05 RA41235EN06GLA1 UE States and LTESAE Signaling PDF

UE States and LTE/SAE Signaling
LTE Radio Link and EPS Signaling FD-LTE RL50 and TD-
LTE RL35TD
RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

Nokia Solutions and Networks Academy
Legal notice
Intellectual Property Rights
All copyrights and intellectual property rights for Nokia Solutions and Networks training
documentation, product documentation and slide presentation material, all of which are forthwith
known as Nokia Solutions and Networks training material, are the exclusive property of Nokia
Solutions and Networks. Nokia Solutions and Networks owns the rights to copying, modification,
translation, adaptation or derivatives including any improvements or developments. Nokia
Solutions and Networks has the sole right to copy, distribute, amend, modify, develop, license,
sublicense, sell, transfer and assign the Nokia Solutions and Networks training material.
Individuals can use the Nokia Solutions and Networks training material for their own personal
self-development only, those same individuals cannot subsequently pass on that same
Intellectual Property to others without the prior written agreement of Nokia Solutions and
Networks. The Nokia Solutions and Networks training material cannot be used outside of an
agreed Nokia Solutions and Networks training session for development of groups without the
prior written agreement of Nokia Solutions and Networks.
2 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

Module 5 Objectives
After completing this module, the participant will be able to:
• List the UE Mobility Management and Session Management

states
• Describe the UE network acquisition process
• Describe “typical” UE call processes
• Describe the UE authentication process
• Describe Mobility to and from CSG and Hybrid cells
• Describe Relay Nodes
• Complete Exercise 01 Faulty trace analysis

Module Contents
• UE States
• Context Information
• Network Attach
• S1 Release
• Dedicated Bearer activation
• Service Request
• Network Detach
• Mobility to and from CSG and Hybrid cells
• Relay Nodes
• Authentication
• Exercise 01 Faulty trace analysis

Radio Resource Control (RRC) States
RRC_IDLE RRC_CONNECT
UE eNodeB
E-UTRAN

RRC Connection
RRC_CONNECT
UE • Carries all UE to eNodeB or MME signaling

• UE location tracking eNodeB
• UE “state” tracking
• Establishes C-RNTI for UE

EPS Mobility Management (EMM)
EPS Connection Management (ECM)
RRC_IDLE RRC_CONNECT
E-UTRAN
EMM_DEREGISTERED EMM_REGISTERED
ECM_IDLE ECM_CONNECT

EPC
EPS Session Management (ESM)
EPS Bearer
Established
ESM_INACTIVE ESM_ACTIVE
No PDN PDN Context for UE

Last EPS
Context for UE • IP Address, APN, QoS
Bearer
• S5 IP Address & TEIDs
Released
• S11 IP Address & TEIDs
• S1-U IP Address & TEIDs
• Default Bearer
• Dedicated Bearer

Non-Access Stratum States
Registration
Service Request
TA update, paging, etc.
EMM-Deregistered, EMM-Registered, EMM-Registered,

ECM-Idle and ESM- ECM-Idle and ESM- ECM-Connected and
Inactive Active ESM-Active
RRC: Null RRC: IDLE RRC: CONNECTED
No RRC or EPC Context EPC Context RRC & EPC Context

Power On
IMSI Identifier S-TMSI, TA-ID, IP Address S-TMSI, TA-ID, IP Address
UE Unknown UE Known at TA Level UE Known at Cell Level
PLMN Selection TA Update Handovers
No Data Transfer DRX on DL UL/DL Data Transfer
Periodic TA update Inactivity

Timeout – out of area
Deregistration

EMM main states in the UE

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

HSS Context Information
HSS
General UE Information
 Subscriber Information PDN Context Information
• IMSI
• Context Identifier
• IMEI/IMEI-SV
• UE IP Address
• Telephone Number (MSISDN)
• Bearer QoS Profile
• Charging Information
• Access Point Name
• Access Restrictions
• Serving P-GW
• Default Bearer QoS/Bandwidth
 Security/Authentication
 Serving MME Information
• MME IP Address

UE Context Information
UE
General UE Information PDN Connection

 Subscriber Information • IP Address
• IMSI • Access Point Name
• IMEI/IMEI-SV • Default Bearer Information
• GUTI
• Tracking Area List
• Last Visited Tracking Area ID
EPS Bearer
• Default Bearer QoS/Bandwidth
• EPS Bearer ID
• DRX Parameters
• Transaction ID
 Security/Authentication • Bearer QoS
 Serving MME Information • UL Traffic Flow Template
• MME IP Address

MME Context Information
MME
Active PDN Connection
• APN in use
General UE Information • UE IP Address
• IMSI • Bearer QoS Profile
• IMEI/IMEI-SV • Access Point Name
• Telephone Number (MSISDN) • P-GW info for S5/S8 (CP)
• Charging Information • Default Bearer Information
• Mobility Management State
• GUTI
• ECGI
• Tracking Area List
EPS Bearer
• EPS Bearer ID
• Last Reported Tracking Area
• Transaction ID
• UE Capabilities
• Bearer QoS
• Selected Core Network ID
• S-GW info for S1-U
• MME info for S11
• P-GW info for S5/S8 (UP)
• S-GW info for S11
• eNodeB Address
• eNodeB/MME UE S1AP IDs

S-GW Context Information
SGW
• IMSI EPS Bearer Information
• Telephone Number (MSISDN) • EPS Bearer ID
• Core Network ID • P-GW/S-GW info for S5/S8 (UP)
• MME/S-GW Info for S11 (CP) • S-GW/eNodeB info for S1-U (UP)
• P-GW/S-GW info for S5/S8 (CP) • EPS Bearer QoS
• APN in use • Charging Information
• APN Restrictions

P-GW Context Information
PGW
• IMSI
EPS Bearer Information
• Telephone Number (MSISDN)
• EPS Bearer ID
• Core Network ID
• P-GW/S-GW info for S5/S8 (UP)
• RAT Type
• EPS Bearer QoS
• UE IP Address(es)
• P-GW/S-GW info for S5/S8 (CP)
• Default Bearer

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

Basic Call Processing Procedures
Process of accessing the E-UTRAN/EPC
Attach Includes authentication and basic bearer
connection
The process of transmitting data through

Service Request the EPC to the E-UTRAN/UE
The process of updating the tracking

Tracking Area Update Area location when in idle mode
The process of changing to a new

Handover serving cell during connect mode
The process of disconnection from the

Detach EPC and E-UTRAN

LTE Attach Process
E-UTRAN
Attach Attach
Authenticate
MME Registration
EPC
Attach P-GW Select
UE MME/S-GW Accept
eNodeB
UE ACK Network Attach

eNodeB Acquisition
Acquire
Frequency
Acquire Timing
UE
Physical Layer eNodeB
Cell ID
Read System
Info

System Information
DL Channel Bandwidth

Number of Transmit Antennas
System Frame Number
Master Information Block (BCH / PBCH)
UE
SIB Type 1 (DL-SCH / PDSCH) eNodeB
PLMN Identity
Tracking Area Identity
Cell Identity
Cell Barring Status
Other SIB Scheduling / Mapping Info

System Information Blocks (SI)
- MasterInformationBlock defines the most essential physical layer information of
the cell required to receive further system information;
- SystemInformationBlockType1 contains information relevant when evaluating if
a UE is allowed to access a cell and defines the scheduling of other system
information blocks;
- SystemInformationBlockType2 contains common and shared channel
information;
- SystemInformationBlockType3 contains cell re-selection information, mainly
related to the serving cell;
- SystemInformationBlockType4 contains information about the serving
frequency and intra-frequency neighboring cells relevant for cell re-selection
(including cell re-selection parameters common for a frequency as well as cell
specific re-selection parameters);
- SystemInformationBlockType5 contains information about other E-UTRA
frequencies and inter-frequency neighboring cells relevant for cell re-selection

System Information Blocks (SI)
- SystemInformationBlockType6 contains information about UTRA frequencies
and UTRA neighboring cells relevant for cell re-selection (including cell re-
selection parameters common for a frequency as well as cellspecific re-selection
parameters);
- SystemInformationBlockType7 contains information about GERAN frequencies
relevant for cell re-selection (including cell re-selection parameters for each
frequency);
- SystemInformationBlockType8 contains information about CDMA2000
frequencies and CDMA2000 neighboring cells relevant for cell re-selection
- SystemInformationBlockType9 contains a home eNB identifier (HNBID);
- SystemInformationBlockType10 contains an ETWS primary notification;
- SystemInformationBlockType11 contains an ETWS secondary notification;
- SystemInformationBlockType12 contains a CMAS warning notification;
- SystemInformationBlockType13 contains MBMS-related information.

Cell Selection
“barred” “suitable cell”

Suitable Cell
Acceptable Cell
Barred & Reserved Cells
eNodeB eNodeB
F1 F2 F3 F4 F5 F6
Acquire Frequency
Acquire Timing
Physical Layer Cell ID

• Stored Information Cell
Selection
• Initial Cell Selection Cell Search System Broadcast Info
UE
Procedure Starting Point
HSS MME SGW PGW
• UE IMSI
• Shared Secret
• UE Services
• IMSI
• Shared Secret
UE
eNodeB
Network Attach – 1




Procedure Ending Point
HSS MME SGW PGW
• UE IMSI  UE IMSI  UE IP Addr  UE IP Addr

• Shared Secret  UE IP Addr  TEID  TEID
 Serving MME  New S-GW  Serving MME  Serving S-GW
 HSS Serving UE
 New GUTI
 Updated TAI
• IMSI
• Serving MME
• Shared Secret
 UE IP Addr
 UE IP Addr
 TEID for UE
 Serving MME
UE  S1AP ID for UE
 GUTI
 TAI eNodeB
Default EPS Bearer Context Activation
• Default EPS bearer is typically activated as part of Attach

procedure.
• When it is executed as standalone procedure, MME sends
ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST
message.
• MME shall include EPS Bearer ID and PTI
UE eNB MME
Activate Default EPS Bearer Context Activation

(EPS Bearer Identity, Procedure Transaction Identifier)
Activate Default EPS Bearer Context Accept

Example of ATTACH REQUEST
Attach Request
UE MME
Message Header ESM message container
Security header type: Plain NAS message EPS bearer identity: 0
Protocol discriminator: EPS mobility management messages Protocol discriminator: EPS session management messages
NAS EPS Mobility Management Message Type: Attach NAS ESM messages: PDN connectivity request
request PDN type: IPv4
Type of security context flag (TSC): Native security context Request type: Initial attach
NAS key set identifier: No key is available Protocol Configuration Options
EPS attach type: EPS attach Configuration Protocol: PPP
EPS mobile identity - Old GUTI or IMSI Protocol: (32801) IP Control Protocol
Type of identity: IMSI PPP IP Control Protocol
IMSI Digits: 530010000000016 Code: Configuration Request
UE network capability Identifier: 0
128-EEA0: Supported Primary DNS server IP address: 0.0.0.0
128-EEA1: Supported
128-EEA2: Not Supported
EIA0 - NULL Integrity: Supported
128-EIA1: Supported
128-EIA2: Supported

Example of INITIAL UE MESSAGE
Initial UE Message
eNB MME
ENB-UE-S1AP-ID IE
ENB UE S1AP ID: 32
NAS-PDU IE
“Attach Request & PDN Connectivity Request”
TAI IE
MCC:530, MNC:01, tAC:124 (7C H)
EUTRAN-CGI IE
MCC:530, MNC:01, cell-ID:257
RRC-Establishment-Cause IE
RRC Establishment Cause: mo-Signaling

Example of CREATE SESSION REQUEST
Create Session Request
MME SGW
Message Header Fully Qualified Tunnel Endpoint Identifier (F-TEID) :
Message Type: Create Session Request Interface Type: S11 MME GTP-C interface
Tunnel Endpoint Identifier: 0 TEID/GRE Key: 50331651
International Mobile Subscriber Identity (IMSI) : F-TEID IPv4: 10.60.22.51
IMSI: 530010000000016 Fully Qualified Tunnel Endpoint Identifier (F-TEID) :
MSISDN : Interface Type: S5/S8 PGW GTP-C interface
Address digits: 642117777001 TEID/GRE Key: 0
User Location Info (ULI) : F-TEID IPv4: 10.60.22.146
TAI: MCC:530, MNC:01, tAC:124 Access Point Name (APN) :
ECGI: MCC:530, MNC:01, cell-ID:257 APN (Access Point Name): lablte
Serving Network : PDN Type :
Mobile Country Code (MCC): 530 PDN Type: IPv4
Mobile Network Code (MNC): 1 PDN Address Allocation (PAA) :
RAT Type : PDN IPv4: 0.0.0.0 (0.0.0.0)
RAT Type: EUTRAN Aggregate Maximum Bit Rate (AMBR) :
AMBR Uplink: 60000
AMBR Downlink: 120000
Bearer Context :
EPS Bearer ID (EBI): 5
Bearer Level Quality of Service (Bearer QoS) :
Label (QCI): 7

Example of CREATE SESSION RESPONSE
Create Session
Response
MME SGW
Message Header Bearer Context :
Message Type: Create Session Response
Cause : Request accepted
Tunnel Endpoint Identifier: 50331651
Fully Qualified Tunnel Endpoint Identifier (F-
Cause: Request accepted
TEID) :
Fully Qualified Tunnel Endpoint Identifier (F-TEID)
Interface Type: S1-U SGW GTP-U
:
interface
Interface Type: S11/S4 SGW GTP-C interface
TEID/GRE Key: 150994957
F-TEID IPv4: 10.60.22.130
F-TEID IPv4: 10.60.22.146
Fully Qualified Tunnel Endpoint Identifier (F-TEID)
:
Interface Type: S5/S8 PGW PMIPv6 interface
F-TEID IPv4: 10.60.22.146
PDN Address Allocation (PAA) :
PDN Type: IPv4
PDN IPv4: 192.168.3.2

Example of INITIAL CONTEXT SETUP REQUEST
Initial Context Setup

Request
eNB MME
MME-UE-S1AP-ID IE TransportLayerAddress
MME UE S1AP ID: 3 Transport Layer Address (IPv4):
ENB-UE-S1AP-ID IE 10.60.22.130
ENB UE S1AP ID: 32 GTP-TEID: 150994957 (900000D H)
UEAggregateMaximumBitrate IE NAS PDU
UEAggregateMaximumBitrateDL: 2000000 UESecurityCapabilities IE
UEAggregateMaximumBitrateUL: 1000000 Encryption Algorithm: 0
RABToBeSetupListCtxtSUReq IE Integrity Protection Algorithm: 0
e-RAB-ID: 5 SecurityKey IE
RABLevelQoSParameters Security Key: 0
QCI: 7
Allocation Retention Priority
Priority Level: highest
Pre-emption capability: shall not
trigger pre-emption
Pre-emption vulnerability: not pre-
emptable

Example of ATTACH ACCEPT
Attach Accept
UE MME
Message Header EPS quality of service
Security header type: Plain NAS message Quality of Service Class Identifier (QCI): QCI 7
Protocol discriminator: EPS mobility management messages Maximum bit rate for uplink : 0 kbps
NAS EMM Message Type: Attach accept Maximum bit rate for downlink : 0 kbps
EPS attach result: EPS only Guaranteed bit rate for uplink : 0 kbps
GPRS Timer: 54 min Guaranteed bit rate for downlink : 0 kbps
Tracking area identity list Access Point Name
Mobile Country Code (MCC): 530 APN: lablte
Mobile Network Code (MNC): 1 PDN address
Tracking area code(TAC): 124 PDN type: IPv4
ESM message container PDN IPv4: 192.168.3.2
EPS bearer identity: 5 EPS mobile identity
Protocol discriminator: EPS session management Type of identity: GUTI
messages Mobile Country Code (MCC): 530
NAS ESM messages: Activate default EPS bearer Mobile Network Code (MNC): 1
context request MME Group ID: 1
MME Code: 1
M-TMSI: 3233808387 (C0C00003 H)

Example of INITIAL CONTEXT SETUP RESPONSE
Initial Context Setup

Response
eNB MME
MME-UE-S1AP-ID IE
MME UE S1AP ID: 3
ENB-UE-S1AP-ID IE
ENB UE S1AP ID: 32
UEAggregateMaximumBitrate IE
UEAggregateMaximumBitrateDL: 2000000
UEAggregateMaximumBitrateUL: 1000000
RABSetupListCtxtSURes IE
e-RAB-ID: 5
transportLayerAddress
transportLayerAddress (IPv4): 10.60.22.36
gTP-TEID: 175

Example of MODIFY BEARER REQUEST
Modify Bearer Request
MME SGW
Message Header
Message Type: Modify Bearer Request
Fully Qualified Tunnel Endpoint Identifier (F-TEID) :
Interface Type: S11 MME GTP-C interface
F-TEID IPv4: 10.60.33.51
Bearer Context
EPS Bearer ID (EBI):
Interface Type: S1-U eNB GTP-U interface
TEID/GRE Key: 175
F-TEID IPv4: 10.60.22.36

MODIFY BEARER RESPONSE Message
Modify Bearer Response
MME SGW
Message Header
Message Type: Modify Bearer Response
Cause :
Cause: Request Accepted
Bearer Context
Cause :
Cause: Request Accepted
Interface Type: S1-U SGW GTP-U interface
F-TEID IPv4: 10.60.22.130

3 GPP & Traces
5.3.2.1 E-UTRAN Initial Attach

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

S1 Release Reference to specs.: TS 23.401 section 5.3.5
• After attach UE is in EMM_Registered state.

• The default Bearer has been allocated (RRC_connected + ECM_connected) on
detection of a period of inactivity.
• If there is a period of inactivity by the UE, the Admission Control should free the
resources (RRC_idle + ECM_idle)
MME Serving PDN

Gateway Gateway
(SGW)
EMM_Registered
ECM_Connected
S1 Release Request
Update Bearer Request
cause
release of eNB S1U resources
Update Bearer Response
S1 Release Command
RRC Connection Release
cause
RRC Connection Release Ack
S1 Release Complete
EMM_Registered
S1 Signaling Connection Release
ECM_Idle

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

Dedicated EPS Bearer Context Activation
• The MME initiate the dedicated bearer context activation

procedure by sending an ACTIVATE DEDICATED EPS
BEARER CONTEXT REQUEST message.
• The MME allocates and sends the EPS bearer identity.
• The message shall include PTI if the procedure is initiated by
the UE.
UE eNB MME
Activate Dedicated EPS Bearer Context Request

(EPS Bearer Identity, PTI*)
Activate Dedicated EPS Bearer Context Accept

Dedicated bearer activation
UE eNodeB MME S-GW P-GW PCRF
1. IP Can session
2. Create Bearer Modification
4. Bearer Setup Request/ Session 3. Create Bearer Request
Management Request Request
5. RRC Connection reconfiguration

Complete
7. Bearer Setup Response
8. Direct Transfer
9. Session Management Response
10. Create Bearer

Response 11. Create Bearer
Response 12. IP Can session
Modification

1. IP Can session

Complete
8. Direct Transfer
10. Create Bearer

Modification

1. IP Can session

Complete
8. Direct Transfer
10. Create Bearer

Modification

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

UE Service Request – 1

UE Service Request – 2

Example of INITIAL UE MESSAGE (Service
Request)
Initial UE Message
(EMM: Service Request)
eNB MME
ENB-UE-S1AP-ID IE EUTRAN-CGI IE
ENB-UE-S1AP-ID: 33 Mobile Country Code (MCC): 530
NAS-PDU IE Mobile Network Code (MNC): 1
Security header type: Security header for Cell-ID: 257
the SERVICE REQUEST message RRC-Establishment-Cause IE
Protocol discriminator: EPS mobility RRC-Establishment-Cause: mo-Data
management messages S-TMSI IE
NAS EPS Mobility Management Message S-TMSI
Type: Service Request
MMEC: 01
NAS key set identifier: No key is available
M-TMSI: 3233808387 (c0c00003 H)
TAI IE
Mobile Country Code (MCC): 530
Mobile Network Code (MNC): 1
Tracking Area Code (TAC): 124

Example of INITIAL CONTEXT SETUP (Service
Request)
Initial Context
Setup
eNB MME
MME-UE-S1AP-ID IE TransportLayerAddress
MME UE S1AP ID: 4 Transport Layer Address (IPv4):
ENB-UE-S1AP-ID IE 10.60.22.130
ENB UE S1AP ID: 33 GTP-TEID: 150994957 (900000D H)
UEAggregateMaximumBitrate IE NAS PDU
UEAggregateMaximumBitrateDL: 2000000 UESecurityCapabilities IE
UEAggregateMaximumBitrateUL: 1000000 Encryption Algorithm: 0
RABToBeSetupListCtxtSUReq IE Integrity Protection Algorithm: 0
e-RAB-ID: 5 SecurityKey IE
RABLevelQoSParameters Security K
QCI: 7 UERadioCapability IE
Allocation Retention Priority rat-Type:eutra
Priority Level: spare accessStratumRelease: r8
Pre-emption capability: shall not ue-Category: 3
trigger pre-emption
Pre-emption vulnerability: not pre-
emptable

Example of MODIFY BEARER REQUEST (Service
Request)
Modify Bearer Request
MME SGW
Message Header
Message Type: Modify Bearer Request
RAT Type
RAT Type: EUTRAN
Interface Type: S11 MME GTP-C interface
F-TEID IPv4: 10.60.22.51
Delay Value
Delay Value: 0
Bearer Context
Interface Type: S1-U eNB GTP-U interface
TEID/GRE Key: 385
F-TEID IPv4: 10.60.22.36

Network Triggered Service Request

Downlink Data Notification
Downlink Data Notification
MME SGW
Message Header
Message Type: Downlink Data Notification
Downlink Data Notification Acknowledge
MME SGW
Message Header
Message Type: Downlink Data Notification Acknowledge
Cause IE
Cause: request accepted

S1 PAGING Message
Paging
eNB MME
UEIdentityIndexValue IE :
UE Identity Index Value: 85 H
UEPagingID IE :
UE Paging ID: S-TMSI
MMEC: 1
M-TMSI: 150994955 (900000B H)
CNDomain IE :
CN Domain: PS
TAIList IE :
TAIItem
TAI
Tracking Area Code (TAC): 123

Network Triggered Service Request
Idle Mode Signaling Reduction (ISR) is a feature that allows the UE to roam
between LTE & 2G/3G. Basically it aims at reducing the frequency of TAU and
RAU procedures caused by UEs reselecting between E-UTRAN and
GERAN/UTRAN which are operated together. Especially it not only reduces the
signaling between UE and network, but also reduces the signaling between E-
UTRAN & UTRAN/GERAN. The dependency between 2G/3G and EPC is
minimized at the cost of ISE-specific node and interface functionality. The idea
behind ISR feature is that UE can be registered in UTRAN/GERAN RA at the
same time it is registered in an E-UTRAN TA or list of TAs. The UE keeps the two
registrations in parallel and run periodic timers for both registrations
independently. Similarly UE keeps the two registrations the two registrations in
parallel and it also ensures that UE can be paged in both the RA and the TAs it is
registered in.

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

UE Triggered Detach
UE eNodeB MME HSS S-GW P-GW PCRF
Detach Request
1
Delete Session Req
2
Delete Session Rsp
3
Delete Session
Req
4
Delete Session
Rsp
5
PCRF
Detach Accept Session
7 Terminate
6
S1 Release Command
8

MME Triggered Detach
UE eNodeB MME HSS S-GW P-GW PCRF

Detach Request
1
Delete Session Req
2
Delete Session Rsp
3 Delete Session
Req
4
Delete Session
Rsp
5
PCRF
Detach Accept Session
7 Terminate
6
S1 Release Command
8

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

Principles for idle-mode mobility with CSG cells
Intra-frequency mobility
Intra-frequency mobility in idle mode in the presence of “allowed” CSG cells
(i.e., CSG cells that the UE is allowed to camp on) is based on cell ranking and
reselection using the “best cell principle”: For cell ranking and reselection, the
UE may ignore all CSG cells that are known by the UE to be not allowed.
Inter-frequency mobility
For cell ranking and reselection, the UE should prioritize CSG cells with CSG
ID present in the UE’s CSG white list, irrespective of normal network
configured frequency priorities.
Inter-RAT Mobility
Inter-RAT inbound mobility to E-UTRAN CSG cells is also supported by a UE
autonomous search when the UE is camped on a RAT other than E-UTRAN.
The UE requirements are defined in the specifications of the concerned RAT.

Inbound mobility to CSG cells
RRC_IDLE
Cell selection/reselection to CSG cells is based on a UE autonomous search
function. The search function determines itself when/where to search, and
need not be assisted by the network with information about frequencies
which are dedicated to CSG cells.
To assist the search function on mixed carriers, all CSG cells on mixed
carriers broadcast in system information a range of PCI values reserved by
the network for use by CSG cells. Optionally also non-CSG cells on the
mixed carrier can send this information in system information. The reserved
PCI range is only applicable to the frequency of the PLMN where the UE
received this information. The UE considers the last received reserved range
of PCI values for CSG cells to be valid for a maximum of 24 hours within the
entire PLMN. UE’s use of the received PCI split information is UE
implementation dependent.

Inbound mobility to CSG cells
RRC_CONNECTED
While the UE is in RRC_CONNECTED state, the UE performs normal
measurement and mobility procedures based on configuration provided by the
network.
The UE is not required to support manual selection of CSG IDs while in

RRC_CONNECTED state.
Handover to a HNB/HeNB is different from the normal handover procedure in three

aspects:
1.Proximity Estimation
2.2. PSC/PCI Confusion
3.3. Access Control

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

RN attach procedure
RN DeNodeB MME HSS
1. RRC connection setup
2a. NAS Attach, Authentication Security 2b. Authentication Security
3. GTP-C Create Session
4a. RRC connection 4b. S1 Context setup

reconfig (NAS Attach Accept)

E-RAB activation/modification
RN DeNodeB MME
1. GTP-C Create/Update Bearer Request
2. S1-AP Bearer Setup/Modify Request

(NAS Session Management Message)
3. RRC connection Reconfig
4. S1-AP Bearer Setup/Modify Response
5a. Direct Transfer

5b. Direct Transfer
(NAS Session Management Message)
6. GTP-C Create/Update Bearer Response

RN startup procedure

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

Security in LTE
Authentication
Vectors
HSS
Authentication & Key Agreement
NAS Ciphering & Integrity MME

• NAS Signaling
Ciphering & Integrity

• Data
UE
• Signaling
eNodeB

EPS Key Hierarchy
Keys
Where stored
or calculated

Function of LTE Security Keys
From MME
NAS Signaling
KNASint Integrity
From S-GW
KNASenc Encryption
User Plane
Data
From eNodeB RRC Signaling
KRRCint Integrity
PDCP
KRRCenc Encryption Encryption KUPenc

Authentication
UE eNB MME HSS
1 Attach Request
(IMSI, UE Network Capability)
2 Authentication-InformationRequest
(User name, visited PLMN)
3 Authentication-InformationAnswer
(RAND, XRES, AUTN, KASME)
4 Authentication Request
(RAND, AUTN)
5 Authentication Response
(RES)
• RAND is a random value

• KASME is an authentication parameter used, among other tasks, for
network authentication
• XRES is the UE expected result of the authentication computation
• AUTN is parameter for the UE to authenticate the EPS network.

AUTHENTICATION INFORMATION REQUEST
Message
Authentication Information Request
MME HSS
Message Header
Command Code: 651 (3GPP Authentication Information)
ApplicationId: 16777251 (3GPP s6a)
AVPs
Session-Id: MME.NSN.COM
Auth-Session-State: No state maintained
Origin-Host: mme1.code.muc.nsn-rdnet.net
Origin-Realm: code.muc.nsn-rdnet.net
Destination-Host: hssemu.muc.ims.net
Destination-Realm: muc.ims.net
Username: 262010002000005
Requested-EUTRAN-Authentication-Info
Number of requested vectors: 1
Immediate response preferred: 1
Visited-PLMN-Id:
Requesting-Node-Type: MME

AUTHENTICATION INFORMATION ANSWER
Message
Authentication Information Answer
MME HSS
Message Header
Command Code: 651 (3GPP Authentication Information)
ApplicationId: 16777251 (3GPP s6a)
AVPs
Session-Id: MME.NSN.COM
Result-Code: DIAMETER_SUCCESS
Auth-Session-State: No state maintained
Origin-Host: mme1.code.muc.nsn-rdnet.net
Origin-Realm: code.muc.nsn-rdnet.net
Authentication-Info
EUTRAN-Vector
RAND: 33fe6a1ab14fe988c4ff53c23334cdcf
XRES: f0c0c796b25b27f4
AUTN: df79cc0e227ebb444bf9ab0c6087cfb4
KASME:
758611a35a472fd61576149f131d6ac3e78026c47abb60a85f7dfe0c169f1b1f

AUTHENTICATION REQUEST and
AUTHENTICATION RESPONSE Messages
Authentication Request
UE MME
Message Header
Security header type: Plain NAS message
Protocol Discriminator: EPS mobility management message
NAS EMM Message Type: Authentication request
NAS key set identifier: KASME
RAND value: df79cc0e227ebb444bf9ab0c6087cfb4
Authentication Parameter AUTN
AUTN value: df79cc0e227ebb444bf9ab0c6087cfb4
Authentication Response
UE MME
Message Header
NAS EMM Message Type: Authentication response
Authentication Response Parameter
RES: f0c0c796b25b27f4

Security Mode Command
• The MME uses the NAS Security Mode Command procedure to establish a NAS
security association between the UE and MME, in order to protect the further NAS
signaling messages.
• This procedure is also used to make changes in the security association, e.g. to
change the security algorithm.
• The MME may also triggers the RRC level AS security mode command procedure
by sending the needed security parameters to the eNB.
UE eNB MME
1 Security Mode Command

(eKSI, UE sec capabilities, selected security and integrity protection algorithms)
2 Security Mode Complete

NAS message authentication code

ME Identity Check
• The ME Identity Check Procedure allows the MME and/or the HSS and/or
the PGW to check the ME's identity.
• It’s typically executed as part of the Attach procedure (i.e. UE does not
send its permanent NAS identity within ‘Attach Request’ message).
UE eNB MME EIR
DownlinkNASTransport
1
(EMM: Identity Request)
DLInformationTransfer
(EMM: Identity Request)
ULInformationTransfer
2 (EMM: Identity Response)

UplinkNASTransport
(EMM: Identity Response)
3 MEIdentityCheck
4 MEIdentityCheckAck

ME Identity Request – Example
Identity Request
UE MME
Message Header
NAS EMM Message Type: Identity request
Identity Type: IMSI
Identity Response
UE MME
Message Header
NAS EMM Message Type: Identity response
Mobile identity
Mobile Identity Type: IMSI
BCD Digit: 262010002000005

Module Contents
• UE States
• Network Attach
• S1 Release
• Service Request
• Network Detach
• Relay Nodes
• Authentication

Exercise 01 Faulty trace analysis
Using the following trace file in Wireshark or text file:

1. State the failure in the trace.
2. State the cause for the failure.
Reference 3GPP 23.401(R10)

Lesson Summary
In this lesson, you learned about:

• The UE Mobility Management and Session Management
states
• The UE network acquisition process
• “typical” UE call processes
• Relay Nodes
• The UE authentication process
• Fault trace analysis

05 RA41235EN06GLA1 UE States and LTESAE Signaling PDF

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

05 RA41235EN06GLA1 UE States and LTESAE Signaling PDF

Hochgeladen von

Copyright:

Verfügbare Formate

UE States and LTE/SAE Signaling

RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

Intellectual Property Rights

2 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

After completing this module, the participant will be able to:

• List the UE Mobility Management and Session Management

4 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

5 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

6 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

UE • Carries all UE to eNodeB or MME signaling

7 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

8 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

No PDN PDN Context for UE

9 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

EMM-Deregistered, EMM-Registered, EMM-Registered,

RRC: Null RRC: IDLE RRC: CONNECTED

No RRC or EPC Context EPC Context RRC & EPC Context

UE Unknown UE Known at TA Level UE Known at Cell Level

PLMN Selection TA Update Handovers

No Data Transfer DRX on DL UL/DL Data Transfer

Periodic TA update Inactivity

10 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

11 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

12 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

13 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

General UE Information PDN Connection

14 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

15 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

16 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

17 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

18 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

The process of transmitting data through

The process of updating the tracking

The process of changing to a new

The process of disconnection from the

19 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

UE ACK Network Attach

20 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

21 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

DL Channel Bandwidth

Master Information Block (BCH / PBCH)

22 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

23 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

24 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

“barred” “suitable cell”

Barred & Reserved Cells

Physical Layer Cell ID

HSS MME SGW PGW

27 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

28 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

29 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

30 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

HSS MME SGW PGW

• UE IMSI  UE IMSI  UE IP Addr  UE IP Addr

• Default EPS bearer is typically activated as part of Attach

Activate Default EPS Bearer Context Activation

Activate Default EPS Bearer Context Accept

32 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

33 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

34 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

Create Session Request

35 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.

36 RA41235EN06GLA1 ©2014 Nokia Solutions and Networks. All rights reserved.