Introduction
Mobile Communications since the early 1980’s keeps on evolving from 2G, 3G, 3.5G, 4G and then recently talks about 5G is in every corner.
But before we dig into the latest evolution (i.e. 5G), lets have a look first what is LTE and VoLTE.
Technology advances in smartphones and mobile devices drove the evolution of mobile data usage. As such those internet-based services were made available to mobile communications, creating the mobile broadband service that should be comparable to the fixed broadband connection in which we’ve known nowadays as LTE or 4G.
This article will drive you through the essential details about LTE core network.
System Architecture
In the overall system architecture that is LTE RAN (radio-access-network) and the GPRS core network was re-worked into what is called SAE (System Architecture Evolution). The GPRS part of the network evolved to an architecture that is called EPC (Evolved Packet Core) and combined with LTE RAN is referred to as the EPS (Evolved Packet System).
SAE is designed to simplify LTE networks and establish a flat architecture similar to IP based communication networks.
The RAN is responsible for all radio-related functionality of the network, for example, scheduling, radio-resource handling, retransmission protocols, coding and various multi-antenna schemes.
While the EPC is an evolution of the GPRS core network and available only for the packet-switch domain and it has no access to circuit-switched domain. It is responsible for functions like authentication, charging, and setup of end-to-end connections. Several RAN can be integrated to an EPC.
EPC Main Network Elements
Between the UE and EPC is functional layer referred to as the Non-Access Stratum (NAS). This layer is used to manage the establishment of communication sessions and for maintaining continuous communications with the user equipment as it moves. Distinguishing it from the Access Stratum (AS) that handles the operation between the terminal and the radio-access network.
Mobility Management Entity (MME)
MME is the control-plane node of the EPC. It is responsible for the connection/release of bearers to a UE, handling of IDLE to ACTIVE transitions, and handling of security keys.
Serving-Gateway (S-GW)
S-GW is the user-plane node connecting the EPC to the LTE RAN. The S-GW acts as a mobility anchor when terminals move between eNodeBs (figure 2), as well as a mobility anchor for other 3GPP technologies (GSM/GPRS and HSPA). Collection of information and statistics necessary for charging is also handled by the S-GW.
Packet Data Network Gateway (PGW)
Connects the EPC to the internet and allocation of the IP address for the UE. It also enforces quality-of-service (QoS) according to the policy provided by the PCRF.
Policy and Charging Rules Function (PCRF)
Responsible for the QoS enforcement and handles charging
Home Subscriber Service (HSS)
Contains database related to subscriber information. This db is interrogated for allowed/disallowed services during the UE attached procedure.
MME <-> HSS
The MME connects to HSS for the retrieval of subscriber information, barring status and services. This interface is referred to as S6 Interface using the Diameter protocol
MME <-> S-GW
This connection is called the S11 Interface it used to coordinate the bearers services. GTP-C Protocol tunnels the signaling messages between MME and S-GW
S-GW <-> P-GW
This connection is referred as the S5 Interface (or S8 Interface when roaming is involve). It provides user plane tunneling and tunnel management between Serving GW and PDN GW. It is used for Serving GW relocation due to UE mobility and if the Serving GW needs to connect to a non-collocated PDN GW for the required PDN connectivity. GTP-C Protocol tunnels the signaling messages between S-GW and P-GW
Note that most EPC implementations have redundant node for loadsharing and disaster handling. Between MMEs you have the S10 Interface. For the legacy core, S4 Interface (SGSN <-> S-GW) provides control and mobility support towards GPRS Core.
UE <-> eNodeB
Between the UE and eNodeB (or eNB) is called the LTE-Uu interface or simply the LTE radio interface.
eNB <-> MME
eNB connects to the EPC network via the S1-MME Interface. This is also referred as control plane interface where the signaling flows and procedures are handled
eNB <-> S-GW
As soon as the required signaling flows successfully established, user data will be sent over to the S1-U interface.
The separation of user plane (S1-U) and control plane (S1-MME) allows the eNB to connect different nodes in the EPC network and allows independent dimensioning between signaling and user data traffic.
Another important interface is the X2 interface or connections between eNodeBs. These connections can be used to exchange signaling messages to handle the radio resources (e.g. to reduce interference) and also to manage traffic when users move from one eNodeB to another during a handover procedure.
User Equipment (UE) to the LTE Network
In order to use the 4G/LTE services, the UE must first register to the network. This is usually called the LTE or EPS Attach Procedure.
Let’s see how the attach flow is done step-by-step. We’ll also describe how the signaling flow and the interaction of the different network elements during this process.
Initial Attach Procedure
- The UE initiates attach procedure by transmitting the “Attach Request” together with the RRC parameters and the selected network is delivered to the MME via the eNodeB (LTE-Uu).
- In this procedure eNodeB selects the MME and forwards the attached request via the S1-MME control interface (S1AP)
- After deriving the IMSI and security capability information, MME will perform the authentication procedure. Using the DIAMETER S6a, MME sends Authentication Information Request to the HSS for authentication vectors.
- LTE requires mutual authentication. A user must authenticate the network and vice versa. The received vectors (RAND, AUTN, XRES, Kasme), RAND, AUTN, KSIasme are send to the UE and use it to generate authentication vectors and authenticate the network. Note that XRES and Kasme is kept by MME for user authentication and NAS security, Kasme index (KSIasme) is sent to the UE.
- After successful authentication, MME can also request the UE’s IMEI to query the EIR database (S13 Interface) by sending MEIdentityCheckResponse and result is responded by MEIdentityCheckReponse. S13 interface is based on the diameter.
- As soon as all the security procedures are successful, MME can now register the user (or subscriber) to the network. In this step through diameter (S6), Update Location Request is sent to HSS. This procedure will notify the HSS about the user registration and obtain subscription information. HSS will keep the MME id as the last known location. Through the Update Location Response, subscription information and other details (APN, QoS, MSISDN) is provided to MME.
Data/Session Establishment
- 7. After selecting the desired S-GW, MME sends Create Session Requests (GTP-C) to establish a session using the default bearer for the newly attached user. This part of the flow is referred to as the S11-Interface
- 8. Note that the MME, based on the APN also decide which P-GW to connect to. Also based on the APN, a S-GW is chosen to reach the P-GW. Create Session Request is now sent to P-GW. This part of the flow is referred to as the S5/S8 interface.
- In the create session request, subscription information received from the HSS is included will be used by P-GW to consulting the PCRF for the default PCC rules. This interaction is made through the Gx interface
- 9. Next step in the S5 interface, S-GW communicates to P-GW the S5 TEID and once this is completed the downlink GTP-U tunnel is created allowing P-GW downlink traffic to be sent and UE IP address is allocated.
- 10. P-GW will now interact with PCRF via the Gx Interface (diameter), to get the PCC rules for the UE and obtain authorization according to the policies implemented. In between, PCRF will also request access profile to SPR for policy rules of the subscribers. The profile may include information such as SDF Filter, QCI, ARP, APN-AMBR (UL/DL), Charging Method (e.g. Offline), Changing Reporting Action (e.g. Start Reporting ECGI, TAI), etc.
- 11. The P-GW informs the MME (via S-GW) of the QoS information applied to the established EPS sessions and default EPS bearer, by sending it in a Create Session Response message. Note that PCRF may decide to keep the value the MME received from the HSS, or select a new value.
- 12. P-GW also allocate the uplink S5 TEID, completing the uplink/downlink traffic exchange
- 13. When the S-GW, received the Create Session Response it will keep the uplink TEID and allocate S1 TEID and sends it to the MME and keeps the S5 TEID. The reason of keep the S5 TEID is to maintain the uplink to the P-GW in case of handover or TAU (tracking area update)
- 14. Now the MME, returns Attach Accept to the UE via eNodeB and prepares E-RAB/Initial Context setup (i.e. resource allocation and S1 bearer setup). Included information are UE IP address, EPS bearer ID, GUTI, TAI, etc..
- 15. eNode and UE will exchange security (AS Security setup) for a secured radio link communications, establish dedicated radio bearer (DRB). UE will send the Attach Complete message and from now on the UE and MME is in EMM Registered state. UE can now send uplink packet to eNodeB which will be tunelled to S-GW and P-GW.
- 16. Upon receiving the Initial Context Response and Attach Complete message, the MME build and send Modify Bearer Request (containing the EPS Bearer ID, eNB TEID) to S-GW. The S-GW will respond and accept thru Modify Bearer Response. This time S-GW can now send the buffered downlink packets and completes the setup procedure for S1 bearer. With the establishment of S1 bearer, the eNB and the S-GW can exchange traffic with each other. Now, the default EPS bearer from the UE all the way to the P-GW is finally established, allowing uplink/downlink EPS bearer communication between the UE and the P-GW.
- 17. MME will also update the HSS (Notify Request) containing the P-GW for mobility record updating.
EPS Session Termination
- 18. With session establish and packet uplink/downlink the P-GW monitors the traffic based on the allotted quota and validity time of the session. This initial allocation (CCR-I, credit-control-request-initial) exchanged between the P-GW and PCRF.
- 19. When a session stopped (i.e. termination from the subscriber), MME will tear-down the session and sends Delete Session Request to the P-GW via the S-GW.
- 20. P-GW inform PCRF that user have terminated the session (CCR-T, credit-control-request-termination)
- 21. UE may initiate a detach procedure after the session and de-register from the network
Hope you liked this article on beginner’s guide on LTE. LTE is an optimized solution for data transfer in mobile communications only. It does not include voice service or capability. As a workaround or short-term solution the Circuit-Fallback is developed to provide telephony services in 4G. I will discuss the CSFB procedure in my next article.
Although more than 20years working on Mobile Telecommunications – Core Network. Always wanting to learn and try new things.