LTE Architecture and LTE Attach

  • 26,818 views
Uploaded on

Describes key network elements and interfaces of LTE architecture. The steps of LTE/EPC Attach procedure are also illustrated.

Describes key network elements and interfaces of LTE architecture. The steps of LTE/EPC Attach procedure are also illustrated.

More in: Technology , Business
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
  • Hi Ali,

    I am also from Turkey. Thank you for the slides, they are great. Especially the Identity parts with local examples:) I wonder if you are doing a research or working on LTE in telecomm. company.
    Are you sure you want to
    Your message goes here
  • Hi Irfan, you did a good job explaining the concepts very clearly. I have one question in my mind, couldn't find clear diagram or answer yet, see if you can help me. I am looking for signalling flow diagram or steps when UE is turned on and goes to idle. You have covered overall attach procedure. But can you explain how UE goes through selecting the cell, reading/decoding all information on DL from PSS, SSS, MIB, SIBs etc. and then how it starts UL procedure to get authenticated. What is the last step when it completes everything and just remain idle. Please explain if it attaches to network and after authentication, it releases RRC connection, just looking for that sequence and diagram which goes from turning on to idle. Thanks!!
    Are you sure you want to
    Your message goes here
  • @KAMAR86 3gpp ko bhej do aap
    Are you sure you want to
    Your message goes here
  • Hi Ali hope your are doing well .. i need to ask lots of thing so i share my mail id please drop me a test mail so i can contact you ( manojdev_21@yahoo.co.in )
    Are you sure you want to
    Your message goes here
  • @aliirfan04 Dear Ali,

    Thank you for you slide,

    I am interested in LTE netwrok and having some doubt about the LTE network structure. How can i contact you ser?

    thanks
    Are you sure you want to
    Your message goes here
No Downloads

Views

Total Views
26,818
On Slideshare
0
From Embeds
0
Number of Embeds
16

Actions

Shares
Downloads
2,066
Comments
8
Likes
23

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. LTE & EPC Architecture LTE Attach Procedure Version: 3.0 (March 2013)Irfan Ali 1
  • 2. 3GPP Network Architecture Network + Radio Access Network (RAN) Core Network (CN) Mobile (U)SIM Equipment (ME) Radio Resource Management Security, IP connectivity, MobilityUser Equipment (UE) orMobile Station (MS) SIM Subscriber Identity Module USIM Universal Subscriber Identity ModuleIrfan Ali Irfan Ali 2 2
  • 3. LTE Network Architecture Internet HSS P-GW S6a S5 S11 S-GW Evolved Packet Core (EPC) S-GW MME S1-MME S1-U Evolved Universal Terrestrial Radio Access Network (E-UTRAN) X2 X2 eNB eNB eNB LTE-Uu eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway P-GW Packet data network Gateway HSS Home Subscriber SystemIrfan Ali Irfan Ali 3 3
  • 4. HSS P-GW LTE Network Architecture UE IP address Authenticator Allocation Inter SGW Mobility Anchoring IMS Internet Subscription S5 S6aHSS MME S-GW P-GW NAS Security Inter eNB Mobility S6a Anchoring S5 Idle Mode Mobility Mgmt S11 S-GW EPS Bearer Control S-GW MME S1-MME S1-MME S1-U S1-U eNB RB Control Inter Cell RRM Radio Admission Connected Mode Control Mobility Mgmt X2 eNB eNB eNB eNB Measurement Scheduler OAM LTE-Uu Control-Plane Functional Entity Radio Bearer Transmission User-Plane (L1/L2/L3) Functional EntityIrfan Ali Irfan Ali 4 4
  • 5. Block Diagram example: LTE Architecture HSS Interfaces Reference Points S1-MME S6a MME Operators IP S11 Services S10 SGi S1u Serving S5 UE eNB PDN GW SGi Internet GW LTE-Uu X2 Functional Entity Logical Entity Network Entity eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway PDN GW Packet data network GW HSS Home Subscriber SystemIrfan Ali Irfan Ali 5 5
  • 6. LTE Architecture Key Concepts  All radio related functions are pushed down to the eNB • There is no centralized radio resource management element like the RNC.  In the core network, there is control-plane and user-plane separation • MME is the control-plane entity • SGW and PGW are the user-plane entity • To allow independent scaling of the control-plane and the user-plane.  LTE is a PS (Packet Switch) only system • No CS (Circuit switch) domain supportIrfan Ali Irfan Ali 6 6
  • 7. Architecture Concept: Access Stratum vs Non-Access Stratum • On the signaling plane, the UE IMS Internet communicates with two entities in the infrastructure: HSS P-GW  (a) the eNB and  (b) the MME (via the eNB). • Access-stratum (AS): UE <-> S-GW eNB.  AS consists of both user- S-GW MME plane and control-plane. The user-plane protocol isNon-Access PDCP and control-plane Stratum protocol is RRC. (NAS) • Non-access Stratum (NAS): UE <-> MME. eNB eNB eNB  NAS is only in the control- Radio Resource Control plane. The protocol is (RRC) called the NAS protocol. UE Access StratumIrfan Ali Irfan Ali 7 7
  • 8. Protocol Stacks: Control Plane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Non-Access Stratum (NAS): The key control interface between MME and UE Radio Resource Control (RRC): The main control interface between eNB and UE Packet Data Convergence Protocol (PDCP): Duplicate detection, ROHC S1-AP S1 Application protocol SCTP Stream Control Transport Protocol Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane acknowledged mode (UAM), etc Medium Access Control (MAC): Access the channel Physical Layer (PHY): Radio layer, eg modulation etc.Irfan Ali Irfan Ali 8 8
  • 9. Protocol Stacks: Control Plane & User Plane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Application Application TCP/UDP TCP/UDP IP IP IP GTP-U GTP-U GTP-U GTP-U PDCP PDCP UDP UDP UDP UDP RLC RLC IP IP IP IP MAC MAC L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 S5 LTE Uu S1-U UE eNB S-GW P-GW End HostIrfan Ali Irfan Ali 9 9
  • 10. User Identifier in the Network • Two important identifiers  International Mobile Subscriber Identifier (IMSI) • Embedded in SIM card • Stored in subscription data of HLR • Used to index UE’s information in most network nodes • Format on the next page  Mobile Station Integrated Services Digital Network Number (MSISDN) • Your phone number • Number used to identify a subscriber when making a call or sending an SMS • The mapping between IMSI and MSISDN is stored in HLR  MSISDN is not required to be stored in the (U)SIM • MSISDN is typically not needed in the LTE systemIrfan Ali Irfan Ali 10 10
  • 11. (International Mobile Subscriber Identifier) IMSI - Structure World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea 9-10 digits MCC MNC MSIN MSIN: Mobile Subscriber Subscriber Max 15 digits Identification Number Irfan Alper Erol Uniquely identifies a subscriber Source for MCC and MNC codes: http://en.wikipedia.org/wiki/Mobile_Network_Code http://en.wikipedia.org/wiki/Mobile_Country_CodeIrfan Ali Irfan Ali 11 11
  • 12. Operator Identity  A mobile operator’s network is also known as a Public Land Mobile Network (PLMN).  The identity used for an operator’s network is called the PLMN- Identity (PLMN-ID) and consists of the Mobile Country Code and the Mobile Network Code.  An operator may be identified by more than one PLMN-ID World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea PLMN ID = MCC + MNCIrfan Ali Irfan Ali 12 12
  • 13. MSISDN – Structure World 1-3 digits CC CC: Country Code 1 90 91 Country US Turkey India 2-3 digits CC NDC NDC: National Destination Code 533, 540, 505, 212,216, Operator … … … Identifies an operator Turk Turkcell Vodafone Avea Telecom 9-10 digits CC NDC SN SN: Subscriber 123 4567 123 4568 Subscriber Number Max 15 digits Irfan Alper Erol +90 533 123 4567 Uniquely identifies a subscriber List of country calling codes: Source for MCC and MNC codes: www.wikipedia.org http://en.wikipedia.org/wiki/List_of_country_calling_codesIrfan Ali Irfan Ali 13 13
  • 14. Identities and Plumbing for LTE IMSI IMSI IMSI GUTI GUTI C-RNTI C-RNTI SRB-0 HSS SRB-1 S1-MME MME SRB-2 NAS GTPC-1 SRB Identity GTPC-1 Data Radio Bearer 10 GTP-U-10 GTP-U-10 EPS Bearer Identity IMSI IMSI UE eNB S-GW P-GW SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary IdentityIrfan Ali Irfan Ali GUTI 14 14 Globally Unique Temporary Identity
  • 15. Identities in LTE • IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network Identity) Temporary Identity)  Permanent identity of UE in SIM  Is created by eNB and only used to (MCC+MNC+MSIN), where identify a UE within the scope of an MCC+MNC = Home PLMN of eNB and provided to the UE during subscriber. random access process and setup of  Kept secret from eNB. RRC connection.  Max 15 digits  C-RNTI is 16 bits long. • GUTI (Globally unique temporary identity)  Created by the MME for the UE.  Used between MME and UE instead of IMSI.  GUTI may be seen by eNB if NAS message is sent un-encrypted, eg when UE has moved to a new area and needs to be served by a new MME.  56 bits + MCC and MNCIrfan Ali Irfan Ali 15 15
  • 16. LTE Attach ProcedureIrfan Ali 16
  • 17. Objective of UE Attach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IPHSS address to communicate with P-GW outside world. • During the process of “attach” S-GW  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- >eNB<->S-GW<->PGW  UE Context created in all the nodes in the network  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary Identity Bearer Setup at end of the Attach ProcedureIrfan Ali Irfan Ali 17 17
  • 18. Objective of UE Attach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IP HSS UE Context: KEY: IMSI address to communicate with UE Context: P-GW KEY: IMSI ….. outside world. ….. S6a • During the process of “attach” UE Context: KEY: IMSI S-GW …..  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- S1-MME >eNB<->S-GW<->PGW  UE Context created in all theUE Context:S1 Cntxt: S1AP nodes in the networkTEID(key)…..RB Cntxt: C-RNTI(key),..  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary IdentityIrfan Ali Irfan Ali 18 18
  • 19. UE Performs attach – Part 1 of 4 UE HSS eNB MME SGW PGW 0. UE has synchronized to the downlink frame of the eNB and hence knows o Interne 0. UE has the DL frame boundaries. The UE has read the MIB and from there the selected eNB SIB2 of the eNB and knows when the random access channel (RACH) slots are in the uplink direction. 1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since 1. Random Access Access multiple UEs could have transmitted on the same subframe and same Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control channel (CC) to see if the UE’s preamble has been accepted by the eNB. PDCCH/PDSCH 2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the nextTemporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel. UL-SCH: SRB0 3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI. RRC Setup 4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3 C-RNTI to the UE. When the UE receives its own transmitted message (unique) 5. RRC Connection Setup and C-RNTI, the contention resolution process is complete. 5. The eNB now transmits RRC Connection Setup message including the C- UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention that could have occurred due to two UEs using the same preamble 6. RRC Connection Complete sequence in RACH access step. NAS Msg Attach Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in NAS Msg PDN the previous step. The UE also includes its IMSI in the message. Connect Req RNTI Radio Network Temporary IdentityIrfan Ali Irfan Ali 19 19 RA-RNTI C-RNTI Random Access RNTI Cell RNTI RAPID Random Access Preamble ID
  • 20. UE Performs Attach – Part 2 of 4 HSS UE eNB MME SGW eNB selects PGW MME Interne S1-MME 7. Initial UE Message S6a 8. Auth Info Request NAS Msg: Attach IMSI, .. Request, IMSI, .. NAS Msg PDN User 9. Auth Info Answer Connect Req Kasme, AUTN, RAND,XRES Authentication DL-SCH:CCH SRB1 Procedure 10. DL NAS Xport 11. DL Info Xfer Authn Request Authn Request: MME Compares AUTN, RAND, RES with XRES. If same, AKA 12. UL Info Transport successful 13. UL NAS Xport Authn Response Authn Response: RES UL-SCH: SRB1 DL-SCH:CCH SRB1 14. DL NAS Xport 15. DL Info Transport Security Mode Command Security Mode Command NAS Security Setup Procedure 16. UL Info Transport 17. UL NAS Xport Security Mode SMC Complete Complete UL-SCH: SRB1 18. Location Update Request Authorization IMSI, … NAS Security 19. Location Update Response Subscription Data Encrypted InfoIrfan Ali Irfan Ali 20 20 AKA: Authentication and Key Agreement Integrity Protected Info
  • 21. UE Performs Attach – Part 3 of 4 HSS UE eNB MME SGW NAS Security PGW Interne GTPC 20. Create Session GTPC Request (IMSI, TEIDs, 21. Create Session PGW IP,…) Request (IMSI, TEIDs, …) S1-MME 22. Create Session 23. Create Session DL-SCH:CCH SRB1 Response (IMSI, TEIDs) 24. Initial Context Setup Request Response(IMSI, TEIDs) 25. RRC Security Mode (UE Context Info, TEIDs) Command, AS Algorithm NAS: Attach Accept NAS: Activate Bearer Setup UL-SCH: SRB1 default bearer req Procedure Start 26. RRC Security Mode GTPC Session GTPC-1 Session Complete GTP-U-10 Tunnel SRB-2 AS Security Setup AS Security Procedure 27. Obtain UE’s Radio Capability DL-SCH:CCH SRB2 28. RRC Connection Reconfiguration NAS1 Attach Completion NAS2 Data Radio Bearer Setup UL-SCH: SRB2 29. RRC Reconfig Complete 30. Initial Context Setup Complete (S1U TEIDs) 31. UL Information Transfer GTPC 32. UL NAS Xport Bearer Setup NAS1 NAS2 33. Modify Bearer Req. NAS: Attach Complete Procedure Completion SRB-0 (IMSI, TEIDs…) NAS: Activate SRB-1 default bearer acpt 34. Modify Bearer Resp (IMSI,…) Encrypted Info SRB-2Irfan Ali Irfan Ali Data Radio Bearer-10 GTPU-10 Tunnel 21 21 Integrity Protected Info
  • 22. UE Performs Attach – Part 4 of 4 DHCP HSS Server UE eNB MME SGW SRB-0 PGW Internet SRB-1 SRB-2 S1-MME GTPC Session GTPC-1 Session Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel DHCP DHCP DHCP DHCP Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel Client Server Client Server IP address of the UE is routed to this interfaceIrfan Ali Irfan Ali 22 22
  • 23. Architecture key Concept: Roaming • 3GPP architecture from early days has supported a subscriber going to a foreign network and still getting service  Home PLMN: Subscriber’s home network (eg. Turkcell)  Visited PLMN: Foreign/Roamed-to network (eg. Orange) • What does roaming require:  Ability from VPLMN to identify the HPLMN of the subscriber  Ability to authenticate the subscriber from VPLMN  Sharing of revenue between VPLMN and HPLMN (roaming charges) PLMN Public Land Mobile Network VPLMN Visited PLMN HPLMN Home PLMNIrfan Ali Irfan Ali 23 23
  • 24. Roaming Concept HPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org HSS IMS Internet IMS Internet HSS P-GW P-GW S6a S6a S5 S5 S11 S-GW S11 S-GW S-GW S-GW MME MME S1-MME S1-MME S1-U S1-U HPLMN VPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org Domain = epc.mnc01.mcc404.pub.3gppnetwork.org X2 X2 X2 X2 eNB eNB eNB eNB eNB eNB LTE-Uu LTE-UuNon-Roaming Roaming IMSI = 286 + 01 + 1234567890 IMSI = 286 + 01 + 1234567890 Turkey Turkcell Turkey Turkcell HPLMN Home PLMN VPLMN Visited PLMNIrfan Ali Irfan Ali Turkcell subscriber in Turkey 24 24 Turkcell subscriber in India
  • 25. General: LTE/EPC Specifications 23.003 Identifiers 29.303 DNS 33.401 Security Stage 2&3 24.301 NAS HSS SPR PCC Stage 2: 23.203 Charging Stage 2: 32.240 S6a Unspecified Sp 29.214 S1-MME 29.272 PCRF Rx 36.410 General MME Operator 36.411 Layer 1 36.412 (Sig xport) S11 29.212 S9 Services S10 29.213 Sig Flow 36.413 (S1AP) Gx 29.21536.133 RRM Reqds 29.274 GTPC S1u Serving S5 SGi UE eNB PDN GW Internet GW LTE-Uu 29.274 GTPC 29.06136.304 Idle X2 36.410 General 29.281 GTPU Gz/Rf36.306 Capability 36.411 Layer 1 Gy/Ro36.314 Measurement 36.414 (Data xport) 32.25123.122 Idle-NAS 29.281 GTPU Online Offline Bx Billing 36.420 General Charging Charging Domain36.201,211,213,214 PHY 36.421 Layer 1 Function Function 32.25136.321 MAC 36.422 (Sig xport)36.322 RLC 36.424 (Data xport)36.323 PDCP 36.423 (X2AP)36.331 RRC 29.281 GTPU E-UTRAN Stage-2: Evolved Packet Core Stage 2: 23.401 36.300 Stage-3 Specification Stage-2 Specification Stage-1 Specification Stage-1: 22.278 Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest Link to find out what a spec covers: http://www.3gpp.org/Specification-NumberingIrfan Ali Irfan Ali 25 25