Completion
NAS2 Data Radio Bearer Setup
UL-SCH: SRB2
29. RRC Reconfig Complete 30. Initial Context Setup
Complete (S1U TEIDs)
31. UL Information Transfer GTPC
32. UL NAS Xport Bearer Setup
NAS1 NAS2 33. Modify Bearer Req.
NAS: Attach Complete Procedure Completion
SRB-0 (IMSI, TEIDs…)
NAS: Activate
SRB-1 default bearer acpt 34. Modify Bearer Resp
(IMSI,…) Encrypted Info
SRB-2
Irfan Ali
Irfan Ali
Data Radio Bearer-10 GTPU-10 Tunnel
21 21 Integrity Protected
Info
22. UE Performs Attach – Part 4 of 4 DHCP
HSS Server
UE eNB MME SGW
SRB-0 PGW Internet
SRB-1
SRB-2 S1-MME GTPC Session GTPC-1 Session
Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel
DHCP DHCP DHCP DHCP
Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel
Client Server Client Server
IP address
of the UE is
routed to this
interface
Irfan Ali
Irfan Ali 22 22
23. Architecture key Concept: Roaming
• 3GPP architecture from early days has supported a subscriber going
to a foreign network and still getting service
Home PLMN: Subscriber’s home network (eg. Turkcell)
Visited PLMN: Foreign/Roamed-to network (eg. Orange)
• What does roaming require:
Ability from VPLMN to identify the HPLMN of the subscriber
Ability to authenticate the subscriber from VPLMN
Sharing of revenue between VPLMN and HPLMN (roaming charges)
PLMN Public Land Mobile Network
VPLMN Visited PLMN
HPLMN Home PLMN
Irfan Ali
Irfan Ali 23 23