Course - LTE-EPC Signaling - 14 July 2 Eogogics

8/10/2019 Course - LTE-EPC Signaling - 14 July 2 Eogogics

1/159

7/2/2

. . . . . . . . . . !

LTE/EPC Signaling CoursePresented Onsite at Nextel de Mexico

DCN NTDR-Jnz-f

!

!

Why Eogogics?Unmatched Expertise: Industry-leading 500-course curriculum based on our first-hand technology experience.Industry Recognized: Preferred or sole-source provider for Fortune 500 companies, R&D organizations, US government agencies, and trade groups.High Client Satisfaction: 100% of our classes rate good-to -excellent, 98% client retention, 85% of bu siness from client referrals.World-class Instructors: With advanced degrees, 15-40 years in the real world, publications, patents, awards/honors. They mix teaching, R&D, andconsulting to keep their technical edge razor sharp. Th eir instruction is clear, dynamic, and entertaining!Customized, Practical Courses: Partner with the instructor to design a course focused on your mission critical needs. Classes onsite or on the Web.Buy Coach, Travel First Class: Using technology to dr ive down our costs, we offer top-tier instructors and tailored courses for 15% below market.Knowledge That Can Power Your Organization: Avoid the cost and delay of trial-and-error! Benefit from our 20+ year experience, knowledge ofindustry best practices, and unbiased advice. We have been engaged in ground-breaking technology implementation projects worldwide for 20+ years.

Disney, Lockheed Martin, UBS, Boeing, Raytheon, Dell, AT&T, ABC News, Sprint Nextel, Comcast,SkyTerra, TruePosition, DIRECTV, L-3 Communications, ITT, SAIC, URS, Shaw, NII, Intelsat, Crown Castle, Harris, Booz Allen Hamilton, SpectraEnergy, Cooper, Bain & Company, DoD, HLS, DoE, DoC, DoJ, national labs, and NASA. Call or email today!

Our Skill SetEngineering: Systems Eng. (Methodol ogy, Best Practi ces, Management), Design Creativity, Out- of-t he-Box Thinking, GD&T, Statisti cal Tolerance Analysis, Po kaYoke, Materials and Processes (Metals, Plastics), Industrial Statistics, Design of Experiments, Statistical Process Control, Root Cause Fail ure Analysis, Failure Modesand Effects Analysis, Pro ject and People Management, Delivery Perfo rmance Improvement, Qualit y Management, Cost Reduction, Engineering Economi csSof tware Engineering: Principles, Writing Requirements, Configuration Management, Testing, Project Management, P roject Estimation, Quality AssuranceTelecom: Network Design/Implementation, Traffic Engineering, Security, Management (SNMP, Ethernet OAM), Cloud Computing, Cyber Security, Carrier Ethernet,ATM, BGP, IP Geo-location, IPv6, MoIP, IP Sec, MPLS, IMS, SIP, SIP Sec, VoIP, VoIP Sec, EoIP, IP TV, CAMEL, SS7, IMS, SIP, Optical Networks (SONET/SDH,DWDM, CWDM), Mobile Backhaul, OSS/BSS (eTOM, SID, TAM), Unified CommunicationsWireless and RF: 5G (Cognizant Radio, SDR, DSA), 4G (LTE, WiMAX), OFDM/MIMO, 3 G (UMTS, HSPA), GSM, GPRS/EDGE, CDMA,1xRTT, EVDO ,iDEN, TETRA, MPBN, MVNO, WiFi, Bluetooth, Mobile TV, Positioning/Location, LBS, RF, RF Safety, HF/VHF, Propagation/Fading, Antennas, Microwaves,SATCOM, Spectrum Engineering, Signal Processing, IEEE WCET ExamDefense, Public Safety and Security: 5G, 4G, 3G, and NextGen Technologies, Cyber Security/Warfare, Info. Security, E911, 911 (Voice, VoIP), CALEAAlso, Technical Management and Communications, Soft Skills, and Management/Leadership Development

www.eogogics.com , www.gogics.com , [email protected] , +1 703 281-3525, 1 (888) 364-6442


2/159

7/2/2

NoticesIntellectual Property Rights

Copyright 2014, Eogogics Inc.The contents of this document are the proprietary and copyrighted intellectual property

of Eogogics Inc. They may not be recorded, stored, reproduced, or transmitted byany means whatsoever without the express, written permission of Eogogics Inc.

Eogogics and Gogics are, respectively, a registered US trade mark and a servicemark of Eogogics Inc. Any other service or trade marks used in this document arethe property of their respective owners.

Contact Information

Eogogics Inc.Web: www.eogogics.com or www.gogics.comEmail: [email protected]: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USAPhone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US

NoticesThis Course Builds on the Following Eogogics Courses

(see www.eogogics.com for details):

LTE Advanced System Techniques LTE ADV 4 days LTE Air Interface Techniques LTE AI 3 days LTE Signaling and Functionality LTESIG 3 days

Contact Information

Eogogics Inc.Web: www.eogogics.com or www.gogics.com

Email: [email protected]: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USAPhone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US


3/159

7/2/2

LTE/EPC Overview

LTE/EPC 3GPP Standards

Evolution Path


4/159

7/2/2

Mobile Systems Evolution

TDMA

GSM

PDC

GPRS

EDGE EdgeEvolution

WCDMA HSDPA/ HSUPA

HSPA+

cdmaOne CDMA2000 CDMA20001xEV/DO

EV/DORevA

EV/DORevB

2G Evolved 3G3G

Source:gsacom.com

4G

LTE/EPC

Market TrendsDramatic uptake in broadband dataMigration to LTE:

From existing WCDMA/GSM networks From existing CDMA networks

High interest in service convergence Fixed and wireless

Broadband triple-play with mobility


5/159

7/2/2

Market TrendsWLAN access integration

Increased expectations for value-addedservices

DPI, policy, charging (subscriber management)

Focus on total cost of ownership Network simplification, shared resources

Driving forces for LTE/EPC

Efficiency Fewer payload carrying nodes between

subscriber and service Shorter latency (service access response,

mobility)

Lowering costs Lower cost per transmitted bit


6/159

7/2/2

Driving forces for LTE/EPC

Improving services High throughput to enable advanced services Common user service provision for all of

access technologies

Making use of new/refarmed spectrum More efficient radio utilization (new modulation

concept, increased spectrum flexibility)

Driving Forces for LTE/EPC

Better integration with other openstandards

Efficient mobility between 3GPP and non-3GPP using the same user service provision(GSM, WCDMA, LTE, CDMA2000, WLAN ...)


7/159

7/2/2

Network Evolution

2009/10

3GPP Rel-8

eNodeB

MME

P+S-GW

User plane directlybetween RAN and

GW!

PDN

2007

3GPP Rel-7

NodeB

RNC

SGSN

GGSN

User planeessentially

outside SGSN!

PDN

2000

3GPP Rel-99

NodeB

RNC

SGSN

GGSN

User planetraffic t hrough

all nodes

PDN

SAE/LTE Releases: Evolution Steps-EPS backbone network, EPC: interconnects the following hosts:

- Mobile Management Entity (MME)

- Home Subscriber Server (HSS)

- Policy and Charging Rules Function (PCRF)

- Serving Gateway (SGW)

- Packet Data Network Gateway (PGW)


8/159


9/159

7/2/2

3GPP LTE and SAE Work Items

SAEEPC Specifications(From Rel 8 onwards)

TSG SASpecification Group Work I tem

Result

SAE: System Architecture Evolution

EPC: Evolved Packet Core

LTEEUTRAN Specifications(36 series)

TSG RANSpecification Group Work I tem Result

LTE: Long Term Evolution

EUTRAN: Evolved UMTS Terrestrial Radio Access Network

LTE Specifications36.201 Physical layer general description36.211 Physical channels and modulation36.212 Multiplexing and channel coding36.213 Physical layer procedures36.214 Physical layer measurements

36.300 E-UTRA overall description36.302 Services provided by the physical layer36.304 UE Functions related to idle mode36.306 UE radio access capabilities36.321 Medium Access Control (MAC)

Protocol Specification36.322 Radio Link Control (RLC)

Protocol Specification36.323 Packet Data convergence Protocol (PDCP)

Protocol Specification36.331 Radio Resource Control (RRC)

Protocol Specification

36.101 UE radio transmission and reception (FDD)36.104 BTS radio transmission and reception (FDD)36.113 Base station EMC36.133 Requirements for support of Radio Resource

Management (FDD)36.141 Base station conformance testing (FDD)

36.401 E-UTRA Architecture Description36.410 S1 interface general aspects & principle36.411 S1 interface Layer 136.412 S1 interface signalling transport36.413 S1 application protocol S1AP36.414 S1 interface data transport36.420 X2 interface general aspects and principles36.421 X2 interface layer136.422 X2 interface signalling transport36.423 X2 interface application part X2AP36.442 UTRAN Implementation Specific O&M Transport29.274 GTP-C29.281 GTP-U

All specifications can be found on theweb site www.3gpp.org

23.002 Network Architecture23.003 Numbering, addressing and identification23.009 Handover Procedures23.048 Security mechanisms for USIM application23.401 GPRS enhancements for eUTRA23.203 QoS Concept

23.272 CS Fallback in EPS

24.301 NAS Protocol for Evolved Packet System (EPS)24.302 Access to the EPC via non 3GPP networks

33.401 System Architecture Evolution (SAE);Security Architecture


10/159

7/2/2

LTE/EPCArchitecture & Protocols

What Is LTE/EPC?Nodes in EPC& LTE

Functionality

Interfaces to other

systems between nodes

EPC(Core Network)

LTE(RadioAccess

Network)


11/159

7/2/2

EPS Overview Architecture

eNB eNB

eNB

MME

S1

X2

X2

X2

SAE(System ArchitectureEvolution)

LTE(Long Term Evolution)

EPC(EvolvedPacket Core)

E-UTRAN

EPS(EvolvedPacketSystem)

UE

P/S-GW

3GPP Work Items

LTE/EPC Architecture

EvolvedPacketCore

S1-CP

E-UTRAN

eNodeBeNodeB

LTE

S1-UP

SAE

MME

S-GW

P-GW

S5/S8

X2-UP

X2-CP

MME

S11

S10HSS

PCRF

S6

Gx

Radio Bearer control,Connection Mobility Control

Scheduling for both UL and DL.

- terminates userplane packets

- switches the userplane to support UE

mobility

handles the chargingfor the service.

IP Point of Presence(PoP)

idle mode moblityand security

Quality of serviceand charging foreach data flow


12/159

7/2/2

Evolved Packet System (EPS) &WCDMA/GPRS

S1-MME S1-U

SGSN S3

S11

S6a

SGi

X2

S5/S8 EPC

EUTRAN

HSSGx

PGW

eNodeBeNodeB

SGW

MSC/VLR

PCRF

GPRS Network

UE

UE: User Equipment

HSS: Home Subscriber Server

PGW: Packet Data Network Gateway

SGW: Serving Gateway

MME: Mobility Management Entity

eNodeB: Enhanced Node B

PCRF: Policy and Charging Rules Function

SGSN: Serving GPRS Support Node

MSC: Mobile Switching Centre

VLR: Visitor Location Register

EPC: Evolved Packet Core

EUTRAN: Evolved UTRAN

LTE Uu LTE Uu: LTE UTRAN UE Interface

MME

S10

IP Networks

Only most importantinterfaces shown here

S4

User Plane

Control Plane

GSM/WCDMA/LTE Architecture - 3GPP

MME

S1-MME S1-U

LTE

IP networks

eNodeB

SGSN

Iu CP Gb

2G 3G

S3

BSC

BTS

RNC

Node B

HLR/HSS

PCRF

Iu UP

S11

Gr

Gx

S10

S4

S6a

SGi

X2 Iur

ServingGW

S5

PDN GW

Rx


13/159

7/2/2

EPC/LTE Architecture for Non- 3GPP

AAA

ePDGPDN GW

Serv GWMME

PCRF

SWx

S10

S11

S5/S8

SGi

S6b

Gx Gxc

Gxa Gxb

SWa

S2a

S2b

S2c

STa

SWn

SWm

ExternalIP networks

S9

S6a

S101S102

S103

Rx

SWu

HSS

ANDSFS14

Trustednon-3GPP

Non-trustednon-3GPP

IMS

Overall Architecture IMS Platform & Non-3GPP

PCRF

X2-UP

S1-UP

EPC

S1-CP

E-UTRAN

eNodeBeNodeB

S11

MME

S-GW

P-GW

S5/S8

X2-CP

P-CSCF

Gx

Network & Servicemanagement

OSS-RC EMA

MM DNS/ENUM

HSS

S-CSCF

I-CSCFIMS Controllayer

Platforms / Concepts

TSP/NSP orTSP/IS

DNS/ENUM

MGC

MGW

SUN

IS

A-SBG

CPP / RBS6000

Juniper/ Redback

WPP

GERAN UTRAN

BroadbandWired Access

GPRSPacketCore

SGSN

GGSN

CDMA2000HRPD

(EV-DO)

WLAN

N-SBG

Internet

S6a

CS Core

MSC

GWMSC

PSTN

PDSN

S1-AP, X2-AP

H.248

ISUP

Diameter

S3

S4

GTP-C

Gxa

S103

S2a

RNCOther

SIP/UDP or SIP/TCP

Rx+

User dataRTP/UDP GTP/UDP

S101

IMS Connectivitylayer

Service LayerAS AS ASApplication Servers MTAS

S6d

Uu


14/159


15/159

7/2/2

EPS Protocol Categories

L3 Signalling L2 Transport Non Access Stratum (NAS)

Communication between UE and MME

Radio Resource Control (RRC)Communication between UE and eNodeB

Packet Data Convergence Protocol (PDCP)- Ciphering and integrity protection for RRC messages- IP header compression/decompression for user plane

Radio Link Control (RLC)- Transfer of RRC messages and user data using:* Acknowledged Mode (AM)* Transparent Mode (TM) or* Unacknow ledged Mode (UM)- Error Correction (ARQ)

Medium Access Control (MAC)- Error Correction (HARQ)- Transfer of RRC mes sages and user data using:- Priority handling (scheduling)- Transport Format selection GPRS Tunneling Protocol Control (GTP-C)

- Communication between MME and SGW- Communication between SGW and PGW- Communication between MME and MME

S1 Application Protocol (S1AP)Communication between eNodeB and MME

X2 Application Protocol (X2AP)Communication between eNodeB and eNodeB

GPRS Tunneling Protocol User (GTP-U)Transfers data between GPRS tunneli ng endpoints

Logical Channels ControlBroadcast Control Channel (BCCH)

DL broadcast of system control information.Paging Control Channel (PCCH)

DL paging information. UE position not known on celllevel

Common Control Channel (CCCH) UL/DL. When no RRC connection exists.

Multicast Control Channel (MCCH) DL point-to-multipoint for MBMS scheduling and control,for one or several MTCHs.

Dedicated Control Channel (DCCH) UL/DL dedicated control information. Used by UEs

having an RRC connection.


16/159

7/2/2

Logical Channels - Traffic

Dedicated Traffic Channel (DTCH) UL/DL Dedicated Traffic to one UE, user

information.Multicast Traffic Channel (MTCH)

DL point-to-multipoint. MBMS user data.

Channel Mapping

UL-SCHPCH DL-SCH

PCCH Logical Channelstype of information(traffic/control)

Transport Channelshow and with whatcharacteristics(common/shared/mc/bc)

Downlink Uplink

PDSCH

Physical Channelsbits, symbols,modulation, radioframes etc

MTCH MCCH BCCH DTCH DCCH DTCH DCCH CCCH

PRACH

RACH

CCCH

MCH BCH

PUSCHPBCH PCFICH PUCCH

-CQI

-ACK/NACK-Sched req.

-Sched TF DL-Sched grant UL-Pwr Ctrl cmd-HARQ info

MIB SIB

PMCH PHICHPDCCH

ACK/NACKPDCCH

info

Physical Signalsonly L1 info

RS SRSP-SCH S-SCH RS

-meas for DL sched-meas for mobility-coherent demod

-half frame sync-cell id

-frame sync-cell id group -coherent demod

-measurements forUL scheduling


17/159

7/2/2

Transport Channels - DL

Broadcast Channel (BCH) System Information broadcasted in the entire coverage

area of the cell. Beamforming is not applied.Downlink Shared Channel (DL-SCH)

User data, control signaling and System Info. HARQ andlink adaptation. Broadcast in the entire cell orbeamforming. DRX and MBMS supported.

Paging Channel (PCH) Paging Info broadcasted in the entire cell. DRX

Multicast Channel (MCH) MBMS traffic broadcasted in entire cell. MBSFN is

supported.

Transport Channels - UL

Uplink Shared channel (UL-SCH) User data and control signaling. HARQ and link

adaptation. Beamforming may be applied.Random Access Channel (RACH)

Random Access transmissions (asynchronous andsynchronous). The transmission is typically contention

based. For UEs having an RRC connection there is somelimited support for contention free access.


18/159


19/159


20/159


21/159

7/2/2

NAS Signaling - MME

3GPP TS 24.301

UE Protocol Stack

ROHC/Ciphering

TM AM UM/AM

Physical Layer

L2

PDCP

RLC

MAC

RRC

NAS

Integrity/Ciphering

System InfoAquisition

CellSelection

PagingReception

MobilityManagement

SessionManagement

ConnectedMode

Mobility

NAS Security

IP

Application

AS Security RRCConnectionRB

ManagementvMeasurement

Reporting

C o

n t r o

l / R e p o r t

S A P s

RA Control HARQControl


22/159

7/2/2

NAS Elementary Procedures

EPS ElementaryProcedures

EPS Session Management EPS Mobility Management

"ready-to-use" IP connectivity and an "always-on" experience

EPS Mobility Management - EMM

3GPP TS 24.301


23/159

7/2/2

LTE States

LTE_DETACHED LTE_ACTIVE LTE_IDLE

IP address assigned

Position partially known

DL DRX period

No IP address

Position not known

IP address assigned

Connected to known cell

OUT_OF_SYNC IN_SYNC DL reception possible

No UL transmission

DL reception possible

UL transmission possible

Power-up

EMM Protocol States - Mobility

ECM-IDLE

EMM-DEREGISTERED

MME

Tracking Area (TA)

UEpositionnot knownin network

Signalingconnectionestablishment

Signalingconnectionrelease

Attach accept,TAU accept

Detach, Attach reject,TAU reject

EMM-REGISTERED

ECM-CONNECTED

Tracking Area Update(TAU)

Handover

PLMNselection

UE position known on Celllevel in eNodeBUE pos known on TA level in MME

eNB

RRC_IDLE RRC_IDLE RRC_CONNECTED

ECM: EPS ConnectionManagement

EMM: EPS MobilityManagement

RRC: Radio ResourceManagement

ECM connected =

S1 bearer+

RRC connection(SRB)


24/159

7/2/2

EPS Network Operational Modes

EPS Session Management - ESM3GPP TS 24.301


25/159

7/2/2

EPS Protocol States - Bearers

3GPP TS 24.301

RRC Signaling

UE-MME


26/159


27/159

7/2/2

RRC States

ECM-IDLE

EMM-DEREGISTERED

UE positionnot knownin network

Signalingconnectionestablishment

Signalingconnectionrelease

Attach accept, TAUaccept

Detach, Attach reject, TAUreject

EMM-REGISTERED

ECM-CONNECTED

PLMNselection

RRC_IDLE RRC_IDLE RRC_CONNECTED

RRC Signaling3GPP TS 25.813

3GPP TS 36.300

3GPP TS 36.331


28/159

7/2/2

RRC Messages

CounterCheck CounterCheckResponse CSFBParametersRequest CSFBParametersResponse DLInformationTransfer HandoverFromEUTRAPreparationRequestMasterInformationBlock MeasurementReport MobilityFromEUTRACommand Paging RRCConnectionReconfiguration RRCConnectionReconfigurationComplete RRCConnectionReestablishment RRCConnectionReestablishmentComplete RRCConnectionReestablishmentReject RRCConnectionRelease RRCConnectionRequest RRCConnectionSetup RRCConnectionSetupComplete

SecurityModeCommand SecurityModeComplete SecurityModeFailure SystemInformation SystemInformationBlockType1UECapabilityEnquiry UECapabilityInformation ULHandoverPreparationTransfer ULInformationTransfer

CSFBParametersRequestCDMA2000 CSFBParametersResponseCDMA2000 HandoverFromEUTRAPreparationRequest (CDMA2000)ULHandoverPreparationTransfer (CDMA2000)

RRC SignalingIdle Mode


29/159

7/2/2

System Information Mapping

PCCH/PCH Paging: System Info Modification

MIB SIB1 SIB2 SIB3 SIB4

SI-2SI-1

SIB5

BCCH

BCH

PBCH PDSCH

BCCH

DL-SCH

PDSCH

DL-SCH

BCCH

TTI=80 TTI= 160 TTI= 320TTI= 40

System Information Blocks (SIBs)


30/159

7/2/2

Idle Mode Cell Selection - Reselection

PLMN Selection

LocationRegistration

PLMNsavailable

PLMNselected

LocationRegistration

response

RegistrationArea

changes

Indicationto user

Manual Mode Automatic mode

Service requests

NAS Control

Radio measurements

Cell Selectionand Reselection

Support for manualCSG ID selection

AvailableCSG IDsto NAS

CSG IDselected

Core Network Initiated Paging

TAC 1

S1AP Paging message

RRC Paging message

TAC 2

The MME sends the PAGING mes sage to each eNode Bwith cells belonging to the tracking area(s) in which the UEis registered.

Each eNode B can c ontain cells belonging to differenttracking areas, whereas each cell can only belong to oneTA.

UEs use DRx when in idle mode in order to wak e at regularintervals to check for paging messages.

The paging response back to the MME is initiated on NASlayer and is sent by the eNB based on NAS-level routinginformation.

MME


31/159

7/2/2

Paging SignalingThe MME initiates a paging message which issent to all eNodeBs in a tracking area(s)

UEs use the RandomAccess procedure toinitiate access to theserving cell

NAS messagingcontinues in order toset up the call

S1-AP: INITIAL UE MESSAGE (FFS)+ NAS: Service Request+ eNB UE signalling connection ID

Random Access Procedure

NAS: Service Request

RRC PAGINGS1AP:Paging

MME

RRC Signaling Connected Mode


32/159

7/2/2

Signaling Radio Bearer (SRB) Establishment

RRC Connection SRB Establishment

LTE

RRC_ CONNECTED

MME

SIGNALLING RADIO BEARER 1 S1 BEARER

SIGNALLING RADIO BEARER 2

SIGNALLING RADIO BEARER 0

RRCConnection

Signalling Connection

+

"Signalling Radio Bearers " (SRBs) are defined as Radio Bearers (RB)that are used only for the transmission of RRC and NAS messages


33/159

7/2/2

Signalling Radio Bearers (SRBs)

Signalling Radio Bearers (SRBs) are offered by the PDCP layer to theRRC layer for transport of RRC (and NAS) messages

SRB0: Used for RRC messages on the CCCH SRB1: Used for RRC and NAS messages on the DCCH SRB2: Used for NAS messages, SRB2 has a lower-priority than

SRB1 and is always configured by E-UTRAN after securityactivation.

PDCP

RRCSRB0 SRB1 SRB2

RRC Connection Establishment

RRC Connection Request is initiated bythe higher layers in the UE

RRC Connection Setup(C-RNTI is allocated)

RRC connection establishmentprocedure creates the signaling radiobearer SRB#1,

RRC Connection Request CCCH/ULSCH

DLSCH RRC Connection Setup

RRC Connection Setup Complete DCCH/ULSCH

RRC IDLE

RRCCONNECTED NAS information for authentication

request is piggybacked to the RRCConnection Setup Complete message

IE/Group Name IE type and reference

RRC Establishment Cause: Emergency Call,High Priority Access,MT-Access,MO-Signalling,MO-Data


34/159

7/2/2

Security Related ProceduresMME

INITIAL CONTEXT SETUP REQUEST(Integrity Protection Algorithm EIA;

Ciphering Algorithm EEA;Security Key)

SECURITY MODE COMMAND(EEA;EIA)

SECURITY MODE COMPLETE

2. Decide Algorithms,Derive KeysActivate Security for SRB

INITIAL CONTEXT SETUP RESPONSE

RRC Security Mode Command is triggered by the EPC (MME) at S1 signaling message InitialContext Setup Request includes all security setting needed to start Integrity Protection ofthe control plane signaling and Encryption of the both user plane and control plane signaling(PDCP protocol).

Security setting includes Integrity Algorithm (EIA) Ciphering Algorithm (EEA) and Security key.

Counter Check Function

Used by UTRAN to request fromthe UE to verify the amount of datasent/received for each DRB

RRC COUNTER CHECK

RRC COUNTER CHECK RESPONSE

Additional security measures are added to LTE/SAE by adding Countercheck function UE is requested to check if, for each DRB, the mostsignificant bits of the COUNT match with the values indicated by E-UTRAN.

When RRC Counter Check is transmitted? Whenever eNB findsthe particular COUNT is exceeded than specific value eNB sends thismessage if it suspects that new data is introduced by an intruder in anyDRB which are used for data transfer between UE and eNB.


35/159

7/2/2



RRC COUNTER CHECK


Action UE will send Counter Check Response to eNB including:

- drb-CountInfoList,- drb-Identity,- counte-Uplick,- count-Downlink

All IE's correspond to that specific COUNT value.

procedure enables E-UTRAN to detect packet insertion by an intruder



RRC COUNTER CHECK


procedure enables E-UTRAN to detect packet insertion by an intruder

Question Why needed to include an extra protection for intruderdetection? Isnt enough Integrity protection on security mode command?

Answer RRC Counter Check Procedure is part of Periodic localauthentication procedure in LTE in many countries regulations cipheringthe data over the Radio Interface is forbidden for National Security thereis a probability of the data connection being compromised by MAN inMIDDLE attack.


36/159

7/2/2

RRC UL/DL Transparent MessagesInformation Transfer

RRC UL INFORMATION TRANSFER (NAS message)

RRC DL INFORMATION TRANSFER (NAS message)

purpose of this procedure transfer NAS or (tunneled) non-3GPPdedicated information from the UE to E-UTRAN

UE Capability Transfer

RRC UE CAPABILITY ENQUIRY

RRC UE CAPABILITY INFORMATION

S1AP: UE Capability Info Indication

UE Capability Retreival - This procedure retreives UE Radio Capability from UE and providesit the the MME.

Step 1 eNodeB requests the UE Radio Capability by sending RRC UE Capability Enquirymessage.

Step 2 UE responds to the eNodeB with requested UE Capability in teh UE CapabilityInformation message

Step 3 eNodeB forwards the received UE Radio Capabilities to teh MME in teh UECapability Info Indication


37/159

7/2/2

Radio Link Failure RCS Algorithm

RCS Algorithm procedure

Step 1 Upon "radio link problems detected, UE starts timer T310 - In case radio linkrecovery happens before T310 expires the UE stops the timer T310 and continues in stateRRC Connected.

Step 2 T310 expires and no recovery takes place UE starts timer T311 and starts searchingfor a new cell.-If the UE finds a cell before T311 expires RRC Connection re-establishment procedure istriggered.- In case T311 expiries before UE finds a cell than the UE enters idle mode.

Normal operationRadio

problemdetection

no recovery duringT310

no recovery duringT311 Return to idle

radio link failure

First Phase Second Phase

RRC_IDLERRC_Connected

-> RRC Connection Re- establishment Request

-> New RRConnection

Request

Maximum number (counterN310) of RLCretransimssions is reached

Radio Link Failure RRC Signaling

RRC CONNECTION RE-ESTABLISHMENT COMPLETE

RRC CONNECTION RE-ESTABLISHMENT REQUEST

RRC CONNECTION RE-ESTABLISHMENT

Procedure:

A waiting timer is started in eNodeB when- maximum number of RLC retransmissions has been reached, or

- maximum number of PDCCH Ordered Re-synchronization failure aredetected.

During this waiting timer, eNodeB expects from UE to trigger RRCConnection Re-establishment Request message If no RRCConnection Re-establishment Request is received during this time, UE isreleased back to idle mode.


38/159

7/2/2

Radio Link Failure

RRC CONNECTION RE-ESTABLISHMENT REQUEST

RRC CONNECTION RE-ESTABLISHMENT REJECT

What if eNodeB cannot handle the incoming RRC Connection Re-establishment Request ?

eNodeB will respond with RRC Connection Re-establishment Reject message to the UE and initiate a UE release procedure towards MME.

RRC Signaling - RRC Mobility


39/159

7/2/2

Measurement Configuration Message

RRC CONNECTION RECONFIGURATION(Measurement configuration)

RRC CONNECTION RECONFIGURATION COMPLETE

E-UTRAN provides the measurement configuration (events to trigger,thresholds, time to trigger, neighbors etc) applicable for a UE inRRC_CONNECTED mode

This is accomplished by dedicated signaling message

RRC Connection Reconfiguration

Measurement Configuration Type ofMeasurements



UE receives RRC Connection Reconfiguration message followingtypes of measurements might be requested:

- Intra-frequency measurements: (serving cell carrier frequency).- Inter-frequency measurements: (neighbor cell measurements at differentcarrier frequencies).- Inter-RAT measurements of UTRA frequencies.- Inter-RAT measurements of GERAN frequencies.- Inter-RAT measurements of CDMA2000 HRPD or CDMA2000 1xRTTfrequencies.


40/159

7/2/2

Measurement ConfigurationParameters (1)



Measurement objects :- For intra-frequency and inter-frequency measurements: object is asingle E-UTRA carrier frequency. Associated with this carrier frequency, E-UTRAN can configure a list of cell specific offsets and a list of blacklistedcells.- For inter-RAT UTRA measurements : object is a set of cells on a singleUTRA carrier frequency.- For inter-RAT GERAN measurements: object is a set of GERAN

carrier frequencies.- For inter-RAT CDMA2000 measurements: object is a set of cells on asingle (HRPD or 1xRTT) carrier frequency.




Reporting configurations: - Reporting criteria: The criteria that trigger the UE to send ameasurement report. This can either be periodical or a single eventdescription.- Reporting format: The quantities that the UE includes in themeasurement report and associated information (e.g. number of cells toreport).


41/159

7/2/2




Measurement identities: A reference number

A list of measurement identities each measurement identity links onemeasurement object with one reporting configuration .

Measurement identity is used as a reference number in the measurement

report.




Quantity configurations: defines the measurement quantities andassociated f iltering used for all event evaluation and related reporting ofthat measurement type. E.g. RSRP (Reference Signal Received Power) ,RSRQ (Reference Signal Received Quality).

- quantity configuration for intra-frequency measurements,- quantity configuration for inter-frequency measurements- quantity configuration for RAT type.

One filter can be configured per measurement quantity


42/159

7/2/2




Measurement gaps: Periods that UE may perform measurements, i.e. no(UL, DL) transmissions are scheduled.

The measurement procedures for different types of cells:

-The serving cell.

-Listed cells - these are cells listed within the measurement object(s).

- Detected cells - these are cells that are not listed within themeasurement object(s) but are detected by the UE on the carrierfrequency(ies) indicated by the measurement object(s).

Measurement Reporting

UE performs measurements and reports back only when event criteria are met!



LTELTE

Best CellEvaluation

LTE

LTE

Examples:

-Event A3 A neighbour cellbecomes offset better thanserving cell

- Event A2 Serving cellbecomes worse than anabsolute threshold


43/159

7/2/2

Measurement Reporting Triggering events

LTE LTE

Best CellEvaluation

LTE

LTE

Examples:

-Event A3 A neighbour cellbecomes offset better thanserving cell

- Event A2 Serving cellbecomes worse than anabsolute threshold

Measurement Reporting Criteria



Reporting criteria Reporting threshold Hysteresis Time-to-trigger Reporting interval


44/159

7/2/2

Example

RRC Signaling Flow Attach Request

To be discussed in class ..

RRC Signaling Flow Example Attach RequestMME

7. INITIAL UE MESSAGE(Attach Request)

14. INITIAL CONTEXT SETUP REQUEST(EPS bearers, AttachAccept, Security)

22. INITIAL CONTEXT SETUP RESPONSE(EPS bearers)

1. System Information*

4. RRC CONNECTION REQUEST

5. RRC CONNECTION SETUP

15. RRC SECURITY MODE COMMAND16.RRC SECURITY MODE COMPLETE

6. RRC CONNECTION SETUP COMPLETE(Attach Request)

2. RandomAccess Preamble3. Random Access Response

20. RRC CONNECTION RECONFIGURATION(Attach Accept, Bearer Setup)

21. RRC CONNECTION RECONFIGURATION COMPLETE

10.RRC DL INFORMATION TRANSFER(Authentication Request)

11. RRC UL INFORMATION TRANSFER(Authentication Response)DL NAS TRANSPORT(Authentication)

UL NAS TRANSPORT(Auth. Response)

12. RRC DL INFORMATION TRANSFER(Security Mode Command)

13. RRC UL INFORMATION TRANSFER(Security Mode Complete)

DL NAS TRANSPORT(NAS SMC)UL NAS TRANSPORT(NAS SMC)

CellSelect*

23. RRC UL INFORMATION TRANSFER(AttachComplete)) UL NAS TRANSPORT(AttachComplete)

RRC IDLE

RRC IDLE

8.RRC DL INFORMATION TRANSFER(UE Identity Request)

9. RRC UL INFORMATION TRANSFER(UE Identity Response)

DL NAS TRANSPORT(UE IdentityReq)UL NAS TRANSPORT(UEidResponse)

17. RRC UE CAPABILITY ENQUIRY

18. RRC UE CAPABILITY iNFORMATION19. UE CAPABILITY INFO I NDICATION

(UE Radio Capability)

24. UE CONTEXT RELEASE COMMAND

26. RRC CONNECTION RELEASE 25. UE CONTEXT RELEASE COMPLETE

RRCCONNECTED


45/159

7/2/2

PDCP Protocol

PDCP Functions


46/159

7/2/2

PDCP Architecture

Radio Bearers

UE/E-UTRAN

PDCP...

RLC

PDCP - PDU

RLC- SDU

PDCP-SAP

RLC UM-SAP RLC AM-SAP

PDCP entity PDCP entity

PDCP-SAP

...

TS 36.323

PDCP Entity Architecture

Radio Interface (Uu)

UE/E-UTRAN E -UTRAN / UETransmittingPDCP entity

Ciphering

Header Compression(user plane only)

ReceivingPDCP entity

Sequence numbering

Integrity Protection(control plane only)

Add PDCP header

Deciphering

Remove PDCP Header

In order delivery and duplicateDetection (U plane)

Integrity Verification(control plane only)

Packets associatedto a PDCP SDU

Header Compression(user plane only)

Packets associatedto a PDCP SDU

P a c k e

t s N

OT

a s s o c i a t e d

t o aP D

C P

S D

U

P a c k e

t s N

OT

a s s o c i a

t e d

t o aP D

C P

S D

U

TS 36.323


47/159

7/2/2

Sequence Numbering

Sequence numbering is used by several functions:

- Reordering of the PDCP PDUs at the receiver side

- Duplicate detection in case of packet forwarding at handover

-Calculation of COUNT, used for integrity protection and ciphering.

Sequence NumberingWHY: * Reordering

* Duplicate detection* Integrity protection* Ciphering

HOW:PDCP SN:

Next_PDCP_TX_SN

TX_HFN

COUNT

eNB

UECtx

SRB1_UL

DRB_UL

COUNT

COUNT

COUNT

SRB1_DL

DRB_DL

COUNT

UE

COUNT SRB1_DL

SRB1_UL

DRB_DL

DRB_UL

HFN PDCP SN

COUNT

COUNT

COUNT


48/159

7/2/2

Header CompressionWHY: Saving the bandwith byHOW: *removing redundant info

*Encoding important info*Hop by Hop*Unidirectional

RB_ULRB_ULHeader PDCP PDU PDCP PDUHeaderPDCP PDU

CRCchecksum covering the header beforecompression is included in the compressed header

CompressedHeaderContainsencoded data

UE/UE Context

UE/UE Context

For Voice over IP, interactive games,messaging etc, the payload of the IP

packet is sometimes even smaller thanthe header.

Based on the RobustHeader Compression

(ROHC) frameworkIETF RFC 3095

Security Handling Integrity &CipheringIntegrity protection:- is implemented in the PDCP layer in order to ensure that the data originof the signaling data is indeed the one claimed.- check also that received data has not been modified in an unauthorizedway.

Data encryption (ciphering): is to ensure that the user data cannot beeavesdropped on the radio.


49/159

7/2/2

Integrity Protection

integrity protection key K_ eNB _ RRC Int

-generated from K ASME procedure during EPS Authentication and Key Agreement(AKA) procedure.- UE computes K ASME based on Authentication Request message parameters.

EIACOUNTDirectionK_ eNB_RRCInt

PDCP PDUPDCP PDUHeader PDCP SDU

Bearer Id

MAC-I

Transmitter

WHY: To ensure data origin

3GPP TS 33.401

Which algorithm to use is decided by eNodeB byduring RRC security activation

Upper layer parameters (required by PDCP):

- BEARER , defined as the radio bearer identifier,(SRB1 will use the value RB identity 1)

- KEY (KRRC int).

Integrity Protection

EIACOUNTDirectionK_ eNB_RRCInt

PDCP PDUPDCP PDUHeader PDCP SDU

Bearer Id

MAC-I

P D

C P P D

U

H e a d er

P D

C P

S D

U

EIACOUNT

DirectionK_ eNB_RRCInt

PDCP PDUPDCP PDUHeaderPDCP SDU

Bearer Id

XMAC-I

XMAC-IMAC-I =

Transmitter Receiver

WHY: To ensure data origin


50/159

7/2/2

Ciphering

PLAINTEXTBLOCK

EEA

COUNT DIRECTION

BEARER LENGTH

KEY UPenc

KEYSTREAMBLOCK

CIPHERTEXTBLOCK

Sender

WHY: To protect the data over radio

3GPP TS 36.331

integrity protection key K_ UP enc-generated from K ASME procedure during EPS Authentication and Key Agreement(AKA) procedure.- UE computes K ASME based on Authentication Request message parameters.

Required parameters by PDCP forciphering (3GPP TS 33.401):

- COUNT

- DIRECTION (DL or UL)

- BEARER (defined as the radio beareridentifier )

- KEY (the ciphering keys for the controlplane and for the user plane are KRRCencand KUPenc, respectively).

Ciphering

PLAINTEXTBLOCK

EEA

COUNT DIRECTION

BEARER LENGTH

KEY UPenc

KEYSTREAM

BLOCK

CIPHERTEXTBLOCK

EEA

DIRECTION

BEARER LENGTH

KEYSTREAM

BLOCK

PLAINTEXTBLOCK

Sender Receiver

EEA0EEA1EEA2

COUNT

WHY: To protect the data over radio

KEY UPenc


51/159

7/2/2

RLC Protocol

RLC Functions3GPP TS 36.322


52/159

7/2/2

RLC Sublayers3GPP TS 36.322

RLC Logical Channels3GPP TS 36.322


53/159

7/2/2

RLC Modes3GPP TS 36.322

RLC TM Entity

Transmissionbuffer

TransmittingTM-RLCentity

TM-SAP

radio interface

ReceivingTM-RLC

entity

TM-SAP

UE/ENB ENB/UE

BCCH/PCCH/CCCH BCCH/PCCH/CCCH

- BCCH Broadcast Control Channel (System Information transfer)- DL/UL CCCH Common Control Channel ( example: RRC Connection Request )- PCCH Paging Control Channel (Paging)

No Header


54/159

7/2/2

RLC Transparent Mode PDU

The RLC TM PDU introduces no overhead

TM is used for signaling on BCCH and

PCCH.

RLC UM Entity

UM RLC entity is supposed to carry user data payload for the time critical servicesthat tolerate a higher packet loss rate. Eg. Voice over IP.RLC in Unacknowledged Mode is a licensed feature


55/159

7/2/2

RLC Unacknowledged Mode PDU,5 Bits SN

UMD PDU with 5 bit SN(Odd number of LIs, i.e. K = 1, 3, 5, )

PDU with 5 bit SN(Even number of LIs, i.e. K = 2, 4, 6, )

E Extension FieldFI Framing InformationSN Sequence Number

RLC Unacknowledged Mode PDU,10 Bits SN, cont

UMD PDU with 10 bit SN(Odd number of LIs, i.e. K = 1, 3, 5, )

UMD PDU with 10 bit SN(Even number of LIs, i.e. K = 2, 4, 6, )

E Extension FieldFI Framing InformationSN Sequence Number


56/159

7/2/2

RLC AM Entity

Transmissionbuffer

Segmentation &Concatenation

Add RLC header

Retransmissionbuffer

RLC control

Routing

Receptionbuffer & HARQ

reordering

SDU reassembly

DCCH /DTCH DCCH /DTCH

AM -SAP

Remove RLC header

RLC Acknowledged Mode PDU

SOSOLSF Oct 3

Oct 4

LI2

E LI2 (if K>=3)E LI1

LI1

D/C RF P FI E SNSN

Data

Oct N

Oct 1Oct 2

Oct 5Oct 6Oct 7

LIK-1

E LIK-1

E LIK-2LIK-2

PaddingE LIK

LIK Oct [4.5+1.5*K]Oct [4.5+1.5*K-1]Oct [4.5+1.5*K-2]Oct [4.5+1.5*K-3]Oct [4.5+1.5*K-4]

Oct [4.5+1.5*K+1]

Present ifK >= 3

D/C Data/ControlE Extension FieldFI Framing InfoLSF Last Segment FlagP Poll BitRF Resegmentation FlagSN Sequence NumberSO Segment Offset


57/159

7/2/2

RLC Acknowledged Mode PDUPositive Acknowledgment

RLC Acknowledged Mode PDUNegative Acknowledgment


58/159

7/2/2

Information Element: E Bit

Extension bit indicates whether Data field follows or a set of Efield and LI field follows

Information Element: Length Indicator LI

Length Indicator (LI) fieldThe LI field indicates the length in bytes ofthe corresponding data field element presentin the RLC data PDU delivered/received byan UM or an AM RLC entity.

The value 0 is reserved.


59/159

7/2/2

Information Element:FI Framing Information Field

Information Element:Segment Offset SO

The Segment Offset field indicates theposition of the AMD PDU segment in byteswithin the original AMD PDU.

The first byte in the Data field of the originalAMD PDU is referred by the SO field value"000000000000000"


60/159

7/2/2

Information Element:Last Segment Flag LSF

Information Element:Resegmentation Flag RF

Value Description0 AMD PDU

1 AMD PDU segment


61/159

7/2/2

Information Element: Poll P

Value Description

0 Status report not requested

1 Status report is requested

Polling bit field

Information Element:Control Pdu Type CPT


62/159

7/2/2

STATUS PDU

NACK_SN

D/C CPTE1

ACK_SNACK_SN

Oct 1Oct 2

NACK_SNE1 E2 NACK_SN

NACK_SNSOstart

SOstart

SOendSOend

E1 E2

SOend

Oct 3Oct 4Oct 5Oct 6Oct 7Oct 8Oct 9

D/C Data/ControlCPT Control PDU TypeE Extension FieldSO Segment Offset

STATUS PDU Fields


63/159


64/159

7/2/2

MAC Sublayers3GPP TS 36.321

MAC Functions - UE Side

RandomAccess Control

PCCH BCCH CCCH DCCH DTCH MAC-control

Upper layers

PCH BCH DL-SCH UL-SCH RACH

Lower layer

(De-) Multiplexing

Logical Channel Prioritization (UL only)

HARQ

Control


65/159

7/2/2

MAC Functions eNodeb Side

Scheduling / Priority Handling

Multiplexing

DCCH DTCHCCCH

HARQ

DL-SCH HARQFeedback

Control

HARQ

Demultiplexing

DCCH DTCH

UL-SCH

CCCH

MAC Control

BCCHPCCH

Scheduling / PriorityHandling

HARQ

HARQFeedback P

D C C H

P U C C H

S R

S c

h e

d u

l e r

BCHPCH DL-SCH

MAC Function Location


66/159

7/2/2

MAC Transport Channels3GPP TS 36.321

MAC DL-SCH Transport Channel3GPP TS 36.321


67/159

7/2/2

Physical Channels

MAC MultiplexingIPvia S1 or fromUEs stack

Payloade.g. 1460 Byte

IP20B

L1Coding,Interleaving,Modulation

CRC3B

Transport Bloc k

TCP20B

Payloade.g. 50 Byte

IP20B

TCP20B

PDCPHeader Compression& Ciphering PDCP SDU

H~3B

PDCP2B

H~3B

PDCP2B

PDCPPDU

RLCSegmentationconcatenation

RLC4B

RLC SDU

Concatenation

Segmentation

RLC SDU RLCPDURLC

2B

MACMultiplexing MAC SDU (e.g. 927 Byte)MAC4B

Multiplexing (Padding)MAC1B MAC SDU (e.g. 599 Byte)

MACPDU


68/159

7/2/2

MAC PDU Structure

A MAC PDU header consists of one or more MAC PDU subheaders

Each subheader corresponds to either a MAC SDU (RLC PDU), a MACcontrol element or padding.

LCID Logical Channel IDE Extension BitR ReservedF Length FlagL Length

MAC Controlelement 1 ...MAC header

MAC payload

MAC Controlelement 2 MAC SDU MAC SDU

Padding(opt)

...R/R/E/LCID/F/Lsub-header

R/R/E/LCID/F/Lsub-header




R/R/E/LCID paddingsub-header

MAC PDU

MAC PDU Structure

LCID Logical Channel IDE Extension BitR ReservedF Length Flag

L Length


MAC payload


Padding(opt)







A MAC PDU subheader consists of the six header f ields R/R/E/LCID/F/L except for the lastsubheader in the MAC PDU and for fixed sized MAC control elements.

R/R/E/LCID sub-header

LCIDR R E Oct 1


69/159


70/159

7/2/2

MAC PDU Structure MAC SDUsLCID Logical Channel IDE Extension BitR ReservedF Length FlagL Length


MAC payload


Padding(opt)







MAC Signaling Procedures

RANDOM ACCESS


71/159

7/2/2

Channel Mapping

UL-SCHPCH DL-SCH

PCCHLogical Channelstype of information(traffic/control)


Downlink Uplink

PDSCH


MTCH MCCH BCCH DTCH DCCH DTCH DCCH CCCH

PRACH

RACH

CCCH

MCH BCH


-CQI-ACK/NACK-Sched req.


MIB SIB

PMCH PHICHPDCCH

ACK/NACKPDCCH

info


RS SRSP-SCH S-SCH RS

-meas for DL sched-meas for mobility-coherent demod

-half frame sync-cell id

-frame sync-cell id group -coherent demod

-measurements forUL scheduling

MAC Signaling Procedures -RANDOM ACCESS PROCEDURESWhen???

- enable initial access - UE to E-UTRAN (CBRA)

- enable Handover access - UE to E-UTRAN (CFRA)

- establish UL synchronization (CFRA)

- Indicate presence of UL data (when not scheduled for long time) (CFRA)


72/159

7/2/2

Random Access CBRA (ContentionBased Random Access)

When???

- used at initial access (initialcall setup)

- subject to collision (ALOHA Protocol)

CBRA

Random Access Preamble(Randomly selected Preamble Id)

Random Access Response

RRC Connection Request

UE eNB

1.

2.

3.

4.RRC Connection Setup

CBRA RANDOM ACCESS Initial Access for RRC Connection Establishment

Example


To be discussed in class


73/159

7/2/2


BCCH: System Information

CCCH: RRC Connection Request (Initial UE identity, Cause)

CCCH: RRC Connection Setup (SRB1 parameters)

DCCH : RRC Connection Setup Complete (Selected PLMN id, NAS: Attach Request *)

PRACH: RACH preamble

DL-SCH: RACH response(RAPID; TC-RNTI);

RRC RRC

RRC RRC

RRC RRC

RRC RRC

e N o

d e

B

rach-Configuration {preambleInformation { numberOfRA-Preambles n64 },powerRampingParameters { powerRampingStep dB2,preambleInitialReceivedTargetPower dBm-104 },ra-SupervisionInformation { preambleTransMax n10,

ra-ResponseWindowSize sf 4,mac-ContentionResolutionTimer sf 48 },maxHARQ-Msg3Tx 1 },

UE randomly selectsone of the 64 preambles and send it based onpreambleInitialReceivedTargetPower


If no answer is received withinra-ResponseWindowSize preamble issent again based onpreambleInitialReceivedTargetPower + powerRampingStep

PDCCH: RA-RNTI; Scheduling Grant;TA

RA-RNTI = 1+ t_id + 10f_idMAC allocate TC-RNTI

PUSCH: TC-RNTIUL SCH: RA message3

PDCCH: TC-RNTI; Scheduling GrantDL-SCH: C-RNTI; Contention Resolution

UL-SCH: C-RNTI; BSR

Use TC-RNTI to decode DL SCH. If the UE contentionresolutionidentity MAC control element matches the RRC connectionrequestmessage promote TC-RNTI to C_RNTI.

The TC-RNTI is "promoted" to a C-RNTI,i.e. the same 16-bit valueallocated for TC-RNTIwill continue to be used as C-RNTIafter the random access procedureis succes sfully concluded.

The 40-bit MAC "UE contention resolutionidentity" is identical to the RRC ConnectionRequest sent in RA message 3.

If the UE sees its preamble, itwill respond with RRCConnectionReqIncluding its 40 bit UE-id and Est.Cause)

MACMAC

MAC MAC

MACMAC

MAC MAC

MACMAC

Random Access CFRA (ContentionFree Random Access)

When???

- is used for UEs in handover

- a special preamble is reserved

CFRA

Random Access Preamble(Pre-allocated Preamble Id)



UE eNB

1.

2.

3.


CFRA RANDOM ACCESS Handover Access


74/159

7/2/2

UE1 is assigned preamble pUE1 by means of RRCsignalling via cell 1 which is the serving cell of UE1

CFRA RANDOM ACCESS Handover Access

p UE1

RRC: RACH - ConfigDedicated

Cell 1 Cel l 2

p UE1

R RC : R ACH - ConfigDedicated

p UE1


Cell 1 Cel l 2

p UE1



When???

- is used for UEs in re-synchronizationprocedure when non scheduled.

- a special preamble is reserved

CFRA




UE eNB

1.

2.

3.


CFRA RANDOM ACCESS UE out_of_sync resynchronization process


75/159

7/2/2

CFRA RANDOM ACCESS Uplink re-synchronization

- UE is scheduled for downlink data from eNodeB uplink Scheduler

- UE is out_of_sync (unsynchonized) due to following event:non scheduled time period > timeAlignmentTimer

and alignment expiration has occurred (UL timing adjustment process)- eNodeB through PDCCH physical channel on downlink transmissionassigns a reserved preample to UE- UE uses preample and starts CFRA process to get back synchronization.

PDCCH for DL

data arrival

PDCCH for DL

data arrival

PDCCH for DL

data arrival

PDCCH for DL

data arrival e

N o

d e

B


When???

- UE has data (overflowing) into buffer

- eNodeB has not scheduled UE sincelong time

- UE requests scheduling using CFRArandom access procedure since it hasbeen UL out_of_sync

- a special preamble is reserved fromeNodeb and signaled through PDCCH

CFRA




UE eNB

1.

2.

3.


CFRA RANDOM ACCESS UE UL_Scheduling Request to eNodeb UL scheduler


76/159

7/2/2

Example


To be discussed in class ...


no PUCCH resources

no UL Synch (TAT is not running)

has repeated SR on PUCCH max no of times

BCCH: System Information


DL-SCH: RACH response(RAPID; TC-RNTI);

RRC RRC

e N o

d e

Brach-Configuration {preambleInformation { numberOfRA-Preambles n64 },powerRampingParameters { powerRampingStep dB2,preambleInitialReceivedTargetPower dBm-104 },ra-SupervisionInformation { preambleTransMax n10,ra-ResponseWindowSize sf 4,mac-ContentionResolutionTimer s f48 },maxHARQ-Msg3Tx 1 },

UE randomly selectsone of the 64 preambles and send it based onpreambleInitialReceivedTargetPower


If no answer is received withinra-ResponseWindowSize preamble issent again based onpreambleInitialReceivedTargetPower + powerRampingStep

PDCCH: RA-RNTI; Sc heduling Grant;TA

RA-RNTI = 1+ t_id + 10f_idMAC allocate TC-RNTI

PUSCH: C-RNTIUL SCH: msg3 (BSR,

PHR)

PDCCH: C-RNTI; Scheduling Grant

UL-SCH: C-RNTI; BSRUse C-RNTI to dec ode DL SCH..

MAC

C-RNTI provides co ntention resolution

If the UE sees its preamable, itwill respond with Scheduling Requestby sending msg3 containing MACcontrol elements( BSR and/or PHR)and identified by C-RNTI

RLCRLCDTCH/DCCH:

Scheduled Unicast Transmission

MAC

MACMAC

MAC MAC

MACMAC

MAC

MAC MAC

MAC


77/159

7/2/2


UL Time Alignment

MAC Signaling ProceduresUL Time AlignmentProblem statement :

Different UEs within a cell will experience different propagation delayto/from the cell site, depending on their exact position within the cellcoverage area.

UE 2

UE 1

Normally transmit timing is basedonly on the timing of the receiveddownlink timing as a result theircorresponding uplink transmissions

will thus arrive at the cell site withpotentially very different timing.

Receive-timing differences might be too large orthogonality betweenuplink transmissions of different UEs will not be retained subcarriers willbe out_of_sync OFDM orthogonality is lost !!! .


78/159

7/2/2

MAC Signaling ProceduresUL Time Alignment

Solution :A mechanism with an active uplink transmit-timing control is needed toensure that uplink transmissions from different UEs are received withapproximately the same timing at the cell site

transmit-timing control mechanism:

- network measures received uplink timingof the different UEs.

- adjusts (advance (+) command or retard() command) transmit timing on a certainamount.

- timing-control commands are transmittedas higher-layer signaling (MAC) to theUEs. UE 2

UE 1

Timing Advance CommandR R Oct 1

MAC Signaling ProceduresUL Time AlignmentSolution :A mechanism with an active uplink transmit-timing control is needed toensure that uplink transmissions from different UEs are received withapproximately the same timing at the cell site

transmit-timing control mechanism:

- UE has a configurable timer,

timeAlignmentTimer ,

- used to control how long the UE is considereduplink time aligned .- When timer expires and no timing controlcommand is received (non scheduled UE)CFRA Random Access process is needed

- timeAlignmentTimer is valid only in the cellfor which it was configured and started .

UE 2

UE 1

Timing Advance CommandR R Oct 1


79/159


80/159

7/2/2

MAC Signaling ProceduresMAC Scheduler Blocks

MAC Signaling ProceduresMAC Schedulerdata1data2data3data4

User #1 scheduled

User #2 scheduled

Time-frequenc yfading, user #1

Time-frequencyfading, user #2

Channel dependant scheduler- Adapts UE rate to channel conditions


81/159

7/2/2

UL-SCHPCH DL-SCH

PCCHLogical Channelstype of information(traffic/control)


Downlink Uplink

PDSCH


BCCH DTCH DCCH DTCH DCCH CCCH

PRACH

RACH

CCCH

BCH


-CQI-(N)ACK-Sched req.


MIB SIB

PHICHPDCCH

ACK/NACKPDCCH

info


DL Scheduling UL Scheduling

RS P-SCH S-SCH RS SRS

MAC Signaling ProceduresScheduled Channels

MAC Signaling ProceduresScheduled DL Resources

f

t

Two RBs

0.5ms0.5ms

One Scheduling Block

180 kHz

1 ms

Scheduler

Link AdaptationSBs

f

SINR

MIMO


82/159

7/2/2

MAC Signaling ProceduresUL Scheduler

Modulation, coding

Buffer

MultiplexingScheduler

Buffer

Uplink channel qualityScheduler

Multiplexing

Buffer

Modulation, coding

Priority handling

Buffer

eNodeB eNodeB

UE UE

C Q I

S t a t u s

T F s e

l e c

t i o n

Downlink Uplink

Downlinkchannel quality

MAC Signaling ProceduresMAC Scheduler


83/159

7/2/2


HARQ

MAC Signaling ProceduresHARQLTE protocols over IP/ethernet transmission ( Link Layer (ethernet), Networklayer (IP) and transport network protocols (TCP, UDP) ) are not prepared torecover from packet header bit errors and packet payload errors.

Although channel dependant MAC Scheduler adjusts scheduling to UEchannel conditions, BER unrecovery conditions might still be a problem thatmight introduce large amount of retransmissions over the air interface

One potential solution might be the propagation of BER recovery functions tohigher layer protocols however it might introduce unaccepted delays

Another potential solution might be the choice to discard and fast retransmitthe entire data unit containing bit errors Physical layer Turbo coding correcterrors on receiver and CRC check BER to decide.....

LTE 3GPP standards define two layers of retransmission protection. HARQ onMAC and ARQ on RLC


84/159

7/2/2

HARQ (MAC) and ARQ (RLC)

UL ARQTransmitter

UL ARQReceiver

UL HARQTransmitter

DL HARQReceiver DL HARQTransmitter

UL HARQReceiver

Sliding Window ARQ

Stop and Wait HARQ

Uplink L1

Downlink L1

RLC Status(DL HARQ data)

RLC Status RLC PDUs RLC PDUs

Transport Block +CRCBLER ~10 -1

RLC

MAC

BLER ~10 -4 to 10 -3 BLER ~10 -4 to 10 -3

RLC PDUs

BLER ~10 -4 to 10 -3

RLC SDUs

BLER ~10-6

BLER ~10 -1


Accessibility Preamples


85/159

7/2/2

Random Access Procedure

RA Preamble Assignment

Random Access Preamble


Scheduled Transmission (MSG3)

Contention Resolution (MSG4)

CFRAContention Free Random Access Process Steps

0

1

2

3

4

CBRAContention Based

Random Access Process Steps

HARQ

HARQ

Uplink Open Loop Power Control1) UE measures RS

UE

RBS

3) The power is ramped up until a response is heardor maximum number of re-attempts is reached

Downlink(PDCCH) ...

RACH Preamble RACH Response No Response

RA-RNTI

Downlink(PDSCH)

subframe1 ms

RA response window

......

RAPID

Timing (UL timing)

Scheduling Grant

Indicates RA Response on PDSCH(Not UE specific)

Uplink

(PRACH) RA msg 3preamble0.8 ms

Power step

preambleInitial power

......

Data

... ...

Max uplink cell power


86/159


87/159

7/2/2

Mobility Case Studies

Signaling on E-Utran

To be discussed in class

LTE Node B

LTE NodeB

LTE Node B

X2X2

Mobility Case X2 Handover

Simplified mobilityscheme to handle themost commonscenarioForwarding of userdata on X2 interface(SelectiveForwarding)After handover iscompleted, EPC isinformed and theroute is optimized

SGWMME


88/159

7/2/2

X2 HandoverMME

RRCCONNECTED

S-GW

Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION(Bearer Setup,Measurement conf))

2. RRC Measurement Report(Event A3)

3. HODecision

4. X2 HANDOVER REQUEST

5.AdmissionControl

6. X2 HANDOVER REQUESTACKNOWLEDGE

10. RRC CONNECTION RECONFIGURATION(Handover Command,Measurement conf)

7. X2 SN STATUS TRANSFER8. Start Data

forwarding

9. BufferForwarded

Data11 MAC: CFRA Random Access Preamble

12. MAC Random Access Response (UL allocation + TA)

13. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Complete)

15. S1 PATH SWITCH REQUEST16. S5 USER PLANE

UPDATE REQ18. S5 USER PLANEUPDATE RSPONSE

19. S1 PATH SWITCH RESPONSE

20. X2 UE CONTEXT RELEASERRCCONNECTED

14.Data Transfer in Target

21. Forward if anyData in transition

and release

T304

TRELOCprep

RegenerateSecurity Keys


Handover Flow1. Measurement Command message is included in RRC Connection

Reconfiguration message.

2. criteria event A3 is fulfilled UE will inform the source eNB bysending Measurement Report .

3. Source eNB makes a handover decision based on MeasurementReport and RRM


89/159

7/2/2

4. Source eNB issues a X2 - Handover Request message to the targeteNB passing necessary information to prepare the HO

- UE X2 signaling context reference at source eNB,- UE S1 EPC signaling context reference,- target cell ID,- KeNB,- RRC context including the C-RNTI of the UE in the source eNB,- AS-configuration,- E-RAB context and physical layer ID of the source cell + MAC for

possible RLF recovery).

UE X2 / UE S1 signaling references enable the target eNB to address thesource eNB and the EPC.

E-RAB context includes also necessary RNL and TNL addressinginformation, and QoS profiles of the E-RABs.

Handover Flow

X2- Handover Request


90/159

7/2/2

X2 HandoverMME

RRCCONNECTED

S-GW

Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION(Bearer Setup,Measurement conf))


3. HODecision


5.AdmissionControl




forwarding

9. BufferForwarded










and release

T304

TRELOCprep



5. AC (Admission Control) is performed by the target eNB

AC dependents on the received E-RAB QoS information

Target eNB configures the required resources according to the received E-RAB QoS information - reserves a C-RNTI and optionally a RACHpreamble.

Handover Flow


91/159

7/2/2

6. Target eNB prepares HO with L1/L2 and sends X2 - HandoverRequest Acknowledge to the source eNB.

Message includes transparent container to be sent to the UE as an RRCmessage ( RRC Connection reconfiguration ) to perform the handover.

Container includes:- new C-RNTI,- target eNB security algorithm identifiers for the selected security

algorithms,- dedicated RACH preamble.

Handover Flow

X2 Handover Request Ack


92/159

7/2/2

7. Source eNB sends SN STATUS TRANSFER message to the targeteNB

Reason: Inform RLC AM about uplink PDCP SN receiver status -includes at least the PDCP SN of the first missing UL SDU and mayinclude a bit map of the receive status of the out of sequence UL SDUsthat the UE needs to retransmit in the target cell if there are any suchSDUs

Reason: Inform RLC AM about downlink PDCP SN transmitter status ofE-RABs includes next PDCP SN that the target eNB shall assign tonew SDUs, not having a PDCP SN yet.

Handover Flow

X2 HandoverMME

RRCCONNECTED

S-GW

Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION

(Bearer Setup,Measurement conf))


3. HODecision


5.AdmissionControl




forwarding

9. BufferForwarded










and release

T304

TRELOCprep

Regenerate

Security Keys



93/159

7/2/2

8. Data forwarding is initiated

9. Target eNB buffers received DL data until the UE access the new cell.

10. Source eNB forwards RRC message RRC ConnectionReconfiguration included on X2 - message Handover Request Acknowledge (includes mobilityControlInformation to the UE).

- source eNB performs necessary integrity protection and ciphering of themessage UE receives RRC Connection Reconfiguration message with necessary parameters.

Handover Flow

RRC Container, ExtractRRCConnectionReconfiguration messageRRCConnectionReconfiguration-r8-IEs {

measConfigmobilityControlInforadioResourceConfigDedicatedsecurityConfigHO

MobilityControlInfo ::=targetPhysCellIdcarrierFreq OcarrierBandwidth OadditionalSpectrumEmission Ot304 ENUMERATED { ms50, ms100, ms150, ms200, ms500, ms1000,

ms2000, spare1},newUE-Identity C-RNTI ,radioResourceConfigCommonrach-ConfigDedicated ra-PreambleIndex INTEGER (0..63),

r a- PRAC H- Ma skI nde x I NTE GE R ( 0. .1 5)

CarrierBandwidthEUTRA ::= SEQUENCE {dl-Bandwidth ENUMERATED { n6, n15, n25, n50, n75, n100}ul-Bandwidth ENUMERATED {n6, n15, n25, n50, n75, n100}

CarrierFreqEUTRA ::=dl-CarrierFrequl-CarrierFreq O

SecurityConfigHO ::=handoverType CHOICE {intraLTE {

sec ur it yAlgor it hmCo nf ig OkeyChangeIndicator BOOLEAN,nextHopChainingCount

},interRAT {

securityAlgorithmConfignas-SecurityParamToEUTRA

5 MHz


94/159

7/2/2

11. UE synchronizes to target eNB (Check MAC protocol slides, CFRA

Handover Access ) and accesses the target cell via RACH- following a contention-free procedure (dedicated RACH preamble wasindicated in the mobility Control Information content of RRCConnection Reconfiguration message )

- following a contention-based procedure if no dedicated preamble wasindicated. UE derives target eNB specific keys and configures theselected security algorithms to be used in the target cell.

12. The target eNB responds with UL allocation and timing advance .

13. UE successfully accessed target cell UE confirms handoversending

- RRC Connection Reconfiguration Complete message- C-RNTI- uplink Buffer Status Report (BSR), whenever possible

Handover Flow

X2 HandoverMME

RRCCONNECTED

S-GW

Source eNB Target eNB1. RRC CONNECTION RECONFIGURATION



3. HODecision


5.AdmissionControl




forwarding

9. BufferForwarded










and release

T304

TRELOCprep

Regenerate

Security Keys



95/159


96/159


97/159

7/2/2

20. Target eNB informs successful handover accomplishment of HO tosource eNB (sending UE CONTEXT RELEASE ) this messagetriggers the release of resources by the source eNB.

21. source eNB can release radio and C-plane related resourcesassociated to the UE context

Handover Flow

LTE NodeB

Mobility Case S1 Handover

S1 handover: Relocation of MME or

SGW Handover to UTRAN or

GSM Change of MME pool

areaSignalling is done via EPCand does not assume theexistance of an X2interface.Similar to inter-RAThandoverForwarding of user dataeither directly betweeneNodeB or in-direct via S-GW (Selective Forwarding)

MMESGW SGWMME



98/159

7/2/2

Handover Events

S1 Handover

RRCCONNECTED

S-GW

Source eNB Targe t eNB1. RRC CONNECTION RECONFIGURATION



3. HODecision

4. S1 HANDOVER REQIRED(Source to Targe t Transparent Container )

8. AdmissionControl 9. S1 HANDOVER REQUEST ACKNOWLEDGE


14 MAC: CFRA Random Access Preamble15. MAC Random Access Response (UL allocation + TA)

16. RRC CONNECTION RECONFIGURATION COMPLETE(Handover Confirm)

RRCCONNECTED

T304

TS1RELOCprep



MME MMES-GW

TargetTarget

5. S10 FORWARD RELOCATIONREQUEST

6. S11 CREATE SESSION REQ/RES7. S1 HANDOVER REQUEST

10. S10 FORWARD RELOCATIONRESPONSE

12. S1 HANDOVER COMMAND

19. S10 FORWARD RELOCATIONCOMPLETE/ ACK

Source Source

20. S1 UE CONTEXT RELEASECOMMAND

(Cause: Successful Handover)

UP Forwarding

Source eNB Targe t eNB SourceSource eNB Targe t eNB TargetSourceSource eNB Targe t eNB SourceTargetSourceSource eNB Targe t eNB TargetSourceTargetSourceSource eNB Targe t eNB

11. S11 CREATE BEARER REQ/RES

17. S1 HANDOVER NOTIFY


99/159

7/2/2

Exercises

Mobility Scenarios


Evolved Packet Core (EPC)


100/159

7/2/2

EPS Interfaces3GPP TS 23.401

EPC/LTE Architecture - 3GPP

MME

S1-MME S1-U

LTE

IP networks

eNodeB

SGSN

Iu CP Gb

2G 3G

S3

BSC

BTS

RNC

Node B

HLR/HSS

PCRF

Iu UP

S11

Gr

Gx

S10

S4

S6a

SGi

X2 Iur

ServingGW

S5

PDN GW

Rx


101/159

7/2/2

LTE/EPC Interfaces

S1: interface between an eNodeB and an EPC provides aninterconnection point between the EUTRAN and the EPC. It is alsoconsidered as a reference point.- S1-MME : Reference point for the control plane protocol between E-UTRANand MME.- S1-UP : Reference point for the transport for data streams on the S1interface between E-UTRAN and SGW using the GTP-U protocol

Interface between eNodeB ( X2) provides capability to support radiointerface mobility between eNodeBs, of UEs having a connection with E-UTRAN.X2 interface enables inter-connection of eNodeBs and support ofcontinuation between eNodeBs of the E-UTRAN services offered via the S1

interface


MME

S1-MME S1-U

LTE

IP networks

eNodeB

SGSN

Iu CP Gb

2G 3G

S3

BSC

BTS

RNC

Node B

HLR/HSS

PCRF

Iu UP

S11

Gr

Gx

S10

S4

S6a

SGi

X2 Iur

ServingGW

S5

PDN GW

Rx


102/159

7/2/2

LTE/EPC Interfaces

Interface between MME and HSS (S6a-interface) used to exchange datarelated to the location of the mobile station and to the management of thesubscriber (capability to transfer packet data within the whole LTE servicearea), using Diameter S6a/S6d Application signaling.

1. MME informs HSS about location of a mobile station managed by the latter.

2. HSS sends to the MME all the data needed to support the service to themobile subscriber.

Exchanges of data may occur when- mobile subscriber requires a particular service,- mobile subscriber wants to change some data attached to his subscription- some parameters of the subscription are modified by administrative means.


MME

S1-MME S1-U

LTE

IP networks

eNodeB

SGSN

Iu CP Gb

2G 3G

S3

BSC

BTS

RNC

Node B

HLR/HSS

PCRF

Iu UP

S11

Gr

Gx

S10

S4

S6a

SGi

X2 Iur

ServingGW

S5

PDN GW

Rx


103/159

7/2/2

LTE/EPC Interfaces

Interface between MME and S-GW (S11-interface) used to supportmobility and bearer management between the MME and S-GW

Interface between MME and MME (S10-interface) used to support userinformation transfer and MME relocation support between the MMEs

Interface between S-GW and PDN-GW (S5 and S8-interface)interfaces between S-GW and PDN-GW, provides support for functions forpacket data services towards end users during roaming and non-roamingcases (i.e. S8 is the inter PLMN variant of S5).


MME

S1-MME S1-U

LTE

IP networks

eNodeB

SGSN

Iu CP Gb

2G 3G

S3

BSC

BTS

RNC

Node B

HLR/HSS

PCRF

Iu UP

S11

Gr

Gx

S10

S4

S6a

SGi

X2 Iur

ServingGW

S5

PDN GW

Rx


104/159

7/2/2

LTE/EPC Interfaces

Interface between MME and SGSN (S3-interface) enables user andbearer (DRB) information exchange for inter 3GPP access network mobility inidle and/or active state

Interface between S-GW and SGSN (S4-interface) provides relatedcontrol and mobility support between GPRS Core and the 3GPP Anchorfunction of Serving GW. In addition, if Direct Tunnel is not established, itprovides the user plane tunnelling

Interface between PCEF - PCRF/H-PCRF/V-PCRF (Gx Reference Point)provides transfer of policy and charging rules from PCRF to Policy andCharging Enforcement Function Point (PCEF) in the GW

Interface from PDN-GW to packet data networks (SGi reference point)reference point between the PDN-GW and a packet data network. It may

be:- operator external public or private packet data network or- an intra operator packet data network, e.g. for provision of IMS services

Basic EPC Architecture

PDN GW

Serv GW

MME

PCRF

LTE

S1-MME S1-U

S10

S11

S5/S8

SGi

Gx Gxc

ExternalIP networks

S9

S6a

Rx OCSOFCS

X2 eNB

Gz Gy

HSS

IMS


105/159

7/2/2


eNodeB LTE Radio Base Station. Provide Wireless access to theUE

MME Mobility Management Entity. Management of subscription-related data for each UE accessing over the LTE-RAN

HSS Home Subscriber Server. User data repository for UEsaccessing over the LTE-RAN

Ser GW Serving Gateway. In charge of user data traffic commingfrom the UEs. Interfaces the eNodeBs

PDN GW Packet Data Network Gateway. Anchor point tointerconnect external IP networks


PCRF Policy and Charging Rules Function. Containspolicy control decision and flow-based charging controlfunctionalities.

OFCS Offline Charging System. Post-processing ofCDRs.

OCS Online Charging System. Real time charging.


106/159

7/2/2

The EPC (SAE) Interfaces S3

S3 Interface

enables user and bearerinformation exchange for inter3GPP access network mobilityin idle and/or active state.

Based on Gn reference pointas defined between SGSNs.

Protocol: GTP-C

HSS

HLR

MMESGSN

PCRF

2G 3G

Gb Iu-C

S3

S4

S1-C S1-U

S12

S11

S10

SGi

Gx

IP networks

S6a

Gr

LTE

PDN GW

Serv GW

S5

SAE GW

The EPC (SAE) Interfaces S4

S4 Interface

Provides related control andmobility support betweenGPRS Core and the 3GPPAnchor function of Serving GW

Is based on Gn referencepoint as defined betweenSGSN and GGSN.

In addition, if Direct Tunnel isnot established, it provides theuser plane tunnelling.

Protocol: GTP-C / -U

HSS

HLR

MMESGSN

PCRF

2G 3G

Gb Iu-C

S3

S4

S1-C S1-U S12

S11

S10

SGi

Gx

IP networks

S6a

Gr

LTE

PDN GW

Serv GW

S5

SAE GW


107/159

7/2/2

The EPC (SAE) Interfaces S5/S8

S5/S8 Interface

Provides user plane tunnelling and tunnelmanagement between Serving GW andPDN GW.

Used for Serving GW relocation due to UEmobility and if the Serving GW needs toconnect to a non-colloc ated PDN GW forthe required PDN connecti vity.

Protocol: GTP (or PMIPv6)

S5 is used in non-roaming scenario (i.e.Serving GW and PDN GW in visitednetwork)

S8 is used in roaming scenario (i.e.Serving GW in visited netw ork and PDNGW in home network).

HSS

HLR

MMESGSN

PCRF

2G 3G

Gb Iu-C

S3

S4

S1-C S1-U S12

S11

S10

SGi

Gx

IP networks

S6a

Gr

LTE

PDN GW

Serv GW

S5/S8

SAE GW

Course - LTE-EPC Signaling - 14 July 2 Eogogics

Documents

Transcript of Course - LTE-EPC Signaling - 14 July 2 Eogogics