Course - LTE-EPC Signaling - 14 July 2 Eogogics

7/2/2014
Knowledge That Powers Organizations!
LTE/EPC Signaling Course

Presented Onsite at Nextel de Mexico
DCN NTDR-Jnz-f
Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525
Knowledge That Powers Organizations!
Learn Technologies from the Team That

Has Been at the Forefront of New
Technology Rollout for 20+ Years!
Why Eogogics?
Unmatched Expertise: Industry-leading 500-course curriculum based on our first-hand technology experience.
Industry Recognized: Preferred or sole-source provider for Fortune 500 companies, R&D organizations, US government agencies, and trade groups.
High Client Satisfaction: 100% of our classes rate good-to-excellent, 98% client retention, 85% of business from client referrals.
World-class Instructors: With advanced degrees, 15-40 years in the real world, publications, patents, awards/honors. They mix teaching, R&D, and
consulting to keep their technical edge razor sharp. Their instruction is clear, dynamic, and entertaining!
Customized, Practical Courses: Partner with the instructor to design a course focused on your mission critical needs. Classes onsite or on the Web.
Buy Coach, Travel First Class: Using technology to drive down our costs, we offer top-tier instructors and tailored courses for 15% below market.
Knowledge That Can Power Your Organization: Avoid the cost and delay of trial-and-error! Benefit from our 20+ year experience, knowledge of
industry best practices, and unbiased advice. We have been engaged in ground-breaking technology implementation projects worldwide for 20+ years.
Our Skill Set

Engineering: Systems Eng. (Methodology, Best Practices, Management), Design Creativity, Out-of-the-Box Thinking, GD&T, Statistical Tolerance Analysis, Poka
Yoke, Materials and Processes (Metals, Plastics), Industrial Statistics, Design of Experiments, Statistical Process Control, Root Cause Failure Analysis, Failure Modes
and Effects Analysis, Project and People Management, Delivery Performance Improvement, Quality Management, Cost Reduction, Engineering Economics
Software Engineering: Principles, Writing Requirements, Configuration Management, Testing, Project Management, Project Estimation, Quality Assurance
Telecom: Network Design/Implementation, Traffic Engineering, Security, Management (SNMP, Ethernet OAM), Cloud Computing, Cyber Security, Carrier Ethernet,
ATM, BGP, IP Geo-location, IPv6, MoIP, IP Sec, MPLS, IMS, SIP, SIP Sec, VoIP, VoIP Sec, EoIP, IP TV, CAMEL, SS7, IMS, SIP, Optical Networks (SONET/SDH,
DWDM, CWDM), Mobile Backhaul, OSS/BSS (eTOM, SID, TAM), Unified Communications
Wireless and RF: 5G (Cognizant Radio, SDR, DSA), 4G (LTE, WiMAX), OFDM/MIMO, 3G (UMTS, HSPA), GSM, GPRS/EDGE, CDMA,1xRTT, EVDO,
iDEN, TETRA, MPBN, MVNO, WiFi, Bluetooth, Mobile TV, Positioning/Location, LBS, RF, RF Safety, HF/VHF, Propagation/Fading, Antennas, Microwaves,
SATCOM, Spectrum Engineering, Signal Processing, IEEE WCET Exam
Defense, Public Safety and Security: 5G, 4G, 3G, and NextGen Technologies, Cyber Security/Warfare, Info. Security, E911, 911 (Voice, VoIP), CALEA
Also, Technical Management and Communications, Soft Skills, and Management/Leadership Development
Join a Distinguished Clientele That Includes Disney, Lockheed Martin, UBS, Boeing, Raytheon, Dell, AT&T, ABC News, Sprint Nextel, Comcast,
SkyTerra, TruePosition, DIRECTV, L-3 Communications, ITT, SAIC, URS, Shaw, NII, Intelsat, Crown Castle, Harris, Booz Allen Hamilton, Spectra
Energy, Cooper, Bain & Company, DoD, HLS, DoE, DoC, DoJ, national labs, and NASA. Call or email today!
www.eogogics.com, www.gogics.com, sales@eogogics.com, +1 703 281-3525, 1 (888) 364-6442
7/2/2014
Notices
Intellectual Property Rights
Copyright 2014, Eogogics Inc.
The contents of this document are the proprietary and copyrighted intellectual property
of Eogogics Inc. They may not be recorded, stored, reproduced, or transmitted by
any means whatsoever without the express, written permission of Eogogics Inc.
Eogogics and Gogics are, respectively, a registered US trade mark and a service
mark of Eogogics Inc. Any other service or trade marks used in this document are
the property of their respective owners.
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
Notices
This Course Builds on the Following Eogogics Courses
(see www.eogogics.com for details):
LTE Advanced System Techniques LTE ADV 4 days

LTE Air Interface Techniques LTE AI 3 days
LTE Signaling and Functionality LTESIG 3 days
Contact Information
Eogogics Inc.
Web: www.eogogics.com or www.gogics.com
Email: sales@eogogics.com
Mail: 333 Maple Avenue East, No. 2005, Vienna VA 22180, USA
Phone: +1-703-281-3525, 1 (888) EOGOGICs (364-6442) toll free in the US
7/2/2014
LTE/EPC Overview
LTE/EPC 3GPP Standards

Evolution Path
7/2/2014
Mobile Systems Evolution

EDGE
TDMA
Edge
Evolution
GPRS
GSM
WCDMA HSDPA/
HSPA+
HSUPA
PDC
LTE/EPC
cdmaOne
2G
CDMA2000
CDMA2000
1xEV/DO
EV/DO
RevA
3G
Evolved 3G
EV/DO
RevB
4G
Source:gsacom.com
Market Trends
Dramatic uptake in broadband data
Migration to LTE:
From existing WCDMA/GSM networks

From existing CDMA networks
High interest in service convergence
Fixed and wireless

Broadband triple-play with mobility
7/2/2014
Market Trends
WLAN access integration
Increased expectations for value-added
services
DPI, policy, charging (subscriber management)
Focus on total cost of ownership
Network simplification, shared resources
Driving forces for LTE/EPC

Efficiency
Fewer payload carrying nodes between

subscriber and service
Shorter latency (service access response,
mobility)
Lowering costs
Lower cost per transmitted bit
7/2/2014
Driving forces for LTE/EPC

Improving services
High throughput to enable advanced services

Common user service provision for all of
access technologies
Making use of new/refarmed spectrum
More efficient radio utilization (new modulation

concept, increased spectrum flexibility)
Driving Forces for LTE/EPC

Better integration with other open
standards
Efficient mobility between 3GPP and non3GPP using the same user service provision
(GSM, WCDMA, LTE, CDMA2000, WLAN ...)
7/2/2014
Network Evolution
3GPP Rel-99
3GPP Rel-7
PDN
PDN
GGSN
GGSN
User plane
essentially
outside SGSN!
SGSN
User plane
traffic through
all nodes
RNC
NodeB
2000
3GPP Rel-8
PDN
P+S-GW
MME
SGSN
RNC
User plane directly

between RAN and
GW!
NodeB
2007
eNodeB
2009/10
SAE/LTE Releases: Evolution Steps

-EPS backbone network, EPC: interconnects the following hosts:
- Mobile Management Entity (MME)
- Home Subscriber Server (HSS)
- Policy and Charging Rules Function (PCRF)
- Serving Gateway (SGW)
- Packet Data Network Gateway (PGW)
7/2/2014
SAE/LTE Release 8 Evolution Steps

Functional changes compared to the current UMTS Architecture
Moving all RNC functions to the Node B
, SGSN CP functions to the MME, and GGSN functions to the
SAE GW
P-GW
S-GW
GGSN
SGSN
(not user plane

functions)
PDN GateWay
Serving GateWay
Mobility Management Entity
MME
RNC
Node B / HSPA
eNodeB
3GPP Project Coordination Group (PCG)
7/2/2014
3GPP LTE and SAE Work Items

Specification Group
TSG RAN
Work Item
Result
LTE
EUTRAN Specifications
(36 series)
LTE: Long Term Evolution

EUTRAN: Evolved UMTS Terrestrial Radio Access Network
Specification Group
TSG SA
Work Item
Result
SAE
EPC Specifications
(From Rel 8 onwards)
SAE: System Architecture Evolution

EPC: Evolved Packet Core
LTE Specifications
36.201 Physical layer general description
36.211 Physical channels and modulation
36.212 Multiplexing and channel coding
36.213 Physical layer procedures
36.214 Physical layer measurements
36.300 E-UTRA overall description

36.302 Services provided by the physical layer
36.304 UE Functions related to idle mode
36.306 UE radio access capabilities
36.321 Medium Access Control (MAC)
Protocol Specification
36.322 Radio Link Control (RLC)
36.323 Packet Data convergence Protocol (PDCP)
36.331 Radio Resource Control (RRC)
36.401 E-UTRA Architecture Description

36.410 S1 interface general aspects & principle
36.411 S1 interface Layer 1
36.412 S1 interface signalling transport
36.413 S1 application protocol S1AP
36.414 S1 interface data transport
36.420 X2 interface general aspects and principles
36.421 X2 interface layer1
36.422 X2 interface signalling transport
36.423 X2 interface application part X2AP
36.442 UTRAN Implementation Specific O&M Transport
29.274 GTP-C
29.281 GTP-U
23.002 Network Architecture
23.003 Numbering, addressing and identification
23.009 Handover Procedures
23.048 Security mechanisms for USIM application
23.401 GPRS enhancements for eUTRA
23.203 QoS Concept
23.272 CS Fallback in EPS
33.401 System Architecture Evolution (SAE);
Security Architecture
36.101 UE radio transmission and reception (FDD)

36.104 BTS radio transmission and reception (FDD)
36.113 Base station EMC
36.133 Requirements for support of Radio Resource
Management (FDD)
36.141 Base station conformance testing (FDD)
24.301 NAS Protocol for Evolved Packet System (EPS)

24.302 Access to the EPC via non 3GPP networks
All specifications can be found on the

web site www.3gpp.org
7/2/2014
LTE/EPC
Architecture & Protocols
What Is LTE/EPC?
Nodes in EPC
& LTE
Functionality
EPC
(Core Network)
Interfaces
to other
systems
between nodes
LTE
(Radio
Access
Network)
10
7/2/2014
EPS Overview Architecture

3GPP Work Items
EPS
(Evolved
Packet
System)
EPC
(Evolved
Packet Core)
SAE
(System Architecture
Evolution)
P/S-GW
MME
S1
E-UTRAN
X2
eNB
LTE
(Long Term Evolution)
eNB
X2
X2
eNB
UE
LTE/EPC Architecture
Quality of service
and charging for
each data flow
Gx
PCRF
P-GW
S10
HSS
MME
S11
S6
SAE
Evolved
Packet
Core
S5/S8
MME
idle mode moblity

and security
- terminates user
plane packets
- switches the user
plane to support UE
mobility
S-GW
S1-CP
LTE
handles the charging

for the service.
IP Point of Presence
(PoP)
S1-UP
E-UTRAN
Radio Bearer control,

Connection Mobility Control
Scheduling for both UL and DL.
X2-UP
eNodeB
X2-CP
eNodeB
11
7/2/2014
Evolved Packet System (EPS) &

WCDMA/GPRS
User Plane
IP Networks
PCRF: Policy and Charging Rules Function

PGW: Packet Data Network Gateway
Control Plane
S4
SGi
HSS: Home Subscriber Server
HSS
Gx
PGW
EPC: Evolved Packet Core
PCRF
SGW: Serving Gateway
SGSN
S5/S8
S6a
S10
S3
UE: User Equipment
EPC
EUTRAN: Evolved UTRAN
SGW
MME
eNodeB: Enhanced Node B
S11
VLR: Visitor Location Register

S1-MME
MSC/VLR
S1-U
MSC: Mobile Switching Centre
X2
eNodeB
GPRS Network
LTE Uu: LTE UTRAN UE Interface
LTE Uu
EUTRAN
Only most important

interfaces shown here
MME: Mobility Management Entity
eNodeB
UE
SGSN: Serving GPRS Support Node
GSM/WCDMA/LTE Architecture - 3GPP

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
12
7/2/2014
EPC/LTE Architecture for Non- 3GPP

IMS
ANDSF
External
IP networks
SGi
HSS
S14
Rx
PCRF
Gxb
Gxa
S9
SWx
SWm
AAA
Gx
SWa
STa
Gxc
S6a
S2b
S6b
ePDG
PDN GW
S2c
S2a
S5/S8
Serv GW
S11
S103
MME
SWn
S101
S102
S10
Trusted
non-3GPP
Non-trusted
non-3GPP
SWu
Overall Architecture IMS Platform & Non-3GPP

AS
MTAS
MGC
Broadband
Wired Access
S-CSCF
P-CSCF
PSTN
AS
IMS Control
layer
I-CSCF
WLAN
Service Layer
AS
Application Servers
Network & Service

management
OSS-RC
DNS/
ENUM
MM
Internet
IMS Connectivity
layer
A-SBG
EMA
DNS/ENUM
N-SBG
Rx+
MGW
User data
RTP/UDP GTP/UDP
PCRF
SIP/UDP or SIP/TCP
GTP-C
Gx
CS Core
GWMSC
MSC
GPRS
Packet
Core
EPC
GGSN
Gxa
SGSN
S6a
S4
S2a
P-GW
S3
GERAN
ISUP
S1-AP, X2-AP
HSS
S6d
MME
S11
UTRAN
S5/S8
S101
S103
S-GW
S1-CP
E-UTRAN
eNodeB
H.248
Diameter
Other
RNC
Platforms / Concepts
CPP /
RBS6000
S1-UP
X2-UP
PDSN
CDMA2000
HRPD
(EV-DO)
Uu
X2-CP eNodeB
TSP/NSP or
TSP/IS
Juniper/
Redback
SUN
WPP
IS
13
7/2/2014
EPS Control Plane Protocols

LTE Uu
S1-MME
NAS
S11
NAS
S5/S8
Relay
RRC
RRC
S1AP
S1AP
GTP-C
GTP-C
GTP-C
PDCP
PDCP
SCTP
SCTP
UDP
UDP
UDP
RLC
RLC
IP
IP
IP
IP
IP
MAC
MAC
L2
L2
L2
L2
L2
L1
L1
L1
L1
L1
L1
L1
SGW
PGW
UE
eNodeB
MME
X2
S10
X2AP
X2AP
GTP-C
GTP-C
SCTP
SCTP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L1
eNodeB
eNodeB
MME
MME
EPS User Plane Protocols

LTE Uu
S1-U
S5/S8
SGi
Application
IP
PDCP
RLC
MAC
L1
UE
IP
Relay
Relay
PDCP
GTP-U
GTP-U
GTP-U
GTP-U
RLC
UDP
UDP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L2
L1
L1
MAC
L1
eNodeB
X2*
SGW
GTP-U
GTP-U
UDP
UDP
IP
IP
L2
L2
L1
L1
eNodeB
PGW
* X2 User plane used
to support Data
forwarding at intra
LTE handover
eNodeB
14
7/2/2014
EPS Protocol Categories

L3 Signalling
Non Access Stratum (NAS)
L2 Transport
Packet Data Convergence Protocol (PDCP)
Communication between UE and MME
- Ciphering and integrity protection for RRC messages

- IP header compression/decompression for user plane
Radio Resource Control (RRC)

Communication between UE and eNodeB
S1 Application Protocol (S1AP)

Communication between eNodeB and MME
X2 Application Protocol (X2AP)

Communication between eNodeB and eNodeB
GPRS Tunneling Protocol Control (GTP-C)

- Communication between MME and SGW
- Communication between SGW and PGW
- Communication between MME and MME
Radio Link Control (RLC)

- Transfer of RRC messages and user data using:
* Acknowledged Mode (AM)
* Transparent Mode (TM) or
* Unacknowledged Mode (UM)
- Error Correction (ARQ)
Medium Access Control (MAC)

- Error Correction (HARQ)
- Transfer of RRC messages and user data using:
- Priority handling (scheduling)
- Transport Format selection
GPRS Tunneling Protocol User (GTP-U)

Transfers data between GPRS tunneling endpoints
Logical Channels Control

Broadcast Control Channel (BCCH)

DL broadcast of system control information.

Paging Control Channel (PCCH)
DL paging information. UE position not known on cell
level
Common Control Channel (CCCH)
UL/DL. When no RRC connection exists.
Multicast Control Channel (MCCH)
DL point-to-multipoint for MBMS scheduling and control,
for one or several MTCHs.
Dedicated Control Channel (DCCH)
UL/DL dedicated control information. Used by UEs
having an RRC connection.
15
7/2/2014
Logical Channels - Traffic

Dedicated Traffic Channel (DTCH)
UL/DL Dedicated Traffic to one UE, user

information.
Multicast Traffic Channel (MTCH)
DL point-to-multipoint. MBMS user data.
Channel Mapping
Downlink
MTCH MCCH
PCCH
BCCH
MIB
PCH
MCH
BCH
Uplink
DTCH DCCH
CCCH
DTCH
DCCH
CCCH
Logical Channels
type of information
(traffic/control)
SIB
UL-SCH
DL-SCH
RACH
Transport Channels
how and with what
characteristics
(common/shared/mc/bc)
PDCCH
info
PMCH
PBCH
PDSCH PCFICH PDCCH
-meas for DL sched

-meas for mobility
-coherent demod
RS
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info ACK/NACK
-half frame sync

-cell id
P-SCH
PHICH
-frame sync
-cell id group
S-SCH
-CQI
-ACK/NACK
-Sched req.
PUCCH
Physical Channels
PUSCH PRACH
-coherent demod
RS
-measurements for
UL scheduling
SRS
bits, symbols,
modulation, radio
frames etc
Physical Signals
only L1 info
16
7/2/2014
Transport Channels - DL
Broadcast Channel (BCH)
System Information broadcasted in the entire coverage

area of the cell. Beamforming is not applied.
Downlink Shared Channel (DL-SCH)
User data, control signaling and System Info. HARQ and
link adaptation. Broadcast in the entire cell or
beamforming. DRX and MBMS supported.
Paging Channel (PCH)
Paging Info broadcasted in the entire cell. DRX
Multicast Channel (MCH)
MBMS traffic broadcasted in entire cell. MBSFN is
supported.
Transport Channels - UL
Uplink Shared channel (UL-SCH)
User data and control signaling. HARQ and link

adaptation. Beamforming may be applied.
Random Access Channel (RACH)
Random Access transmissions (asynchronous and
synchronous). The transmission is typically contention
based. For UEs having an RRC connection there is some
limited support for contention free access.
17
7/2/2014
Channel Mapping
Downlink
MTCH MCCH
PCCH
BCCH
MIB
PCH
MCH
BCH
Uplink
DTCH DCCH
CCCH
DTCH
DCCH
CCCH
Logical Channels
type of information
(traffic/control)
SIB
DL-SCH
UL-SCH
RACH
Transport Channels
how and with what
characteristics
PDCCH
info
PMCH
PBCH
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info ACK/NACK
PDSCH PCFICH PDCCH
-meas for DL sched

-meas for mobility
-coherent demod
-half frame sync

-cell id
P-SCH
RS
PHICH
-frame sync
-cell id group
S-SCH
-CQI
-ACK/NACK
-Sched req.
PUCCH
Physical Channels
PUSCH PRACH
-coherent demod
RS
-measurements for
UL scheduling
SRS
bits, symbols,
modulation, radio
frames etc
Physical Signals
only L1 info
Physical Channels and Signals

Physical channels

Physical Downlink Shared Channel (PDSCH)

transmission of the DL-SCH transport channel
Physical Uplink Shared Channel (PUSCH)
transmission of the UL-SCH transport channel
Physical Control Format Indicator Channel (PCFICH)
indicates the PDCCH format in DL
Physical Downlink Control Channel (PDCCH)
DL L1/L2 control signaling
Physical Uplink Control Channel (PUCCH)
UL L1/L2 control signaling
Physical Hybrid ARQ Indicator Channel (PHICH)
DL HARQ info
Physical Broadcast Channel (PBCH)
DL transmission of the BCH transport channel.
Physical Multicast Channel (PMCH)
DL transmission of the MCH transport channel.
Physical Random Access Channel (PRACH)
UL transmission of the random access preamble as given by the RACH
transport channel.
18
7/2/2014
Physical Channels and Signals

Physical signals
Reference Signals (RS)
support measurements and coherent demodulation in uplink and downlink.

Primary and Secondary Synchronization signals (P-SCH and S-SCH)
DL only and used in the cell search procedure.
Sounding Reference Signal (SRS)
supports UL scheduling measurements
Channel Mapping
Downlink
MTCH MCCH
PCCH
BCCH
MIB
PCH
MCH
BCH
Uplink
DTCH DCCH
CCCH
DTCH
DCCH
CCCH
Logical Channels
type of information
(traffic/control)
SIB
UL-SCH
DL-SCH
RACH
Transport Channels
how and with what
characteristics
PDCCH
info
PMCH
PBCH
PDSCH PCFICH PDCCH
-meas for DL sched

-meas for mobility
-coherent demod
RS
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info ACK/NACK
-half frame sync

-cell id
P-SCH
PHICH
-frame sync
-cell id group
S-SCH
-CQI
-ACK/NACK
-Sched req.
PUCCH
Physical Channels
PUSCH PRACH
-coherent demod
RS
-measurements for
UL scheduling
SRS
bits, symbols,
modulation, radio
frames etc
Physical Signals
only L1 info
19
7/2/2014
NAS Signaling
UE-MME

LTE Uu
S1-MME
NAS
S11
NAS
S5/S8
Relay
RRC
PDCP
RRC
S1AP
S1AP
GTP-C
GTP-C
GTP-C
PDCP
SCTP
SCTP
UDP
UDP
UDP
RLC
RLC
IP
IP
IP
IP
IP
MAC
MAC
L2
L2
L2
L2
L2
L1
L1
L1
L1
L1
L1
L1
SGW
PGW
UE
eNodeB
MME
X2
S10
X2AP
X2AP
GTP-C
GTP-C
SCTP
SCTP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L1
eNodeB
eNodeB
MME
MME
20
7/2/2014
NAS Signaling - MME

3GPP TS 24.301
UE Protocol Stack
NAS
Session
Management
Mobility
Management
NAS Security
Application
Control/Report SAPs
RRC
System Info
Aquisition
Cell
Selection
AS Security
RRC
Connection
Paging
Reception
Connected
Mode
Mobility
RB
Managementv
Measurement
Reporting
IP
Integrity/
Ciphering
ROHC/
Ciphering
PDCP
TM
AM
UM/AM
RLC
RA Control
L2
MAC
HARQ
Control
Physical Layer
21
7/2/2014
NAS Elementary Procedures
EPS Elementary
Procedures
EPS Session Management
EPS Mobility Management
"ready-to-use" IP connectivity and an "always-on" experience
EPS Mobility Management - EMM

3GPP TS 24.301
22
7/2/2014
LTE States
Power-up
LTE_DETACHED
LTE_ACTIVE
LTE_IDLE
No IP address
IP address assigned
IP address assigned
Position not known
Connected to known cell
Position partially known

DL DRX period
OUT_OF_SYNC
IN_SYNC
DL reception possible
DL reception possible
No UL transmission
UL transmission possible
EMM Protocol States - Mobility

MME
Tracking Area Update

(TAU)
Handover
eNB
Tracking Area (TA)
UE pos known on TA level in MME
UE position known on Cell

level in eNodeB
Detach, Attach reject,

TAU reject
ECM connected =
ECM-CONNECTED
ECM-IDLE
RRC_IDLE
PLMN
selection
EMM: EPS Mobility

Management
RRC: Radio Resource
Management
Signaling
connection
establishment
UE
position
not known
in network
ECM: EPS Connection

Management
EMMDEREGISTERED
RRC_IDLE
Signaling
connection
release
RRC_CONNECTED
S1 bearer
+
RRC connection(SRB)
EMMREGISTERED
Attach accept,
TAU accept
23
7/2/2014
EPS Network Operational Modes
EPS Session Management - ESM

3GPP TS 24.301
24
7/2/2014
EPS Protocol States - Bearers

3GPP TS 24.301
RRC Signaling
UE-MME
25
7/2/2014

LTE Uu
S1-MME
NAS
S11
NAS
S5/S8
Relay
RRC
RRC
S1AP
S1AP
GTP-C
GTP-C
GTP-C
PDCP
PDCP
SCTP
SCTP
UDP
UDP
UDP
RLC
RLC
IP
IP
IP
IP
IP
MAC
MAC
L2
L2
L2
L2
L2
L1
L1
L1
L1
L1
L1
L1
SGW
PGW
UE
eNodeB
MME
X2
S10
X2AP
X2AP
GTP-C
GTP-C
SCTP
SCTP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L1
eNodeB
eNodeB
MME
MME
UE Protocol Stack
NAS
Session
Management
Mobility
Management
NAS Security
Application
Control/Report SAPs
RRC
System Info
Aquisition
Cell
Selection
AS Security
RRC
Connection
Paging
Reception
Connected
Mode
Mobility
RB
Managementv
Measurement
Reporting
IP
Integrity/
Ciphering
ROHC/
Ciphering
PDCP
TM
AM
UM/AM
RLC
RA Control
L2
MAC
HARQ
Control
Physical Layer
26
7/2/2014
RRC States
Detach, Attach reject, TAU
reject
Signaling
connection
establishment
UE position
not known
in network
PLMN
selection
ECM-CONNECTED
ECM-IDLE
RRC_IDLE
EMMDEREGISTERED
RRC_IDLE
Signaling
connection
release
RRC_CONNECTED
EMM-REGISTERED
Attach accept, TAU

accept
RRC Signaling
3GPP TS 25.813
3GPP TS 36.300
3GPP TS 36.331
27
7/2/2014
RRC Messages

CounterCheck
CounterCheckResponse
CSFBParametersRequest
CSFBParametersResponse
DLInformationTransfer
HandoverFromEUTRAPreparationRequest
MasterInformationBlock
MeasurementReport
MobilityFromEUTRACommand
Paging
RRCConnectionReconfiguration
RRCConnectionReconfigurationComplete
RRCConnectionReestablishment
RRCConnectionReestablishmentComplete
RRCConnectionReestablishmentReject
RRCConnectionRelease
RRCConnectionRequest
RRCConnectionSetup
RRCConnectionSetupComplete

SecurityModeCommand
SecurityModeComplete
SecurityModeFailure
SystemInformation
SystemInformationBlockType1
UECapabilityEnquiry
UECapabilityInformation
ULHandoverPreparationTransfer
ULInformationTransfer
CSFBParametersRequestCDMA2000
CSFBParametersResponseCDMA2000
HandoverFromEUTRAPreparationRequest (CDMA2000)
ULHandoverPreparationTransfer (CDMA2000)
RRC Signaling
Idle Mode
28
7/2/2014
System Information Mapping

PCCH/PCH Paging: System Info Modification
MIB
SIB1
SIB2
SI-1
BCH
PBCH
SIB4
BCCH
DL-SCH
TTI=80
SIB5
SI-2
BCCH
BCCH
TTI= 40
SIB3
DL-SCH
TTI= 160
TTI= 320
PDSCH
PDSCH
System Information Blocks (SIBs)
29
7/2/2014
Idle Mode Cell Selection - Reselection

Automatic mode
Manual Mode
PLMN Selection
Indication
to user
Location
Registration
response
PLMNs
available
AvailableCSG IDs
to NAS
Support for manual

CSG ID selection
PLMN
selected
CSG ID
selected
NAS Control
Cell Selection
and Reselection
Radio measurements
Registration
Area
changes
Service requests
Location
Registration
Core Network Initiated Paging

The MME sends the PAGING message to each eNode B
with cells belonging to the tracking area(s) in which the UE
is registered.
Each eNode B can contain cells belonging to different
tracking areas, whereas each cell can only belong to one
TA.
MME
UEs use DRx when in idle mode in order to wake at regular

intervals to check for paging messages.
S1AP Paging message
TAC 2
The paging response back to the MME is initiated on NAS

layer and is sent by the eNB based on NAS-level routing
information.
TAC 1
RRC Paging message
30
7/2/2014
Paging Signaling
The MME initiates a paging message which is
sent to all eNodeBs in a tracking area(s)
MME
UEs use the Random

Access procedure to
initiate access to the
serving cell
S1AP:Paging
RRC PAGING
Random Access Procedure

NAS: Service Request
S1-AP: INITIAL UE MESSAGE (FFS)

+ NAS: Service Request
+ eNB UE signalling connection ID
NAS messaging
continues in order to
set up the call
RRC Signaling Connected Mode
31
7/2/2014
Signaling Radio Bearer (SRB) Establishment
RRC Connection SRB Establishment

MME
RRC_
CONNECTED
LTE
SIGNALLING RADIO BEARER 0
RRC
Connection
S1 BEARER
Signalling Connection
"Signalling Radio Bearers" (SRBs) are defined as Radio Bearers (RB)
that are used only for the transmission of RRC and NAS messages
32
7/2/2014
Signalling Radio Bearers (SRBs)

RRC
SRB0
SRB1
SRB2
PDCP
Signalling Radio Bearers (SRBs) are offered by the PDCP layer to the
RRC layer for transport of RRC (and NAS) messages
SRB0: Used for RRC messages on the CCCH

SRB1: Used for RRC and NAS messages on the DCCH
SRB2: Used for NAS messages, SRB2 has a lower-priority than
SRB1 and is always configured by E-UTRAN after security
activation.
RRC Connection Establishment

IE/Group Name
RRC Establishment Cause:
RRC IDLE
RRC Connection Request CCCH/ULSCH
IE type and reference

Emergency Call,
High Priority Access,
MT-Access,
MO-Signalling,
MO-Data
RRC Connection Request is initiated by

the higher layers in the UE
RRC Connection Setup

(C-RNTI is allocated)
RRC connection establishment

procedure creates the signaling radio
bearer SRB#1,
DLSCH RRC Connection Setup
RRC Connection Setup Complete DCCH/ULSCH

RRC
CONNECTED
NAS information for authentication

request is piggybacked to the RRC
Connection Setup Complete message
33
7/2/2014
Security Related Procedures

MME
INITIAL CONTEXT SETUP REQUEST

(Integrity Protection Algorithm EIA;
Ciphering Algorithm EEA;
Security Key)
2. Decide Algorithms,
Derive Keys
Activate Security for SRB
SECURITY MODE COMMAND(EEA;EIA)
SECURITY MODE COMPLETE

INITIAL CONTEXT SETUP RESPONSE
RRC Security Mode Command is triggered by the EPC (MME) at S1 signaling message Initial
Context Setup Request includes all security setting needed to start Integrity Protection of
the control plane signaling and Encryption of the both user plane and control plane signaling
(PDCP protocol).
Security setting includes Integrity Algorithm (EIA) Ciphering Algorithm (EEA) and Security key.
Counter Check Function

RRC COUNTER CHECK
Used by UTRAN to request from

the UE to verify the amount of data
sent/received for each DRB
RRC COUNTER CHECK RESPONSE
Additional security measures are added to LTE/SAE by adding Counter

check function UE is requested to check if, for each DRB, the most
significant bits of the COUNT match with the values indicated by E-UTRAN.
When RRC Counter Check is transmitted? Whenever eNB finds
the particular COUNT is exceeded than specific value eNB sends this
message if it suspects that new data is introduced by an intruder in any
DRB which are used for data transfer between UE and eNB.
34
7/2/2014

RRC COUNTER CHECK

Action UE will send Counter Check Response to eNB including:

- drb-CountInfoList,
- drb-Identity,
- counte-Uplick,
- count-Downlink
All IE's correspond to that specific COUNT value.
procedure enables E-UTRAN to detect packet insertion by an intruder

RRC COUNTER CHECK

procedure enables E-UTRAN to detect packet insertion by an intruder

Question Why needed to include an extra protection for intruder
detection? Isnt enough Integrity protection on security mode command?
Answer RRC Counter Check Procedure is part of Periodic local
authentication procedure in LTE in many countries regulations ciphering
the data over the Radio Interface is forbidden for National Security there
is a probability of the data connection being compromised by MAN in
MIDDLE attack.
35
7/2/2014
RRC UL/DL Transparent Messages

Information Transfer
RRC UL INFORMATION TRANSFER (NAS message)
RRC DL INFORMATION TRANSFER (NAS message)
purpose of this procedure transfer NAS or (tunneled) non-3GPP

dedicated information from the UE to E-UTRAN
UE Capability Transfer
RRC UE CAPABILITY ENQUIRY
RRC UE CAPABILITY INFORMATION

S1AP: UE Capability Info Indication
UE Capability Retreival - This procedure retreives UE Radio Capability from UE and provides
it the the MME.
Step 1 eNodeB requests the UE Radio Capability by sending RRC UE Capability Enquiry
message.
Step 2 UE responds to the eNodeB with requested UE Capability in teh UE Capability
Information message
Step 3 eNodeB forwards the received UE Radio Capabilities to teh MME in teh UE
Capability Info Indication
36
7/2/2014
Radio Link Failure RCS Algorithm

Second Phase
First Phase
Radio
problem
detection
Normal operation
no recovery during
T310
no recovery during
T311
RRC_Connected
Maximum number (counter
N310) of RLC
retransimssions is reached
Return to idle
RRC_IDLE
radio link failure
-> New RRC

Connection
Request
-> RRC Connection Reestablishment Request
RCS Algorithm procedure
Step 1 Upon "radio link problems detected, UE starts timer T310 - In case radio link
recovery happens before T310 expires the UE stops the timer T310 and continues in state
RRC Connected.
Step 2 T310 expires and no recovery takes place UE starts timer T311 and starts searching
for a new cell.
-If the UE finds a cell before T311 expires RRC Connection re-establishment procedure is
triggered.
- In case T311 expiries before UE finds a cell than the UE enters idle mode.
Radio Link Failure RRC Signaling

RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT
RRC CONNECTION RE-ESTABLISHMENT COMPLETE
Procedure:
A waiting timer is started in eNodeB when
- maximum number of RLC retransmissions has been reached, or
- maximum number of PDCCH Ordered Re-synchronization failure are
detected.
During this waiting timer, eNodeB expects from UE to trigger RRC
Connection Re-establishment Request message If no RRC
Connection Re-establishment Request is received during this time, UE is
released back to idle mode.
37
7/2/2014
Radio Link Failure
RRC CONNECTION RE-ESTABLISHMENT REQUEST
RRC CONNECTION RE-ESTABLISHMENT REJECT
What if eNodeB cannot handle the incoming RRC Connection Reestablishment Request ?
eNodeB will respond with RRC Connection Re-establishment Reject
message to the UE and initiate a UE release procedure towards MME.
RRC Signaling - RRC Mobility
38
7/2/2014
Measurement Configuration Message

RRC CONNECTION RECONFIGURATION
(Measurement configuration)
RRC CONNECTION RECONFIGURATION COMPLETE
E-UTRAN provides the measurement configuration (events to trigger,

thresholds, time to trigger, neighbors etc) applicable for a UE in
RRC_CONNECTED mode
This is accomplished by dedicated signaling message
RRC Connection Reconfiguration
Measurement Configuration Type of

Measurements
UE receives RRC Connection Reconfiguration message following

types of measurements might be requested:
- Intra-frequency measurements: (serving cell carrier frequency).
- Inter-frequency measurements: (neighbor cell measurements at different
carrier frequencies).
- Inter-RAT measurements of UTRA frequencies.
- Inter-RAT measurements of GERAN frequencies.
- Inter-RAT measurements of CDMA2000 HRPD or CDMA2000 1xRTT
frequencies.
39
7/2/2014
Measurement Configuration
Parameters (1)
Measurement objects:
- For intra-frequency and inter-frequency measurements: object is a
single E-UTRA carrier frequency. Associated with this carrier frequency, EUTRAN can configure a list of cell specific offsets and a list of blacklisted
cells.
- For inter-RAT UTRA measurements: object is a set of cells on a single
UTRA carrier frequency.
- For inter-RAT GERAN measurements: object is a set of GERAN
carrier frequencies.
- For inter-RAT CDMA2000 measurements: object is a set of cells on a
single (HRPD or 1xRTT) carrier frequency.
Parameters (2)
Reporting configurations:
- Reporting criteria: The criteria that trigger the UE to send a
measurement report. This can either be periodical or a single event
description.
- Reporting format: The quantities that the UE includes in the
measurement report and associated information (e.g. number of cells to
report).
40
7/2/2014
Parameters (3)

Measurement identities: A reference number

A list of measurement identities each measurement identity links one
measurement object with one reporting configuration.
Measurement identity is used as a reference number in the measurement
report.
Parameters (4)
Quantity configurations: defines the measurement quantities and

associated filtering used for all event evaluation and related reporting of
that measurement type. E.g. RSRP (Reference Signal Received Power) ,
RSRQ (Reference Signal Received Quality).
- quantity configuration for intra-frequency measurements,
- quantity configuration for inter-frequency measurements
- quantity configuration for RAT type.
One filter can be configured per measurement quantity
41
7/2/2014
Parameters (5)
Measurement gaps: Periods that UE may perform measurements, i.e. no

(UL, DL) transmissions are scheduled.
The measurement procedures for different types of cells:
-The serving cell.
-Listed cells - these are cells listed within the measurement object(s).
- Detected cells - these are cells that are not listed within the
measurement object(s) but are detected by the UE on the carrier
frequency(ies) indicated by the measurement object(s).
Measurement Reporting
UE performs measurements and reports back only when event criteria are met!
Examples:
Best Cell
Evaluation
-Event A3 A neighbour cell

becomes offset better than
serving cell
LTE
LTE
- Event A2 Serving cell

becomes worse than an
absolute threshold
LTE
LTE
42
7/2/2014
Measurement Reporting Triggering events
Best Cell
Evaluation
Examples:
-Event A3 A neighbour cell
becomes offset better than
serving cell
LT
E
LTE
LTE
LTE
- Event A2 Serving cell

becomes worse than an
absolute threshold
Measurement Reporting Criteria

Reporting criteria
Reporting threshold
Hysteresis
Time-to-trigger
Reporting interval
43
7/2/2014
Example
RRC Signaling Flow Attach Request
To be discussed in class ..
RRC Signaling Flow Example Attach Request

MME
1. System Information *
RRC IDLE
Cell
Select *
2. Random Access Preamble

3. Random Access Response
4. RRC CONNECTION REQUEST
5. RRC CONNECTION SETUP
RRC
CONNECTED
6. RRC CONNECTION SETUP COMPLETE (Attach Request)
7. INITIAL UE MESSAGE (Attach Request)
8.RRC DL INFORMATION TRANSFER (UE Identity Request)
DL NAS TRANSPORT (UE Identity Req)
9. RRC UL INFORMATION TRANSFER (UE Identity Response)
UL NAS TRANSPORT (UEid Response)
10.RRC DL INFORMATION TRANSFER (Authentication Request)

11. RRC UL INFORMATION TRANSFER (Authentication Response)
12. RRC DL INFORMATION TRANSFER (Security Mode Command)
13. RRC UL INFORMATION TRANSFER (Security Mode Complete)
15. RRC SECURITY MODE COMMAND
16.RRC SECURITY MODE COMPLETE
DL NAS TRANSPORT (Authentication)

UL NAS TRANSPORT (Auth. Response)
DL NAS TRANSPORT (NAS SMC)
UL NAS TRANSPORT (NAS SMC)
14. INITIAL CONTEXT SETUP REQUEST
(EPS bearers, Attach Accept, Security)
17. RRC UE CAPABILITY ENQUIRY

18. RRC UE CAPABILITY iNFORMATION
20. RRC CONNECTION RECONFIGURATION (Attach Accept, Bearer Setup)
21. RRC CONNECTION RECONFIGURATION COMPLETE
23. RRC UL INFORMATION TRANSFER (Attach Complete))
RRC IDLE
26. RRC CONNECTION RELEASE
19. UE CAPABILITY INFO INDICATION

(UE Radio Capability)
22. INITIAL CONTEXT SETUP RESPONSE
(EPS bearers)
UL NAS TRANSPORT (Attach Complete)
24. UE CONTEXT RELEASE COMMAND
25. UE CONTEXT RELEASE COMPLETE
44
7/2/2014
PDCP Protocol
PDCP Functions
45
7/2/2014
PDCP Architecture
TS 36.323
UE/E-UTRAN
Radio Bearers
PDCP-SAP
PDCP-SAP
...
PDCP
PDCP entity
PDCP entity
PDCP - PDU
RLC - SDU
...
RLC
RLC UM-SAP
RLC AM -SAP
PDCP Entity Architecture

E - UTRAN / UE
UE/E-UTRAN
Transmitting
PDCP entity
Receiving
PDCP entity
In order delivery and duplicate

Detection (U plane)
Sequence numbering
Header Compression
(user plane only)
Header Compression
(user plane only)
Ciphering
Packets associated
to a PDCP SDU
Integrity Verification
(control plane only)
Deciphering
Add PDCP header
Packets NOT associated

to a PDCP SDU
Integrity Protection
(control plane only)
Packets NOT associated

to a PDCP SDU
Packets associated
to a PDCP SDU
TS 36.323
Remove PDCP Header
Radio Interface (Uu)

46
7/2/2014
Sequence Numbering
Sequence numbering is used by several functions:
- Reordering of the PDCP PDUs at the receiver side

- Duplicate detection in case of packet forwarding at handover
-Calculation of COUNT, used for integrity protection and ciphering.
Sequence Numbering
WHY:
*
*
*
*
Reordering
Duplicate detection
Integrity protection
Ciphering
eNB
COUNT
SRB1_UL
SRB1_UL
COUNT
COUNT
SRB1_DL
SRB1_DL
COUNT
COUNT
DRB_UL
DRB_UL
UE
Ctx
COUNT
COUNT
DRB_DL
DRB_DL
COUNT
UE
HOW:
PDCP SN:
Next_PDCP_TX_SN
HFN
PDCP SN
TX_HFN
COUNT
47
7/2/2014
Header Compression
WHY:
HOW:
Saving the bandwith by

*removing redundant info
*Encoding important info
*Hop by Hop
*Unidirectional
Based on the Robust

Header Compression
(ROHC) framework
IETF RFC 3095
For Voice over IP, interactive games,

messaging etc, the payload of the IP
packet is sometimes even smaller than
the header.
UE/UE Context
Header
PDCP PDU
RB_UL
PDCP PDU
CRC
checksum covering the header before
compression is included in the compressed header
Compressed
Header
Contains
encoded data
RB_UL
PDCP PDU
Header
UE/UE Context
Security Handling Integrity &

Ciphering
Integrity protection:
- is implemented in the PDCP layer in order to ensure that the data origin
of the signaling data is indeed the one claimed.
- check also that received data has not been modified in an unauthorized
way.
Data encryption (ciphering): is to ensure that the user data cannot be
eavesdropped on the radio.
48
7/2/2014
3GPP TS 33.401
integrity protection key K_eNB_RRCInt
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
Which algorithm to use is decided by eNodeB by
during RRC security activation
WHY: To ensure data origin
Upper layer parameters (required by PDCP):

PDCP PDU
PDCP PDU
Header
- BEARER, defined as the radio bearer identifier,

(SRB1 will use the value RB identity 1)
PDCP SDU
COUNT
Direction
K_eNB_RRCInt
- KEY (KRRCint).
EIA
MAC-I
Bearer Id
Transmitter
WHY: To ensure data origin
PDCP PDU PDCP SDU

Header
PDCP PDU
PDCP PDU
Header
PDCP SDU
COUNT
Direction
K_eNB_RRCInt
EIA
MAC-I
PDCP PDU
PDCP SDU
XMAC-I
COUNT
Direction
K_eNB_RRCInt
EIA
Bearer Id
Bearer Id
MAC-I
Transmitter
PDCP PDU
Header
XMAC-I
Receiver
49
7/2/2014
Ciphering
3GPP TS 36.331
integrity protection key K_UPenc
-generated from KASME procedure during EPS Authentication and Key Agreement
(AKA) procedure.
- UE computes KASME based on Authentication Request message parameters.
WHY: To protect the data over radio
Required parameters by PDCP for

ciphering (3GPP TS 33.401):
DIRECTION
COUNT
BEARER
- COUNT
- DIRECTION (DL or UL)
KEYUPenc
LENGTH
EEA
- BEARER (defined as the radio bearer

identifier )
KEYSTREAM
BLOCK
- KEY (the ciphering keys for the control

plane and for the user plane are KRRCenc
and KUPenc, respectively).
PLAINTEXT
BLOCK
CIPHERTEXT
BLOCK
Sender
Ciphering
WHY: To protect the data over radio
COUNT
DIRECTION
BEARER
KEYUPenc
EEA0
EEA1
EEA2
COUNT
LENGTH
EEA
BEARER
KEYUPenc
KEYSTREAM
BLOCK
PLAINTEXT
BLOCK
DIRECTION
LENGTH
EEA
KEYSTREAM
BLOCK
PLAINTEXT
BLOCK
CIPHERTEXT
BLOCK
Sender
Receiver
50
7/2/2014
RLC Protocol
RLC Functions
3GPP TS 36.322
51
7/2/2014
RLC Sublayers
3GPP TS 36.322
3GPP TS 36.322
RLC Logical Channels
52
7/2/2014
RLC Modes
3GPP TS 36.322
RLC TM Entity
UE/ENB
ENB/UE
radio interface
TM-SAP
Transmission
buffer
TM-SAP
Transmitting
TM-RLC
entity
Receiving
TM-RLC
entity
No Header
BCCH/PCCH/CCCH
BCCH/PCCH/CCCH
- BCCH Broadcast Control Channel (System Information transfer)

- DL/UL CCCH Common Control Channel ( example: RRC Connection Request )
- PCCH Paging Control Channel (Paging)
53
7/2/2014
RLC Transparent Mode PDU
The RLC TM PDU introduces no overhead
TM is used for signaling on BCCH and
PCCH.
RLC UM Entity
UM RLC entity is supposed to carry user data payload for the time critical services
that tolerate a higher packet loss rate. Eg. Voice over IP.
RLC in Unacknowledged Mode is a licensed feature
54
7/2/2014
RLC Unacknowledged Mode PDU,

5 Bits SN
UMD PDU with 5 bit SN

(Odd number of LIs, i.e. K = 1, 3, 5, )
PDU with 5 bit SN

(Even number of LIs, i.e. K = 2, 4, 6, )
E
FI
SN
Extension Field
Framing Information
Sequence Number
RLC Unacknowledged Mode PDU,

10 Bits SN, cont

(Odd number of LIs, i.e. K = 1, 3, 5, )

(Even number of LIs, i.e. K = 2, 4, 6, )
E
FI
SN
Extension Field
Framing Information
Sequence Number
55
7/2/2014
RLC AM Entity
AM -SAP
Transmission
buffer
RLC control
SDU reassembly
Remove RLC header

Segmentation &
Concatenation
Retransmission
buffer
Reception
buffer & HARQ
reordering
Add RLC header

Routing
DCCH /DTCH
DCCH /DTCH
RLC Acknowledged Mode PDU
D/C
RF
FI
SN
LSF
SN
SO
SO
LI1
E
LI2 (if K>=3)
LIK-2
E
LIK-1
LI1
LI2
Present if
K >= 3
E
LIK-2
LIK-1
LIK
E
LIK
Padding
Data
Oct
Oct
Oct
Oct
Oct
Oct
Oct
1
2
3
4
5
6
7
Oct
Oct
Oct
Oct
Oct
Oct
[4.5+1.5*K-4]
[4.5+1.5*K-3]
[4.5+1.5*K-2]
[4.5+1.5*K-1]
[4.5+1.5*K]
[4.5+1.5*K+1]
Oct N
D/C
E
FI
LSF
P
RF
SN
SO
Data/Control
Extension Field
Framing Info
Last Segment Flag
Poll Bit
Resegmentation Flag
Sequence Number
Segment Offset
56
7/2/2014

Positive Acknowledgment

Negative Acknowledgment
57
7/2/2014
Information Element: E Bit

Extension bit indicates whether Data field follows or a set of E
field and LI field follows
Information Element: Length Indicator LI

Length Indicator (LI) field
The LI field indicates the length in bytes of

the corresponding data field element present
in the RLC data PDU delivered/received by
an UM or an AM RLC entity.
The value 0 is reserved.
58
7/2/2014
Information Element:
FI Framing Information Field
Segment Offset SO
The Segment Offset field indicates the
position of the AMD PDU segment in bytes

within the original AMD PDU.
The first byte in the Data field of the original
AMD PDU is referred by the SO field value
"000000000000000"
59
7/2/2014
Last Segment Flag LSF
Resegmentation Flag RF
Value
Description
AMD PDU
AMD PDU segment
60
7/2/2014
Information Element: Poll P

Polling bit field
Value
Description
Status report not requested
Status report is requested
Control Pdu Type CPT
61
7/2/2014
STATUS PDU
D/C
CPT
ACK_SN
ACK_SN
E1
NACK_SN
E1
E2
NACK_SN
NACK_SN
E1
E2
SOstart
SOstart
SOend
SOend
SOend
NACK_SN
D/C
CPT
E
SO
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
Oct
1
2
3
4
5
6
7
8
9
Data/Control
Control PDU Type
Extension Field
Segment Offset
STATUS PDU Fields
62
7/2/2014
MAC Protocol
3GPP TS 36.322
MAC Functions
63
7/2/2014
MAC Sublayers
3GPP TS 36.321
MAC Functions - UE Side

Upper layers
PCCH
BCCH
CCCH
DCCH
DTCH
Logical Channel Prioritization
(UL only)
(De-) Multiplexing
BCH
DL-SCH
Control
Random
Access Control
HARQ
PCH
MAC-control
UL-SCH
RACH
Lower layer
64
7/2/2014
MAC Functions eNodeb Side

MAC Control
CCCH
DCCH
DTCH
DCCH
DTCH
CCCH
PCCH
Scheduling / Priority
Handling
Control
DL-SCH HARQ
Feedback
HARQ
HARQ
UL-SCH HARQ
Feedback
PDCCH
PUCCH
SR
HARQ
Demultiplexing
Scheduler
Scheduling / Priority Handling
Multiplexing
BCCH
PCH BCH DL-SCH
MAC Function Location
65
7/2/2014
3GPP TS 36.321
MAC Transport Channels
MAC DL-SCH Transport Channel

3GPP TS 36.321
66
7/2/2014
Physical Channels
MAC Multiplexing
IP
via S1 or from
UEs stack
IP TCP
Payload
IP TCP
20B
e.g. 50 Byte
20B
20B
PDCP
Header Compression
& Ciphering
PDCP
2B
RLC
RLC
4B
Segmentation
concatenation
MAC
H
~3B
PDCP
PDCP
PDU
2B
Segmentation
RLC SDU
RLC
Concatenation
MAC
Multiplexing
e.g. 1460 Byte
~3B
PDCP SDU
Payload
20B
1B
2B
RLC SDU
RLC
PDU
Multiplexing (Padding)
MAC SDU (e.g. 599 Byte)

MAC
4B
L1
MAC SDU (e.g. 927 Byte)
Transport Block
Coding,
Interleaving,
Modulation
MAC
PDU
CRC
3B
67
7/2/2014
MAC PDU Structure

R/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L
sub-header
sub-header
sub-header
sub-header
MAC header
...
R/R/E/LCID/F/L R/R/E/LCID padding

sub-header
sub-header
MAC Control MAC Control

element 1
element 2
...
MAC SDU
LCID
E
R
F
L
MAC SDU
Logical Channel ID
Extension Bit
Reserved
Length Flag
Length
Padding
(opt)
MAC payload
MAC PDU
A MAC PDU header consists of one or more MAC PDU subheaders

Each subheader corresponds to either a MAC SDU (RLC PDU), a MAC
control element or padding.
MAC PDU Structure
LCID
Oct 1
R/R/E/LCID sub-header
R/R/E/LCID/F/LR/R/E/LCID/F/L R/R/E/LCID/F/L R/R/E/LCID/F/L

sub-header
sub-header
sub-header
sub-header
MAC header
...

sub-header
sub-header

element 1
element 2
MAC SDU
...
LCID
E
R
F
L
MAC SDU
Logical Channel ID
Extension Bit
Reserved
Length Flag
Length
Padding
(opt)
MAC payload
A MAC PDU subheader consists of the six header fields R/R/E/LCID/F/L except for the last
subheader in the MAC PDU and for fixed sized MAC control elements.
68
7/2/2014
MAC PDU Structure

Buffer Status Report (BSR) MAC control elements consist of either:
- Short BSR and Truncated BSR format: one LCG ID field and one corresponding Buffer Size
field, or
- Long BSR format: four Buffer Size fields, corresponding to LCG IDs #0 through #3.

sub-header
sub-header
sub-header
sub-header
MAC header
...

sub-header
sub-header

element 1
element 2
...
MAC SDU
LCID
E
R
F
L
MAC SDU
Logical Channel ID
Extension Bit
Reserved
Length Flag
Length
Padding
(opt)
MAC payload
MAC Control Elements

Buffer
Size #1
Buffer Size #0
LCG ID
Buffer Size
Oct 1
Short BSR
Buffer Size #1
Buffer
Size #2
Buffer Size #2
Buffer Size #3
Oct 1
Oct 2
Oct 3
Long BSR
MAC Control Element fields
- LCG ID: Logical Channel Group ID field identifies the group of logical
channel(s) which buffer status is being reported. The length of the field is 2 bits;
- Buffer Size: Buffer Size field identifies total amount of data available across all
logical channels of a logical channel group after the MAC PDU has been built
(scheduled) amount of data is indicated in number of bytes (including all data that
is available for transmission in the RLC layer and in the PDCP layer). The length of
this field is 6 bits
69
7/2/2014
MAC PDU Structure MAC SDUs

sub-header
sub-header
sub-header
sub-header
MAC header
...

sub-header
sub-header

element 1
element 2
MAC SDU
...
LCID
E
R
F
L
MAC SDU
Logical Channel ID
Extension Bit
Reserved
Length Flag
Length
Padding
(opt)
MAC payload
MAC Signaling Procedures

RANDOM ACCESS
70
7/2/2014
Channel Mapping
Downlink
MTCH MCCH
PCCH
BCCH
MIB
PCH
MCH
BCH
Uplink
DTCH DCCH
CCCH
DTCH
DCCH
CCCH
Logical Channels
type of information
(traffic/control)
SIB
DL-SCH
UL-SCH
RACH
Transport Channels
how and with what
characteristics
PDCCH
info
PMCH
PBCH
PDSCH PCFICH PDCCH
-meas for DL sched

-meas for mobility
-coherent demod
-half frame sync

-cell id
P-SCH
RS
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd
-HARQ info ACK/NACK
PHICH
-frame sync
-cell id group
S-SCH
-CQI
-ACK/NACK
-Sched req.
PUCCH
Physical Channels
PUSCH PRACH
-coherent demod
-measurements for
UL scheduling
RS
SRS
bits, symbols,
modulation, radio
frames etc
Physical Signals
only L1 info
MAC Signaling Procedures RANDOM ACCESS PROCEDURES

When???
- enable initial access - UE to E-UTRAN (CBRA)
- enable Handover access - UE to E-UTRAN (CFRA)
- establish UL synchronization (CFRA)
- Indicate presence of UL data (when not scheduled for long time) (CFRA)
71
7/2/2014
CBRA RANDOM ACCESS
Initial Access for RRC Connection Establishment
CBRA
Random Access CBRA (Contention

Based Random Access)
UE
When???
1.
- used at initial access (initialcall setup)

- subject to collision (ALOHA Protocol)
eNB
Random Access Preamble
(Randomly selected Preamble Id)
Random Access Response
3.
2.
RRC Connection Request
4.
Example
CBRA RANDOM ACCESS
To be discussed in class
72
7/2/2014
CBRA RANDOM ACCESS

eNodeB
rach-Configuration {
preambleInformation { numberOfRA-Preambles n64 },
powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4,
mac-ContentionResolutionTimer sf48 },
maxHARQ-Msg3Tx 1 },
RRC
MAC
UE randomly selects
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
MAC
If no answer is received within

ra-ResponseWindowSize preamble is
sent again based on
preambleInitialReceivedTargetPower + powerRampingStep
MAC
BCCH: System Information
RRC
PRACH: RACH preamble
MAC
MAC
PDCCH: RA-RNTI; Scheduling Grant;TA

DL-SCH: RACH response
(RAPID; TC-RNTI);
RA-RNTI = 1+ t_id + 10f_id

MAC allocate TC-RNTI
MAC
PUSCH: TC-RNTI
UL SCH: RA message3
If the UE sees its preamble, it

will respond with RRCConnectionReq
Including its 40 bit UE-id and Est.
Cause)
RRC
The 40-bit MAC "UE contention resolution

identity" is identical to the RRC Connection
Request sent in RA message 3.
CCCH: RRC Connection Request

(Initial UE identity, Cause)
RRC
PDCCH: TC-RNTI; Scheduling Grant

MAC
RRC
Use TC-RNTI to decode DL SCH. If the UE contention

resolution
identity MAC control element matches the RRC connection
request
message promote TC-RNTI to C_RNTI.
MAC
RRC
DL-SCH: C-RNTI; Contention Resolution MAC

CCCH: RRC Connection Setup
(SRB1 parameters)
The TC-RNTI is "promoted" to a C-RNTI,

i.e. the same 16-bit value
allocated for TC-RNTI
will continue to be used as C-RNTI
after the random access procedure
is successfully concluded.
RRC
UL-SCH: C-RNTI; BSR
MAC
DCCH: RRC Connection Setup Complete

(Selected PLMN id, NAS: Attach Request *)
RRC
CFRA RANDOM ACCESS

Handover Access
Random Access CFRA (Contention
Free Random Access)
CFRA
When???
UE
1.
- is used for UEs in handover
eNB
(Pre-allocated Preamble Id)
2.
- a special preamble is reserved

3.
4.
73
7/2/2014
CFRA RANDOM ACCESS

Handover Access
Cell 2
Cell 1
RRC: RACH -
ConfigDedicated
p UE1
UE1 is assigned preamble pUE1 by means of RRC

signalling via cell 1 which is the serving cell of UE1
CFRA RANDOM ACCESS

UE out_of_sync resynchronization process
Free Random Access)
CFRA
When???
UE
1.
- is used for UEs in re-synchronization

procedure when non scheduled.
- a special preamble is reserved
eNB
3.
2.
4.
74
7/2/2014
CFRA RANDOM ACCESS

Uplink re-synchronization
eNodeB
- UE is scheduled for downlink data from eNodeB uplink Scheduler

- UE is out_of_sync (unsynchonized) due to following event:
non scheduled time period > timeAlignmentTimer
and alignment expiration has occurred (UL timing adjustment process)
- eNodeB through PDCCH physical channel on downlink transmission
assigns a reserved preample to UE
- UE uses preample and starts CFRA process to get back synchronization.
PDCCH for DL
data arrival
CFRA RANDOM ACCESS

UE UL_Scheduling Request to eNodeb UL scheduler
Free Random Access)
CFRA
When???
UE
1.
- UE has data (overflowing) into buffer
eNB
- eNodeB has not scheduled UE since

long time
- UE requests scheduling using CFRA
random access procedure since it has
been UL out_of_sync
3.
2.
4.
- a special preamble is reserved from

eNodeb and signaled through PDCCH
75
7/2/2014
Example
CFRA RANDOM ACCESS
To be discussed in class ...
CFRA RANDOM ACCESS

rach-Configuration {
preambleInformation { numberOfRA-Preambles n64 },
powerRampingParameters { powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104 },
ra-SupervisionInformation { preambleTransMax n10,
ra-ResponseWindowSize sf4,
mac-ContentionResolutionTimer sf48 },
maxHARQ-Msg3Tx 1 },
eNodeB
RRC
BCCH: System Information
RRC
no PUCCH resources
no UL Synch (TAT is not running)
has repeated SR on PUCCH max no of times
UE randomly selects
one of the 64 preambles and send it based on
preambleInitialReceivedTargetPower
MAC
MAC
If no answer is received within

ra-ResponseWindowSize preamble is
sent again based on
preambleInitialReceivedTargetPower + powerRampingStep
If the UE sees its preamable, it
will respond with Scheduling Request
by sending msg3 containing MAC
control elements( BSR and/or PHR)
and identified by C-RNTI
MAC
MAC
RA-RNTI = 1+ t_id + 10f_id

MAC allocate TC-RNTI
PDCCH: RA-RNTI; Scheduling Grant;TA
DL-SCH: RACH response
MAC
MAC
(RAPID; TC-RNTI);
MAC
MAC
PUSCH: C-RNTI
UL SCH: msg3 (BSR,
PHR)
PDCCH: C-RNTI; Scheduling Grant
C-RNTI provides contention resolution
Use C-RNTI to decode DL SCH..

MAC
RLC
UL-SCH: C-RNTI; BSR

DTCH/DCCH:
Scheduled Unicast Transmission
MAC
MAC
MAC
RLC
76
7/2/2014

UL Time Alignment

UL Time Alignment
Problem statement:
Different UEs within a cell will experience different propagation delay
to/from the cell site, depending on their exact position within the cell
coverage area.
Normally transmit timing is based
only on the timing of the received
downlink timing as a result their
corresponding uplink transmissions
will thus arrive at the cell site with
potentially very different timing.
UE 2
UE 1
Receive-timing differences might be too large orthogonality between

uplink transmissions of different UEs will not be retained subcarriers will
be out_of_sync OFDM orthogonality is lost !!! .
77
7/2/2014

UL Time Alignment
Solution:
A mechanism with an active uplink transmit-timing control is needed to
ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism:
R
- network measures received uplink timing

of the different UEs.
Timing Advance Command
Oct 1
- adjusts (advance (+) command or retard

() command) transmit timing on a certain
amount.
- timing-control commands are transmitted
as higher-layer signaling (MAC) to the
UEs.
UE 2
UE 1

UL Time Alignment
Solution:
A mechanism with an active uplink transmit-timing control is needed to

ensure that uplink transmissions from different UEs are received with
approximately the same timing at the cell site
transmit-timing control mechanism:
Timing Advance Command
Oct 1
- UE has a configurable timer,

timeAlignmentTimer,
- used to control how long the UE is considered
uplink time aligned.
- When timer expires and no timing control
command is received (non scheduled UE)
CFRA Random Access process is needed
UE 2
UE 1
- timeAlignmentTimer is valid only in the cell

for which it was configured and started .
78
7/2/2014

MAC Scheduler

MAC Scheduler
79
7/2/2014

MAC Scheduler Blocks

MAC Scheduler
Time-frequency
fading, user #1 data1
data2
data3
Time-frequency
data4
fading, user #2
Channel dependant scheduler

- Adapts UE rate to channel conditions
User #1 scheduled
User #2 scheduled
80
7/2/2014

Scheduled Channels
Downlink
Uplink
UL Scheduling
DL Scheduling
BCCH
MIB
PCCH DTCH
DCCH
CCCH
DTCH
CCCH
DCCH
type of information
(traffic/control)
SIB
PCH
BCH
Logical Channels
RACH
UL-SCH
DL-SCH
Transport Channels
how and with what
characteristics
-Sched TF DL
-Sched grant UL
-Pwr Ctrl cmd PDCCH
-HARQ info
info
PBCH
PDSCH
ACK/NACK
PCFICH PHICH
PDCCH
-CQI
-(N)ACK
-Sched req.
Physical Channels
PUCCH PUSCH
PRACH
bits, symbols,
modulation, radio
frames etc
Physical Signals
RS
S-SCH
P-SCH
SRS
RS
only L1 info

Scheduled DL Resources
Scheduler
One Scheduling Block

SBs
Link Adaptation
Two RBs
SINR
f
MIMO
0.5ms
0.5ms
180 kHz
1 ms
t | +1 703 281 3525

Copyright Eogogics Inc | www.eogogics.com
81
7/2/2014

UL Scheduler
eNodeB
eNodeB
Buffer
Scheduler
Buffer
Multiplexing
Scheduler
Uplink channel quality
UE
TF selection
CQI
Status
Modulation, coding
UE
Downlink
channel quality
Modulation, coding
Priority handling
Multiplexing
Buffer
Downlink
Buffer
Uplink

MAC Scheduler
82
7/2/2014

HARQ

HARQ
LTE protocols over IP/ethernet transmission (Link Layer (ethernet), Network
layer (IP) and transport network protocols (TCP, UDP)) are not prepared to
recover from packet header bit errors and packet payload errors.
Although channel dependant MAC Scheduler adjusts scheduling to UE
channel conditions, BER unrecovery conditions might still be a problem that
might introduce large amount of retransmissions over the air interface
One potential solution might be the propagation of BER recovery functions to
higher layer protocols however it might introduce unaccepted delays
Another potential solution might be the choice to discard and fast retransmit
the entire data unit containing bit errors Physical layer Turbo coding correct
errors on receiver and CRC check BER to decide.....
LTE 3GPP standards define two layers of retransmission protection. HARQ on
MAC and ARQ on RLC
83
7/2/2014
HARQ (MAC) and ARQ (RLC)

RLC SDUs
BLER ~10-6
RLC
UL ARQ
Transmitter
RLC Status
Sliding Window ARQ
UL ARQ
Receiver
RLC PDUs
RLC PDUs
BLER ~10-4 to 10-3
RLC Status
(DL HARQ data)
BLER ~10-4 to 10-3
MAC
DL HARQ
Receiver
UL HARQ
Transmitter
Stop and Wait HARQ
BLER ~10-1
UL HARQ
Receiver
DL HARQ
Transmitter
Transport Block +CRC

BLER ~10-1
Uplink L1
Downlink L1

Accessibility Preamples
84
7/2/2014
Random Access Procedure
RA Preamble Assignment

CBRA
Contention Based
Random Access
Process Steps
CFRA
Contention Free
Random Access
Process Steps
Scheduled Transmission (MSG3)
HARQ
Contention Resolution (MSG4)
HARQ
Uplink Open Loop Power Control

1) UE measures RS
RBS
UE
3) The power is ramped up until a response is heard

or maximum number of re-attempts is reached
Max uplink cell power
Power step
Data
preambleInitial power
Uplink
(PRACH)
...
...
...
preamble
0.8 ms
Downlink
(PDCCH)
...
Indicates RA Response on PDSCH

(Not UE specific)
RA-RNTI
...
subframe
1 ms
...
RA response window
RAPID
Downlink
(PDSCH)
RACH Preamble
...
RA msg 3
RACH Response
No Response
Timing (UL timing)

Scheduling Grant
85
7/2/2014
Random Access KPIs Using Drive Test

Random Access Success:
#RaSuccCbra
False Preamble probability:
X 100
#RaAttCbra
#RaAttCbra - #RaSuccCbra
Measurement period
RBS
Exercises
RRC Signaling UE Log Traces
86
7/2/2014
Mobility Case Studies

Signaling on E-Utran
Mobility Case X2 Handover

Simplified mobility
MME
SGW
LTE Node B
LTE NodeB
X2
X2
LTE Node B
scheme to handle the

most common
scenario
Forwarding of user
data on X2 interface
(Selective
Forwarding)
After handover is
completed, EPC is
informed and the
route is optimized
87
7/2/2014
X2 Handover
S-GW
Source eNB
MME
Target eNB
1. RRC CONNECTION RECONFIGURATION
RRC
CONNECTED
(Bearer Setup,Measurement conf))

2. RRC Measurement Report
(Event A3)
3. HO
Decision
4. X2 HANDOVER REQUEST
5.Admission
Control
TRELOCprep
ACKNOWLEDGE
8. Start Data
forwarding
T304
7. X2 SN STATUS TRANSFER
9. Buffer
Forwarded
Data
(Handover Command,Measurement conf)

Regenerate
Security Keys
11 MAC: CFRA Random Access Preamble

12. MAC Random Access Response (UL allocation + TA)
(Handover Complete)
14.Data Transfer in Target

RRC
CONNECTED
21. Forward if any

Data in transition
and release
15. S1 PATH SWITCH REQUEST

16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
19. S1 PATH SWITCH RESPONSE
20. X2 UE CONTEXT RELEASE
Handover Flow
1. Measurement Command message is included in RRC Connection
Reconfiguration message.
2. criteria event A3 is fulfilled UE will inform the source eNB by
sending Measurement Report.
3. Source eNB makes a handover decision based on Measurement
Report and RRM
88
7/2/2014
Handover Flow
4. Source eNB issues a X2 - Handover Request message to the target
eNB passing necessary information to prepare the HO
- UE X2 signaling context reference at source eNB,
- UE S1 EPC signaling context reference,
- target cell ID,
- KeNB,
- RRC context including the C-RNTI of the UE in the source eNB,
- AS-configuration,
- E-RAB context and physical layer ID of the source cell + MAC for
possible RLF recovery).
UE X2 / UE S1 signaling references enable the target eNB to address the
source eNB and the EPC.
E-RAB context includes also necessary RNL and TNL addressing
information, and QoS profiles of the E-RABs.
X2- Handover Request
89
7/2/2014
X2 Handover
S-GW
Source eNB
MME
Target eNB
RRC
CONNECTED

(Event A3)
3. HO
Decision
5.Admission
Control
TRELOCprep
ACKNOWLEDGE
8. Start Data
forwarding
T304
9. Buffer
Forwarded
Data

Regenerate
Security Keys

(Handover Complete)

RRC
CONNECTED
21. Forward if any

Data in transition
and release

16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
Handover Flow
5. AC (Admission Control) is performed by the target eNB
AC dependents on the received E-RAB QoS information
Target eNB configures the required resources according to the received ERAB QoS information - reserves a C-RNTI and optionally a RACH
preamble.
90
7/2/2014
Handover Flow
6. Target eNB prepares HO with L1/L2 and sends X2 - Handover
Request Acknowledge to the source eNB.
Message includes transparent container to be sent to the UE as an RRC
message (RRC Connection reconfiguration) to perform the handover.
Container includes:
- new C-RNTI,
- target eNB security algorithm identifiers for the selected security
algorithms,
- dedicated RACH preamble.
X2 Handover Request Ack
91
7/2/2014
Handover Flow
7. Source eNB sends SN STATUS TRANSFER message to the target
eNB
Reason: Inform RLC AM about uplink PDCP SN receiver status includes at least the PDCP SN of the first missing UL SDU and may
include a bit map of the receive status of the out of sequence UL SDUs
that the UE needs to retransmit in the target cell if there are any such
SDUs
Reason: Inform RLC AM about downlink PDCP SN transmitter status of
E-RABs includes next PDCP SN that the target eNB shall assign to
new SDUs, not having a PDCP SN yet.
X2 Handover
S-GW
Source eNB
RRC
CONNECTED
MME
Target eNB

(Event A3)
3. HO
Decision
5.Admission
Control
TRELOCprep
ACKNOWLEDGE
8. Start Data
forwarding
T304
9. Buffer
Forwarded
Data

Regenerate
Security Keys

(Handover Complete)

RRC
CONNECTED
21. Forward if any

Data in transition
and release

16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
92
7/2/2014
Handover Flow
8. Data forwarding is initiated
9. Target eNB buffers received DL data until the UE access the new cell.
10. Source eNB forwards RRC message RRC Connection
Reconfiguration included on X2 - message Handover Request
Acknowledge (includes mobilityControlInformation to the UE).
- source eNB performs necessary integrity protection and ciphering of the
message UE receives RRC Connection Reconfiguration
message with necessary parameters.
RRC Container, Extract

RRCConnectionReconfiguration message
RRCConnectionReconfiguration-r8-IEs {
measConfig
mobilityControlInfo
radioResourceConfigDedicated
securityConfigHO
MobilityControlInfo ::=
targetPhysCellId
carrierFreq
carrierBandwidth
additionalSpectrumEmission
t304
O
O
O
ENUMERATED { ms50, ms100, ms150, ms200, ms500, ms1000,
ms2000, spare1},
C-RNTI,
newUE-Identity
radioResourceConfigCommon
rach-ConfigDedicated
ra-PreambleIndex
ra-PRACH-MaskIndex
INTEGER (0..63),
INTEGER (0..15)
5 MHz
CarrierBandwidthEUTRA ::=
SEQUENCE {
dl-Bandwidth ENUMERATED
ul-Bandwidth ENUMERATED
CarrierFreqEUTRA ::=
dl-CarrierFreq
ul-CarrierFreq
SecurityConfigHO ::=handoverType CHOICE {
intraLTE {
securityAlgorithmConfig
keyChangeIndicator
nextHopChainingCount
},
interRAT {
securityAlgorithmConfig
nas-SecurityParamToEUTRA
{ n6, n15, n25, n50, n75, n100}

{n6, n15, n25, n50, n75, n100}
O
O
BOOLEAN,
93
7/2/2014
Handover Flow
11. UE synchronizes to target eNB (Check MAC protocol slides, CFRA
Handover Access) and accesses the target cell via RACH
- following a contention-free procedure (dedicated RACH preamble was
indicated in the mobility Control Information content of RRC
Connection Reconfiguration message)
- following a contention-based procedure if no dedicated preamble was
indicated. UE derives target eNB specific keys and configures the
selected security algorithms to be used in the target cell.
12. The target eNB responds with UL allocation and timing advance .
13. UE successfully accessed target cell UE confirms handover
sending
- RRC Connection Reconfiguration Complete message
- C-RNTI
- uplink Buffer Status Report (BSR), whenever possible
X2 Handover
S-GW
Source eNB
RRC
CONNECTED
MME
Target eNB

(Event A3)
3. HO
Decision
5.Admission
Control
TRELOCprep
ACKNOWLEDGE
8. Start Data
forwarding
T304
9. Buffer
Forwarded
Data

Regenerate
Security Keys

(Handover Complete)

RRC
CONNECTED
21. Forward if any

Data in transition
and release

16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
94
7/2/2014
14. Target eNB starts data transmission to UE
Handover Flow
15. target eNB sends an S1: PATH SWITCH message to MME to inform
that the UE has changed cell.
Handover Flow
16. MME sends an UPDATE USER PLANE REQUEST message to the
Serving Gateway
17. Serving Gateway switches the downlink data path to the target side
S-GW sends one or more "end marker" packets on the old path to the
source eNB and then can release any U-plane/TNL resources towards
the source eNB .
18. Serving Gateway sends an UPDATE USER PLANE RESPONSE
message to MME.
19. MME confirms the PATH SWITCH message with the PATH SWITCH
ACKNOWLEDGE message.
95
7/2/2014
S1 Path Switch Request Acknowledge
X2 Handover
S-GW
Source eNB
RRC
CONNECTED
MME
Target eNB

(Event A3)
3. HO
Decision
5.Admission
Control
TRELOCprep
ACKNOWLEDGE
8. Start Data
forwarding
T304
9. Buffer
Forwarded
Data

Regenerate
Security Keys

(Handover Complete)

RRC
CONNECTED
21. Forward if any

Data in transition
and release

16. S5 USER PLANE
UPDATE REQ
18. S5 USER PLANE
UPDATE RSPONSE
96
7/2/2014
Handover Flow
20. Target eNB informs successful handover accomplishment of HO to
source eNB (sending UE CONTEXT RELEASE) this message
triggers the release of resources by the source eNB.
21. source eNB can release radio and C-plane related resources
associated to the UE context
Mobility Case S1 Handover

S1 handover:
MME
SGW
MME
LTE NodeB
SGW
Relocation of MME or
SGW
Handover to UTRAN or
GSM
Change of MME pool
area
Signalling is done via EPC
and does not assume the
existance of an X2
interface.
Similar to inter-RAT
handover
Forwarding of user data
either directly between
eNodeB or in-direct via SGW (Selective Forwarding)

97
7/2/2014
Handover Events
S1 Handover
Source
Source eNB
eNB
RRC
CONNECTED
Target
Target eNB
eNB
S-GW
S-GW
MME
MME
Source
Target
Source
Target

(Event A3)
3. HO
Decision
4. S1 HANDOVER REQIRED
(Source to Target Transparent Container )
5. S10 FORWARD RELOCATION

REQUEST
6. S11 CREATE SESSION REQ/RES
7. S1 HANDOVER REQUEST
TS1RELOCprep
8. Admission
Control
9. S1 HANDOVER REQUEST ACKNOWLEDGE
12. S1 HANDOVER COMMAND
T304

11. S11 CREATE BEARER REQ/RES RESPONSE
UP Forwarding

Regenerate
Security Keys

17. S1 HANDOVER NOTIFY
(Handover Confirm)
20. S1 UE CONTEXT RELEASE

COMMAND
(Cause: Successful Handover)
RRC
CONNECTED

COMPLETE/ ACK
98
7/2/2014
Exercises
Mobility Scenarios
Evolved Packet Core (EPC)
99
7/2/2014
EPS Interfaces
3GPP TS 23.401
EPC/LTE Architecture - 3GPP

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
100
7/2/2014
LTE/EPC Interfaces
S1: interface between an eNodeB and an EPC provides an
interconnection point between the EUTRAN and the EPC. It is also
considered as a reference point.
- S1-MME: Reference point for the control plane protocol between E-UTRAN
and MME.
- S1-UP : Reference point for the transport for data streams on the S1
interface between E-UTRAN and SGW using the GTP-U protocol
Interface between eNodeB ( X2) provides capability to support radio
interface mobility between eNodeBs, of UEs having a connection with EUTRAN.
X2 interface enables inter-connection of eNodeBs and support of
continuation between eNodeBs of the E-UTRAN services offered via the S1
interface

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
101
7/2/2014
LTE/EPC Interfaces
Interface between MME and HSS (S6a-interface) used to exchange data
related to the location of the mobile station and to the management of the
subscriber (capability to transfer packet data within the whole LTE service
area), using Diameter S6a/S6d Application signaling.
1. MME informs HSS about location of a mobile station managed by the latter.
2. HSS sends to the MME all the data needed to support the service to the
mobile subscriber.
Exchanges of data may occur when
- mobile subscriber requires a particular service,
- mobile subscriber wants to change some data attached to his subscription
- some parameters of the subscription are modified by administrative means.

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
102
7/2/2014
LTE/EPC Interfaces
Interface between MME and S-GW (S11-interface) used to support
mobility and bearer management between the MME and S-GW
Interface between MME and MME (S10-interface) used to support user
information transfer and MME relocation support between the MMEs
Interface between S-GW and PDN-GW (S5 and S8-interface)
interfaces between S-GW and PDN-GW, provides support for functions for
packet data services towards end users during roaming and non-roaming
cases (i.e. S8 is the inter PLMN variant of S5).

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
103
7/2/2014
LTE/EPC Interfaces
Interface between MME and SGSN (S3-interface) enables user and
bearer (DRB) information exchange for inter 3GPP access network mobility in
idle and/or active state
Interface between S-GW and SGSN (S4-interface) provides related
control and mobility support between GPRS Core and the 3GPP Anchor
function of Serving GW. In addition, if Direct Tunnel is not established, it
provides the user plane tunnelling
Interface between PCEF - PCRF/H-PCRF/V-PCRF (Gx Reference Point)
provides transfer of policy and charging rules from PCRF to Policy and
Charging Enforcement Function Point (PCEF) in the GW
Interface from PDN-GW to packet data networks (SGi reference point)
reference point between the PDN-GW and a packet data network. It may
be:
- operator external public or private packet data network or
- an intra operator packet data network, e.g. for provision of IMS services
Basic EPC Architecture

IMS
OFCS
OCS
Gz
Gy
External
IP networks
SGi
Rx
PCRF
S9
HSS
Gx
Gxc
S6a
PDN GW
S5/S8
Serv GW
S11
MME
S10
S1-MME
S1-U
eNB
X2
LTE
104
7/2/2014

eNodeB LTE Radio Base Station. Provide Wireless access to the

UE
MME Mobility Management Entity. Management of subscriptionrelated data for each UE accessing over the LTE-RAN
HSS Home Subscriber Server. User data repository for UEs

accessing over the LTE-RAN
Ser GW Serving Gateway. In charge of user data traffic comming

from the UEs. Interfaces the eNodeBs
PDN GW Packet Data Network Gateway. Anchor point to

interconnect external IP networks

PCRF Policy and Charging Rules Function. Contains
policy control decision and flow-based charging control

functionalities.
OFCS Offline Charging System. Post-processing of
CDRs.
OCS Online Charging System. Real time charging.
105
7/2/2014
The EPC (SAE) Interfaces S3

S3 Interface
IP networks
enables user and bearer

information exchange for inter
3GPP access network mobility
in idle and/or active state.
Gx
HSS
Based on Gn reference point

as defined between SGSNs.
HLR
Protocol: GTP-C
Gr
PCRF
SGi
S6a
SAE GW
PDN GW
S5
S4
Serv GW
S11
SGSN
MME
S3
S10
Gb
S12
Iu-C
S1-U
S1-C
3G
2G
LTE

S4 Interface
IP networks
Provides related control and

mobility support between
GPRS Core and the 3GPP
Anchor function of Serving GW
Gx
HSS
Is based on Gn reference
point as defined between
SGSN and GGSN.
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
In addition, if Direct Tunnel is

not established, it provides the
user plane tunnelling.
S5
S4
Serv GW
S11
Protocol: GTP-C / -U
SGSN
MME
S3
S10
Gb
Iu-C
S12
S1-C
2G
3G
S1-U
LTE
106
7/2/2014
The EPC (SAE) Interfaces S5/S8

IP networks
Gx
HSS
PCRF
SGi
S5/S8 Interface
HLR
S6a
Provides user plane tunnelling and tunnel

management between Serving GW and
PDN GW.
SAE GW
Gr
PDN GW
Serv GW
S11
SGSN
Used for Serving GW relocation due to UE

mobility and if the Serving GW needs to
connect to a non-collocated PDN GW for
the required PDN connectivity.
S5/S8
S4
S3
MME
Protocol: GTP (or PMIPv6)
S10
Gb
Iu-C
S1-U
S1-C
3G
2G
S5 is used in non-roaming scenario (i.e.

Serving GW and PDN GW in visited
network)
S12
S8 is used in roaming scenario (i.e.

Serving GW in visited network and PDN
GW in home network).
LTE
The EPC (SAE) Interfaces S6a
IP networks
S6a Interface
Gx
Enables transfer of
subscription and authentication
data for
authenticating/authorizing user
access to the evolved system
(AAA interface) between MME
and HSS.
HSS
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
Protocol: Diameter.
S5
S4
Serv GW
S11
SGSN
MME
S3
S10
Gb
Iu-C
S12
S1-C
2G
3G
S1-U
LTE
107
7/2/2014
The EPC (SAE) Interfaces - Gx

IP networks
Gx
HSS
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
Serv GW
S11
SGSN
Gx Interface
S5
S4
provides transfer of (QoS) policy and

charging rules from PCRF to Policy and
Charging Enforcement Function (PCEF) in
the PDN GW.
MME
S3
S10
Gb
Iu-C
Protocol: DIAMETER
S12
S1-U
S1-C
3G
2G
LTE

IP networks
Gx
HSS
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
Serv GW
S11
SGSN
S3
MME
S10
Gb
Iu-C
Protocol: GTP-C
S12
S1-C
2G
3G
S10 Interface
Reference point between MMEs for MME
relocation and MME to MME information
transfer.
S1-U
LTE
108
7/2/2014

IP networks
Gx
HSS
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
SGSN
S3
S11 Interface
Serv GW
S11
MME
Reference point between MME and

Serving GW.
S10
Protocol: GTP-C
Gb
Iu-C
S12
S1-U
S1-C
3G
2G
LTE

IP networks
Gx
HSS
PCRF
SGi
HLR
S6a
SAE GW
Gr
PDN GW
S5
S4
Serv GW
S11
SGSN
MME
S3
S10
Gb
Iu-C
S12
S1-C
2G
3G
S12 Interface
Reference point between UTRAN and
Serving GW for user plane tunnelling when
Direct Tunnel is established.
S1-U
Protocol: based on the Iu-u/Gn-u

reference point using the GTP-U protocol
as defined between SGSN and UTRAN
LTE
109
7/2/2014
The EPC (SAE) Interfaces - SGi

IP networks
Gx
HSS
SGi
SGi Interface
HLR
S6a
SAE GW
Reference point between the PDN GW

and the packet data network.
Gr
PDN GW
Serv GW
S11
SGSN
Packet data network may be an operator

external public or private packet data
network or an intra operator packet data
network, e.g. for provision of IMS services.
S5
S4
MME
S3
This reference point corresponds to Gi

and Wi functionalities and supports any
3GPP and non-3GPP access systems
S10
Gb
Iu-C
S12
S1-U
S1-C
3G
2G
PCRF
LTE
The EPC (SAE) Interfaces - SGs

IP networks
Gx
HSS
SGi
HLR
SAE GW
Gr
Iu
S11
SGSN
SGs Interface
PDN GW
Reference point between the MME in EPC

network and MSC/VLR in circuit switch
nework (2G/3G).
Serv GW
SCTP based interface.
SGs
MSC
PCRF
S6a
MME
S3
S10
Gb
Iu-C
S12
S1-C
2G
3G
S1-U
LTE
110
7/2/2014
EPC Core Protocols

IP networks
HLR/HSS
SGi
Gr
Rx
S6a
S4
SGSN
S3
MME
PDN GW
S11
Gx
S5
PCRF
Serving
GW
S10
Gb
Iu CP
Iu UP
S1-MME
BSC
RNC
BTS
Node B
S1-U
Iur
eNodeB
2G
3G
X2
LTE
111
7/2/2014

LTE Uu
S1-MME
NAS
S11
NAS
S5/S8
Relay
RRC
RRC
S1AP
S1AP
GTP-C
GTP-C
GTP-C
PDCP
PDCP
SCTP
SCTP
UDP
UDP
UDP
RLC
RLC
IP
IP
IP
IP
IP
MAC
MAC
L2
L2
L2
L2
L2
L1
L1
L1
L1
L1
L1
L1
SGW
PGW
UE
eNodeB
MME
X2
S10
X2AP
X2AP
GTP-C
GTP-C
SCTP
SCTP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L1
eNodeB
eNodeB
MME
MME
EPS User & Control Plane
112
7/2/2014
EPS User Plane Protocols

LTE Uu
S1-U
S5/S8
SGi
Application
IP
PDCP
RLC
MAC
L1
UE
IP
Relay
Relay
PDCP
GTP-U
GTP-U
GTP-U
GTP-U
RLC
UDP
UDP
UDP
UDP
IP
IP
IP
IP
L2
L2
L2
L2
L1
L1
L1
L2
L1
L1
MAC
L1
eNodeB
X2*
SGW
GTP-U
GTP-U
UDP
UDP
IP
IP
L2
L2
L1
L1
eNodeB
PGW
* X2 User plane used
to support Data
forwarding at intra
LTE handover
eNodeB
S1 Protocol
113
7/2/2014
S1 Interface
Radio
Network
Layer
Transport
Network
Layer
Control Plane
S1-AP
Transport Network
User Plane
User Plane
User Plane
PDUs
Transport Network
User Plane
GTP-U
SCTP
UDP
IP
IP
Data link layer
Data link layer
Physical layer
Physical layer
S1 Interface
Two types of S1 interfaces are defined at the boundary depending on the
EPC access point:
S1-MME towards an MME
S1-U towards an S- GW.
There may be multiple S1-MME logical interfaces towards the EPC from
any one eNB. The selection of the S1-MME interface is then determined by
the NAS Node Selection Function.
There may be multiple S1-U logical interfaces towards the EPC from any
one eNB. The selection of the S1-U interface is done within the EPC and
signaled to the eNB by the MME.
114
7/2/2014
S1 Application Protocol (S1-AP)
S1-AP
S1-AP
SCTP
SCTP
IP
IP
L2
L2
L1
L1
eNodeB
S1-MME
MME
S1AP: eNBMME Signaling

E-RAB Management
Initial Context Transfer Function
Common ID management
UE Capability Info Indication Function
Mobility Function for UEs in LTE_ACTIVE
Paging
S1 Interface Management Functions
MME
NAS signaling Transport between UE and MME

S1 UE Context Release Function
UE Context Modification Function
Status Transfer
Trace Function
Location Reporting
S1 CDMA 2000 Tunneling Function
Warning Message Transmission Function
115
7/2/2014
S1-AP Functions
Initial Context Transfer function: This functionality is used to
- establish an S1-UE context in the eNB,
- to setup the default IP connectivity,
- to setup one or more E-RAB(s) if requested by the MME,
- transfer NAS signaling related information to the eNB if needed.
Signaling Flow
The E-RAB Modify procedure signal flow
UE
eNB
MME
List of RABs and corresponding

QoS Profile to be modified
aswell as an optional NAS
message per RAB
E-RAB MODIFY REQUEST

RRC: Connection Reconf.
RRC: Connection Reconf. complete
E-RAB MODIFY RESPONS
Contains a list of all successfully

modified RABs and possibly a
list of all RABs that failed to be
modified
Includes the optional NAS

message Radio Modify Setup
Note that this RRC procedure is
not always triggered
116
7/2/2014
S1-AP Functions
UE Capability Info Indication function: This functionality is used to
provide the UE Capability Info when received from the UE to the MME.
Mobility Functions for UEs in LTE_ACTIVE in order to enable a change
of eNBs within SAE/LTE (Inter MME/Serving S-GW Handovers) via the S1
interface (with EPC involvement).
Paging: This functionality provides the EPC with the capability to page the
UE.
S1-AP Functions
S1 interface management functions comprise the following:
-Reset functionality to ensure a well defined initialization on the S1
interface.
-Error Indication functionality to allow a proper error reporting/handling in
cases where no failure messages are defined.
-Overload function to indicate the load situation in the control plane of the
S1 interface.
-Load balancing function to ensure equally loaded MMEs within an MME
pool area.
-S1 Setup functionality for initial S1 interface setup for providing
configuration information.
- eNB and MME Configuration Update functions are to update application
level configuration data needed for the eNB and MME to interoperate
correctly on the S1 interface.
117
7/2/2014
S1-AP Functions
NAS Signaling transport function between the UE and the MME is
used:
- to transfer NAS signaling related information and to establish the S1 UE
context in the eNB.
- to transfer NAS signaling related information when the S1 UE context in
the eNB is already established.
S1 UE context Release function: This functionality is responsible for
managing the release of UE specific context in the eNB and the MME.
UE Context Modification function: This functionality allows modification
of the established UE Context in part.
Status Transfer: This functionality transfers PDCP SN Status information
from source eNB to target eNB in support of in-sequence delivery and
duplication avoidance at intra LTE handover.
S1-AP Functions
Trace function: This functionality is to control a trace recording for a UE in
ECM_CONNECTED.
Location Reporting: This functionality allows MME to be aware of the
UEs current location.
S1 CDMA2000 Tunneling function: This functionality is used to carry
CDMA2000 signaling between UE and CDMA2000 RAT over the S1
Interface.
Warning message transmission function:
This functionality provides the means to start and overwrite the
broadcasting of warning message.
118
7/2/2014
S1AP Elementary Procedures, Class 1
119
7/2/2014
120
7/2/2014
X2 Interface
eNodeB Interfaces X2
The interface between eNodeB
Mainly used to support active mode UE
mobility
May also be used for multi-cell Radio
Resource Management (RRM) functions
X2-CP interface will consist of a signalling
protocol called X2-AP on top of SCTP
The X2-UP interface is based on GTP-U
The X2-UP interface will be used to
support loss-less mobility (packet
forwarding).
The X2 interface is a many-to-many interface.
MME/GW
S1
S1
X2
eNode B
S1
X2
eNode B
eNode B
121
7/2/2014
X2 Protocol Model
Radio
Network
Layer
Transport
Network
Layer
Control Plane
User Plane
User Plane
PDUs
X2-AP
Transport Network
User Plane
Transport Network
User Plane
GTP-U
UDP
SCTP
IP
IP
Data link layer
Data link layer
Physical layer
Physical layer
X2AP: eNBeNB Signaling
Mobility Management
Load Management
Reporting of General Error Situations
Resetting the X2
Setting up the X2
eNodeB Configuration Update
122
7/2/2014
X2AP Functions
Intra LTE-Access-System mobility support for ECMCONNECTED UE
allows the eNB to handover the control of a certain UE to another eNB.
Context transfer from source eNB to target eNB
allows the transferring of information required to maintain the E-UTRAN
services for an UE in ECM-CONNECTED from source to target eNB.
Control of user plane transport bearers: source eNB target eNB
allows the establishing and releasing unique transport bearers between
source and target eNB during DL/UL data forwarding phases.
Handover cancellation
informs already prepared target eNB for a canceled pre-decided handover
execution releases resources allocated during preparation phase
X2AP Functions
UE context release in source eNB
allows target eNB to trigger release of UE allocated resources
in source eNB.
Load Management
allows exchanging overload and traffic load information
between eNBs for traffic load management. (according to
3GPP information may be spontaneously sent to selected
neighbor eNBs or reported as configured by a neighbor
eNB).
Inter-cell interference coordination (Feature)
allows keeping inter-cell interference under control
neighboring eNBs exchange appropriate information
allowing eNBs assign resources (PRB) to control
interference.
123
7/2/2014
X2AP Functions
Uplink interference load management
indicates uplink interference overload and resource blocks
especially sensitive to inter-cell interference between
neighboring eNBs leads to Neighbor eNBs resource
allocation co-ordination to mutually mitigate interference
caused by their uplink radio resource allocations.
Downlink interference avoidance
allows eNB to inform its neighbors about downlink power
restrictions in its own cells, per resource block, for
interference aware scheduling by the neighbor eNBs.
General X2 management and error handling functions
allow management of signaling associations between eNBs,
surveying X2 interface and recovering from errors.
X2AP Functions
Error indication
allows reporting of general error situations on application level.
Reset
allows eNB1 to inform X2 neighbor eNB2 about:
- recovering from an abnormal failure
- all contexts related to eNB1 and stored in eNB2 shall be
deleted, and the associated resources released.
Trace functions
UE trace recoding sessions on E-UTRAN interfaces initiated by
EPC. The trace initiation information is also propagated to
the Target eNB during handover, attached to certain
handover messages on X2.
Application level data exchange between eNBs
allows eNBs to exchange application level data during setting
up X2 connection and update this information any time.
124
7/2/2014
X2AP Elementary Procedures, Class 1
X2AP Elementary Procedures, Class 2
125
7/2/2014
SCTP
SCTP
SCTP (Stream Control Transmission Protocol) can be
used as the transport protocol for applications where

monitoring and detection of loss of session is required.
It is according to IETF RFC2960 and IETF RCF3309.
Used by S1-AP, X2-AP and Diameter (S6a, S10, Gx
and Rx)
126
7/2/2014
SCTP
SCTP is a transport layer protocol that provides
reliable, in-sequence transport of messages with

congestion control mechanisms.
SCTP is also a connection-oriented protocol that
maintains a relationship between the end points of an

SCTP association for the duration of the message
transmission.
SCTP is designed to transport telecommunications
signaling messages over Internet Protocol (IP)

networks.
SCTP Concepts
Primary destination IP5
PORT

PORT
2905
2905
IP4,IP5,
IP6,IP7
IP1,IP2,IP3
Primary destination IP1
Message (sequenced delivery)

IP1,IP2
Inbound/outbound stream
PORT
2905
SCTP
endpoint
SCTP Association
127
7/2/2014
SCTP Terminology
SCTP Association: An SCTP association is a logical connection

between two SCTP end points.
SCTP End Point: An SCTP End Point is the logical sender and
receiver of SCTP packets.
Heartbeat: The heartbeat is an SCTP message sent on an SCTP

association to monitor the availability of the paths to the remote
addresses of the SCTP association.
Stream: A stream is a sequence of user messages within a single

SCTP association.
Multi Homing: An SCTP association is multi homed if it supports

multiple IP addresses or interfaces at a given SCTP end point.
SCTP Terminology
Primary and Secondary Addresses: A multi homed
SCTP association has one primary address that is used

for receiving data.
remaining supported addresses are secondary
addresses that are spare addresses for the event the

primary address becomes unreachable.
SCTP does not support load sharing between the
multiple addresses of an SCTP association.
128
7/2/2014
SCTP Terminology
SCTP Client and Server: SCTP is used for both client
and server applications in the SGSN-MME.

Example: SGSN-MME acts as an SCTP server when
communicating with the eNodeB SCTP clients over the

S1-MME interface, whereas the SGSN-MME acts as an
SCTP client when communicating with Home Subscriber
Server (HSS) over the S6a interface.
SCTP datagram: The unit of data that constitutes an
SCTP message. Each datagram consists of a common

header followed by one or more chunks. Each chunk
may contain either user data or SCTP control
information. There are a limited set of chunk types
defined in SCTP.
SCTP Singe-Homed to MultiHomed SCTP End Point
129
7/2/2014
SCTP - Multi-Homed SCTP End Point
SCTP Services
SCTP offers the following services to its users:
- Acknowledged error-free non-duplicated transfer of user data
- Data fragmentation to conform to configured Maximum Transmission Unit
(MTU) size
- Sequenced delivery of user messages within multiple streams, with an
option for order-of-arrival delivery of individual user messages
- Optional bundling of multiple user messages into a single SCTP packet
- Network-level fault tolerance through support of multi-homing at either end
or at both ends of an association
130
7/2/2014
SCTP Procedure for Initializing an Association

SCTP uses the heartbeat mechanism to avoid half-open states (one end of
a connection has closed without the knowledge of the other end point).
Heartbeat mechanism: sending a heartbeat message to the inactive remote
addresses of the host. The SCTP user can choose the set of addresses on
which the heartbeat mechanism is to be performed.
Association Establishment
- initiated by the SCTP client sending a datagram with a INIT chunk.
- state cookie sent from SCTP server to SCTP client as part of the INIT ACK
chunk.
- SCTP client returns the received state cookie by sending a datagram with a
COOKIE ECHO chunk to the SCTP server.
-SCTP server can now safely create the server side of the association and
finalize the four-way handshake by sending a datagram with a COOKIE ACK
chunk to the SCTP client that creates the client side of the association.
SCTP Procedure for Initializing an Association

basic service offered by SCTP is the reliable transfer of user messages
between peer SCTP users.
SCTP performs this service using an association between two SCTP end
SCTP Node 2
points
SCTP Node 1
Create Association
(destination, # stream)
Communication UP
(assocID)
Communication UP
(assocID)
SCTP entity
SCTP entity
INIT
PortID
PortID
INIT ACK
COOKIE ECHO
SCTP
SCTP
IP1,IP2
IP3,IP4,IP5
COOKIE ACK
IP R
IP R
IP Network
IP R
IP R
IP R
131
7/2/2014
SCTP Message Types

CHUNK TYPES:
ID value
0
1
2
3
4
5
Chunk type (SCTP message name)

Payload data (DATA)
Initiation (INIT)
Initiation Acknowledgement (INIT ACK)
Selective Acknowledgement (SACK)
Heartbeat Request (HEARTBEAT)
Heartbeat Acknowledge (HEARTBEAT ACK)
6
7
8
9
10
11
12
13
Abort (ABORT)
Shutdown (SHUTDOWN)
Shutdown Acknowledgement (SHUTDOWN ACK)
Operation error (ERROR)
State Cookie (COOKIE ECHO)
Cookie Acknowledgement (COOKIE ACK)
Reserved for Explicit Congestion Notification Echo (ECNE)
Reserved for Congestion Window Reduced (CWR)
14
15- 255
Shutdown Complete (SHUTDOWN COMPLETE)

Reserved by IETF for future expansion of the protocol
SCTP Message Structure

Source Port
Destination Port
Verification Tag
Flags
Common
Header
Check Sum
Type
SCTP
Length
CHUNK 1
User Data
Type
Flags
Length
CHUNK 1
User Data
Type
Flags
Length
CHUNK n
User Data
132
7/2/2014
SCTP Payload Data
Type=0
Reserved U|B|E
Chunk Length
TSN
Stream identifier S
Stream Sequence number N
Payload protocol identifier

User data ( Sequence N of stream S)
NAS
133
7/2/2014
NAS
NAS
NAS
Relay
RRC
S1-AP
RRC
PDCP
S1-AP
SCTP
RLC
RLC
IP
IP
MAC
MAC
L2
L2
L1
L1
L1
PDCP
UE
LTE-Uu
eNodeB
SCTP
L1
S1-MME
MME
NAS Functions
NAS protocol supports
-
mobility management functionality

user plane bearer activation, modification and deactivation.
ciphering and integrity protection of NAS signaling.
Attach: The Attach procedure is initiated by the UE to announce its

presence in the network. On completion, the UE is in the EMMREGISTERED state.
UE Requested PDN Connectivity Procedure: PDN Connectivity

Request procedure is used by the UE during an attach to request
the setup of a default EPS bearer to a PDN.
134
7/2/2014
NAS Functions
Authentication: The EPS authentication procedure provides mutual

authentication between the user and the network. For an EPS
subscriber authentication information is collected (if needed) from
the HSS and verified during the Authentication procedure. The
procedure is always initiated and controlled by the network.
TAU: The Periodic TAU procedure is used by the UE to notify the

network about its existence and to show that it is functioning
properly.

Service Request: The Service Request procedure is used to

change the state of the MM context to ECM-CONNECTED, to allow
the UE to send or receive desired data.
Detach: The Detach procedure is used to detach the UE from the

network. It is initiated by the UE or the network. On completion of the
Detach procedure, the UE is in the EMM-DEREGISTERED state
and cannot send and receive data.
SG Application Part
135
7/2/2014
SGs AP
SGs Application Part (SGsAP) protocol sends messages over the SGs
interface.
SCTP supports transferring of the SGsAP signaling messages.
SG AP Protocol
Summary SGsAP procedures over the SGs interfaces (3GPP TS 29.118):
Paging for Non-EPS Services Procedure

used by MSC/VLR to send paging request to the SGSN-MME. Paging is
only supported when the Service indicator IE indicates "SMS indicator".
Other paging requests are rejected.
Location Update for Non-EPS Services Procedure

used by SGSN-MME to initiated location update procedure towards the
Home Subscriber Server (HSS). The procedure is triggered by a
combined attach request or a combined tracking area update request from
the User Equipment (UE).
Non-EPS Alert Procedure

used by the MSC/VLR to request an indication from the SGSN-MME when
any signaling activity from the UE is detected.
136
7/2/2014
SG AP Protocol
Explicit IMSI Detach from EPS Services
This procedure used by the SGSN-MME to indicate to the

MSC/VLR that the UE has been detached from EPS
services. The SGs association between the MSC/VLR and
the SGSN-MME is deactivated for the UE.
Explicit IMSI Detach from Non-EPS Services
This procedure is used by the SGSN-MME to indicate to the

MSC/VLR that the UE has performed IMSI detach from the
non-EPS services.
SGs association between the MSC/VLR and the SGSNMME is deactivated for the UE.
SG AP Protocol
Implicit IMSI Detach from Non-EPS Services
used by SGSN-MME to indicate when an internal SGSNMME timer mechanism has caused the SGSN-MME to
delete EPS Mobility Management (EMM) context of a UE.
VLR Failure Procedure
used by MSC/VLR to inform the associated MMEs about a

restart, and that the SGs associations are no longer reliable
because the MSC/VLR has lost information about the state
of the UEs and during the failure the MSC/VLR might have
missed signaling messages.
137
7/2/2014
GTP GPRS Tunneling Protocol
What is Tunneling in Networks?

Network use a tunneling protocol when one
network protocol (usually the delivery

protocol should encapsulate a different payload
protocol for:
- carrying a payload over an incompatible deliverynetwork,
- provide a secure path through an untrusted
network.
Notice that typically, delivery protocol could
operate at an equal or higher OSI layer in the

model than does the payload protocol.
138
7/2/2014
GTP
GPRS Tunneling Protocol (GTP) is the protocol between GSN nodes in

the GPRS backbone network. Includes both the GTP signaling (GTP-C)
and data (GTP-U) transfer procedures.
In EPC it will be used on S1-U,S10,S11,S4,S5/S8 and S3.
Always in a connection there is a user-plane connection (S1-U, X2-U)

that requires a GTP-U (User payload) tunnel across the EPC Backbone
Network and a GTP-C (Control Signaling) tunnel.
GTP packets use the User Datagram Protocol (UDP) as the transport
protocol. Both signaling and payload are carried on the same ports. The
GTP packets contain a message type field that allows the GTP
protocol to distinguish signaling from payload.
GTP GPRS Tunneling Protocol

GTP
Node A
GTP
Node B
GTP I/F
TEID=yyy
Destination Port:
GTPv2-C=2123
GTPv1-U=2152
Protocol ID:
UDP=17
GTP
UDP
GTP TUNNEL
TEID=xxx
GTP
UDP
IP Address = AAA
IP
IP
IP Address = BBB
L1/L2
L1/L2
GTP TUNNEL
Identified in each node by:
[TEID, IP-addr, Port number]
S12
UTRAN
S16
SGSN
MSC
Server
Sv
CDMA
2000
HRPD
PDSN
S101
All interfaces are GTPv2C only, except:

S4
S1-U, S12, X2
(only GTPv1-U)
S4, S5/S8 (both)
S3
MME
S11
S10
X2
S1-U
SGW
HRPD High Rate Packet Data

PDSN Packet Data Serving Node
S5/S8
GTP
TEID
PGW
GPRS Tunneling Protocol

Tunnel Endpoint Identifier
139
7/2/2014
What is TEID in GTP??

GPRS tunneling protocol (GTP) stack assigns a unique tunnel endpoint
identifier (TEID) to each GTP control connection to the peers.
GTP stack also assigns a unique TEID to each GTP user connection
(bearer) to the peers. The TEID is a 32-bit number field in the GTP
(GTP-C or GTP-U) packet
GTP
GTP tunnel is uniquely identified in a given node by the combination of:
IP-addresses + UDP port number + Tunnel Endpoint Identifier
(TEID)
Tunnel is bi-directional two TEIDs, one in each end
GTP-U user plane (S1-U, X2-U), there is a one-to-one relationship
between a tunnel and a bearer there may be multiple user plane
tunnels associated with a given UE.
GTP-C control plane (S10, S11, S4, S5/S8 S3) there always one tunnel
associated with a given UE between two nodes.
140
7/2/2014
GPRS Tunnelling Protocol (GTP-U)

User Plane:
Application
IP
IP
Relay
Relay
PDCP
GTP-U
GTP-U
GTP-U
PDCP
GTP-U
RLC
RLC
UDP/IP
UDP/IP
UDP/IP
UDP/IP
MAC
MAC
L2
L2
L2
L2
L1
L1
L1
L1
L1
L1
LTE-Uu
S1-U
UE
eNodeB
S5/S8
a
Serving GW
SGi
PDN GW
GTP-U is indeed a framing protocol which allows multi-protocol packets to be tunneled

through the EPC Backbone to provide a service for carrying user data packets .
GTP-C Protocol Stack
GTP
GTP
UDP
UDP
IP
IP
L2
L2
L1
L1
GTPv2 entit y
GTPv2 entity
GTPv2 based
interface
141
7/2/2014
GTP-C v2: MMESGW PGW

Signaling
PGW
MME
Path Management
Tunnel Management
Mobility Management
CS Fallback and SRVCC related msgs
Non 3GPP related msgs
MME
SGW
GTP Message Types

Path Management
142
7/2/2014
Path Management Messages

Echo Request
Echo Response
ECHO Request
ECHO Response
ECHO Request
T3-RESPONSE
N3-REQUESTS
PGW
ECHO Response
MME
ECHO Request
MME
ECHO Response
T3-RESPONSE
N3-REQUESTS
SGW/
T3-RESPONSE
N3-REQUESTS
GTP-C v2: MMESGW PGW

Signaling
Session Creation:
E-UTRAN Initial Attach
UE requested PDN connectivity
S5/S8
GTP-C is also used to convey:
-Tracking Area Update procedure with Serving GW change
-S1/X2-based handover with SGW change
-UTRAN Iu mode to E-UTRAN
Inter RAT handover with SGW change
S11
Create Session Request (QoS)
PGW
MME -GERAN A/Gb mode to E-UTRAN Inter RAT handover with SGW change
SGW
-3G Gn/Gp SGSN
to MME
combined
handover and SRNS relocation
Create
Session
Requesthard
(QoS)
procedure
-Gn/Gp SGSN to MME Tracking Area Update procedure
143
7/2/2014
GTP-C MME SGWPGW
TS 29.274
Message Type value

(Decimal)
Message
GTP-C
SGSN/MME to PGW (S4/S11, S5/S8)

32
Create Session Request
33
Create Session Response
34
Modify Bearer Request
35
Modify Bearer Response
36
Delete Session Request
37
Delete Session Response
EPC Geographical Parameters
144
7/2/2014
Network Structure
Geographical Parameters
Tracking Area
A Tracking Area (TA) is a geographical domain that
consists of one or more cells.

Size of a TA can range from a part of a city to an entire
province.
TA can be covered by one or multiple MMEs, if MME pool
is used.
UE can move between different TAs within the MME area
without having to change MME.

Network Structure
Tracking Area
All TAs served by the same MME (TAs UE could enter
without initiation a Tracking Area Update (TAU)

procedure) are listed in a Tracking Area Identity (TAI) list.
When the UE leaves the TAI list coverage area it has to
initiate the TAU procedure.

Tracking Area Identity is constructed from the MCC
(Mobile Country Code), MNC (Mobile Network Code) and

TAC (Tracking Area Code)
145
7/2/2014
Network Structure
Tracking Area
A sub domain name shall be derived from the MNC and
MCC by adding the label "tac" to the beginning of the

Home Network Realm/Domain
The TAI FQDN shall be constructed as:
tac-lb<TAC-low-byte>.tac-hb<TAC-highbyte>.tac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
The TAC is a 16 bit integer. <TAC-high-byte> is the
hexadecimal string of the most significant byte in the TAC
and <TAC-low-byte > is the hexadecimal string of the
least significant byte. If there are less than 2 significant
digits in <TAC-high-byte> or <TAC-low-byte >, "0" digit(s)
shall be inserted at the left side to fill the 2 digit coding.
Tracking Area - Multiple Tracking Areas

UEs belong to multiple TA
1.
UE belongs to TA1, TA3 and TA2.

The UE can move within TA1, TA2 and TA3
without TA update.
2.
The UE will perform a TA update when

moving to a cell withinTA4.
3.
After succesful TA update in TA4 the UE will

belong to TA2, TA3 and TA4
TA1
TA2
MME
TA3
TA4
TA list 1:
- TA1
- TA2
- TA3
TA list 2:
- TA2
- TA3
- TA4
..........
146
7/2/2014
Network Structure
MME Pool Area 3GPP optional feature
An area where the UE is served without having to change the serving

MME. An MME pool area is served by one or more MMEs working in
parallel in a pool constellation. MME pool areas are a collection of
complete TAs
MME pool is a group of MMEs that serve a number of eNodeBs.

Each MME in a pool serves the same pool service area or pool
service areas, and the eNodeBs in the respective pool service area
are connected to each of the MMEs in the pool.
A pool service area consists of several TAs served by eNodeBs. As

long as a UE remains in the pool service area, it is attached to a
specific MME. If the MME is unavailable, the eNodeB reroutes the
signalling for the attached UE to another MME in the pool.
MME Pool Area

Pool Service Area
MMEs in Pool
147
7/2/2014
Network Structure
MME Pool Area Planning hints
MME pool service area should be generally larger than a
single MME service area thus network experiences

fewer Inter-MME Tracking Area Update (TAU) procedures
and reduced signaling to the Home Subscriber Server
(HSS) and the Serving Gateway.
Increase the pool capacity add more MMEs to the
pool area connected to all eNodeBs in the pool service

area loadsharing algorithms will distribute eNodeBs
traffic to the new MMEs.
Network Structure
SGW Service Area
An area where the UE is served without having to change
SGWs.
SGW service area is served by one or more SGWs in
parallel.
SGW service areas are a collection of complete TAs.
SGWs service areas may overlap each other.
148
7/2/2014
SGW Service Area

Before: S+P-GW
After: P-GW only
SGW
MME
MME
S10
MME
MME
MME
IP PoP
PGW
S5
SGW SGW SGW
SGW
S-GW
MME
MME
MME
MME
MME
SGW
SGW
SGW
SGW Service area is an area where the UE is served without having

to change SGW
MME/SGW relocation occurs primarily only when moving between
MME Pool Areas/SGW service area.
The IP Point of Presence (IP PoP) is fixed in the originally selected
PDN GW
EPC Identities
149
7/2/2014
E-UTRAN Identities - Overview

Inside E-UTRAN environment a general protocol id shall
uniquely identify a logical connection associated to a UE

over the S1 (MME) interface or X2 (eNodeB) interface.
These ids are used during signalling message interactions.
Example: Receiving a setup new message containing a
new id from sending node, receiving node shall store the AP

ID of the sending node for the duration of the logical
connection Receiving node shall assign the allocated id
as a logical connection identification in the first returned
message to the sending node.

eNB UE S1AP ID:
shall be allocated to uniquely identify the UE over the S1
interface within an eNB.
Example:
- When MME receives an eNB UE S1AP ID it shall store it
for the duration of the UE-associated logical S1connection for this UE.
- Once known to an MME this IE is included in all UE
associated S1-AP signaling.
- Remember: eNB UE S1AP ID is unique within the eNB
logical node.
150
7/2/2014

MME UE S1AP ID:
shall be allocated so as to uniquely identify the UE over the
S1 interface within the MME.
Example:
- When an eNB receives MME UE S1AP ID it shall store it
for the duration of the UE-associated logical S1connection for this UE.
- Once known to an eNB this IE is included in all UE
associated S1-AP signaling.
- Remember: MME UE S1AP ID is unique within the MME
logical node.

Old eNB UE X2AP ID:
Old eNB UE X2AP ID shall be allocated so as to uniquely
identify the UE over the X2 interface within a source eNB.
Example:
- When a target eNB receives an Old eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to a target eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: Old eNB UE X2AP ID is unique within the
eNB logical node.
151
7/2/2014

New eNB UE X2AP ID:
shall be allocated so as to uniquely identify the UE over the
X2 interface within a target eNB.
Example:
- When a source eNB receives a New eNB UE X2AP ID it
shall store it for the duration of the UE-associated logical
X2-connection for this UE.
- Once known to source eNB this IE is included in all UE
associated X2-AP signaling.
- Remember: New eNB UE X2AP ID shall be unique within
the eNB logical node.

eNB1 Measurement ID:
shall be allocated so as to uniquely identify the
measurement configuration over the X2 interface within
the eNB that requests the measurement.
The eNB1 Measurement ID shall be unique within the eNB
logical node.
152
7/2/2014

eNB2 Measurement ID:
shall be allocated so as to uniquely identify the
measurement configuration over the X2 interface within
the eNB that performs the measurement.
eNB2 Measurement ID shall be unique within the eNB
logical node.
EPC PLMN Identity - GUTI

Globally Unique Temporary UE Identity (GUTI)
The purpose of the GUTI is
to provide an unambiguous identification of the UE that
does not reveal the UE or the user's permanent identity in
the Evolved Packet System (EPS).
- To allow the identification of the MME and network.
-
Example: Since Attach, TAU and Service Request signaling

is sent non-ciphered, a temporary identity, GUTI or STMSI, is used instead of IMSI in most cases.
153
7/2/2014
Identity - GUTI
Globally Unique Temporary UE Identity (GUTI)
A new GUTI will always be allocated at UE Attach
In 2G/3G networks P-TMSI is used which is locally (national-wide)

unique.
GUTI is globally unique No GUTI collisions can occur due to inter

MME roaming.
GUTI and P-TMSI have no relation to each other

Example: when UE moves from 3G to LTE, a new GUTI is allocated by
the MME independent on the existing 3G allocated P-TMSI + old PTMSI is sent to the MME as if it was a GUTI
Identity - GUTI
GUTI Structure
GUTI has two main components:
-
one that uniquely identifies the MME which allocated the

GUTI known as GUMMEI
one that uniquely identifies the UE within the MME that

allocated the GUTI known as M-TMSI
154
7/2/2014
Identity - GUTI
GUTI Structure
Globally Unique MME Identifier <GUMMEI> = <MCC> + <MNC> + <MMEI>.
where <MMEI> = (MME Group ID <MMEGI>) + (MME Code <MMEC>).
<GUTI> = <GUMMEI> + <M-TMSI>.

Attach TAU signaling UE leaves a pool service area (Attach or TAU)
to a new MME outside the pool service area target MME extracts
GUMMEI of serving MME from UE GUTI.
New (target) MME uses this GUMMEI to query the DNS for the address of
the serving (old) MME and fetches the UE context from the old MME.
Identity - GUTI
GUTI Structure- Hints
Paging purposes: mobile is always paged with the S-TMSI S-TMSI

shall be constructed from the MMEC and the M-TMSI.
<S-TMSI> = <MMEC> + <M-TMSI>
The operator shall need to ensure that the MMEC is unique within the
MME pool area and, if overlapping pool areas are in use, unique within
the area of overlapping MME pools.
The GUTI shall be used to support subscriber identity confidentiality, and,

in the shortened S-TMSI form, to enable more efficient radio signalling
procedures (e.g. paging and Service Request).
155
7/2/2014
GUTI, S-TMSI
GUTI
MCC / MNC
(3)
MMEGI
(2)
MMEC
(1)
M-TMSI
(4)
MMEI
GUMMEI
S-TMSI
MMEC
(1)
M-TMSI
(4)
GUTI provides unique identification of the UE that does not reveal

the UE or the user's permanent identity
Mobile is paged with the S-TMSI
EPC PLMN Identity

Globally eNodeB id
used to globally identify an eNodeB
E-UTRAN Cell Global Identifier ECGI id
used to globally identify a cell
E-RAB ID
uniquely identifies an E-RAB for one UE accessing via E-UTRAN.
156
7/2/2014
Identities
Not more than 15 digits
3 digits
2 or 3
MCC
MNC
MSIN
NMSI
IMSI
Mobile Country Code (MCC) .
Mobile Network Code (MNC).
Mobile Subscriber Identification Number (MSIN)
Identities
Country Code. National Destination Code . Subscriber

Number
CC
NDC
SN
National (significant)
mobile number
Mobile station international
ISDN number
157
7/2/2014
Identities
eNodeB S1-AP UE Identity (eNB S1-AP UE ID)
This is the temporary identity used to identify a UE on

the S1-MME reference point within the eNodeB. It is
unique within the eNodeB.
MME S1-AP UE Identity (MME S1-AP UE ID)
This is the temporary identity used to identify a UE on

the S1-MME reference point within the MME. It is unique
within the MME.
Case Studies
EPC Mobility Cases
158
7/2/2014
Thank You!
Please take a moment

to complete the evaluation forms
provided by the instructor.
Thank you for participating

in this class. See you in
the next class!
Eogogics Inc. provides technical and soft-skills training and consulting services
to businesses and government clients in the US and abroad. The Eogogics
principals include seasoned executives who have been involved with exciting,
landmark projects. Our courses are developed by industry veterans with 15+
years experience. They are taught by instructors who are among the most
knowledgeable, experienced, and dynamic available anywhere today.
Eogogics Inc.
www.eogogics.com or www.gogics.com
Phone: +1-703-281-3525, 1 (888) 364-6442 toll free in the US * Email: sales@eogogics.com
159

Course - LTE-EPC Signaling - 14 July 2 Eogogics

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Course - LTE-EPC Signaling - 14 July 2 Eogogics

Caricato da

Copyright:

Formati disponibili

7/2/2014

Knowledge That Powers Organizations!

LTE/EPC Signaling Course

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Knowledge That Powers Organizations!

Learn Technologies from the Team That

Our Skill Set

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

LTE Advanced System Techniques LTE ADV 4 days

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

LTE/EPC 3GPP Standards

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Mobile Systems Evolution

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

From existing WCDMA/GSM networks

Fixed and wireless

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Network simplification, shared resources

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving forces for LTE/EPC

Fewer payload carrying nodes between

Lower cost per transmitted bit

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving forces for LTE/EPC

High throughput to enable advanced services

More efficient radio utilization (new modulation

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Driving Forces for LTE/EPC

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

User plane directly

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

SAE/LTE Releases: Evolution Steps

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

SAE/LTE Release 8 Evolution Steps

(not user plane

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

3GPP Project Coordination Group (PCG)

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

3GPP LTE and SAE Work Items

LTE: Long Term Evolution

SAE: System Architecture Evolution

36.300 E-UTRA overall description

36.401 E-UTRA Architecture Description

36.101 UE radio transmission and reception (FDD)

24.301 NAS Protocol for Evolved Packet System (EPS)

All specifications can be found on the

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

EPS Overview Architecture

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

idle mode moblity

handles the charging

Radio Bearer control,

Copyright Eogogics Inc | www.eogogics.com | +1 703 281 3525

Evolved Packet System (EPS) &

PCRF: Policy and Charging Rules Function

EPC: Evolved Packet Core

SGW: Serving Gateway

UE: User Equipment

EUTRAN: Evolved UTRAN

eNodeB: Enhanced Node B

VLR: Visitor Location Register

LTE Uu: LTE UTRAN UE Interface