PolyMooc4G.pdf

4G Network Essentials
Xavier Lagrange, Christophe Couturier, Alexander Pelov
2018
Institut Mines-Télécom
The course and all the material are under license CC BY-NC-SA 4.0.
For more information, visit
https://creativecommons.org/licenses/by-nc-sa/4.0/

Contents
Week 1: Architecture and General Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Week 2: Security Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Week 3: Radio Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Week 4: Management of Data Flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Week 5: Management of the Sporadic Nature of Data Flows . . . . . . . . . . . . . . . . . . . . . . . . 107
Week 6: Mobility Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
List of some LTE acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Architecture and General Principles,
Week 1
Video 1: Visible Elements of a Mobile Network
and Sub-networks (UE, SIM Card, Antennas and
eNodeB, EPC, eUTRAN)
Video 2: The Cellular Concept
Video 3: Equipment of the Core of the Network
Routing Data (SGW, PGW)
Video 4: Control Equipment in the Core of the
Network (HSS, MME)
Video 5: Synthesis of the Architecture and
Interfaces (S1, S5/S8, S6a, S11, X2)
Video 6: Organization of the Course
Video 7: Services and Various Generations
Video 1: Visible Elements of a Mobile Network
and Sub-networks (UE, SIM Card, Antennas and
eNodeB, EPC, eUTRAN)
What of the mobile network do I see?
Are there other elements?
5
Week 1: Architecture and General Principles

The Terminal
 The terminal is called the UE, User Equipment
 To work, it must be equipped with a SIM card, Subscriber Identity
Module
 The SIM contains
• the subscriber identity unique throughout the world
• the subscription data (e.g., the subscription identity)
 The SIM
• is called, more precisely, USIM, Universal Subscriber Identity Module, for
3G/4G
• is provided by the operator
In this course: UE = Terminal = Cell phone
6

An Example of a Base Station
Source: Alcatel-Lucent
Source: Télécom Bretagne
The Base Station Antennas
 Base station: set of transceivers in one place
 Each base station is equipped with antennas
 Terminals around the base station can communicate with the base
station by radio transmission
 In 4G technology, a base station is called an eNB or eNodeB
• e for “evolved” (evolution in comparison with 3G)
• Node because the base station is inserted in a network
• B for Base station
7

A Mobile Network Is Not Limited to “Antennas”
 The base stations are connected to an IP network, deployed by the cell phone operator
 This network is interconnected to the Internet (to the IP networks of other operators)
eNodeB
UE
IP network
(of the cell phone
operator)
Internet
server
Router
Access Network and Core Network
 eUTRAN = Evolved Universal Terrestrial Radio Access Network
 EPC = Evolved Packet Core
server
eNodeB
UE
IP network
(of the cell phone
operator)
Internet
Router
eUTRAN
Access Network
EPC
Core Network
eNodeB
8

Video 2: The Cellular Concept
How is it possible that I can communicate
practically everywhere?
The Need to Cover the Entire Territory with Base Stations
 The transmission power of a UE (User Equipment) is typically
0.2 W (200 mW)
 The maximum range is typically several kilometers for a signal of
this strength
9

The Need to Cover the Entire Territory with Base Stations
 The operator deploys base stations on the territory to be
covered so that a terminal is always less than a few kilometers
away from a base station
 In practice, it’s not always true!
 How do we know that we have network access?
General Principle of the Beacon Channel
 Each base station broadcasts a signal regularly
• Which indicates its existence
• Which gives the characteristics of the network (example: identity of the operator)
 Concept of the beacon channel
(broadcast control channel)
 By measuring the strength of the
signal received, each terminal
can indicate if it receives the
base station well or not
Received
signal is
strong
Received
signal is
weak
Signal is not
detected
NO
NETWORK
Syldavie
Télécom
Syldavie
Télécom
10

The Case of a Rural Zone
 Source: ANFR, consulted the 22/07/2015 on http://www.cartoradio.fr
The Case of a Suburban Zone
11

The Case of an Urban Zone
Capacity and Coverage
 Dividing the territory up into cells
• Each cell is served by a base station
• The division into cells is not perceptible to the user
─ Passing from one cell to another is, ideally, imperceptible
• The capacity of a cell in Mbit/s does not depend on the size
of the cell
 Urban zone = high user density
• The base stations are deployed to provide sufficient capacity
• Deploy enough base stations so that the capacity in Mbit/s
per km2 is superior to the traffic created by the customers
 Rural zone = low user density
• The base stations are deployed to ensure coverage
• Deploy enough base stations so that, at every point of the
territory, a terminal is under the range of a base station and
can connect
12

Video 3: Equipment of the Core of the Network
(EPC) that Participate in the Routing of Data
(SGW, PGW)
Where do the packets pass when I consult a
server?
The PGW
 The Internet network cannot manage mobility
 The data packets must be routed to a “gateway”: PGW, Packet
GateWay
13

The PGW
 PGW, Packet GateWay
• Routes data to the terminal
• Ensures certain security functions
The PGW
 PGW, Packet GateWay
• Routes data to the terminal and terminal data to the Internet
• Ensures certain security functions
14

The Need for an Intermediary Gateway
The Regional Gateways or SGW
 Platforms serving a geographic zone: SGW, Serving Gateway
15

The Regional Gateways or SGW
• Collecting data sent by the mobile terminals through various eNodeBs
• The distribution of data coming from servers to the eNodeBs where the terminals
are located
 An SGW enables:
Video 4: Control Equipment in the Core of the
Network (HSS, MME)
Can I use my terminal freely on any network?
How is network access controled?
16

The Need for Control Procedures
 Before data can be transmitted by a terminal, there are several access and
control procedures
The HSS, Subscriber Data Base
17

 The HSS, Home Subscriber Server, only exchanges signaling
 Signaling: set of
messages exchanged to
manage network access,
tracking terminals when
moving, etc.
 Mobility and the sporadic nature of terminal activity lead to sending
(or receiving) frequent signaling by the terminal
18

MME, Mobility Management Entity, The Mobility Controller
 MME, Mobility Management Entity
 Attachment of the terminal to the network upon powering up
19

 Transfer of the profile, security data, from the HSS to the MME
 Signaling exchanges are made between the terminal and the MME
20

Principle Functions of the MME
The MME, Mobility Management Entity,
• Communicates with a set of base stations
• Communicates with the HSS to get the
profiles and the security information
of the subscribers present in the zone
it manages
• Stores these profiles and security data
• Manages control mechanisms related
to network access, security and mobility for
terminals present in its zone
• Maintains awareness of the location of terminals
in its area
• Selects the PGW and the SGW when the terminal attaches to the network and
connects to the Internet
• Ensures the reachability of the terminal
• Is involved in handover (handoff)
Video 5: Synthesis of the Architecture and
Interfaces (S1, S5/S8, S6a, S11, X2)
What is the architecture of the 4G network?
Are all equipment linked directly with each other?
Do all the pieces of equipment communicate with each other?
21

Physical Interface vs Logical Interfaces
 All the network equipment has a protocol stack from the IP family
 Equipment can communicate between each other even if they’re not directly
physically interconnected by a link: communication via the IP network
22

23

Interfaces Between Equipment of the Network Core
 All the network equipment has a protocol stack from the IP family
Interfaces Between Equipment of the Network Core
24

Interfaces in the Core Network and the Access Network
 SGi interface: between the PGW and the external IP network (Internet)
 S5 interface: between the SGW and the PGW (same network)
• Transporting user data + a few signaling messages
 S11 interface: between the SGW and the MME
• Transporting signaling messages
 S6a interface: between the MME et le HSS
 S1-MME interface: between the eNodeB and the MME
 S1-U interface: between the eNodeB and the SGW
• Transporting user data, no signaling exchanges
 X2 interface: between 2 eNodeBs
• Transporting user data and signaling messages
 Uu or radio interface: between the terminal (UE) and the eNodeB
• Transporting user data and signaling messages
Interconnection of Network Cores
IP network
of cell phone operator2
SGW
SGW
SGW
SGW SGW Country B
Country F
PGW
PGW
Internet
HSS
MME
MME
UE
IP network
of cell phone operator1
Interconnection network
25

Interconnection of Network Cores
 S8 interface: between the SGW and the
PGW of another network
Other equipment and interfaces not covered in the course
 EIR, Equipement Identity Register: terminal data base of terminals stolen
• interface S13 with MME
 PCRF, Policy and Charging Rules Function: service quality management
• Interface Gx with PGW
26

Presentation of the Core of the Network and Interfaces
in the Course
Video 6: Organization of the Course
How is this course structured?
27

Organization of the Course
28

29

30

Video 7: Services and Various Generations of Cell
Phone Networks (European View)
What do 2G, 3G, and 4G mean?
31

Various Generations of Mobile Networks
Gene-
ration
Principle Services Name of the
technology
in Europe
Type of access on
the radio interface
Lifetime
1 Telephony R2000, NMT,.. Analog FDMA 1980-1995
2 Telephony, SMS GSM TDMA 1995-
2.5 Telephony, SMS
IP access at 100 kbit/s
+ packet access
new modulation
2000-
3 Telephony, SMS
IP access at 1 Mbit/s
UMTS CDMA 2002-
3.9 Telephony, SMS
IP access at 10 Mbit/s
extension
HSDPA
CDMA
+ packet access
new modulation
2008-
4 IP access at 100 Mbit/s
with low latency
LTE, LTE -
advanced
OFDMA 2010-
extension
GPRS EDGE
32

Security Procedures,
Week 2
Video 1: Powering Up the Terminal, Security
Functions
Video 2: Authentication and Authorization
Video 3: Data Encryption
Video 4: Integrity
Video 5: Key Hierarchy
Video 6: Temporary Identity
Video 7: Second visit of the attachment
A. Pelov, Security Procedures in 4G Networks
Vidéo 1 : Powering Up the Terminal, Security
Functions
What happens when I turn my terminal on?
How are the security mechanisms organized?
33
Week 2: Security Procedures

15 digits max
MCC
Mobile
Country Code
3 digits
Mobile
Network Code
2-3 digits
MNC MSIN
Mobile Subscriber
Identification Number
9-10 digits
208 = FRANCE
01 = ORANGE
10 = SFR
15 = FREE
20 = BOUYGUES TELECOM
…
208 10 1234567890
208 15 5123462346
IMSI (International Mobile Subscriber Identity)
SIM
(USIM)
IP address?
IMSI
APN = Access Point Name
Example: internet or prooperator.mnc10.mcc208.gprs or weboperator.fr
eNodeB
Internet
server
PGW
PGW
Public
Access
Professional
Access
Cell phone operator’s network
34

Attach Request (IMSI)
Subscriber profile (APN, connect. parameters)
IMSI, MME identifiers
APN
APN
IP address, …
IP address, …
IP address
MME PGW
SGW HSS
PDN Type = Packet Data Network Type
IMSI = International
Mobile Subscriber
Identity
The Principle Security Mechanisms
• Fraudulent use of the network  Authentication
• Listening to exchanges  Encryption
• Modifying messages  Integrity
• Tracking/location of the terminal  Temporary identity
35

Video 2 : Authentication and Authorization
How the network can verify that a terminal that
attaches gives its valid identity ?
IMSI
RAND
RES
RES = XRES ?
K
RES = RESult
XRES=eXpected RESult
RES=
f(RAND, K)
XRES=
f(RAND, K)
128-bit secret key
HSS
IMSI
K
IMSI
K
36

RES = XRES ?
K
RES = RESult
XRES=eXpected RESult
RES=
f(RAND, K)
XRES=
f(RAND, K)
128-bit secret key
HSS
IMSI
K
IMSI
K
f(RAND, K)
32 … 128 bits
128 bits
128 bits
IMSI
RAND, XRES, …
RAND
RES = XRES ?
K
RES
Authentication vector
IMSI
RES
K
HSS
MME
37

RES, AUTN expected
IMSI
RAND, XRES, AUTN, …
IMSI
RAND, AUTN
K
K
RES
AUTN=AUthentication TokeN
AUTN = AUTN expected?
RES = XRES ?
AUTN=
g(RAND, K)
HSS
MME
RES, AUTN expected
IMSI
RAND, XRES, AUTN (+SQN), …
IMSI
RAND, AUTN (+SQN)
K
K
RES
AUTN=AUthentication TokeN
SQN valid and
RES = XRES ?
AUTN=
g(RAND, K, SQN)
SQN = SQN+1
HSS
MME
SQN = SQN+1
SQN = Sequence
Number
38

Authentication
vector
IMSI
1
2
1’
2’
HSS MME
MME
MME MME
Country F Country B
Authentication
• Based on a secret key, cryptographic functions and
random numbers
• The secret key is stored in the SIM and the HSS
• The secret key is never transmitted in the network
• The SIM and the HSS make the same calculation.
• The authentication is valid when both find the same
results
• Mutual Authentication
– Authentication of the UE by the network
– Authentication of the network by the terminal
39

Video 3: Ciphering
Can someone listen in on my communications?
= XOR
exclusive OR
0 1
0 0 1
1 1 0
Ciphering of Messages
Clear data to transmit
Packet N+1 Packet N
…
ciphering sequence
Sequence N
… Sequence N+1
Length L Packet N
Ciphered
Data
Length L
10101
00011
10110 10110
00011
10101
MME
Sequence N
Packet N
Data received
clear
Packet N
40

Packet N
Sequence N
Key Kenc
Packet number
Bearer
Direction
Packet size
Sequence N-1 Sequence N+1
… …
Ciphering algorithm
Packet N chiffré
RAND, Secret key K
Ciphering algorithm
0 NULL
1 SNOW 3G
2 AES
HSS
MME
Uu
S11
S1-MME
eNB
eNB S1-U S5/S8 SGi
X2
UE
S6a
PGW
SGW
41

Packet size
Packet number
Bearer
Direction
Ciphering algorithm
1 798 bits
28394283 12
Kenc
HSS
MME
Uu
S11
S1-MME
eNB
eNB S1-U S5/S8 SGi
X2
UE
S6a
PGW
SGW
IP1
Ciphering (Encryption)
• Based on a stable encryption key Kenc generated with secret
key K and the random number used during authentication
• Ciphering sequence specific to each packet generated with
Kenc and parameters including a packet counter
• Ciphering based on XOR
• Ciphering and De-ciphering are the same operation
42

Video 4: Integrity
Can I be sure that the message I just received has
not been modified by intermediary equipment?
Protection Against Modifications
Packet N
+ Packet N
L+32 bits
MAC
MAC
Message
Authentication
Code
32 bits
Length L
Packet N
MAC
Protection Against Modifications
MME
MAC
cryptographic
hash function
43

MAC
Integrity algorithm
Key Kint
Packet number
Signaling
message
Direction
Bearer
+ MAC
Packet N Packet N
RAND, Secret key K
Only for signaling messages between MME and UE
1 SNOW 3G
2 AES
Integrity algorithm
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
UE
S6a
PGW
SGW
eNB
44

Packet N ciphered
Ciphering
Packet N
Integrity and Ciphering
L+32 bits
MAC
MAC
Message
Authentication
Code
32 bits
Length L
De-ciphering
Packet N
MAC
Packet N ciphered MAC
Packet N ciphered
De-cipher
if and only if
integrity = OK
MME
Integrity Control
• Only for signalling messages
• MAC added to each message
• Computed by both the sender and the receiver
• With an integrated key generated
– with the secret key
– With RAND (used for the authentication)
• Same Mac => Integrity is considered as
guaranteed
45

Video 5: Key Hierarchy
IMSI K
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
S6a
PGW
SGW
eNB
UE
46

Encryption algorithm
Key
Integrity algorithm
Key
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
S6a
PGW
SGW
eNB
UE
Encryption algorithm
Integrity algorithm
Key
Key
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
S6a
PGW
SGW
eNB
UE
47

KASME
Operator B
Operator C
KASME
K
IMSI,
Identity of the visited
network (MCC, MNC) (MCC, MNC)
KASME
X
ASME = Access Security Management Entity
HSS
MME
MME
KASME
KeNB
KeNB
KASME
K
KeNB
ASME = Access Security Management Entity
KASME
K
(MCC, MNC)
(MCC, MNC)
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
S6a
PGW
SGW
eNB
UE
48

KeNB
KASME
Integrity
KNASInt
Encryption
KNASEnc
Encryption
KRRCEnc
Integrity
KRRCInt
Encryption
KUPEnc
HSS
MME
Uu
S11
S1-MME
eNB S1-U S5/S8 SGi
X2
S6a
PGW
SGW
eNB
UE
K
KASME
KeNB
RAND
Operator identifier
Number of authentications (SQN)
Number of messages
between the MME and the UE
KNASInt
KNASEnc
KRRCEnc
KUPEnc
KRRCInt
Cryptographic hash function,
e.g., SHA-2
49

Video 6: Temporary Identity
Could someone track my movements?
IMSI
RAND,XRES,AUTN,KASME
IMSI
RAND, AUTN
RES
TMSI <-> IMSI
RES = XRES ?
TMSI
All messages
transmitted in clear text!
Ciphered data
HSS
MME
50

TMSI
Temporary Mobile
Subscriber Identity
MCC
Mobile
Country Code
Mobile
Network Code
MNC
32 bits
80 bits
MME
Group ID
MME
Code
GUTI (Globally Unique Temporary UE Identity)
GUTI, message in clear text
GUTI -> IMSI
Security context
Control the integrity
of the message
HSS
MME
51

GUTI, message in clear text
former
new
GUTI -> former MME
GUTI, …
IMSI, Security context
Control the integrity
of the message
HSS
MME
MME
Temporary Identity
• Necessary to prevent a hacker from tracking the
location of a UE,
• TMSI = Temporary Mobile Subscriber Identity
– Allocated to the UE.
– Chosen by the MME that controls the UE
– Transferred only after activation of ciphering
– Can be frequently renewed
• GUTI = Globally unique temporary identity
• Necessary to recover the IMSI of the UE in case
of change of MME.
52

Video 7: Second visit of the attachment
How are the different security procedures executed
during the attachment ?
User’s communication
channel
IMSI, UE security capacity
n × (RAND,XRES,AUTN,KASME)
IMSI, MCC+MNC
Authentication Request (RAND, AUTN)
Authentication Response (RES)
RES = XRES ?
AUTN?
Security Mode Complete
KNASInt
KNASEnc
Security Mode Command (algorithms, …) KNASInt
KRRCInt
KRRCEnc
GUTI, IP address, …
Security Mode(alg,…) KRRCInt
Calculate KNASInt, KNASEnc, KeNB
KNASEnc
Calculate KRRCInt, KRRCSEnc
KRRCSEnc
Accept(KeNB)
HSS
MME PGW
SGW
UE
53

Connectivity parameters (APN,… )
IMSI, MME identifiers
APN
APN
IP address
IP address
IP address
KNASInt
KNASEnc
HSS
MME PGW
SGW
54

C. Couturier, Radio Interface
Video 1: Radio Transmission
Video 2: Resource Blocks and Sub-frames
Video 3: Packet Allocation
Video 4: Transmission Reliability in Radio
Video 5: RLC Protocol
Video 6: Random Access
Video 7: PDCP and the Global Vision
Radio Interface, Week 3
How is information transmitted by radio
between the eNodeBs and the UE?
Week 3
Video 1: Radio Transmission
How is information transmitted over the air?
55
Week 3: Radio Interface

Modulation
1 0
1 0 0 0
1 1 1 1 0 1 0 0 0
1 1 1 1 0
0 1 0 1 1 1 0
0
1
BPSK: Binary Phase Shift Keying
0
1
0 1 1 0
56

BPSK: Binary Phase Shift Keying
0
1
0
amplitude = 1
phase = 0
1
amplitude = 1
phase = p
0 0
0 1
1 1
1 0
0 0
amplitude = 1
phase = p/2
0 1
amplitude = 1
phase = 3p/2
1 1
amplitude = 1
phase = 5p/2
1 0
amplitude = 1
phase = 7p/2
6
QPSK: Quaternary Phase Shift Keying
C. Couturier, Interface radio
p/4
5p/4
7p/4
3p/4
57

0 1 1 0
0 1 1 0
BPSK vs QPSK
1 symbol = 1 bit
1 symbol = 2 bits
BPSK
QPSK
1 symbol
Transmission Reliability
 “Disturbances” can occur and create errors
• The quality is measured by the bit error rate (BER)
 Error Correction
• By error correction codes called FEC (Forward Error Correction)
• Adding redundancy (i.e., repetition) which permits the
detection and correction of certain errors.
• The code rate indicates the relation (useful information) / (transmitted information)
I LOVE U
I LOVE U I LOVE U
I LOVE U I LOST U I LOVE U
I LEAVE U
I LOVE U
58

Coding rate
 Coding rate = Useful Information / Total Transmitted
• 1/3: Maximum correction
Information repeated 3 times
• 1: No correction
Best data-rate
MCS: Modulation Coding Scheme
Modulation
(eg: BPSK, QPSK, etc)
Coding Rate
(1/3 … 1)
MCS
(29 in LTE)
59

Summary
 Compromise: Throughput vs Immunity
• High throughput requires good propagation
 LTE adapts the MCS (Adaptive modulation)
• In real time
• Independently for each user
Video 2: Resource Blocks and Sub-frames
How to share spectrum resource
between users…
60

Radio Resource Sharing
 Spectrum is sparse and expensive
 Several users
=> Allocation must be dynamic
time
Frequency
1.4 to 20 MHz
Radio Resource Sharing
 Spectrum is sparse and expensive
 Several users
=> Allocation must be dynamic
 Division by frequency and time
 LTE frequency bands
• Different central frequencies
(e.g.: 700MHz, 1.8GHz, 2.6GHz…)
• Different bandwidths (from 1.4 to 20 MHz)
61

time
Frequency
Resource
Block
(84 RE)
12 sub-carriers
180 kHz
0,5 ms
Resource element
15 kHz
66 µs
Resource Element / Resource Block
 Resource Element (RE)
• 1 RE = 1 symbol
• 1 sub-carrier (15 kHz)
 Resource Block (RB)
• 12 sub-carriers (180 kHz)
• 0.5ms, 7 symbols
Available
Bandwidth
1.4 MHz 5 MHz 10 MHz 20 MHz
Nb RBs 6 25 50 100
12
sub-carriers
time
Frequency
Resource
Block
Sub-frame: 1 ms
Resource
Block
Resource element
 Resource Element (RE)
• 1 RE = 1 symbol
• 1 sub-carrier (15 kHz)
 Resource Block (RB)
• 12 sub-carriers (180 kHz)
• 0.5ms, 7 symbols
 Sub-frame = 2 RB
• 1ms
• Heartbeat of allocation
Resource Element / Resource Block / Sub-frame
62

Resource Element / Resource Block / Sub-frame
t
f
Resource
Block
Resource
Block
1
symbol
Sub-frame: 1 ms
Reserved Resource Elements
 Some RE are reserved
• LTE Internal control (synchronisation, channel estimation, allocation, ack…)
• Group of reserved resources = “physical channel”
...
...
...
63

Transport Block
 At each sub-frame (1ms),
• Devices are allocated with 1 or several Resource Blocks
• By the eNodeB
 Transport block
• Size of the data to transmit on allocated RBs
 The size depends on
• Number of RB allocated
• MCS in use (i.e. propagation conditions)
MCS
Index
Number of Resource Block Pairs
1 2 3 4 5 6 … 25 … 50 … 100
0 16 32 56 88 120 152 .. 680 … 1 384 … 2 792
1 24 56 88 144 176 208 904 1 800 3 624
2 32 72 144 176 208 256 1 096 2 216 4 584
3 40 104 176 208 256 328 1 416 2 856 5 736
4 56 120 208 256 328 408 1 800 3 624 7 224
5 72 144 224 328 424 504 2 216 4 392 8 760
6 328 176 256 392 504 600 2 600 5 160 10 296
7 104 224 328 472 584 712 3 112 6 200 12 216
8 120 256 392 536 680 808 3 496 6 968 14 112
9,10 136 296 456 616 776 936 4 008 7 992 15 840
…
16,17 280 600 904 1 224 1 544 1 800 7 736 15 264 30 576
…
23 488 1 000 1 480 1 992 2 472 2 984 12 576 25 456 51 024
24 520 1 064 1 608 2 152 2 664 3 240 13 536 27 376 55 056
25 552 1 128 1 736 2 280 2 856 3 496 14 112 28 336 57 336
26 584 1 192 1 800 2 408 2 984 3 624 15 264 30 576 61 664
27 616 1 256 1 864 2 536 3 112 3 752 15 840 31 704 63 776
28 712 1 480 2 216 2 984 3 752 4 392 18 336 36 696 75 376
Transport Block
 Size of transport
blocks (in bits)
• Size <-> throughput
• Max throughput: 75 Mb/s
• Min throughput: 16 kb/s
• 2 to 9422 bytes
• Identical sizes for
different MCS
Source: 3GPP Technical Specification 36.213 “Evolved Universal Terrestrial Radio Access (E-UTRA)”, www.3gpp.org
64

Summary
 Resource sharing
• In time and frequency
• RE: 1 symbol
• RB: Block of 7x12=84 RE
 Allocation of Transport Blocks
• By the eNodeB
• At each sub-frame (1 ms)
• Size adjusted dynamically
• Similar principles for uplink and downlink
• More details in another lesson
C
R
C
Error detection
code
x1 à x3
number of bits
Digital
Modulation
RB pairs
Sub-frame (1ms)
Transport
Block
Turbo coding
Symbols
Transmission Chain (simplified)
 Transport Block
• From 16 to 75376 bits (2 to 9422 bytes)
 Addition of CRC
• Error detection
 Encoding
• Error correction
 Modulation
• Symbols
 Transmission on one sub-frame
• On one or more RB pairs
65

Video 3: Principle of Packet Allocation
How are UEs informed about the resources
they can use?
Principles of Allocation: Scheduling
 Allocation only if needed
 Allocation by eNodeBs
• For both Uplink (UL) and Downlink (DL)
• Arbitration if demand > capacity
• Algorithms not specified by the standard
 eNodeBs publish allocation tables
• one for DL
• one for UL
66

Addresses on the radio: RNTI
 Addressing
• Identification terminals within a given cell
• Identifiers have to be short because they are used frequently
 RNTI: Radio Network Temporary Identifier
• Allocated by the eNB when a new terminal arrives
• Enables identification of each cell phone within a given cell
• Uniqueness limited to the cell
 16 bits long
• ~ 65 000 mobiles / cell
• Encoded between 0x3D and 0xFFF3 (61 to 65523)
• Values are reserved for broadcast, paging, random access, etc.
61
t
62 64
63
1 sub-frame
(1ms)
65
RB RNTI
4-7 62
12-13 63
0-3; 8-11; 14 64
Allocation Table
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Allocation on DL
 Resource allocation by the eNB
• Not necessarily adjacent
 Short UE identification
• RNTI: Radio Network Temporary Identifier
• The RNTI is not part of the transport block
 Allocation table
• At beginning of sub-frame
• Indicates the recipient of each RB
• Transmitted at beginning of sub-frame (1 to 3 RE)
• DCI: Downlink Control Information
 UE only decodes its own messages
• The UE only decodes what is intended for it
• => energy savings
67

61
65
62
63
64
Downlink
Uplink
...
...
4 ms
Waiting for
resource
availability
Allocation on UL
 Same as DL but …
 The UE first makes a request
• Problem of the chicken and the egg
 The eNB allocates a resource
• Publication in the allocation table
 Anticipation of 4ms
• Reaction time of the terminal
Liaison descendante Liaison montante
PDCCH
Physical Downlink Control CHannel
PUCCH
Physical Uplink Control CHannel
PDSCH
Physical Downlink Shared CHannel
PUSCH
Physical
Uplink
Shared
CHannel
Data Channels / Control Channels
Uplink
Downlink
68

Summary
 Allocation
• Managed by the eNB (on both UL and DL)
• When there is a need for transmission
• “Control channels” are reserved for exchanges related to allocation:
e.g.: allocation tables (DL and UL), requests for transmission, etc.
 On Uplink
• The terminal must first make a request on the control channel
• And be allocated a resource
which will be active 4 sub-frames later
PDCP PDCP PDCP
RLC RLC RLC
MAC
PDCP
PHY
RLC
PDCP PDCP
RLC RLC
Video 4: Transmission Reliability in Radio
How can we increase the reliability
of the radio?
How can we share the connection
between several services?
69

Automatic Repeat reQuest (ARQ)
 Error detection
• MAC (Media Access Control) layer
• Error detection codes :CRC
(Cyclic Redundancy Check)
 Send and Wait ARQ
• ARQ: Automatic Repeat reQuest
• If data OK: acknowledgement (ACK) sent
• If data corrupt: NonACK sent
• If data lost: no ACK (implicit)
 If transmission problem
• Retransmission
 If too many retransmissions
• Discontinue (taken up by higher levels)
0 1 2 3 4 5 6 7 8
Processing by UE
Processing by eNB
9
9
Msg
sent
ACK
Sent
 Processing time: 8 sub-frames
 Fixed delay: 8ms
• 4 ms for the receiver + 4 ms for the sender
Acknowledgement
70

Parallel Acknowledgements
 Optimization: Parallel “Send And Wait”
• 8 parallel cycles
• For each eNB-UE couple
0 1 2 3 4 5 6 7 8 9
9
process 1 process 2 process 3 process 1 process 2
process 0 process 0
process 7
...
Block 2
Block 1 Block 3 Block 4
0 1 2 3 4 5 6 7 8
NACK
9
9
Block 2
process 1 process 2 process 3 process 1 process 2
process 0 process 0
ACK
process 7
...
ACK ACK
Block 1 Block 3 Block 4 Block 2
Parallel Acknowledgements
 De-sequencing
• Losses of each process are independent
 Not handled by MAC layer
• Left to the upper level (RLC)
71

n
n-1
C
R
C
n
Transport
Block
Integrity
Check
Error
Correction I LOST U I LOVE U
I LEAVE U
I LOVE U
HARQ: Hybrid ARQ
 Retransmission = Redundancy
• Redundancy increases error correction performance
SDU
SDU
Priority Management
and multiplexing
Logical channels
H-ARQ
RLC
MAC
PHY
MAC PDU
SDU SDU
SDU
SDU
Header SDU1 SDU2 SDUn padding
Transport Block
(2 to 9422 bytes)
Control
Data
MAC SDU
signalling voice data
...
...
Transmission
(16 kb/s to 75 Mb/s)
LCID 1
LCID 2
LCID n
Transport Channel
Multiplexing
 MAC-SDU (Service Data Unit)
• Data to/from the upper layer
• Several sources = “logical channels”
(different levels of QoS)
LCID: Logical Channel IDentifier
 MAC-PDU (Protocol Data Unit)
• At the bottom of the MAC layer
• => Transport Block
72

In Brief
Functions of the MAC layer:
 Resource allocation
• See previous video
 HARQ: Transmission reliability
• Retransmission of corrupted transport blocks
• Several processes in parallel
 Multiplexing
• Management of the priorities of several logical channels
• Assembly of data to make transport blocks
Video 5: RLC Protocol
What are the levels of quality of service (QoS)
provided by the radio interface?
73

 Applications have varying needs
• Latency
• Reliability (error rate)
• (de)-sequencing
 QoS is a compromise
• Especially latency vs reliability
• Several compromises available
• Depending on application needs
Quality of Service (QoS)
RLC: Radio Link Control
 Additional services over MAC layer
• Re-sequencing
• Segmentation
• Additional re-transmission stage
 Optional services
• 3 classes of service
74

RLC Modes
 TM: Transparent Mode
• No additional service
• No segmentation => short signalling messages (RRC)
 UM: Unacknowledged Mode
• Re-sequencing
• Segmentation according to MAC layer needs
• Low latency but low reliability => VoIP, real-time video, etc.
 AM: Acknowledged Mode
• Like UM + Re-transmission of lost packets
• Reliability => Web, emails, file transfer, etc.
 Several instances can operate parallel
RLC SDU RLC SDU RLC SDU
RLC
Header
RLC
Header
RLC
Header
RLC
MAC
RLC PDU
MAC SDU MAC SDU MAC SDU
Memorisation
Segmentation
Concatenation
HARQ
Re-sequencing
Re-assembly
Addition of
Header
Header
Removal
 Segmentation / concatenation
• Fit to the size of the MAC-SDU
 Header
• Identification messages boundaries
• Sequence number (for re-sequencing)
Unacknowledged Mode (UM)
75

Memorisation
Segmentation
Concaténation
HARQ
RE-sequencing
Re-assembly
Addition
of Header
Header
Removal
Sent msg.
Memorisation
Control / Data
Separation
RLC
Control
Acknowledged Mode (AM)
Same functions as UM plus:
 Re-transmission of lost data
• => Memorisation of transmitted messages
• Protocol:
─ Transmitter requests recipient’s status
─ Response by RLC message
(list of received/expected PDUs)
─ Free Memory (messages OK)
or retransmit lost messages
In Brief
 RLC is above the MAC layer
 RLC functions:
• Re-sequencing of blocks held up by HARQ
• Concatenation/segmentation to fit the
size requested by the MAC layer
• Retransmission of lost blocks
 QoS is a compromise
• Re-sequencing and repetition generate delays
• RLC enables 3 modes:
Transparent, Unacknowledged, Acknowledged
76

Video 6: Random Access
How do UEs register
when entering in a new cell?
Hey!
Where’s the
queue?
Access Methods
 Contention
• Competition for resources
• Collisions
• Re-transmission in case of error
 Reservation
• Breaking up in elemental resources
• Static or dynamic allocation
 Issues in LTE
• Newcomers
• Solution => a bit of contention
77

PRACH: Physical Random Access Channel
 Contention based access
• 6 RB, 1 ms wide
• Every 1 to 20 ms (configurable)
• Access by CDMA (Code Division Multiple Access)
• 64 different sequences
1ms
1 to 20 ms
Arrival of a new UE / RNTI (1st part)
Random Access
on PRACH
Channel monitoring
Sequence selection
RA-RNTI calculation
Parameters Preparation
Allocation of temp. RNTI
RA-RNTI calculation
@RA-RNTI
Random access acknoledge (RNTI temp…)
Connection Request
(RRCConnectionRequest (TMSI 1))
TMSI 1
Temporary RNTI
memorisation
78

Arrival of a New UE - Competition on Random Access
Random Access
on PRACH
Channel monitoring
Sequence selection
RA-RNTI calculation
Parameters Preparation
Allocation of temp. RNTI
RA-RNTI calculation
@RA-RNTI
Connection Request
Echo of Request
(RRCConnectionSetup (TMSI 1))
RNTI Confirmed
Connection Follow up
(RRCConnectionSetupComplete)
Random Access
on PRACH
@RA-RNTI
Echo of Request
(RRCConnectionSetup (TMSI 1))
Wrong Identity
->STOP
Channel monitoring
Sequence selection
RA-RNTI calculation
TMSI 1 TMSI 2
Connection Request
Temporary RNTI
memorisation
Temporary RNTI
memorisation
In Brief
 LTE is reservation-based
• Allocation is managed dynamically by the eNB
• On the uplink, terminals must first make a request
 Random-access channel on UL (PRACH)
• New terminals announcement
• Contention-based (CDMA)
• Collisions managed by protocol
79

PDCP PDCP PDCP
RLC RLC RLC
MAC
PDCP
PHY
RLC
PDCP PDCP
RLC RLC
Video 7: PDCP and Global Vision
How does interfacing with LTE core network work ?
Radio Interface summary
PDCP PDCP
RLC RLC RLC
RLC
TM
PDCP PDCP
RLC
UM
RLC
AM
RRC RRC
IP RRC
IP
RRC
PDCP: Packet Data Convergence Protocol
 One instance of PDCP per RLC instance
• Except for TM
 Header compression
• ROHC: RObust Header Compression (IETF protocol)
• Point to point => headers vary little => compression is possible
 Handovers mitigation
• Communication between the old and the new eNB
• Synchronization of received packets, waiting for ACK, de-sequencing, etc.
• Loss / duplication of packets (on the data plane only)
• Re-sequencing
 Security
• Cyphering
• Error detection
80

PDCP Functionalities
Control Plane (RRC) Data Plane (IP)
UM AM UM AM
Header Compression
(ROHC)
YES
(not IP)
YES
(not IP)
YES YES
Loss Prevention
(Handover)
NO YES NO YES
Cyphering
YES
(optional)
YES
(optional)
YES
(optional)
YES
(optional)
Integrity Check YES YES NO NO
Summary
PDCP PDCP PDCP
RLC RLC RLC
MAC
PDCP
PHY
RLC
PDCP PDCP
RLC RLC
· Header Compression (ROHC)
· Handover Mitigation
· Cyphering / Integrity Check
· Re-sequencing
· Retransmission (AM)
· Segmentation (According to MAC requirements)
· Logical Channels Multiplexing
(Priorities management)
· HARQ
· Radio resources allocation
Controls:
· Size of RLC PDU
· Adaptative Modulation (MCS)
· Coding (Error correction)
· Modulation
81

Summary
control
PDCP
header
data
PDCP
header
H
RLC SDU RLC SDU RLC SDU
RLC
header
MAC
header
RLC
header
RLC
MAC
Tranport Block (2 to 9422 bytes) CRC
PHY
data
PDCP
header
data
PDCP
header
control
PDCP
header
PDCP
data
(IP)
headers
data
(IP)
headers
control
(RRC)
MAC PDU
RLC PDU
IP / RRC
H H header
data
PDCP
header
H
MAC SDU MAC SDU
data
entête
PDCP
H
RLC
header
data
PDCP
header
H control
PDCP
header
RLC
header
LCID 2
LCID 1
RNTI
header
header
header
82

Week 4, Managing Data Flows
Video 1: Principle of Encapsulation and Tunnels
Video 2: The GTP Protocol
Video 3: Identifying and Managing Tunnels (TEID)
Video 4: Transmitting Packets in a Tunnel
Video 5: S1-AP Connection and the Dialogue between UE and MME
Video 6: Establishing an S1-AP Connection
Video 7: Concept of the Non Access Stratum (NAS)
and Global View of the Protocol Stacks
X. Lagrange, Management of Data Flows
Video 1: Principle of Encapsulation and Tunnels
How can data packets be transmitted to my
terminal when I can be anywhere in the network?
83
Week 4: Management of Data Flows

Fixed Network
 The IP address
(the prefix) is
used for routing
 A “machine”
which changes
location,
changes prefix
(and therefore IP
address)
Router
Router
Router
Router
Router
Router
Prefix 1,
ID interface 1
Prefix 1,
ID interface 2
Sub-network 2
Prefix 2,
ID interface 1
Prefix 2,
ID interface 2
Sub-network 3
Prefix 3,
ID interface 1
Prefix 3,
ID interface 2
Sub-network 1
prefix1
Prefix 3
Prefix 2
Principle of Encapsulation
 Encapsulation = putting the “user” IP packet in another IP packet
 Same prefix for all subscribers of a mobile network
 Routing from the Internet to the PGW
transport
block
SGW
IP address
eNB
IP Address
RNTI
IP
Packet
UE IPad
IP
Packet
UE IPad
SGW PGW
IP
Packet
UE IPad
IP
Packet
UE IPad
CN=
corresponding
node
84

 Independently of the network topology
used, the packet leaves the PGW and
arrives at the SGW as if a tunnel was
established between the PGW and SGW
Encapsulation and the Use of Tunneling
Router
SGW PGW
Router
Router
Router
Router
Router
S-GWIP
IP address
IP
Packet
UE IPad
tunnel
SGW PGW
<=>
tunnel
Video 2: Place of the GTP protocol in the protocol
stack
Which protocols are used for data exchanges
between 4G-network equipment?
85

Reminder on Encapsulation
 Encapsulation = putting the “user” IP packet in another IP packet
transport
block
S-GWIP
IP address
eNB
IP Address
RNTI
IP
Packet
UE IPad
IP
Packet
UE IPad
SGW PGW
IP
Packet
UE IPad
IP
Packet
UE IPad
CN=
corresponding
node
 The PGW’s purpose is to send the packet to the SGW
 The PGW doesn’t care what happens to the packet past the SGW
Need for a Layer 4 Protocol between Intermediary Nodes
 Need for a transport protocol
(coherent with the IP stack of all
equipment)
• TCP? Too complex
• UDP? Simple. Reliability
(when needed) is managed
by endpoints (UE, server)
 Use of UDP
• Between SGW and PGW
• Between SGW and eNodeB
PGW
SGW IP
src
dest
header
…
P-GW IP address
S-GW IP address
…
86

PGW
SGW IP
src
dest
header
…
P-GW IP address
S-GW IP address
…
PGW
SGW IP
src
dest
header
header
UDP
…
P-GW IP address
S-GW IP address
…
Port numbers
87

How to Ease Processing for Every Packet Type
Transported?
 Addition of a new layer (new protocol, new format)
• GTP, GPRS Tunneling protocol
PGW
SGW IP
src
dest
header
header
UDP
…
P-GW IP address
S-GW IP address
…
Port numbers
IP packet
(for the UE)
IPv4? IPv6?
Another format?
How to avoid
processing specific to
each format?
Place of GTP-U in the Protocol Stack and its Principle
Function
 GTP-U: transporting user
data with established
tunnels (U=User Plane)
 Addition of a new layer (new protocol, new format)
• GTP, GPRS Tunneling protocol
PGW
SGW
S-GW IP address
...
...
IP P-GW IP address
Port numbers
IP packet
(for the UE)
Only the GTP-U header
Is analyzed to process the
packet (forwarding,
managing QoS)
UDP
header
GTP-U
header
src
dest
header
MME
SGW
GTP-U
IP
Layer 2
UDP UDP
GTP-U
IP
Layer 2
Layer 1
S5/S8
UDP
GTP-U
IP
Layer 2
Layer 1
Layer 2
Layer 1
IP
PGW
Layer 1
.
UE
GTP-U
GTP-U
IP
88

Place of GTP-U in the Protocol Stack and its Principle
Function
 GTP-U
• On the S1-U interface between eNodeB and SGW
• On the S5/S8 interface between SGW and PGW
RLC
MME
PDCP UDP
GTP-U
IP
MA Layer 2
L1 Layer 1
MME
SGW
GTP-U
IP
Layer 2
Layer 1
UDP UDP
GTP-U
IP
Layer 2
Layer 1
S5/S8
S1-U
UDP
GTP-U
IP
Layer 2
Layer 1
Layer 2
Layer 1
PGW
eNode B
PDN
GW
Tunnel SGW PGW
eNB
Tunnel
.
.
.
UE
GTP-U
IP
Summary
89

Video 3: Identifying tunnels (TEID)
How to retransmit packets very rapidly and efficiently
coming from different PGWs and going to different
eNodeBs?
Managing Multiple Tunnels
 Tens of millions of users per network
• Not all are on the same eNB
• Not all are serviced by the same SGW
 Several tunnels possible for users
 Need for very rapid processing
PDN
tunnel SGW PGW
tunnel
UE2
UE1
tunnel
eNB 2
eNB 1
90

Let’s Leave the World of Telecommunications
Lunar Rock Productions Ltd 7 April 2000
7 Moonlight Boulevard, Dover, 2030 NSW, Australia
tel: +61 2 337 476 fax: +61 2 337 477
Mr James Bound
Sales Director
Universal Aspects Ltd
769 Oxford Street
LONDON WC1 007
UK
Your ref: 16538
Our ref: SR/tgh/7
Dear Mr Bound
PLANNED VISIT TO LONDON
Thank you for your letter dated 3 April 2000. We intend to stay in London for five days and I should be
grateful if you could make the necessary arrangements as previously discussed.
I am enclosing a copy of our intended programme. I very much look forward to meeting you.
Yours sincerely
Susan Rogers
Art Director
Lunar Rock Productions Ltd
Enc: 1
Universal aspects Ltd
…
16536: xxx
16537: xxx
16538: Lunar Rock business
16536: xxx
….
Lunar Rock Prod Ltd
…
SR/tgh/6: xxx
SR/tgh/7: Univ asp
SR/tgh/5: xx
SR/xxx/y
…
Source of the letter
http://www.englishclub.com/esl-articles/200004.htm
Letter
Numbering of Tunnel Endpoints
 TEID = Tunnel EndpointIDentifier
 Each node affected by a tunnel gives a unique identifier to the local
end of the tunnel
 Therefore, each tunnel has 2 identifiers
 The TEID is coded on 32 bits in GTP (4 bytes)
SGW PGW
eNB 1
eNB 2
16538
16538
32000
102
101
101
103
104
tunnel
tunnel
tunnel
IP
Packet
UE IPad
91

1st Possibility: Put the TEID Allocated by the Sender in the
GTP Header
 Complex processing
• The receiver has to know the TEID used by the body at the other end of the
tunnel
• For that, it needs to analyze the TEID and the address
• => We need a different method
Identify the sender
Find which local
tunnel corresponds to
the pair (PGW,TEID)
SGW 102 16538
16538
tunnel PGW
2nd Possibility: Put the TEID Allocated by the Recipient in
the Header
 The sender has to know the TEID used by the body at the other end
 Slight increase in complexity for the sender
 Processing much simpler for the recipient
GTP-U PDU
SGW 16538
102
Examine the context
linked to TEID=102,
process the packet
tunnel
102 PGW
Find the TEID
allocated by the
distant body for the
TEID=16538 => 102
Used by GTP
92

3rd Possibility: Put Both TEIDs !
 Same processing as when only the recipient TEID is there
 Header is a bit longer
 Advantage: if equipment wants to change the value of the TEID, it
can do so without extra signaling
 This solution not used for GTP but used between eNodeB and MME
SGW 16538
102
16538
Examine the context
linked to TEID=102,
process the packet
tunnel
102 PGW
Find the TEID
allocated by the
TEID=16538 => 102
Conclusion
 A TEID (Tunnel Endpoint Identifier) on each end of each tunnel
 TEID allocated by each node : locally unique
 The GTP header of each packet includes the TEID on the receiver
side
GTP-U PDU
SGW 16538
102
Examine the context
linked to TEID=102,
process the packet
tunnel
102 PGW
Find the TEID
allocated by the
TEID=16538 => 102
TEID TEID
93

Video 4: Transmitting Packets in a Tunnel
How does equipment communicate to establish a
tunnel?
How is the processing of packets done once the
tunnel is established?
Initialization of a Tunnel
 Exchange of control messages to establish the tunnel : GTP-C protocol
 At the end of the exchange, each end knows the TEID allocated by the
opposite body
PGW
1) Choose a new TEID value
(locally unique) (16538)
2) Store the sender’s address
3) Store the received TEID and
the link 16538-ad SGW/102
Set up a tunnel with TEID=102
Choose a new TEID
value (locally unique)
102
Ack, TEID=16358, TEID=102
S5-S8 bearer 16538
102
SGW
1) store the sender's address
2) store the received TEID
and the link 102-PGW
address/16538
94

Example of TEID Management Table
Ack. TEID=16538,
TEID=102
Set up a tunnel
with TEID=102
SGW PGW
SGW Table
TEID Action Details
Peer entity
IP ad TEID
...
102 ? ? PGW IP@ 16538
...
103
SGW
102
PGW
16538
tunnel
SGW Table
TEID Action Details
Peer entity
IP ad TEID
...
102 Forward TEID=103 PGW IP@ 16538
103 Forward TEID=102 eNB 2 IP@ 101
...
95

SGW Table
103
SGW
102
PGW
16538
tunnel
TEID Action Details
Peer entity
IP ad TEID
...
...
SGW Table
TEID Action Details
Peer entity
IP ad TEID
...
...
SGW PGW
eNB 1
16538
16538
32000
102
101
101
eNB 2
103
104
tunnel
tunnel
tunnel
96

Use of Data Tunnels in the Core of the EPC Network
 User Plane
• All the mechanisms and protocols that are directly related to the
transmission of user data and the messages/packets/frames containing user
data (as seen from the EPC network)
• Remark: A connection request to a web site, the set-up of a phone call,…
are seen by the EPC network as being part of the user plane
 For each tunnel, a pair of TEIDs!
 Many data tunnels
• Various tunnels to manage levels of quality of service
• The association of a data tunnel and a quality of service level (perhaps best
effort) is called a data bearer
Video 5: S1-AP Connection and the Dialogue
Between UE and MME
One MME is responsible for several million
terminals.
How to structure and facilitate exchanges
between a UE and a MME?
MME
97

Managing the Dialogue Between the UE and the MME
 Naive approach: place the mobile identity in every message
received or sent by the MME
• IMSI = problem of confidentiality, GUTI => what if the GUTI changes?
MME
UE
Message
de GUTI
Message
de GUTI
IMSI/GUTI
IP address
GUTI
Message
GUTI
Message
The S1-AP Protocol
 Signaling radio bearer identified by RNTI+LCID
MME
eNB
signaling radio bearer
Identified by RNTI
LCID
RNTI
RNTI = Radio Network
Temporary Identifier
LCID = Logical Channel
Identifier
98

The S1-AP Protocol
 Signaling radio bearer identified by RNTI+LCID
 Association in the eNB : RNTI+LCID <-> Connection identity
MME
eNB
LCID
One connection per UE
identified by a pair of
connection IDs
Identified by RNTI
RNTI
(with radio
connection)
Specification
of a connection-oriented protocol
between the eNB and the MME
Example of the Transmission of a Signaling Message from a
Terminal to the MME
MME
RNTI LCID=2
RNTI
eNB
transport
block
signaling
message
ID=0x03FE01
ID=0x72828A00
signaling
message
0x72828A00
0x03FE01
Identified by a pair
of connection IDs
identified by RNTI
LCID=2
RNTI LCID ID
Peer entity
IP ad ID
...
2351 2 0x03FE01 MME IP@ 0x72828A00
...
99

Summary
 For each UE
• Radio Connection between the UE and the eNB
• S1-AP connection
─ Between the eNB and the MME
─ Identified by a pair of connection ID
• On each side (eNB, MME), the connection ID is unique
Video 6: Establishing an S1-AP Connection
How is an S1-AP connection established?
100

Example of the Establishment of an S1-AP Connection
(Attachment)
MME
eNodeB
Mobile
Store ID1,
Choose ID=>ID2
S1AP DOWNLINK NAS TRANSPORT(ID2,ID1) [EMM
AUTHENTICATION REQUEST]
RRC DL INFORMATION TRANSFER
[EMM AUTHENTICATION REQUEST]
...
S1AP UPLINK NAS TRANSPORT(ID2,ID1)
[EMM AUTHENTICATION RESPONSE]
...
RRC UL INFORMATION TRANSFER
[EMM AUTHENTICATION RESPONSE]
Random access and RNTI
verification mechanism
RNTI confirmed RNTI confirmed
Choose ID => ID1
RRCCOnnectionSetupComplete
[EMM ATTACH REQUEST]
Store ID2
S1 AP INITIAL UE MESSAGE (ID1) [EMM ATTACH REQUEST]
S1-AP Protocol Functions
 The S1-AP protocol permits:
• The MME and the eNB to exchange general configuration messages
• The MME to send messages to an eNB to activate certain functions related
to tunnel connection
• The eNB to signal state changes of a terminal to the MME
• Transporting messages exchanged between a terminal and the MME
 Each time a message is linked to a particular terminal
• Presence in the header of a pair of connection identities (except for the first
message which only has one identity)
101

Video 7: Concept of the Non Access Stratum (NAS)
and Global View of the Protocol Stack
How to permit a MME to deal with only security
and mobility?
How to permit the eNB to deal only with radio
aspects?
The Control Plane
 The control plane
• All the protocols, mechanisms, and messages that enable the configuration of
network (informatic or telecom) elements in order to permit the effective delivery of a
communication service
─ Signaling transport
• Example : attachment to network, security exchanges, mobility management, routing,
etc.
 Dialogue between UE and MME
• Exclusively in the control plane
 Control
• Mobility, security management => between UE and MME
• Allocation radio resources, establishment of connection => between UE and eNB
─ Messages, protocols, linked to radio technology
102

Non Access Stratum (NAS) vs Access Stratum (AS)
 NAS messages are exchanged between the terminal and the MME
• They are relayed by the eNB without any analysis of their contents
 AS messages are exchanged between the terminal and the eNB
• Example : modification of the radio bearer
PDN
GW
MME
SGW PGW
eNB
LCID=2
LCID=0/1
signalling radio bearer
RNTI
NAS, Non Access
Stratum
AS, AccessStratum
AS, NAS et S1-AP in the Protocol Stack
 SCTP transport protocol, Stream Control Transmission Protocol
─ Reliable transport protocol but avoids unnecessary retransmissions
─ Better adapted to message transport than TCP (stream-oriented)
 S1-AP protocol, Application Protocol
• Management of messages between eNodeB and MME
• Messages related to the dialogue of a specific UE with the network
Layer 1
Layer 2
IP
SCTP
S1-AP
EMM
ESM
RLC
L1
RRC
.
IP/
..
EMM
S1-MME
eNode B
UE Uu MME
SCTP
RRC S1-AP
Layer 1
MAC Layer 2
IP
PDCP
non access stratum (NAS)
RLC
MAC
L1
PDCP
Relay of NAS
messages
Access stratum
(AS)
ESM
103

Review of the User Plane
 How to establish and release bearers?
PDN
G
S1 bearer bearer S5/S8
SGW PGW
Identified by
a pair of
TEIDs
Identified by
a pair of
TEIDs
eNB
MME
Control Tunnels and Bearers (Data Tunnel)
 GTP Control = GTP-C
• Messages necessary to establish, maintain, and release data tunnels
• Rests as well on the TEIDs (different values of TEIDs on the user plane)
PDN
G
S1 bearer bearer S5/S8
SGW PGW
Control tunnel
Identified by
a pair of
TEIDs
Identified by
a pair of
TEIDs
eNB
MME
Identified by a
pair of TEIDs
Identified by a
pair of TEIDs
104

GTP-C’s Place in the Protocol Stack and its Main Function
 GTP Control = GTP-C
• Messages necessary to establish, maintain, and release data tunnels
IP
Layer 2
Layer 1
GTP-C
IP
SGW
S5/S8
S11
PGW
MME
IP
Layer 2
Layer 1
UDP
GTP-C
Control Tunnel
SGW
eNB
MME
PDN
G
PGW
IP
Layer 2
Layer 1
UDP UDP
GTP-C
IP
Layer 2 Layer 2
Layer 1 Layer 1
UDP
GTP-C
Global View of the Control Protocol Stacks
ESM Evolved Session Management
EMM Evolved Mobility Management
RRC Radio Resource Control
PDCP Packet Data Convergence Protocol
RLC Radio Link Control
MAC Medium Access Control
S1-AP S1 Application Protocol
SCTP Stream Control Transport Protocol
GTP-C GPRS Tunnel Protocol
for the Control plane
MAC
L1
RLC
MAC
Layer 1
Layer 2
IP
SCTP
PDCP
RLC
PDCP
Layer 1
Layer 2
IP
S1-AP
EMM
ESM
IP
Layer 2
Layer 1
SCTP UDP
GTP-C
.
IP
/..
ESM
S1-U
S1-MME
eNode B
MME
EMM
Uu
RRC S1-AP
RRC
L1
UE PGW
SGW S5/S8
S11
IP
Layer 2
Layer 1
GTP-C
IP
Layer 2
Layer 1
UDP UDP
GTP-C
IP
Layer 2
Layer 1
UDP
GTP-C
105

Global View of the Protocol Stacks
GTP-C GPRS Tunnel Protocol
for the Control plane
GTP-U GPRS Tunnel Protocol
for the User Plane
Layer 1
Layer 2
IP
S1-AP
EMM
ESM
IP
Layer 2
Layer 1
SCTP UDP
GTP-C
MME
RLC
PDCP UDP
GTP-U
IP
MAC Layer 2
L1 Layer 1
RRC
PDCP
RLC
MAC
RRC
.
IP
/..
EMM
ESM
Layer 1
MME
SGW
GTP-U
IP
Layer 2
UDP UDP
GTP-U
IP
Layer 2
Layer 1
S5/S8
S1-U
S1-MME S11
Layer 1
UDP
GTP-U
IP
Layer 2
Layer 1
Layer 2
Layer 1
IP/...
PGW
eNode B
MME
IP
L1
UE
Layer 2
IP
Layer 1
CN
SGi
Uu
ESM Evolved Session Management
EMM Evolved Mobility Management
RRC Radio Resource Control
PDCP Packet Data Convergence Protocol
RLC Radio Link Control
MAC Medium Access Control
S1-AP S1 Application Protocol
SCTP Stream Control Transport Protocol
106

Management of the Sporadic Nature of Data Flows,
Week 5
Video 1: Attachment and Detachment Procedures
Revisited (EMM attach/EMM detach)
Video 2: Concept of ECM-Connected et ECM-Idle
States
Video 3: Passing to Standby Mode After a Long
Period of Inactivity
Video 4: UE Triggered Service Request
Video 5: Network-Triggered Service Request
Video 6: Principles of Dedicated Bearers
X. Lagrange, Management of the Sporadic Nature of Data Flows
Video 1: Attachment and Detachment Procedures
Revisited (EMM Attach/EMM Detach)
What happens when I turn my 4G terminal on or
off?
107
Week 5: Management of the Sporadic Nature of Data Flows

Establishment of a Default Bearer
 Permanent IP connectivity
• As soon as the terminal is powered up, it requests the establishment of
tunnels for IP connectivity
 Independently of the terminal’s activity, there’s an established
bearer
• Default bearer
 EPS Connectivity Request procedure
• Message included in the attachment message
• Attachment and establishment of connectivity realized simultaneously
Initial State (UE Powered Up, GUTI1 Stored in the SIM Card)
MME
EMM-deregistered
EMM-deregistered
HSS
UE
SGW PGW
IMSI and
profile of the
subscriber
Context for this
IMSI:
- GUTI1...
-security
-association
GUTI1
IMSI security
association
108

AKA procedure
(Authentication and Key Agreement)
EMM ATTACH REQUEST(GUTI1,
ESM PDN CONNECTIVITY REQUEST(IPvx))
Analysis of IPvx field
and APN to determine
the SGW, PGW
GTP-C CREATE
SESSION REQUEST
(IMSI,IPVX,APN)
GTP-C CREATE SESSION
REQUEST
(IMSI,IPVX,APN)
RESPONSE (IP address)
EPS BEARER CONTEXT REQUEST(IP address))
EMM ATTACH COMPLETE(ESM ACTIVATE
DEFAULT EPS BEARER CONTEXT
ACCEPT)
S5/S8 Bearer established
Store the GUTI2,
the IP address
Choose the GUTI2
GTP-C MODIFY BEARER REQUEST
GTP-C MODIFY BEARER COMPLETE
S1 Bearer established
MME
eNodeB
UE
SGW PGW
The
messages
include
the TEIDs
(except on
the radio
interface)
establishment of
S1-AP connection
(not represented)
DHCP
RESPONSE (IP address)
EMM ATTACH ACCEPT (GUTI2, ESM ACTIVATE DEFAULT
Contexts Stored in Various Equipment (Simplified View)
MME
EMM-registered
EMM-registered
Context for this
IP address
Context for this
IP address
HSS
SGW PGW
UE
IMSI and
profile of the
subscriber
Context for this
IMSI:
-profile of the
subscriber (APN)
-GUTI2,
-Security
association,
IP address
-location
...
GUTI2
IMSI security
association
IP address
109

Established Tunnels and Connections
user radio bearer S1 bearer S5/S8 bearer
PDN
GW
MME HSS
UE
tunnel for control
SGW PGW
Detach Procedure
 Terminal powered down
• The terminal makes a detach request
 Release of all connections and tunnels
 The MME retains the GUTI and the security keys
110

MME
eNodeB
[EMM DETACH REQUEST(GUTI2)]
SGW PGW
S1AP UPLINK NAS TRANSPORT
GTP-C DELETE SESSION REQUEST
GTP-C Delete SESSION RESPONS
S5/S8 Bearer Established
Radio Bearer Established S1 Bearer Established
GTP-C DELETE SESSION RESPONSE
Release of S5/S8 Bearer
S1-AP UE CONTEXT RELEASE COMMAND
Powered down
Bearer Radio Established
Releases the context but
retains the GUTI and the
security keys
[EMM DETACH REQUEST(GUTI2]]
S1-AP UE CONTEXT RELEASE COMPLET
Releases radio
connection (RNTI)
HSS
Release of Radio Bearer
DIAM NOTIFICATION ANSWER
Release of S1 Bearer
DIAM NOTIFICATION REQUEST(PGW and APN removed)
Video 2: Concept of ECM Connected and ECM Idle State
Is my terminal always connected to the network?
Isn’t it consuming too much energy?
111

Permanent Connection in EPC
 When a terminal powers up, establishment of a default
bearer
• An IP packet arriving from the network must be routed as quickly as possible
• An IP packet created by the terminal must be transmitted as quickly as possible (e.g.,
the user requests a web page)
 When a terminal is used (transmission or reception of data by the UE)
• Use of the RNTI for radio transmissions
• Measurement of the power levels to verify that the UE is still in the cell
 When a terminal is not in use (user is reading the screen, no
transmission or reception on the radio channel), do we keep the radio
connection?
• Necessary for the UE to transmit from time to time to verify that it is still in the cell
• RNTI reserved but not used
Radio Inactivity Timer
 Timer (in the eNodeB) set at the end of an exchange
• RRC inactivity timer
 When the timer runs out
• The RRC connection is released
• The UE loses its RNTI
Web-page reading
No radio exchange
inactivity
timer
packets IP
(user plane) Order to release
radio connection
112

Status of Tunnels and Connections During Activity
 During radio activity the radio connection is maintained
S1 bearer
UE
SGW
user radio bearer
MME
tunnel for control
S5/S8 bearer PGW
Release of the Radio Connection
 If there is no radio transmission radio for a while, the radio connection is released
 Releasing the radio connection prevents the MME from knowing exactly which
base station the UE is under (see week 6)
S1 bearer
MME
UE
SGW
tunnel for control
S5/S8 bearer PGW
113

Releasing the Radio Connection and the S1 Connections
 At the same time that the radio connection is released…
• The data tunnel between the eNodeB and the SGW is destroyed (S1-U tunnel)
• The S1-AP connection is destroyed
MME
SGW
tunnel for control
S5/S8 bearer PGW
UE
Definition of the ECM-Idle State
 In ECM_IDLE state, the terminal stays attached to the network (it keeps the IP
address) but is no longer really connected to the radio access network
MME
SGW
UE
ECM-IDLE
ECM-IDLE
No Radio context
for the UE
S5/S8 bearer PGW
IMSI/TMSI
sec. assoc,...
IP address
tunnel for control
114

Definition of the ECM-Connected State
 In the ECM_Connected state, the radio connection and all the
tunnels and connections are established
S1 bearer
tunnel for control
UE
SGW S5/S8 bearer PGW
user radio bearer
MME
ECM-CONNECTED
ECM-CONNECTED
Radio context
for the UE
RRC connection RRC connection
IMSI/TMSI
sec. assoc,...
IP address
+RNTI
Summary
PDN
GW
MME HSS
UE
tunnel for control
SGW PGW
115

Video 3: Passing to Standby Mode After a Long
Period of Inactivity
What happens if I don’t use the radio functions of
my terminal for a long period?
Initial State
 Long period of inactivity
116

S1 Release Procedure upon Inactivity
 At the end of the procedure, the terminal and the MME (for that terminal)
are in the ECM_Idle state (and EMM_Registered)
MME
eNodeB SGW PGW
Bearer Radio established S1 Bearer established
Releases the radio
connection (RNTI)
S1-AP UE CONTEXT RELEASE
REQUEST (cause=User Inactivity)
inactivity
GTP-C RELEASE
ACCESS BEARERS REQUEST
RRCConnectionRelease
Returns to standby,
cannot use the
RNTI
GTP-C RELEASE ACCESS
BEARERS RESPONSE
S1-AP UE CONTEXT RELEASE COMMAND
S1-AP UE CONTEXT RELEASE
COMPLETE
Conclusion on ECM and EMM States
 EMM-deregistered (necessarily ECM_idle)
• Terminal not connected to the network, no IP address
 EMM-registered and ECM-connected
• Terminal connected to the network, with an IP address
• RNTI allocated to the terminal
• Location of the UE known (in which cell the UE is)
• All tunnels and connections are established
 EMM-registered and ECM-idle
• Terminal (apparently) connected to the network, with an IP address
• No RNTI allocated to the terminal
• No tunnels, nor connection from an eNodeB
• Tunnels between SGW and PGW and between SGW and MME maintained
• Relative location of the UE (group of cells)
117

Evolution of the ECM-Idle ECM-Connected States
118

Video 4: UE-Triggered Service Request
Can I use my terminal when there’s no radio
connection?
Can my terminal transmit data rapidly after a long
period of inactivity?
119

Scenario Hypotheses
 1) UE attached to a cell and active
eNB1
eNB2
Scenario Hypotheses
 2) Inactive for several minutes
eNB1
eNB2
120

Scenario Hypotheses
 3) User mobility: The UE goes into a neighbouring cell
eNB1
eNB2
Scenario Hypotheses
 4) User action: UE transmits data
=> Need for a connection and tunnel re-establishment procedure
eNB2
121

Service Request : Simplistic Management of S1 Tunnel
MME
SGW PGW
Data to
transmit
RNTI confirmed
Verification
auth. subscriber
RRCConnectionRequest(TMSI)
RRCConnectionSetup
RRCConnectionSetupComplete
[EMM Service Request(KSI)]
RRCConnectionReconfiguration
(E-RAB to be set up list)
S1-AP INITIAL UE MESSAGE (TMSI,CELLID
[EMM SERVICE REQUEST(KSI]
S1-AP INITIALCONTEXT REQUEST
(E-RAB to be set up list )
S1-AP INITIAL CONTEXT
SETUP COMPLETE (TEID)
GTP-C MODIFY BEARER REQUEST(TEID)
RESPONSE(TEID=16358,TEID'=105)
Choice of TEID'=105
Bearer Radio established S1 Bearer established S5/S8 Bearer established
Random access, temp. alloc RNTI
RESPONSE(TEID=16358, TEID'=105)
RNTI confirmed
Choice of TEID
=16538
eNodeB2
Purpose of Partial Release of Tunnel S1
 1) UE attached and active in a cell => the TEIDs of tunnel S1 are
memorized by the MME
122

 2) Inactivity during several minutes => tunnel S1 has not been totally
released by the SGW
 3) User mobility: the UE goes into a neighbouring cell
123

 4) User action: UE transmits data
UE-Triggered Service Request Procedure
(E-RAB to be set up list)
TMSI
context
TEID=102,...
MME
eNodeB2
SGW PGW
Data to
transmit
Random access, temporary allocation
of RNTI
RNTI confirmed RNTI confirmed
S1-AP INITIAL UE MESSAGE (TMSI,CELL ID
[EMM SERVICE REQUEST(KSI)] )
verification
subscriber auth.
TEID=102
S1-AP INITIAL CONTEXT
SETUP COMPLETE (TEID)
TEID choice
=16538
Bearer Radio Established S1 Bearer Established
S1-AP INITIAL CONTEXT REQUEST
(TEID=102, E-RAB to be set up list)
GTP-C MODIFY BEARER REQUEST(TEID)
RRCConnectionRequest(TMSI)
RRCConnectionSetup
RRCConnectionSetupComplete[EMM Service Request(KSI)]
GTP-C MODIFY BEARER RESPONSE
124

Video 5: Network-Triggered Service
Request
Can a server transmit data to a terminal after this
terminal has been inactive for a long period?
Service Request Procedures
 Initial state of the cell phone
• EMM-REGISTERED and ECM-IDLE
 UE Triggered Service Request
• Request made by the UE
• Example: user action (consulting Web page)
 Network Triggered service Request
• Request made by the network
• Example: application with messages sent by a server, SIP phone call
 At the end of the procedure (if it succeeds)
• EMM-REGISTERED and ECM-CONNECTED
125

Case of a Packet to Send to a UE after a Period of Inactivity
 IP packet sent by a server to the UE: received by the PGW
tunnel for control
SGW PGW
MME
IMSI/GUTI
IP address
Context for this
IMSI:
...
-TMSI,
- unaccurate
location
EMM-registered
ECM-Idle
EMM-registered
ECM-idle
S5/S8 bearer
TEID=102
General Principle of Processing When a Packet Comes
from the Network and the Cell Phone is in Standby
 The MME maintains an approximative localisation of the UE
(see week 6 on mobility management)
tunnel for control
SGW PGW
MME
IMSI/GUTI
IP address
Context for this
IMSI:
...
-TMSI,
-unaccurate
location
Paging (TMSI)
S5/S8 bearer
IP Packet
EMM-registered
ECM-Idle
Paging (TMSI)
Paging (TMSI)
EMM-registered
ECM-idle
TEID=102
TMSI = Temporary Mobile
Station Identity
126

Network-triggered Service Request Procedure
MME
eNodeB
SGW PGW
RRC Paging (TMSI)
TEID=102 IP
Packet
Buffering packet
and next
S1-AP Paging (S-TMSI)
Bearer Radio Established S1 Bearer Established
UE Triggered Service Request Procedure
transfer of packets
on the tunnel
GTP-C DOWNLINK DATA NOTIFICATION
GTP-C DOWNLINKDATA NOTIFICATION ACK
GTP-U [IP Packet]
Summary on the Network-triggered Service Request
Procedure
 When?
• When the UE is in EMM-REGISTERED and ECM-IDLE states
• When a packet should be sent to the UE
 What is the problem?
• To reach the UE
 How?
• Paging the UE on a set of cells
• The UE triggers the Service Request Procedure
127

Video 6: Principles of Dedicated Bearers
Can you have quality of service in a 4G network?
Limit of the Default Bearer
 As soon as the UE powers up, a default bearer is established
• A priori, no guarantee of quality
of service (best effort)
─ The transit delays of packets can fluctuate
─ Certain packets can be lost
• The default bearer is suitable for a
very large range of services
─ Reliability from one end to the other
(UE and server) managed by TCP
─ Long delays are tolerated
─ Example: consulting Web pages, messages, etc.
 Need to guarantee quality of service
• IP telephony (principally)
• Critical applications
MME
signalling radio bearer tunnel for control
Defaul
t
bearer
UE
SGW PGW
128

General Presentation of Dedicated Bearers
 Possibility of establishing one or several supplementary bearers
• Dedicated bearer
• Establishment triggered by the network
(the PGW)
• Request made by UE with signaling
at the application level
─ SIP signaling transmitted
on the default bearer
 Different cases possible
• Dedicated bearer : dedicated to the same context as the context of the default bearer
(same APN and same IP address)
─ Case handled in the course
• Establishment of a new context (e.g., different PGW)
─ Not seen in the course
MME
Default
bearer
Dedicated
bearer
UE
SGW PGW
Initial State
 UE in EMM-registered and ECM-connected state
MME
Default
bearer
UE
SGW PGW
129

Dedicated Bearer Activation Procedure
MME
eNodeB
SGW PGW
GTP-C CREATE BEARER REQUEST
(QoS level)
The
messages
incude
the TEIDs
(except on
the radio
interface)
GTP-C CREATE BEARER REQUEST
(QoS level)
Taken into account
by the scheduler
S1-AP E-RAB SETUP REQUEST
(QoS level)
[ESM ACTIVATE DEDICATED EPS
BEARER CONTEXT REQUEST]
[ESM ACTIVATE DEDICATED EPS
BEARER CONTEXT REQUEST]
RRCConnectionReconfigurationComplete
S1-AP E-RAB SETUP RESPONSE
[ESM ACTIVATE DEDICATED
EPS BEARER CONTEXT ACCEPT]
[ESM ACTIVATE DEDICATED
GTP-C CREATE BEARER RESPONSE
GTP-C CREATE BEARER RESPONSE
Bearers after the Activation of a Dedicated Bearer
 Different TEIDs for the different bearers of the same user
MME
Default
bearer
Dedicated
bearer
UE
SGW PGW
130

Deactivation of a Dedicated Bearer
MME
eNodeB
SGW PGW
Taken into account
by the scheduler
GTP-C DELETE BEARER REQUEST
(cause)
[ESM DEACTIVATE DEDICATED
EPS BEARER CONTEXT REQUEST]
EPS BEARER CONTEXT REQUEST]
S1-AP E-RAB RELEASE RESPONSE
[ESM DEACTIVATE DEDICATED EPS
BEARER CONTEXT ACCEPT]
GTP-C DELETE BEARER RESPONSE
S1-AP E-RAB RELEASE COMMAND
(cause)
The
messages
include
the TEIDs
(except on
the radio
interface)
GTP-C DELETE BEARER REQUEST
GTP-C DELETE BEARER RESPONSE
State after the Deactivation of the Dedicated Bearer
 Release of dedicated bearer
 Maintenance of default bearer (connectivity maintained)
MME
Default
bearer
UE
SGW PGW
131

Week 6 : Mobility Management
Video 1: Managing Location (Tracking Area)
Video 2: Balancing the Location Update Load (TA list)
Video 3: Mobility Management of a Terminal in Idle Mode
Video 4: Mobility Management with a Change of SGW or MME
Video 5: Overview of the Handover
Video 6: Progress of the X2 Handover
Video 7: Other Handover Cases
X. Lagrange, Mobility Management
Video 1: Managing Location
How can the terminal be reached at any moment
without it using up too much energy?
133
Week 6: Mobility Management

Review of the Concept of a Cell
 Each base station (eNodeB) covers a cell
 To simplify calculations, we assume that the cell is square
• The same calculations are possible with hexagonal cells
 The terminal can be in any cell
• How to reach it? How to establish a link wherever it is?
Principle of Location Update
I am in the
cell
Hi, it’s me
134

Need for a Beacon Channel (Broadcast Control Channel)
 Each eNodeB regularly broadcasts its identity on the beacon
channel (typically every 1 to 5 seconds)
B1 B2 B3
B1 B2 B3
Estimating the Number of Location Updates per Second
and per Terminal
600 meters
1 m/s
10 m/s
Hi, it’s
me
Hi, it’s
me
Hi, it’s
me
135

Concept of a Tracking Area
 Tracking Area Identity, TAI
• MCC, Mobile Country
Code
• MNC, Mobile Network
Code
• TAC, Tracking Area Code
 The TAI of the tracking
zone is broadcast
regularly by each eNodeB
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA2
TA2
TA2
B1
B4
B2
B5
B3
B6
B7 B8 B9
Tracking area TA1
B13
B16
B10
UE
Principle of the Location Update
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA2
TA2
TA2
B1
B4
B2
B5
B3
B6
B7 B8 B9
Tracking Area TA1
B10
B13
B16
I am in
TA1
136

Principle of the Location Update
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA1
TA2
TA2
TA2
B1
B4 B5
B3
B6
B7 B8 B9
Tracking Area TA1
B10
B13
B16
B2
Nothing
Estimating the Number of Location Updates per Second
and per Terminal
600 meters
Tracking Area TA1
10m/s
137

Ambiguity of Location
Tracking Area TA1
I am in TA1
UE
Principle of Paging
 Paging consists of
broadcasting the
identity (TMSI,
Temporary Mobile
Subscriber Identity)
to all the cells in the
tracking area (TA)
Paging in the tracking area TA1
UE identity
B1
UE identity
B2
UE identity
B3
B10
UE identity
B4
UE identity
B5
UE identity
B6
B13
UE identity
B7
UE identity
B8
UE identity
B9
B16
138

Conclusion
 A tracking area regroups several cells
• A UE can move within the tracking area without updating its location
 The larger the area
• The lower the frequency of terminal updates
• The greater the load of paging messages
 At first approximation,
• a tracking area of N cells allows you to divide the number of updates made
per unit of time by par √N
• The number of paging messages is multiplied by N
14
X. Lagrange, Management of Mobility in 4G Networks
Video 2: Balancing the Location Update
Load (TA list)
How to ensure that a cell does not have to manage a
lot of location update traffic?
139

15
Signaling Load on Edge Cells
 The location updates are made in the cells on the edge of the tracking area
Load of mobility
signaling
TA1
TA8
TA = Tracking Area
16
Principle of Tracking Area Lists or TA lists
 With each update, the
network provides a tracking
area list
• Tracking Area List or TA List
 Two terminals in the same
list can have different lists
 Paging must be made on all
cells of the TA list
140

Video 3: Mobility Management of a
Terminal in Idle Mode
How is location update processed in the network?
Example of Location Update
MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
Context for this UE:
TMSI,
UE in {TA0,TA1,…}
{TA0,TA1}
141

MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
TMSI,
UE in {TA0,TA1,…}
{TA0,TA1}
 The location update is done in ECM-idle state
• Management of mobility in ECM-connected state = Handover
MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
TMSI,
UE in {TA0,TA1,…}
{TA0,TA1}
142

MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
TMSI,
UE in {TA0,TA1,…}
{TA0,TA1}
MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
TMSI,
UE in {TA2,TA3,…}
{TA2,TA3,…}
143

MME
S5/S8 GTP-U Tunnel
tunnel for control
SGW PGW
TA1
TA2
TMSI,
UE in {TA2,TA3,…}
{TA2,TA3,…}
Message Sequence Chart of Location Update
MME
EMM TRACKING AREA
SGW PGW
detection
TA off list
establishment of radio connection
EMM TRACKING AREA UPDATE REQUEST(GUTI, old TAI)
EMM TRACKING AREA UPDATE ACCEPT(nGUTI, TAI2,TAI3)
Storing
nGUTI, TAI2, TAI3,...
release of radio connection Release of S1-AP connection
UPDATE COMPLETE
Alloc. Of new TMSI =>nGUTI
Choice of TA list= TAI2, TAI3,…
Optional AKA (Authentication and Key Agreement), Cyphering activation
(includes S1AP connection setup),
144

Location Update
 In ECM-idle state
 Set up of a radio connection and S1-AP connection
 NAS signaling
 Possibly allocation of a new GUTI
 Update of the Tracking Area List (TAL)
Video 4: Mobility Management with a
Change of SGW and MME
How is mobility managed when the terminal changes
SGW, MME?
145

Example of a Location Update with a Change of SGW
146

147

148

Tracking Area Update with a Change of SGW
EMM TRACKING AREA UPDATE COMPLETE
GTP-C DELETE SESSION RESPONSE
HSS
MME
EMM TRACKING AREA UPDATE REQUEST
(GUTI, oldTAI)
old SGW
new SGW PGW
Optional security procedure
(AKA)
GTP-CCREATE
SESSIONREQUEST
GTP-CCREATE
SESSION RESPONSE
GTP-C MODIFY BEARER REQUEST
EMM TRACKING AREA UPDATE ACCEPT
(nGUTI, TAIlist)
GTP-C MODIFY BEARER RESPONSE
Case of a Change of MME
149

 The terminal must
indicate its GUTI
150

indicate its GUTI
indicate its GUTI
151

 Tunnels at the end of the
procedure
Synthesis
 The location update procedure is defined for all cases
• New SGW, new MME
 In all cases, the procedure is the same from the UE point of view
• The UE puts its GUTI in the TRACKING AREA UPDATE REQUEST
message
 When the procedure in the network involves a new MME
• The GUTI is analyzed by this MME to find the previous MME
• The previous MME sends the IMSI of the UE
152

Video 5: Overview of the Handover
How can I continue to use a service on my terminal
while I’m moving?
The Need for and Complexity of the Handover
 A user can have an active session while moving
• User close to the base station => strong signal => high data bit rate
153

The Need for and Complexity of the Handover:
Identification of One or More Target Cells
 The more the user distances himself from the base station, the weaker the
signal received from the base station becomes
• Decrease of throughput, risk of loss of connection
• The radio connection must be transferred to another eNodeB
The Need and Complexity of the Handover
 Handover (or handoff): transfer of a connection (active) from one
eNodeB to another eNodeB
154

The Need and Complexity of the Handover
 Handover (or handoff): transfer of a connection (active) from one
eNodeB to another eNodeB
• To which eNodeB?
 Transmission by each eNodeB of a specific reference signal (in
conjunction with an identity called PCI, Physical Cell Identity)
155

 Terminal measures the strength of signals received from (typically)
the 6 best received base stations
 Regular upload to the enodeB of measurements made
• UE-assisted Network-triggered Handover
 Identification of the target cell by the eNodeB
156

Actions in the Network
 Bearer between eNodeB and SGW
 S1-AP connection between the eNodeB and the MME
157

 Packet-switched network
• Buffer containing packets in the intermediary equipment: PGW, SGW and especially eNodeB
• The further the terminal is from the eNodeB, the lower the throughput on the radio band => strong possibility
of loss of queued packets
 Handover, a complex operation
• Not too early, not too late
• Transfer of the radio connection, tunnels or connections, queued packets (if possible)
• The target eNodeB must have sufficient resources to accommodate the terminal
SeNB = Source eNodeB
TeNB = Target eNodeB
158

 Inside the network, two types of handover
• X2 handover,
─ Practically no break in connectivity in the core of the network
─ Transfer of queued SeNB packets to TeNB
• S1 handover
─ Break in connectivity
─ Possibility of re-routing packets but
more complex
SeNB = Source eNodeB
TeNB = Target eNodeB
X2 = Interface
between eNodeBs
Phases of the Handover
 Before the handover
• Activation of the transmission of measurements by the terminal when the
signal strength of the base station is below a threshold
• Analysis by the eNodeB of the levels of the signal strengths indicated by the
terminal for the current eNodeB and the neighboring eNodeBs
 Handover in 3 phases
• Handover Preparation
─ Reservation of resources in the network (target eNodeB)
• Handover Execution
─ Transmission of handover order to the terminal, rerouting packets, modifying
tunnels and connections, establishing the radio connection with the target
eNodeB
• Handover Completion
159

Video 6: Progress of the X2 Handover
So, how does a handover really work?
Scenario of the X2 Handover Considered
 studied case : the Target eNodeB (TeNB) is controlled by the same
MME and connected to the same SGW as the source eNodeB (SeNB)
MME
SeNB
T
eNB
user radio bearer
tunnel for control
SGW PGW
S1 bearer S5/S8 bearer
X2
160

X2 Protocol Stack
IP
S1-AP
EMM
ESM
IP
Layer 2 Layer 2
Layer 1 Layer 1
SCTP UDP
GTP-C
MME
RLC
PDCP UDP
GTP-U
IP
MAC Layer 2
L1 Layer 1
RRC
PDCP
RLC
MAC
L1
.
IP/
..
EMM
ESM
Layer 1
MME
SGW
GTP-U
IP
Layer 1
UDP UDP
GTP-U
IP
Layer 2
Layer 1
S1-MME S11
Layer 2
eNode B
MME
IP
RRC
UE
S1-U
Uu
Uu
X2
MME
SCTP
X2-AP
IP
Layer 2
Layer 1
eNode B
MME
SCTP
X2-AP
IP
Layer 2
Layer 1
eNode B
 X2 Interface
• Based on IP
• Same philosophy as S1-U/S1-MME
• Control plane: X2-AP on SCTP
• User plane: GTP-U on UDP
(trigger measurements)
Detachment
from cell
X2AP SN STATUS TRANSFER
handover
preparation
MME
SeNB SGW
T
eNB
...
handover
execution
packet data flow
packet data flow
packet data flow
data packet forwarding
Buffer packets
Handover decision
Choice of TeNB
X2AP HANDOVER REQUEST
Admission control
ACKNOWLEDGE (preamble)
(new RNTI, TeNB, preamble)
X2 Handover Without a Change of SGW or MME (1/2)
RRC MeasurementReport
Choice and
exchange of TEIDs
and connection
identities on X2
161

X2 Handover Without a Change of SGW or MME (2/2)
MME
SeNB
SGW
TeNB
S1AP PATH SWITCH REQUEST
Route data
to TeNB
on S1-U tunnel GTP-U END MARKER
on X2APtunnel
GTP-U END MARKER
handover
execution
Transmission allocated preamble
packet data flow packet data flow
data packet forwarding
packet data flow
packet data flow
packet data flow
handover
completion
GTP-C MODIFY
BEARER RESPONSE
S1AP PATH SWITCH
REQUEST ACKNOWLEDGE
X2AP UE CONTEXT
RELEASE
Release
resources
GTP-C MODIFY
BEARER REQUEST
X2 Handover Refused by Target eNodeB
(trigger measurements)
Handover decision
Choice of TeNB
admission control
=> refused
X2AP HANDOVER
PREPARATION FAILURE
handover
preparation
MME
SeNB
SGW
T
eNB
...
packet data flow
packet data flow
162

X2 Handover
 X2-AP connection
• Used by the SeNB to request that the TeNB accommodate the terminal
 Tunnel GTP-U
• The source eNB temporarily forwards downlink data packets to the target eNB
Video 7: Other Handover Cases
Is an X2 interface absolutely necessary for a
successful handover?
Is a handover possible when the terminal
changes MME or SGW ?
163

S1-based Handover without Change of SGW or MME
164

165

X2-based Handover with a Change of SGW
166

 The X2-based handover with a change of MME is not possible
167

S1-based Handover with a Change of SGW
 The S1-based handover with a change of MME is also specified
• Rare case
Conclusions on the Handover
 All cases of handovers within the same network are specified
 Temporary service disruption
• From several tens to several hundreds of ms
• The handover must be fast enough to avoid disturbing the upper layers
(TCP, applications)
 The handover based on X2 enables a lower rate of packet loss
 Disconnections noticed by the user are often failed handovers
 There is an automatic connection re-establishment procedure in
case of an interruption
168

List of some LTE acronyms
3GP 3GPP file format
3GPP Third Generation Partnership Project
A
AAA Authentication, Authorization and
Accounting
ACK Acknowledgement
AES Advanced Encryption Standard
AKA Authentication and Key Agreement
AM Acknowledged Mode
AMBR Aggregate Maximum Bit Rate
AMR Adaptive Multi Rate
AMR-WB Adaptive Multi Rate Wide Band
AN Access Network
ANDSF Access Network Discovery and
Selection Function
ANDSF-SN Access Network Discovery and
Selection Function Server Name
APN Access Point Name
ARFCN Absolute Radio Frequency Channel
Number
ARP Address Resolution Protocol
ARQ Automatic Repeat ReQuest
AS Access Stratum
ASE Application Service Element
AUTN Authentication token
B
BBU Base-Band Unit (DRoF context)
BCCH Broadcast Control Channel (logical
channel)
BER Bit Error Rate
BPSK Binary Phase Shift Keying
BS Base Station
C
CA Carrier Aggregation
CBR Constant Bit Rate
CCF Call Control Function
CDMA Code Division Multiple Access
CHAP Challenge Handshake Authentication
Protocol
CN Core Network
COMP Coordinated Multi-Point transmission
and reception
CP Cyclic Prefix (OFDM major
Parameter)
CPRI Common Public Radio Interface
CQI Channel Quality Indicator
CRC Cyclic Redundancy Check
CRE Call Ree-establishment procedure
C-RNTI Cell Radio Network Temporary
Identity
C-TEID Common Tunnel Endpoint IDentifier
CSG Closed Subscriber Group
D
DFTS-OFDM Direct Fourier Transform Spread –
OFDM
DHCP Dynamic Host Configuration
Protocol
diff-serv Differentiated services
DLCI Data Link Connection Identifier
DNS Domain Name System
DRoF Digital Radio Over the Fiber
DRX Discontinuous Reception
DS-CDMA Direct-Sequence Code Division
Multiple Access
DSCH Downlink Shared Channel
DTX Discontinuous Transmission
E
EAP Extensible Authentication Protocol
ECM EPS Connection Management (also
called ESM)
EEA EPS (Evolved Packet System)
Encryption Algorithm
EIR Equipment Identity Register
EMM EPS Mobility Management
eNB Evolved Node B
eNodeB Evolved Node B
EPC Evolved Packet Core
EPS Evolved Packet System
E-RAB E-UTRAN Radio Access Bearer
ESM EPS Session Management (also
called ECM)
E-UTRA Evolved UTRA
E-UTRAN Evolved UTRAN
F
FDD Frequency Division Duplex
FDMA Frequency Division Multiple Access
FEC Forward Error Correction
FER Frame Erasure Rate,
FFS For Further Study
FLUTE File deLivery over Unidirectional
Transport
FMC Fixed Mobile Convergence
FQDN Fully Qualified Domain Name
FR Full Rate
G
GBR Guaranteed Bit Rate
GERAN GSM EDGE Radio Access Network
GGSN Gateway GPRS Support Node
GIF Graphics Interchange Format
GMLC Gateway Mobile Location Centre
GMM GPRS Mobility Management
GMSC Gateway MSC
GMSK Gaussian Minimum Shift Keying
GRE Generic Encapsulation
GSA Global mobile Suppliers Association
GSM Global System for Mobile
communications
GSN GPRS Support Nodes
GTP GPRS Tunneling Protocol
169
List of some LTE acronyms

PolyMooc4G.pdf

Recommended

Recommended

More Related Content

Similar to PolyMooc4G.pdf

Similar to PolyMooc4G.pdf (20)

More from Mohamedshabana38

More from Mohamedshabana38 (20)

Recently uploaded

Recently uploaded (20)

PolyMooc4G.pdf