Uploaded byaliirfan04
53,610 views

LTE Architecture and LTE Attach

The document outlines the LTE and EPC architecture, detailing the network components, key concepts, protocol stacks, and the UE attach procedure. It highlights the roles of various entities such as the eNB, MME, and SGW in handling communication and resource management. Additionally, it describes the technical identities involved in the LTE system, including IMSI, MSISDN, and various temporary identifiers used during the attach process.

Embed presentation

Downloaded 5,606 times
LTE & EPC Architecture LTE Attach Procedure Version: 3.0 (March 2013) Irfan Ali 1
3GPP Network Architecture Network + Radio Access Network (RAN) Core Network (CN) Mobile (U)SIM Equipment (ME) Radio Resource Management Security, IP connectivity, Mobility User Equipment (UE) or Mobile Station (MS) SIM Subscriber Identity Module USIM Universal Subscriber Identity Module Irfan Ali Irfan Ali 2 2
LTE Network Architecture Internet HSS P-GW S6a S5 S11 S-GW Evolved Packet Core (EPC) S-GW MME S1-MME S1-U Evolved Universal Terrestrial Radio Access Network (E-UTRAN) X2 X2 eNB eNB eNB LTE-Uu eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway P-GW Packet data network Gateway HSS Home Subscriber System Irfan Ali Irfan Ali 3 3
HSS P-GW LTE Network Architecture UE IP address Authenticator Allocation Inter SGW Mobility Anchoring IMS Internet Subscription S5 S6a HSS MME S-GW P-GW NAS Security Inter eNB Mobility S6a Anchoring S5 Idle Mode Mobility Mgmt S11 S-GW EPS Bearer Control S-GW MME S1-MME S1-MME S1-U S1-U eNB RB Control Inter Cell RRM Radio Admission Connected Mode Control Mobility Mgmt X2 eNB eNB eNB eNB Measurement Scheduler OAM LTE-Uu Control-Plane Functional Entity Radio Bearer Transmission User-Plane (L1/L2/L3) Functional Entity Irfan Ali Irfan Ali 4 4
Block Diagram example: LTE Architecture HSS Interfaces Reference Points S1-MME S6a MME Operators IP S11 Services S10 SGi S1u Serving S5 UE eNB PDN GW SGi Internet GW LTE-Uu X2 Functional Entity Logical Entity Network Entity eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway PDN GW Packet data network GW HSS Home Subscriber System Irfan Ali Irfan Ali 5 5
LTE Architecture Key Concepts  All radio related functions are pushed down to the eNB • There is no centralized radio resource management element like the RNC.  In the core network, there is control-plane and user-plane separation • MME is the control-plane entity • SGW and PGW are the user-plane entity • To allow independent scaling of the control-plane and the user-plane.  LTE is a PS (Packet Switch) only system • No CS (Circuit switch) domain support Irfan Ali Irfan Ali 6 6
Architecture Concept: Access Stratum vs Non-Access Stratum • On the signaling plane, the UE IMS Internet communicates with two entities in the infrastructure: HSS P-GW  (a) the eNB and  (b) the MME (via the eNB). • Access-stratum (AS): UE <-> S-GW eNB.  AS consists of both user- S-GW MME plane and control-plane. The user-plane protocol is Non-Access PDCP and control-plane Stratum protocol is RRC. (NAS) • Non-access Stratum (NAS): UE <-> MME. eNB eNB eNB  NAS is only in the control- Radio Resource Control plane. The protocol is (RRC) called the NAS protocol. UE Access Stratum Irfan Ali Irfan Ali 7 7
Protocol Stacks: Control Plane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Non-Access Stratum (NAS): The key control interface between MME and UE Radio Resource Control (RRC): The main control interface between eNB and UE Packet Data Convergence Protocol (PDCP): Duplicate detection, ROHC S1-AP S1 Application protocol SCTP Stream Control Transport Protocol Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane acknowledged mode (UAM), etc Medium Access Control (MAC): Access the channel Physical Layer (PHY): Radio layer, eg modulation etc. Irfan Ali Irfan Ali 8 8
Protocol Stacks: Control Plane & User Plane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Application Application TCP/UDP TCP/UDP IP IP IP GTP-U GTP-U GTP-U GTP-U PDCP PDCP UDP UDP UDP UDP RLC RLC IP IP IP IP MAC MAC L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 S5 LTE Uu S1-U UE eNB S-GW P-GW End Host Irfan Ali Irfan Ali 9 9
User Identifier in the Network • Two important identifiers  International Mobile Subscriber Identifier (IMSI) • Embedded in SIM card • Stored in subscription data of HLR • Used to index UE’s information in most network nodes • Format on the next page  Mobile Station Integrated Services Digital Network Number (MSISDN) • Your phone number • Number used to identify a subscriber when making a call or sending an SMS • The mapping between IMSI and MSISDN is stored in HLR  MSISDN is not required to be stored in the (U)SIM • MSISDN is typically not needed in the LTE system Irfan Ali Irfan Ali 10 10
(International Mobile Subscriber Identifier) IMSI - Structure World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea 9-10 digits MCC MNC MSIN MSIN: Mobile Subscriber Subscriber Max 15 digits Identification Number Irfan Alper Erol Uniquely identifies a subscriber Source for MCC and MNC codes: http://en.wikipedia.org/wiki/Mobile_Network_Code http://en.wikipedia.org/wiki/Mobile_Country_Code Irfan Ali Irfan Ali 11 11
Operator Identity  A mobile operator’s network is also known as a Public Land Mobile Network (PLMN).  The identity used for an operator’s network is called the PLMN- Identity (PLMN-ID) and consists of the Mobile Country Code and the Mobile Network Code.  An operator may be identified by more than one PLMN-ID World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea PLMN ID = MCC + MNC Irfan Ali Irfan Ali 12 12
MSISDN – Structure World 1-3 digits CC CC: Country Code 1 90 91 Country US Turkey India 2-3 digits CC NDC NDC: National Destination Code 533, 540, 505, 212,216, Operator … … … Identifies an operator Turk Turkcell Vodafone Avea Telecom 9-10 digits CC NDC SN SN: Subscriber 123 4567 123 4568 Subscriber Number Max 15 digits Irfan Alper Erol +90 533 123 4567 Uniquely identifies a subscriber List of country calling codes: Source for MCC and MNC codes: www.wikipedia.org http://en.wikipedia.org/wiki/List_of_country_calling_codes Irfan Ali Irfan Ali 13 13
Identities and Plumbing for LTE IMSI IMSI IMSI GUTI GUTI C-RNTI C-RNTI SRB-0 HSS SRB-1 S1-MME MME SRB-2 NAS GTPC-1 SRB Identity GTPC-1 Data Radio Bearer 10 GTP-U-10 GTP-U-10 EPS Bearer Identity IMSI IMSI UE eNB S-GW P-GW SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary Identity Irfan Ali Irfan Ali GUTI 14 14 Globally Unique Temporary Identity
Identities in LTE • IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network Identity) Temporary Identity)  Permanent identity of UE in SIM  Is created by eNB and only used to (MCC+MNC+MSIN), where identify a UE within the scope of an MCC+MNC = Home PLMN of eNB and provided to the UE during subscriber. random access process and setup of  Kept secret from eNB. RRC connection.  Max 15 digits  C-RNTI is 16 bits long. • GUTI (Globally unique temporary identity)  Created by the MME for the UE.  Used between MME and UE instead of IMSI.  GUTI may be seen by eNB if NAS message is sent un-encrypted, eg when UE has moved to a new area and needs to be served by a new MME.  56 bits + MCC and MNC Irfan Ali Irfan Ali 15 15
LTE Attach Procedure Irfan Ali 16
Objective of UE Attach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IP HSS address to communicate with P-GW outside world. • During the process of “attach” S-GW  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- >eNB<->S-GW<->PGW  UE Context created in all the nodes in the network  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary Identity Bearer Setup at end of the Attach Procedure Irfan Ali Irfan Ali 17 17
Objective of UE Attach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IP HSS UE Context: KEY: IMSI address to communicate with UE Context: P-GW KEY: IMSI ….. outside world. ….. S6a • During the process of “attach” UE Context: KEY: IMSI S-GW …..  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- S1-MME >eNB<->S-GW<->PGW  UE Context created in all the UE Context: S1 Cntxt: S1AP nodes in the network TEID(key)….. RB Cntxt: C-RNTI(key),..  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary Identity Irfan Ali Irfan Ali 18 18
UE Performs attach – Part 1 of 4 UE HSS eNB MME SGW PGW 0. UE has synchronized to the downlink frame of the eNB and hence knows o Interne 0. UE has the DL frame boundaries. The UE has read the MIB and from there the selected eNB SIB2 of the eNB and knows when the random access channel (RACH) slots are in the uplink direction. 1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since 1. Random Access Access multiple UEs could have transmitted on the same subframe and same Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control channel (CC) to see if the UE’s preamble has been accepted by the eNB. PDCCH/PDSCH 2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the next Temporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel. UL-SCH: SRB0 3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI. RRC Setup 4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3 C-RNTI to the UE. When the UE receives its own transmitted message (unique) 5. RRC Connection Setup and C-RNTI, the contention resolution process is complete. 5. The eNB now transmits RRC Connection Setup message including the C- UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention that could have occurred due to two UEs using the same preamble 6. RRC Connection Complete sequence in RACH access step. NAS Msg Attach Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in NAS Msg PDN the previous step. The UE also includes its IMSI in the message. Connect Req RNTI Radio Network Temporary Identity Irfan Ali Irfan Ali 19 19 RA-RNTI C-RNTI Random Access RNTI Cell RNTI RAPID Random Access Preamble ID
UE Performs Attach – Part 2 of 4 HSS UE eNB MME SGW eNB selects PGW MME Interne S1-MME 7. Initial UE Message S6a 8. Auth Info Request NAS Msg: Attach IMSI, .. Request, IMSI, .. NAS Msg PDN User 9. Auth Info Answer Connect Req Kasme, AUTN, RAND,XRES Authentication DL-SCH:CCH SRB1 Procedure 10. DL NAS Xport 11. DL Info Xfer Authn Request Authn Request: MME Compares AUTN, RAND, RES with XRES. If same, AKA 12. UL Info Transport successful 13. UL NAS Xport Authn Response Authn Response: RES UL-SCH: SRB1 DL-SCH:CCH SRB1 14. DL NAS Xport 15. DL Info Transport Security Mode Command Security Mode Command NAS Security Setup Procedure 16. UL Info Transport 17. UL NAS Xport Security Mode SMC Complete Complete UL-SCH: SRB1 18. Location Update Request Authorization IMSI, … NAS Security 19. Location Update Response Subscription Data Encrypted Info Irfan Ali Irfan Ali 20 20 AKA: Authentication and Key Agreement Integrity Protected Info
UE Performs Attach – Part 3 of 4 HSS UE eNB MME SGW NAS Security PGW Interne GTPC 20. Create Session GTPC Request (IMSI, TEIDs, 21. Create Session PGW IP,…) Request (IMSI, TEIDs, …) S1-MME 22. Create Session 23. Create Session DL-SCH:CCH SRB1 Response (IMSI, TEIDs) 24. Initial Context Setup Request Response(IMSI, TEIDs) 25. RRC Security Mode (UE Context Info, TEIDs) Command, AS Algorithm NAS: Attach Accept NAS: Activate Bearer Setup UL-SCH: SRB1 default bearer req Procedure Start 26. RRC Security Mode GTPC Session GTPC-1 Session Complete GTP-U-10 Tunnel SRB-2 AS Security Setup AS Security Procedure 27. Obtain UE’s Radio Capability DL-SCH:CCH SRB2 28. RRC Connection Reconfiguration NAS1 Attach Completion NAS2 Data Radio Bearer Setup UL-SCH: SRB2 29. RRC Reconfig Complete 30. Initial Context Setup Complete (S1U TEIDs) 31. UL Information Transfer GTPC 32. UL NAS Xport Bearer Setup NAS1 NAS2 33. Modify Bearer Req. NAS: Attach Complete Procedure Completion SRB-0 (IMSI, TEIDs…) NAS: Activate SRB-1 default bearer acpt 34. Modify Bearer Resp (IMSI,…) Encrypted Info SRB-2 Irfan Ali Irfan Ali Data Radio Bearer-10 GTPU-10 Tunnel 21 21 Integrity Protected Info
UE Performs Attach – Part 4 of 4 DHCP HSS Server UE eNB MME SGW SRB-0 PGW Internet SRB-1 SRB-2 S1-MME GTPC Session GTPC-1 Session Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel DHCP DHCP DHCP DHCP Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel Client Server Client Server IP address of the UE is routed to this interface Irfan Ali Irfan Ali 22 22
Architecture key Concept: Roaming • 3GPP architecture from early days has supported a subscriber going to a foreign network and still getting service  Home PLMN: Subscriber’s home network (eg. Turkcell)  Visited PLMN: Foreign/Roamed-to network (eg. Orange) • What does roaming require:  Ability from VPLMN to identify the HPLMN of the subscriber  Ability to authenticate the subscriber from VPLMN  Sharing of revenue between VPLMN and HPLMN (roaming charges) PLMN Public Land Mobile Network VPLMN Visited PLMN HPLMN Home PLMN Irfan Ali Irfan Ali 23 23
Roaming Concept HPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org HSS IMS Internet IMS Internet HSS P-GW P-GW S6a S6a S5 S5 S11 S-GW S11 S-GW S-GW S-GW MME MME S1-MME S1-MME S1-U S1-U HPLMN VPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org Domain = epc.mnc01.mcc404.pub.3gppnetwork.org X2 X2 X2 X2 eNB eNB eNB eNB eNB eNB LTE-Uu LTE-Uu Non-Roaming Roaming IMSI = 286 + 01 + 1234567890 IMSI = 286 + 01 + 1234567890 Turkey Turkcell Turkey Turkcell HPLMN Home PLMN VPLMN Visited PLMN Irfan Ali Irfan Ali Turkcell subscriber in Turkey 24 24 Turkcell subscriber in India
General: LTE/EPC Specifications 23.003 Identifiers 29.303 DNS 33.401 Security Stage 2&3 24.301 NAS HSS SPR PCC Stage 2: 23.203 Charging Stage 2: 32.240 S6a Unspecified Sp 29.214 S1-MME 29.272 PCRF Rx 36.410 General MME Operator 36.411 Layer 1 36.412 (Sig xport) S11 29.212 S9 Services S10 29.213 Sig Flow 36.413 (S1AP) Gx 29.215 36.133 RRM Reqds 29.274 GTPC S1u Serving S5 SGi UE eNB PDN GW Internet GW LTE-Uu 29.274 GTPC 29.061 36.304 Idle X2 36.410 General 29.281 GTPU Gz/Rf 36.306 Capability 36.411 Layer 1 Gy/Ro 36.314 Measurement 36.414 (Data xport) 32.251 23.122 Idle-NAS 29.281 GTPU Online Offline Bx Billing 36.420 General Charging Charging Domain 36.201,211,213,214 PHY 36.421 Layer 1 Function Function 32.251 36.321 MAC 36.422 (Sig xport) 36.322 RLC 36.424 (Data xport) 36.323 PDCP 36.423 (X2AP) 36.331 RRC 29.281 GTPU E-UTRAN Stage-2: Evolved Packet Core Stage 2: 23.401 36.300 Stage-3 Specification Stage-2 Specification Stage-1 Specification Stage-1: 22.278 Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering Irfan Ali Irfan Ali 25 25

More Related Content

PPTX
Lte default and dedicated bearer / VoLTE
bymanish_sapra
 
PDF
Lte ue initial attach & detach from networkx
bytharinduwije
 
PDF
LTE network: How it all comes together architecture technical poster
byDavid Swift
 
PDF
Lte protocol-stack-mac-rlc-pdcp
byPrashant Sengar
 
PDF
Lte signaling
byMansour Naslcheraghi
 
PDF
LTE Call Processing and Handover
bySitha Sok
 
PPSX
Paging in LTE
bySurya Munda
 
PDF
3 g call flow
byAmit Kumar Saini
 
Lte default and dedicated bearer / VoLTE
bymanish_sapra
 
Lte ue initial attach & detach from networkx
bytharinduwije
 
LTE network: How it all comes together architecture technical poster
byDavid Swift
 
Lte protocol-stack-mac-rlc-pdcp
byPrashant Sengar
 
Lte signaling
byMansour Naslcheraghi
 
LTE Call Processing and Handover
bySitha Sok
 
Paging in LTE
bySurya Munda
 
3 g call flow
byAmit Kumar Saini
 

What's hot

PDF
LTE EPC Technology Essentials
byHussien Mahmoud
 
PDF
Lte system signaling procedures
bytharinduwije
 
PDF
Best practices-lte-call-flow-guide
byMorg
 
PDF
Attach flow &amp; srb
byMausam Panchal
 
PDF
volte ims network architecture
byVikas Shokeen
 
PDF
LTE KPI
bySitha Sok
 
PPTX
IMS Core Elements
byKent Loh
 
PDF
VoLTE flows - basics
byKarel Berkovec
 
PPTX
IMS + VoLTE Overview
byHamidreza Bolhasani
 
PPT
Initial LTE call Setup Flow
byassinha
 
PPTX
5gc call flow
byKoorosh Hoveyda
 
PDF
End to End volte ims sip call flow Guide - Mobile originating and Mobile term...
byVikas Shokeen
 
PDF
UMTS/LTE/EPC Call Flows for CSFB
byJustin MA (馬嘉昌)
 
PDF
LTE KPI and PI Formula_NOKIA.pdf
byVahidZibakalam3
 
PDF
IPRAN BASICS.pdf
bymengistuyirga
 
PDF
VoLTE Interfaces , Protocols & IMS Stack
byVikas Shokeen
 
PDF
Lte kpis, counters & amp; timers
byAbhishek Jena
 
PDF
LTE and EPC Specifications
byaliirfan04
 
DOC
Ims call flow
byMorg
 
PPTX
5G NR parameters
bySasi Reddy
 
LTE EPC Technology Essentials
byHussien Mahmoud
 
Lte system signaling procedures
bytharinduwije
 
Best practices-lte-call-flow-guide
byMorg
 
Attach flow &amp; srb
byMausam Panchal
 
volte ims network architecture
byVikas Shokeen
 
LTE KPI
bySitha Sok
 
IMS Core Elements
byKent Loh
 
VoLTE flows - basics
byKarel Berkovec
 
IMS + VoLTE Overview
byHamidreza Bolhasani
 
Initial LTE call Setup Flow
byassinha
 
5gc call flow
byKoorosh Hoveyda
 
End to End volte ims sip call flow Guide - Mobile originating and Mobile term...
byVikas Shokeen
 
UMTS/LTE/EPC Call Flows for CSFB
byJustin MA (馬嘉昌)
 
LTE KPI and PI Formula_NOKIA.pdf
byVahidZibakalam3
 
IPRAN BASICS.pdf
bymengistuyirga
 
VoLTE Interfaces , Protocols & IMS Stack
byVikas Shokeen
 
Lte kpis, counters & amp; timers
byAbhishek Jena
 
LTE and EPC Specifications
byaliirfan04
 
Ims call flow
byMorg
 
5G NR parameters
bySasi Reddy
 

Viewers also liked

PDF
Netmanias.2012.09.03 [en] emm_procedure_1._initial_attach_(part_1)
byson6971
 
PDF
Anirudh resume 2_19
byAnirudh Yadav
 
PDF
Lte attach-messaging
byPraveen Kumar
 
PDF
LTE Radio Layer 2 And Rrc Aspects
byBP Tiwari
 
DOC
c1 & c2 values
byVirender Aswal
 
PDF
ANSYS RedHawk-CPA: New Paradigm for Faster Chip-Package Convergence
byAnsys
 
PDF
LTE Air Interface
byAbdulrahman Fady
 
PDF
Quick attach summaryl
byLarry Cragun
 
PPTX
PDN Overview
byAllen Rodgers
 
PDF
LTE Procedures
byAbdulrahman Fady
 
PPTX
20121129 lte basic procedures (2)
byDebasish Sahoo
 
PDF
Simplified Call Flow Signaling: Registration - The Attach Procedure
by3G4G
 
PDF
AIRCOM LTE Webinar 1 - Network Architecture
byAIRCOM International
 
PDF
S1ap lte-attach-eps-bearer-setup
byPrashant Sengar
 
PPTX
EPS presentation
byAnirudh Yadav
 
PDF
LTE Redirection attacks: Zhang Shan
byDarren Pauli
 
PDF
LTE Key Technologies
byAbdulrahman Fady
 
PDF
3 gpp lte-rlc
byPrashant Sengar
 
PDF
Lte rrc-connection-setup-messaging
byPrashant Sengar
 
PPTX
TRACK C: PDN (Power Delivery Network)/ Ronen Stilkol
bychiportal
 
Netmanias.2012.09.03 [en] emm_procedure_1._initial_attach_(part_1)
byson6971
 
Anirudh resume 2_19
byAnirudh Yadav
 
Lte attach-messaging
byPraveen Kumar
 
LTE Radio Layer 2 And Rrc Aspects
byBP Tiwari
 
c1 & c2 values
byVirender Aswal
 
ANSYS RedHawk-CPA: New Paradigm for Faster Chip-Package Convergence
byAnsys
 
LTE Air Interface
byAbdulrahman Fady
 
Quick attach summaryl
byLarry Cragun
 
PDN Overview
byAllen Rodgers
 
LTE Procedures
byAbdulrahman Fady
 
20121129 lte basic procedures (2)
byDebasish Sahoo
 
Simplified Call Flow Signaling: Registration - The Attach Procedure
by3G4G
 
AIRCOM LTE Webinar 1 - Network Architecture
byAIRCOM International
 
S1ap lte-attach-eps-bearer-setup
byPrashant Sengar
 
EPS presentation
byAnirudh Yadav
 
LTE Redirection attacks: Zhang Shan
byDarren Pauli
 
LTE Key Technologies
byAbdulrahman Fady
 
3 gpp lte-rlc
byPrashant Sengar
 
Lte rrc-connection-setup-messaging
byPrashant Sengar
 
TRACK C: PDN (Power Delivery Network)/ Ronen Stilkol
bychiportal
 

Similar to LTE Architecture and LTE Attach

PDF
LTE in a Nutshell: Protocol Architecture
byFrank Rayal
 
PDF
Overview lte
byProcExpl
 
PDF
NewGrid HeNB Gateway Datasheet
byNewGrid (Communications Business of SMEC)
 
PPT
Gsm architecture
byRamraj Vaishnav
 
PDF
Rev 090004 Radio Layer 2 And Rrc Aspects
bymaddiv
 
PDF
통신시스템(Gprs network)
by영기 김
 
PDF
Telesemana webinar enero 22 2013
byRafael Junquera
 
PDF
Using SS7 & SIGTRAN to Solve Today's Network Challenges
byContinuous Computing
 
PDF
통신시스템(Gsm network)
by영기 김
 
PDF
10 fn s26
byScott Foster
 
PDF
10 fn s26
byScott Foster
 
PDF
3 gpp lte radio layer 2
byالمهندس عمران
 
PPTX
下一代移动互联网架构
byMars Chen
 
PDF
Brokerage 2007 presentation wireless
byimec.archive
 
PPT
Telecommunication network architecture
byTapio Meskanen
 
PDF
LTE Femtocell Roadmap- From Concept to Reality
byContinuous Computing
 
PDF
Architecting Femtocell Solutions- The Ten Most Important Steps to Building a ...
byContinuous Computing
 
PDF
Wcdma Training
byRohit Joshi
 
PDF
Lte Latam 2012 Alberto Boaventura V6
byAlberto Boaventura
 
PDF
Access network discovery
byabenitop
 
LTE in a Nutshell: Protocol Architecture
byFrank Rayal
 
Overview lte
byProcExpl
 
NewGrid HeNB Gateway Datasheet
byNewGrid (Communications Business of SMEC)
 
Gsm architecture
byRamraj Vaishnav
 
Rev 090004 Radio Layer 2 And Rrc Aspects
bymaddiv
 
통신시스템(Gprs network)
by영기 김
 
Telesemana webinar enero 22 2013
byRafael Junquera
 
Using SS7 & SIGTRAN to Solve Today's Network Challenges
byContinuous Computing
 
통신시스템(Gsm network)
by영기 김
 
10 fn s26
byScott Foster
 
10 fn s26
byScott Foster
 
3 gpp lte radio layer 2
byالمهندس عمران
 
下一代移动互联网架构
byMars Chen
 
Brokerage 2007 presentation wireless
byimec.archive
 
Telecommunication network architecture
byTapio Meskanen
 
LTE Femtocell Roadmap- From Concept to Reality
byContinuous Computing
 
Architecting Femtocell Solutions- The Ten Most Important Steps to Building a ...
byContinuous Computing
 
Wcdma Training
byRohit Joshi
 
Lte Latam 2012 Alberto Boaventura V6
byAlberto Boaventura
 
Access network discovery
byabenitop
 

Recently uploaded

PPTX
AI's Impact on Cybersecurity - Challenges and Opportunities
byYasir Naveed Riaz
 
PPT
software-security-intro in information security.ppt
byismaeelsahib032
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PDF
API-First Architecture in Financial Systems
bycyy111112
 
PPTX
Data Privacy and Protection: Safeguarding Information in a Connected World
byYasir Naveed Riaz
 
PPTX
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
DOCX
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
December Patch Tuesday
byIvanti
 
PPTX
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
PPTX
Chapter 3 Introduction to number system.pptx
byGetachewAbera9
 
PDF
Access Control 2025: From Security Silo to Software-Defined Ecosystem
byMemoori
 
PPTX
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
PDF
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
PPTX
Protecting Data in an AI Driven World - Cybersecurity in 2026
byYasir Naveed Riaz
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PPTX
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
PPTX
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
PPTX
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
AI's Impact on Cybersecurity - Challenges and Opportunities
byYasir Naveed Riaz
 
software-security-intro in information security.ppt
byismaeelsahib032
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
API-First Architecture in Financial Systems
bycyy111112
 
Data Privacy and Protection: Safeguarding Information in a Connected World
byYasir Naveed Riaz
 
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
December Patch Tuesday
byIvanti
 
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
Chapter 3 Introduction to number system.pptx
byGetachewAbera9
 
Access Control 2025: From Security Silo to Software-Defined Ecosystem
byMemoori
 
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
Protecting Data in an AI Driven World - Cybersecurity in 2026
byYasir Naveed Riaz
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 

LTE Architecture and LTE Attach

  • 1.
    LTE & EPCArchitecture LTE Attach Procedure Version: 3.0 (March 2013) Irfan Ali 1
  • 2.
    3GPP Network Architecture Network + Radio Access Network (RAN) Core Network (CN) Mobile (U)SIM Equipment (ME) Radio Resource Management Security, IP connectivity, Mobility User Equipment (UE) or Mobile Station (MS) SIM Subscriber Identity Module USIM Universal Subscriber Identity Module Irfan Ali Irfan Ali 2 2
  • 3.
    LTE Network Architecture Internet HSS P-GW S6a S5 S11 S-GW Evolved Packet Core (EPC) S-GW MME S1-MME S1-U Evolved Universal Terrestrial Radio Access Network (E-UTRAN) X2 X2 eNB eNB eNB LTE-Uu eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway P-GW Packet data network Gateway HSS Home Subscriber System Irfan Ali Irfan Ali 3 3
  • 4.
    HSS P-GW LTE Network Architecture UE IP address Authenticator Allocation Inter SGW Mobility Anchoring IMS Internet Subscription S5 S6a HSS MME S-GW P-GW NAS Security Inter eNB Mobility S6a Anchoring S5 Idle Mode Mobility Mgmt S11 S-GW EPS Bearer Control S-GW MME S1-MME S1-MME S1-U S1-U eNB RB Control Inter Cell RRM Radio Admission Connected Mode Control Mobility Mgmt X2 eNB eNB eNB eNB Measurement Scheduler OAM LTE-Uu Control-Plane Functional Entity Radio Bearer Transmission User-Plane (L1/L2/L3) Functional Entity Irfan Ali Irfan Ali 4 4
  • 5.
    Block Diagram example:LTE Architecture HSS Interfaces Reference Points S1-MME S6a MME Operators IP S11 Services S10 SGi S1u Serving S5 UE eNB PDN GW SGi Internet GW LTE-Uu X2 Functional Entity Logical Entity Network Entity eNB Enhanced Node B MME Mobility Management Entity S-GW Serving Gateway PDN GW Packet data network GW HSS Home Subscriber System Irfan Ali Irfan Ali 5 5
  • 6.
    LTE Architecture KeyConcepts  All radio related functions are pushed down to the eNB • There is no centralized radio resource management element like the RNC.  In the core network, there is control-plane and user-plane separation • MME is the control-plane entity • SGW and PGW are the user-plane entity • To allow independent scaling of the control-plane and the user-plane.  LTE is a PS (Packet Switch) only system • No CS (Circuit switch) domain support Irfan Ali Irfan Ali 6 6
  • 7.
    Architecture Concept: AccessStratum vs Non-Access Stratum • On the signaling plane, the UE IMS Internet communicates with two entities in the infrastructure: HSS P-GW  (a) the eNB and  (b) the MME (via the eNB). • Access-stratum (AS): UE <-> S-GW eNB.  AS consists of both user- S-GW MME plane and control-plane. The user-plane protocol is Non-Access PDCP and control-plane Stratum protocol is RRC. (NAS) • Non-access Stratum (NAS): UE <-> MME. eNB eNB eNB  NAS is only in the control- Radio Resource Control plane. The protocol is (RRC) called the NAS protocol. UE Access Stratum Irfan Ali Irfan Ali 7 7
  • 8.
    Protocol Stacks: ControlPlane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Non-Access Stratum (NAS): The key control interface between MME and UE Radio Resource Control (RRC): The main control interface between eNB and UE Packet Data Convergence Protocol (PDCP): Duplicate detection, ROHC S1-AP S1 Application protocol SCTP Stream Control Transport Protocol Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane acknowledged mode (UAM), etc Medium Access Control (MAC): Access the channel Physical Layer (PHY): Radio layer, eg modulation etc. Irfan Ali Irfan Ali 8 8
  • 9.
    Protocol Stacks: ControlPlane & User Plane NAS NAS RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C PDCP PDCP SCTP SCTP UDP UDP UDP UDP RLC RLC IP IP IP IP IP IP MAC MAC L2 L2 L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 L1 L1 UE LTE-Uu S1-MME S11 S5 eNB MME S-GW P-GW Application Application TCP/UDP TCP/UDP IP IP IP GTP-U GTP-U GTP-U GTP-U PDCP PDCP UDP UDP UDP UDP RLC RLC IP IP IP IP MAC MAC L2 L2 L2 L2 PHY PHY L1 L1 L1 L1 S5 LTE Uu S1-U UE eNB S-GW P-GW End Host Irfan Ali Irfan Ali 9 9
  • 10.
    User Identifier inthe Network • Two important identifiers  International Mobile Subscriber Identifier (IMSI) • Embedded in SIM card • Stored in subscription data of HLR • Used to index UE’s information in most network nodes • Format on the next page  Mobile Station Integrated Services Digital Network Number (MSISDN) • Your phone number • Number used to identify a subscriber when making a call or sending an SMS • The mapping between IMSI and MSISDN is stored in HLR  MSISDN is not required to be stored in the (U)SIM • MSISDN is typically not needed in the LTE system Irfan Ali Irfan Ali 10 10
  • 11.
    (International Mobile SubscriberIdentifier) IMSI - Structure World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea 9-10 digits MCC MNC MSIN MSIN: Mobile Subscriber Subscriber Max 15 digits Identification Number Irfan Alper Erol Uniquely identifies a subscriber Source for MCC and MNC codes: http://en.wikipedia.org/wiki/Mobile_Network_Code http://en.wikipedia.org/wiki/Mobile_Country_Code Irfan Ali Irfan Ali 11 11
  • 12.
    Operator Identity  A mobile operator’s network is also known as a Public Land Mobile Network (PLMN).  The identity used for an operator’s network is called the PLMN- Identity (PLMN-ID) and consists of the Mobile Country Code and the Mobile Network Code.  An operator may be identified by more than one PLMN-ID World 3 digits MCC: Mobile Country Code MCC 310 Country 286 404 US Turkey India PLMN 2-3 digits MCC MNC MNC: Mobile Network Code Operator 01 02 03 Identifies an operator Turkcell Vodafone Avea PLMN ID = MCC + MNC Irfan Ali Irfan Ali 12 12
  • 13.
    MSISDN – Structure World 1-3 digits CC CC: Country Code 1 90 91 Country US Turkey India 2-3 digits CC NDC NDC: National Destination Code 533, 540, 505, 212,216, Operator … … … Identifies an operator Turk Turkcell Vodafone Avea Telecom 9-10 digits CC NDC SN SN: Subscriber 123 4567 123 4568 Subscriber Number Max 15 digits Irfan Alper Erol +90 533 123 4567 Uniquely identifies a subscriber List of country calling codes: Source for MCC and MNC codes: www.wikipedia.org http://en.wikipedia.org/wiki/List_of_country_calling_codes Irfan Ali Irfan Ali 13 13
  • 14.
    Identities and Plumbingfor LTE IMSI IMSI IMSI GUTI GUTI C-RNTI C-RNTI SRB-0 HSS SRB-1 S1-MME MME SRB-2 NAS GTPC-1 SRB Identity GTPC-1 Data Radio Bearer 10 GTP-U-10 GTP-U-10 EPS Bearer Identity IMSI IMSI UE eNB S-GW P-GW SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary Identity Irfan Ali Irfan Ali GUTI 14 14 Globally Unique Temporary Identity
  • 15.
    Identities in LTE • IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network Identity) Temporary Identity)  Permanent identity of UE in SIM  Is created by eNB and only used to (MCC+MNC+MSIN), where identify a UE within the scope of an MCC+MNC = Home PLMN of eNB and provided to the UE during subscriber. random access process and setup of  Kept secret from eNB. RRC connection.  Max 15 digits  C-RNTI is 16 bits long. • GUTI (Globally unique temporary identity)  Created by the MME for the UE.  Used between MME and UE instead of IMSI.  GUTI may be seen by eNB if NAS message is sent un-encrypted, eg when UE has moved to a new area and needs to be served by a new MME.  56 bits + MCC and MNC Irfan Ali Irfan Ali 15 15
  • 16.
  • 17.
    Objective of UEAttach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IP HSS address to communicate with P-GW outside world. • During the process of “attach” S-GW  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- >eNB<->S-GW<->PGW  UE Context created in all the nodes in the network  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol C-RNTI Cell- Radio Network Temporary Identity Bearer Setup at end of the Attach Procedure Irfan Ali Irfan Ali 17 17
  • 18.
    Objective of UEAttach Procedure Internet • The goal of “attaching” to the UE’s IP address network is to obtain an IP HSS UE Context: KEY: IMSI address to communicate with UE Context: P-GW KEY: IMSI ….. outside world. ….. S6a • During the process of “attach” UE Context: KEY: IMSI S-GW …..  The UE is authenticated and authorized to use send/receive S-GW data. MME  Data path created beteween UE<- S1-MME >eNB<->S-GW<->PGW  UE Context created in all the UE Context: S1 Cntxt: S1AP nodes in the network TEID(key)….. RB Cntxt: C-RNTI(key),..  UE is provided an IP address X2 eNB eNB SRB Signalling Radio Bearer DRB Data Radio Beaer TEID Tunnel Endpoint Identifier GTP GPRS Tunneling Protocol Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary Identity Irfan Ali Irfan Ali 18 18
  • 19.
    UE Performs attach– Part 1 of 4 UE HSS eNB MME SGW PGW 0. UE has synchronized to the downlink frame of the eNB and hence knows o Interne 0. UE has the DL frame boundaries. The UE has read the MIB and from there the selected eNB SIB2 of the eNB and knows when the random access channel (RACH) slots are in the uplink direction. 1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since 1. Random Access Access multiple UEs could have transmitted on the same subframe and same Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control channel (CC) to see if the UE’s preamble has been accepted by the eNB. PDCCH/PDSCH 2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the next Temporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel. UL-SCH: SRB0 3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI. RRC Setup 4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3 C-RNTI to the UE. When the UE receives its own transmitted message (unique) 5. RRC Connection Setup and C-RNTI, the contention resolution process is complete. 5. The eNB now transmits RRC Connection Setup message including the C- UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention that could have occurred due to two UEs using the same preamble 6. RRC Connection Complete sequence in RACH access step. NAS Msg Attach Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in NAS Msg PDN the previous step. The UE also includes its IMSI in the message. Connect Req RNTI Radio Network Temporary Identity Irfan Ali Irfan Ali 19 19 RA-RNTI C-RNTI Random Access RNTI Cell RNTI RAPID Random Access Preamble ID
  • 20.
    UE Performs Attach– Part 2 of 4 HSS UE eNB MME SGW eNB selects PGW MME Interne S1-MME 7. Initial UE Message S6a 8. Auth Info Request NAS Msg: Attach IMSI, .. Request, IMSI, .. NAS Msg PDN User 9. Auth Info Answer Connect Req Kasme, AUTN, RAND,XRES Authentication DL-SCH:CCH SRB1 Procedure 10. DL NAS Xport 11. DL Info Xfer Authn Request Authn Request: MME Compares AUTN, RAND, RES with XRES. If same, AKA 12. UL Info Transport successful 13. UL NAS Xport Authn Response Authn Response: RES UL-SCH: SRB1 DL-SCH:CCH SRB1 14. DL NAS Xport 15. DL Info Transport Security Mode Command Security Mode Command NAS Security Setup Procedure 16. UL Info Transport 17. UL NAS Xport Security Mode SMC Complete Complete UL-SCH: SRB1 18. Location Update Request Authorization IMSI, … NAS Security 19. Location Update Response Subscription Data Encrypted Info Irfan Ali Irfan Ali 20 20 AKA: Authentication and Key Agreement Integrity Protected Info
  • 21.
    UE Performs Attach– Part 3 of 4 HSS UE eNB MME SGW NAS Security PGW Interne GTPC 20. Create Session GTPC Request (IMSI, TEIDs, 21. Create Session PGW IP,…) Request (IMSI, TEIDs, …) S1-MME 22. Create Session 23. Create Session DL-SCH:CCH SRB1 Response (IMSI, TEIDs) 24. Initial Context Setup Request Response(IMSI, TEIDs) 25. RRC Security Mode (UE Context Info, TEIDs) Command, AS Algorithm NAS: Attach Accept NAS: Activate Bearer Setup UL-SCH: SRB1 default bearer req Procedure Start 26. RRC Security Mode GTPC Session GTPC-1 Session Complete GTP-U-10 Tunnel SRB-2 AS Security Setup AS Security Procedure 27. Obtain UE’s Radio Capability DL-SCH:CCH SRB2 28. RRC Connection Reconfiguration NAS1 Attach Completion NAS2 Data Radio Bearer Setup UL-SCH: SRB2 29. RRC Reconfig Complete 30. Initial Context Setup Complete (S1U TEIDs) 31. UL Information Transfer GTPC 32. UL NAS Xport Bearer Setup NAS1 NAS2 33. Modify Bearer Req. NAS: Attach Complete Procedure Completion SRB-0 (IMSI, TEIDs…) NAS: Activate SRB-1 default bearer acpt 34. Modify Bearer Resp (IMSI,…) Encrypted Info SRB-2 Irfan Ali Irfan Ali Data Radio Bearer-10 GTPU-10 Tunnel 21 21 Integrity Protected Info
  • 22.
    UE Performs Attach– Part 4 of 4 DHCP HSS Server UE eNB MME SGW SRB-0 PGW Internet SRB-1 SRB-2 S1-MME GTPC Session GTPC-1 Session Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel DHCP DHCP DHCP DHCP Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel Client Server Client Server IP address of the UE is routed to this interface Irfan Ali Irfan Ali 22 22
  • 23.
    Architecture key Concept:Roaming • 3GPP architecture from early days has supported a subscriber going to a foreign network and still getting service  Home PLMN: Subscriber’s home network (eg. Turkcell)  Visited PLMN: Foreign/Roamed-to network (eg. Orange) • What does roaming require:  Ability from VPLMN to identify the HPLMN of the subscriber  Ability to authenticate the subscriber from VPLMN  Sharing of revenue between VPLMN and HPLMN (roaming charges) PLMN Public Land Mobile Network VPLMN Visited PLMN HPLMN Home PLMN Irfan Ali Irfan Ali 23 23
  • 24.
    Roaming Concept HPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org HSS IMS Internet IMS Internet HSS P-GW P-GW S6a S6a S5 S5 S11 S-GW S11 S-GW S-GW S-GW MME MME S1-MME S1-MME S1-U S1-U HPLMN VPLMN Domain = epc.mnc01.mcc286.pub.3gppnetwork.org Domain = epc.mnc01.mcc404.pub.3gppnetwork.org X2 X2 X2 X2 eNB eNB eNB eNB eNB eNB LTE-Uu LTE-Uu Non-Roaming Roaming IMSI = 286 + 01 + 1234567890 IMSI = 286 + 01 + 1234567890 Turkey Turkcell Turkey Turkcell HPLMN Home PLMN VPLMN Visited PLMN Irfan Ali Irfan Ali Turkcell subscriber in Turkey 24 24 Turkcell subscriber in India
  • 25.
    General: LTE/EPCSpecifications 23.003 Identifiers 29.303 DNS 33.401 Security Stage 2&3 24.301 NAS HSS SPR PCC Stage 2: 23.203 Charging Stage 2: 32.240 S6a Unspecified Sp 29.214 S1-MME 29.272 PCRF Rx 36.410 General MME Operator 36.411 Layer 1 36.412 (Sig xport) S11 29.212 S9 Services S10 29.213 Sig Flow 36.413 (S1AP) Gx 29.215 36.133 RRM Reqds 29.274 GTPC S1u Serving S5 SGi UE eNB PDN GW Internet GW LTE-Uu 29.274 GTPC 29.061 36.304 Idle X2 36.410 General 29.281 GTPU Gz/Rf 36.306 Capability 36.411 Layer 1 Gy/Ro 36.314 Measurement 36.414 (Data xport) 32.251 23.122 Idle-NAS 29.281 GTPU Online Offline Bx Billing 36.420 General Charging Charging Domain 36.201,211,213,214 PHY 36.421 Layer 1 Function Function 32.251 36.321 MAC 36.422 (Sig xport) 36.322 RLC 36.424 (Data xport) 36.323 PDCP 36.423 (X2AP) 36.331 RRC 29.281 GTPU E-UTRAN Stage-2: Evolved Packet Core Stage 2: 23.401 36.300 Stage-3 Specification Stage-2 Specification Stage-1 Specification Stage-1: 22.278 Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering Irfan Ali Irfan Ali 25 25