Lte interview questions

LTE Frequently Asked Questions
 What isLTE?
 What isgoal of LTE?
 What speedLTE offers?
 What isLTE Advanced?
 What isLTE architecture?
 What isEUTRAN?
 What are LTE Interfaces?
 What are LTE Networkelements?
 What are LTE protocols& specifications?
 What isVoLGA?
 What isCS FallbackinLTE?
 How doesLTE Securityworks?
 What isIP MultimediaSubsystem(IMS)?
 How doesmeasurementsworkinLTE?
 What isAutomaticNeighbourRelation?
 How doesIntraE-UTRAN Handoverisperformed?
 How doespolicycontrol andchargingworksinLTE?
 What isSON & howdoesit workinLTE?
 How doesNetworkSharingworksinLTE?
 How doesTimingAdvance (TA) worksinLTE?
 How doesLTE UE positioningworksinE-UTRAN?
 How manyoperatorshave committedforLTE?
 What isSingle RadioVoice Call Continuity(SRVCC)?
 How doesLocationService (LCS) workinLTE network?
 How doesLawful InterceptionworksinLTEEvolvedPacketSystem?
 What iscarrier aggregationinLTE-Advanced?
 What isRelayNode andhow doesRelayingworksinLTE-Advanced?
What isLTE?
LTEi (Long Term Evolution) is initiated by 3GPPi to improve the mobile phone standard to cope
with future technology evolutions and needs.
 Loginor registertopost comments

What isgoal of LTE?

The goals for LTE include improving spectral efficiency, lowering costs, improving services,
making use of new spectrum and reformed spectrum opportunities, and better integration with
other open standards.

What speedLTE offers?
LTE provides downlink peak rates of at least 100Mbit/s, 50 Mbit/s in the uplink and RAN
(Radio Access Network) round-trip times of less than 10 ms.

What isLTE Advanced?
LTE standards are in matured state now with release 8 frozen. While LTE Advanced is still
under works. Often the LTE standard is seen as 4G standard which is not true. 3.9G is more
acceptable for LTE. So why it is not 4G? Answer is quite simple - LTE does not fulfill all
requirements of ITU 4G definition.
Brief History of LTE Advanced: The ITU has introduced the term IMT Advanced to identify
mobile systems whose capabilities go beyond those of IMT 2000. The IMT Advanced systems
shall provide best-in-class performance attributes such as peak and sustained data rates and
corresponding spectral efficiencies, capacity, latency, overall network complexity and quality-of-
service management. The new capabilities of these IMT-Advanced systems are envisaged to
handle a wide range of supported data rates with target peak data rates of up to approximately
100 Mbit/s for high mobility and up to approximately 1 Gbit/s for low mobility.
See LTE Advanced: Evolution of LTE for more details.

What isLTE architecture?
The evolved architecture comprises E-UTRAN (Evolved UTRAN) on the access side and EPC
(Evolved Packet Core) on the core side.
The figure below shows the evolved system architecture


What isEUTRAN?
The E-UTRAN (Evolved UTRAN) consists of eNBs, providing the E-UTRA user plane
(PDCP/RLC/MAC/PHY) and control plane (RRC) protocol terminations towards the UE. The
eNBs are interconnected with each other by means of the X2 interface. The eNBs are also
connected by means of the S1 interface to the EPC (Evolved Packet Core), more specifically to
the MME (Mobility Management Entity) by means of the S1-MME and to the Serving Gateway
(S-GW) by means of the S1-U.

What are LTE Interfaces?
The following are LTE Interfaces : (Ref: TS 23.401 v 841)
 S1-MME :- Reference pointforthe control plane protocol betweenE-UTRAN andMME.
 S1-U:- Reference pointbetweenE-UTRAN andServingGWforthe per beareruserplane
tunnellingandintereNodeBpathswitchingduringhandover.
 S3:- It enablesuserandbearerinformationexchangeforinter3GPPaccessnetworkmobility
inidle and/oractive state.

 S4:- It providesrelatedcontrol andmobilitysupportbetweenGPRSCore andthe 3GPP
Anchorfunctionof ServingGW.In addition,if DirectTunnel isnotestablished,itprovidesthe
userplane tunnelling.
 S5:- It providesuserplane tunnellingandtunnel managementbetweenServingGWandPDN
GW. It is usedforServingGW relocationdue toUE mobilityandif the ServingGWneedsto
connectto a non-collocatedPDN GWfor the requiredPDN connectivity.
 S6a:- It enablestransferof subscriptionandauthenticationdatafor
authenticating/authorizinguseraccesstothe evolvedsystem(AAA interface) betweenMME
and HSS.
 Gx:- It providestransferof (QoS) policyandchargingrulesfromPCRFtoPolicyandCharging
EnforcementFunction(PCEF) inthe PDN GW.
 S8:- Inter-PLMN referencepointprovidinguserandcontrol plane betweenthe ServingGWin
the VPLMN andthe PDN GW inthe HPLMN. S8 isthe interPLMN variantof S5.
 S9:- It providestransferof (QoS) policyandchargingcontrol informationbetweenthe Home
PCRFand the VisitedPCRFinorderto supportlocal breakoutfunction.
 S10:- Reference pointbetweenMMEsfor MME relocationand MME to MME information
transfer.
 S11:- Reference pointbetweenMME andServingGW.
 S12:- Reference pointbetweenUTRAN andServingGWfor userplane tunnellingwhenDirect
Tunnel isestablished.Itisbasedonthe Iu-u/Gn-ureference pointusingthe GTP-Uprotocol as
definedbetweenSGSN andUTRAN or respectivelybetweenSGSN andGGSN.Usage of S12 is an
operatorconfigurationoption.
 S13:- It enablesUE identitycheckprocedure betweenMMEand EIR.
 SGi:- It isthe reference pointbetweenthe PDN GWand the packetdata network.Packetdata
networkmaybe an operatorexternal publicorprivate packetdatanetworkoran intra operator
packetdata network,e.g.forprovisionof IMSservices.Thisreference pointcorrespondstoGi
for 3GPP accesses.
 Rx:- The Rx reference pointresidesbetweenthe AFandthe PCRFinthe TS 23.203.
 SBc:- Reference pointbetweenCBCandMME forwarningmessage deliveryandcontrol
functions.

What are LTE Networkelements?
eNB
eNB interfaces with the UE and hosts the PHYsical (PHY), Medium Access
Control (MAC), Radio Link Control (RLC), and Packet Data Control
Protocol (PDCP) layers. It also hosts Radio Resource Control (RRC)
functionality corresponding to the control plane. It performs many
functions including radio resource management, admission control,
scheduling, enforcement of negotiated UL QoS, cell information
broadcast, ciphering/deciphering of user and control plane data, and
compression/decompression of DL/UL user plane packet headers.
Mobility Management Entity
manages and stores UE context (for idle state: UE/user identities, UE mobility state, user security

parameters). It generates temporary identities and allocates them to UEs. It checks the
authorization whether the UE may camp on the TA or on the PLMN. It also authenticates the
user.
Serving Gateway
The SGW routes and forwards user data packets, while also acting as the mobility anchor for the
user plane during inter-eNB handovers and as the anchor for mobility between LTE and other
3GPP technologies (terminating S4 interface and relaying the traffic between 2G/3G systems and
PDN GW).
Packet Data Network Gateway
The PDN GW provides connectivity to the UE to external packet data networks by being the
point of exit and entry of traffic for the UE. A UE may have simultaneous connectivity with
more than one PDN GW for accessing multiple PDNs. The PDN GW performs policy
enforcement, packet filtering for each user, charging support, lawful Interception
and packet screening.

What are LTE protocols& specifications?
In LTE architecture, core network includes Mobility Management Entity (MME), Serving
Gateway (SGW), Packet Data Network Gateway (PDN GW) where as E-UTRAN has E-
UTRAN NodeB (eNB).
See LTE protocols & specifications for specification mappings.
Protocol links are as below
 AirInterface Physical Layer
 GPRS TunnellingProtocol UserPlane (GTP-U)
 GTP-U Transport
 MediumAccessControl (MAC)
 Non-Access-Stratum(NAS) Protocol
 PacketData Convergence Protocol (PDCP)
 RadioLinkControl (RLC)
 RadioResource Control (RRC)
 S1 ApplicationProtocol (S1AP)
 S1 layer1
 S1 SignallingTransport
 X2 ApplicationProtocol (X2AP)
 X2 layer1
 X2 SignallingTransport
Loginor registertopost comments

What isVoLGA?
VoLGA stands for "Voice over LTE via Generic Access". The VoLGA service resembles the
3GPP Generic Access Network (GAN). GAN provides a controller node - the GAN controller
(GANC) - inserted between the IP access network (i.e., the EPS) and the 3GPP core network.
The GAN provides an overlay access between the terminal and the CS core without requiring
specific enhancements or support in the network it traverses. This provides a terminal with a
'virtual' connection to the core network already deployed by an operator. The terminal and
network thus reuse most of the existing mechanisms, deployment and operational aspects.
see VoLGA - Voice over LTE via Generic Access for more details.

What isCS FallbackinLTE?
LTE technology supports packet based services only, however 3GPP does specifies fallback for
circuit switched services as well. To achieve this LTE architecture and network nodes require
additional functionality, this blog is an attempt to provide overview for same.
In LTE architecture, the circuit switched (CS) fallback in EPS enables the provisioning of voice
and traditional CS-domain services (e.g. CS UDI video/ SMS/ LCS/ USSD). To provide these
services LTE reuses CS infrastructure when the UE is served by E UTRAN.
See Understanding CS Fallback in LTE for more details.

How doesLTE Securityworks?
The following are some of the principles of 3GPP E-UTRAN security based on 3GPP Release 8
specifications:
 The keysusedfor NASandAS protectionshall be dependentonthe algorithmwithwhich
theyare used.
 The eNB keysare cryptographicallyseparatedfromthe EPCkeysusedforNASprotection
(makingitimpossible touse the eNBkeytofigure outan EPC key).
 The AS(RRC and UP) and NASkeysare derivedinthe EPC/UEfromkeymaterial thatwas
generatedbya NAS(EPC/UE) level AKA procedure (KASME) andidentifiedwithakeyidentifier
(KSIASME).
 The eNB key(KeNB) issentfromthe EPCto the eNBwhenthe UE isenteringECM-
CONNECTEDstate (i.e.duringRRCconnectionorS1 contextsetup).

See LTE Security Principles for more details.

What isIP MultimediaSubsystem(IMS)?
The 3GPP IP Multimedia Subsystem (IMS) technology provides an architectural framework for
delivering IP based multimedia services. IMS enables telecom service providers to offer a new
generation of rich multimedia services across both circuit switched and packet switched
networks. IMS offers access to IP based services independent of the access network e.g. wireless
access (GPRS, 3GPP’s UMTS, LTE, 3GPP2’s CDMA2000) and fixed networks (TISPAN’s
NGN)
IMS defines a architecture of logical elements using SIP for call signaling between network
elements and Provides a layered approach with defined service, control, and transport planes.
Some of IMS high level requirements are noted below:
The application plane provides an infrastructure for the provision and management of services,
subscriber configuration and identity management and defines standard interfaces to common
functionality.
The IMS control plane handles the call related signaling and controls transport plane. Major
element of control plane is the Call Session Control Function (CSCF) , which comprises Proxy-
CSCF (P-CSCF), Interrogating-CSCF (I-CSCF) and Serving-CSCF (S-CSCF). The CSCF
(Call/Session Control Function) is essentially a SIP server.
The IMS transport plane provides a core IP network with access from subscriber device over
wireless or wireline networks.

How doesmeasurementsworkinLTE?
In LTE E-UTRAN measurements to be performed by a UE for mobility are classified as below
 Intra-frequencyE-UTRAN measurements
 Inter-frequencyE-UTRAN measurements
 Inter-RATmeasurementsforUTRAN andGERAN
 Inter-RATmeasurementsof CDMA2000 HRPD or 1xRTT frequencies
See Measurements in LTE E-UTRAN for details.


What isAutomaticNeighbourRelation?
According to 3GPP specifications, the purpose of the Automatic Neighbour Relation (ANR)
functionality is to relieve the operator from the burden of manually managing Neighbor
Relations (NRs). This feature would operators effort to provision.
Read Automatic Neighbour Relation in LTE for more details.

How doesIntraE-UTRAN Handoverisperformed?
Intra E-UTRAN Handover is used to hand over a UE from a source eNodeB to a target eNodeB
using X2 when the MME is unchanged. In the scenario described here Serving GW is also
unchanged. The presence of IP connectivity between the Serving GW and the source eNodeB, as
well as between the Serving GW and the target eNodeB is assumed.
The intra E-UTRAN HO in RRC_CONNECTED state is UE assisted NW controlled HO, with
HO preparation signalling in E-UTRAN.
Read LTE Handovers - Intra E-UTRAN Handover for more details.

How doespolicycontrol andchargingworksinLTE?
A important component in LTE network is the policy and charging control (PCC) function that
brings together and enhances capabilities from earlier 3GPP releases to deliver dynamic control
of policy and charging on a per subscriber and per IP flow basis.
LTE Evolved Packet Core (EPC) EPC includes a PCC architecture that provides support for fine-
grained QoS and enables application servers to dynamically control the QoS and charging
requirements of the services they deliver. It also provides improved support for roaming.
Dynamic control over QoS and
charging will help operators monetize their LTE investment by providing customers with a
variety of QoS and charging options when choosing a service.
The LTE PCC functions include:
 PCRF(policyandchargingrulesfunction) providespolicycontrol andflow basedcharging
control decisions.
 PCEF (policyandchargingenforcementfunction) implementedinthe servinggateway,this
enforcesgatingandQoSfor individualIPflowsonthe behalf of

 the PCRF.It alsoprovidesusage measurementtosupportcharging
 OCS (online chargingsystem) providescreditmanagementandgrantscredittothe PCEF
basedon time,trafficvolume orchargeable events.
 OFCS(off-line chargingsystem) receiveseventsfromthe PCEFandgenerateschargingdata
records(CDRs) for the billingsystem.
Refer following whitepapers for more details.
Introduction to Evolved Packet Core
Policy control and charging for LTE networks
Quality of Service (QoS) and Policy Management in Mobile Data Networks

What isSON & howdoesit workinLTE?
Self-configuring, self-optimizing wireless networks is not a new concept but as the mobile
networks are evolving towards 4G LTE networks, introduction of self configuring and self
optimizing mechanisms is needed to minimize operational efforts. A self optimizing function
would increase network performance and quality reacting to dynamic processes in the network.
This would minimize the life cycle cost of running a network by eliminating manual
configuration of equipment at the time of deployment, right through to dynamically optimizing
radio network performance during operation. Ultimately it will reduce the unit cost and retail
price of wireless data services.
See Self-configuring and self-optimizing Networks in LTE for details.

How doesNetworkSharingworksinLTE?
3GPP network sharing architecture allows different core network operators to connect to a
shared radio access network. The operators do not only share the radio network elements, but
may also share the radio resources themselves.
Read Network Sharing in LTE for more.

How doesTimingAdvance (TA) worksinLTE?

In LTE, when UE wish to establish RRC connection with eNB, it transmits a Random Access
Preamble, eNB estimates the transmission timing of the terminal based on this. Now eNB
transmits a Random Access Response which consists of timing advance command, based on that
UE adjusts the terminal transmit timing.
The timing advance is initiated from E-UTRAN with MAC message that implies and adjustment
of the timing advance.
See Timing Advance (TA) in LTE for further details.

How doesLTE UE positioningworksinE-UTRAN?
UE Positioning function is required to provide the mechanisms to support or assist the
calculation of the geographical position of a UE. UE position knowledge can be used, for
example, in support of Radio Resource Management functions, as well as location-based services
for operators, subscribers, and third-party service providers.
See LTE UE positioning in E-UTRAN for more details.

How manyoperatorshave committedforLTE?
List of operators committed for LTE has been compiled by 3GAmericas from Informa Telecoms
& Media and public announcements. It includes a variety of commitment levels including
intentions to trial, deploy, migrate, etc.
For latest info visit http://ltemaps.org/

What isSingle RadioVoice Call Continuity(SRVCC)?
Along with LTE introduction, 3GPP also standardized Single Radio Voice Call Continuity
(SRVCC) in Release 8 specifications to provide seamless continuity when an UE handovers
from LTE coverage (E-UTRAN) to UMTS/GSM coverage (UTRAN/GERAN). With SRVCC,
calls are anchored in IMS network while UE is capable of transmitting/receiving on only one of
those access networks at a given time.

See Evolution of Single Radio Voice Call Continuity (SRVCC) for more details.

How doesLocationService (LCS) workinLTE network?
In the LCS architecture, an Evolved SMLC is directly attached to the MME. The objectives of
this evolution is to support location of an IMS emergency call, avoid impacts to a location
session due to an inter-eNodeB handover, make use of an Evolved and support Mobile
originated location request (MO-LR) and mobile terminated location request MT-LR services.
Release 9 LCS solution introduces new interfaces in the EPC:
 SLg betweenthe GMLC andthe MME
 SLs betweenthe E-SMLCandthe MME
 Diameter-basedSLhbetweenthe HSSandthe HGMLC
For details read LCS Architecture for LTE EPS and LTE UE positioning in E-UTRAN

How doesLawful InterceptionworksinLTEEvolvedPacketSystem?
3GPP Evolved Packet System (EPS) provides IP based services. Hence, EPS is responsible only
for IP layer interception of Content of Communication (CC) data. In addition to CC data, the
Lawful Interception (LI) solution for EPS offers generation of Intercept Related Information
(IRI) records from respective control plane (signalling) messages as well.
See Lawful Interception Architecture for LTE Evolved Packet System for more details.

What iscarrier aggregationinLTE-Advanced?
To meet LTE-Advanced requirements, support of wider transmission bandwidths is required than
the 20 MHz bandwidth specified in 3GPP Release 8/9. The preferred solution to this is carrier
aggregation.
It is of the most distinct features of 4G LTE-Advanced. Carrier aggregation allows expansion of
effective bandwidth delivered to a user terminal through concurrent utilization of radio resources
across multiple carriers. Multiple component carriers are aggregated to form a larger overall
transmission bandwidth.

See Carrier Aggregation for LTE-Advanced for more details.

What isRelayNode andhow doesRelayingworksinLTE-Advanced?
For efficient heterogeneous netw ork planning, 3GPP LTE-Advanced has introduced concept of Relay Nodes (RNs). The Relay
Nodes are low pow ereNodeBs that provide enhanced coverage and capacity at cell edges. One of the main benefits of relaying is
to provide extended LTE coverage in targeted areas at low cost.
The Relay Node is connected to the Donor eNB (DeNB) via radio interface, Un, a modified version of E-UTRAN air interface Uu.
Donor eNB also srves its ow n UE as usual, in addition to sharing its radio resources for Relay Nodes.
LTE Interview Questions?
1) What happens when a LTE UE is powered on? From PHY Layer
Point of view & NAS Point of view?
2) Explain attach procedure in LTE?
3) Why there is two types of security in LTE?
4) What are the measurement events in LTE?
Ans:
Intra/Inter Frequency Events:
Event A1 (Serving becomes better than threshold)
Event A2 (Serving becomes worse than threshold)
Event A3 (Neighbour becomes offset better than PCell)
Event A4 (Neighbour becomes better than threshold)
Event A5 (PCell becomes worse than threshold1 and neighbour becomes
better than threshold2)
Event A6 (Neighbour becomes offset better than SCell)
Inter RAT Events:
Event B1 (Inter RAT neighbour becomes better than threshold)
Event B2 (PCell becomes worse than threshold1 and inter RAT
neighbour becomes better than
threshold2)
5) What is DCI?
6) What are the contents of DCI?
7) What are the main difference between DCI0 and DCI1a?
8) What is contention resolution?
9) When Radio Link Failure is detected?
Ans:
Radio link failure to be detected:

1) upon T310 expiry
2) upon random access problem indication from MAC while
neither T300, T301, T304 nor T311 is running
3) upon indication from RLC that the maximum number of re-
transmissions has been reached
10) What is SRS used for?
Ans: UL reference signal used to measure the channel quality
over a section of the bandwidth.
Node B use this information for frequency selective scheduling
and link adaptation decisions.
11) What is DMRS/DRS?
Ans: DMRS/DRS is uplink reference signal.
Used for : 1)Channel Estimation and synchronization in UL
2)EnodeB can use DMRS for calculating TA command
for each UE.
Two Types: 1) PUSCH DMRS.
2) PUCCH DMRS.
PUSCH DMRS:
1) Included in every resource block allocated to
UE for PUSCH transmission.
2) Distributed only in Frequency domain to
preserve the PAPR characteristic of SC-FDMA.
3) 12 Resource element per resource block
allocated to PUSCH DMRS.
PUCCH DMRS:
1) Included in every resource block allocated to
UE for PUCCH transmission(if transmitted).PUCCH occupies 2
resource block per 1 ms subframe when transmitted.
2) No of REs used for PUCCH DMRS depends on a)
PUCCH format to be transmitted and whether b) normal or extended
cyclic prefix used.
3) PUCCH DRMS used more no of bits in case of
format 1,1a,1b and less no of bits in caseof format 2, 2a, 2b.
12) What is SPS? Explain SPS?
Ans: http://howltestuffworks.blogspot.in/2013/10/semi-persistent-scheduling.html
13) What is DRX?
14) Explain Connected mode DRX and Idle mode DRX?
15) Why PHICH configuration is mentioned in MIB?
16) In what are the scenario RACH is triggered?
17) What is RACH Procedure?
18) How UE come to know which RACH Preamble to USE?
19) Why there is no SOFT HO in LTE?
20) What PLMN Selection Order UE follows during Automatic PLMN
selection and Manual PLMN Selection?
21) What is Timing Advance? What happens if Timing Advance Timer
Expires?

Ans: The timing of UL radio frame is relative to DL radio frame.
EnB provides timing advance command to each UE such that all
UL transmissions arrive at the eNodeB in synchronous manner.
If TA timer expires UE goes of reestablishment procedure or
move to idle.
22) What is SR? What is the use of SR?
23) What is MAC CE?
24) What is BackOff Indicator? What is the use of Backoff
indicator?
Ans :
Backoff Indicator is a special MAC subheader that carries the
parameter indicating the time delay between a PRACH and the next
PRACH.
if the Random Access Response contains a Backoff Indicator
subheader
set the backoff parameter value in the UE as indicated by the
BI field of the Backoff Indicator subheader
else,
set the backoff parameter value in the UE to 0 ms.
25) What is BSR?
Ans: The Buffer Status reporting procedure is used to
provide the serving eNB with information about the amount of
data available for transmission in the UL buffers of the UE.
26) At what scenario UE triggers BSR?

Ans:
 UL data, for a logical channel which belongs to a LCG,
becomes available for transmission in the RLC entity or in
the PDCP entity and either the data belongs to a logical
channel with higher priority than the priorities of the
logical channels which belong to any LCG and for which data
is already available for transmission, or there is no data
available for transmission for any of the logical channels
which belong to a LCG, in which case the BSR is referred
below to as "Regular BSR";
 UL resources are allocated and number of padding bits is
equal to or larger than the size of the Buffer Status
Report MAC control element plus its subheader, in which
case the BSR is referred below to as "Padding BSR"
 retxBSR-Timer expires and the UE has data available for
transmission for any of the logical channels which belong
to a LCG, in which case the BSR is referred below to as
"Regular BSR"
 periodicBSR-Timer expires, in which case the BSR is
referred below to as "Periodic BSR".
27) When different types of BSR are Triggered?
Ans:
For Regular and Periodic BSR:
if more than one LCG has data available for transmission in the
TTI where the BSR is transmitted
report Long BSR
else,
report Short BSR.
For Padding BSR:
if the number of padding bits is equal to or larger than the
size of the Short BSR plus its subheader but smaller than the
size of the Long BSR plus its subheader:
if more than one LCG has data available for transmission
in the TTI where the BSR is transmitted: report Truncated BSR of
the LCG with the highest priority logical channel with data
available for transmission;
else
report Short BSR.
else if the number of padding bits is equal to or larger than
the size of the Long BSR plus its subheader,
report Long BSR.

28) What is the use of system info modification period?
29) What is the content of RAR?
Ans:
A MAC RAR consists of the four fields
 R
 Timing Advance Command
 UL Grant
 Temporary C-RNTI
30) What is the USE of UE specific Reference signal?
31) What is Cell Specific Reference Signal?
32) In what are the scenario UE Triggers RRC Connection
Reestablishment?
Ans:
UE Triggers RRC Connection Reestablishment procedure on
following condition:
 Upon detecting Radio Link Failure
 Handover Failure
 Mobility From E-UTRA Failure
 Integrity Failure Indication Received From Lower Layers

 RRC Connection Reconfiguration Failure
33) What is GUTI?
34) What is the significance of S-TMSI?
35) What is the content of Paging Message?
36) When UE activates integrity and ciphering?
Ans:
 The SECURITY MODE COMMAND message is used to command the UE
for the activation of AS security. E-UTRAN always initiates
this procedure prior to the establishment of Signalling
Radio Bearer2 (SRB2) and Data Radio Bearers (DRBs).
 AS security comprises of the integrity protection of RRC
signalling (SRBs) as well as the ciphering of RRC
signalling (SRBs) and user plane data (DRBs). The integrity
protection algorithm is common for signalling radio bearers
SRB1 and SRB2. The ciphering algorithm is common for all
radio bearers (i.e. SRB1, SRB2 andDRBs). Neither integrity
protection nor ciphering applies for SRB0.
 The eNodeB sends integrity protected SECURITY MODE
COMMAND message to the UE. The UE shall
derive KeNB and KRRCint which is associated with integrity
protection algorithm indicated in the SECURITY MODE
COMMAND. Then, UE verifies the Integrity of the
received SECURITY MODE COMMAND by checking the Message
Authentication Code (MAC) in the SECURITY MODE
COMMAND message. If the SECURITY MODE COMMANDmessage fails
the integrity protection check, then the UE sends SECURITY
MODE FAILURE to the eNodeB.
 If the SECURITY MODE COMMAND passes the integrity
protection check, then the UE shall derive the encryption
keys KRRCenc key and the KUPenc keys associated with the
ciphering algorithm indicated in theSECURITY MODE COMMAND.
 The UE shall apply integrity protection using the indicated
algorithm (EIA) and the integrity key, KRRCintimmediately,
i.e. integrity protection shall be applied to all
subsequent messages received and sent by the UE, including
the SECURITY MODE COMPLETE message.
 The UE shall apply ciphering using the indicated algorithm
(EEA), KRRCenc key and the KUPenc key after completing the
procedure, i.e. ciphering shall be applied to all
subsequent messages received and sent by the UE, except for
the SECURITY MODE COMPLETE message which is sent un-
ciphered.

Lte interview questions

More Related Content

What's hot

Similar to Lte interview questions

Recently uploaded

In this document

Lte interview questions