Sunday, November 18, 2012

MME, SGW, PGW, SGSN selection function


The format that is used for node selection is as follows,
node.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

MNC and MCC can be obtained from IMSI
For ex :
If IMSI is 652019876543210
whether MCC is 2/3 digit can be found out from the following link,
click here

For the above mentioned IMSI, MCC is 2 digit and hence we have to append a zero to MNC - '01'
node.epc.mnc001.mcc652.3gppnetwork.org


MME selection function :
MME node selection -
Mmec<MMECode>.mmegi<MMEGroupId>.mme.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

MME pool selection -
mmegi<MMEGroupId>.mme.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org


SGW selection function :
tac-lb<TAC-low-byte>.tac-hb<TAC-high-byte>.tac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

For TAC 9999 and IMSI 652019876543210, hex equivalent of 9999 is 270F,
tac-lb0F.tach-hb27.tac.epc.mnc001.mcc652.3gppnetwork.org
This format can be used by MME/SGSN to find the MME also


PGW selection function :
APN has two parts - APN NI [APN Network Identifier] and APN OI [APN Operator Identifier]

APN NI - <APN-NI>
APN OI - mnc<MNC>.mcc<MCC>

PGW selection uses the following format,
<APN-NI>.apn.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

For APN, google.com and IMSI 652019876543210
google.com.apn.epc.mnc001.mcc652.3gppnetwork.org


SGSN selection function :
nri-sgsn<NRI>.rac<RAC>.lac<LAC>.rac.epc.mnc<MNC>.mcc<MCC>.
3gppnetwork.org


Acronyms and what they stand for :
MNC- Mobile Network Code
MCC- Mobile Country Code
EPC - Evolved Packet Core
APN - Access Point Name
NI     - Network Identifier
OI     - Operator Identifier
TAC - Tracking Area Code
NRI  - Network Resource Identifier
LAC - Location Area Code
RAC - Routing Area Code
MME- Mobility Management Entity
SGSN- Serving GPRS Supporting Node

Wednesday, October 10, 2012

Dual Transfer Mode (DTM) Handover


What is a Dual Transfer Mode (DTM) Handover?

The DTM handover is a special handover type in GERAN in which the source BSS (or source RNS) requests the target BSS to allocate both circuit-switched (CS) and packet-switched resources.
This is useful in scenarios when the UE has, for instance, a conventional (CS) voice call ongoing and a packet session active (e.g. for email sync up or file download) and a handover is required to a GERAN cell that supports DTM operation.
The DTM handover is essentially composed of two handover procedures (one in the CS domain and another in the PS domain), which are synchronized and conducted in parallel.
The DTM handover is initiated by the source BSS by sending a PS Handover Required (with a CS Indication) to the SGSN and a Handover Required (with a PS Indication) to the MSC over the Gb and A interfaces respectively.
The CS and PS Indicators are used to inform the target BSS that there is an ongoing CS and PS handover in parallel.
These indications require the target BSS to wait for both the HANDOVER REQUEST message (from the MSC) and PS HANDOVER REQUEST message (from the SGSN) before responding.

Saturday, July 21, 2012

Authentication in LTE


Once Attach request is received, MME has to authenticate the UE

This Authentication procedure involves,
1.AIR [Authentication Information Request] sent from MME to HSS
2.AIA [Authentication Information Answer] sent from HSS to MME
3.Authentication request sent from MME to UE
4.Authentication response sent from UE to MME



1.Authentication Information Request has username and visited PLMN ID in addition to many other AVPs. These AVPs are used by HSS to generate authentication parameters



2.Authentication Information Answer sends Authentication Info AVP in addition to many other AVPs. This will be used by MME to authenticate UE




3.MME sends AUTN, RAND in authentication request



4.UE uses RAND and generates AUTN and XRES. If AUTN sent in Authentication request matches the one UE generates, UE has successfully authenticated MME. Now UE send Authentication Ans which has
XRES.

MME checks this XRES received from UE against the one received from HSS. If both match, MME has successfully authenticated the UE

In this way mutual authentication happens.

Authentication can also happen during inter-RAT TAU, periodic TAU

Sunday, July 8, 2012

LTE DEDICATED BEARER SETUP

DEDICATED BEARER -

UE should have default bearer before dedicated bearer can be created. However, in case of Piggybacked dedicated bearer, default and dedicated bearers are simultaneously activated
UE can create a max of 11 bearers.1 has to be default, rest can be dedicated
Every APN will have 1 default bearer.

EBI varies from 1 to 9

QCI [Qos Class identifier] range 1 to 9
1-4 : Dedicated bearer
5-9 : Default bearer

Default bearer has MBR[Maximum Bit rate], Dedicated bearer has GBR[Guaranteed bit rate]. MBR = GBR for dedicated bearer


Who initiates it ?
Network initiates it. UE can also do it by sending Bearer resource allocation
Dedicated bearer creation can be initiated by PGW based on local config or based on PCRF

Dedicated bearer can be created in one of the following ways -

1.Piggybacked 


Piggybacked dedicated bearer can be done during attach and additional PDN creation
The outcome of dedicated bearer creation depends on whether default bearer activation was successful or not
The dedicated bearer creation request can be sent to UE along with attach accept/activate default bearer request[during additional PDN conn req]
Multiple dedicated bearer creation request can be sent piggybacked
Request is always piggybacked to response
For ex : Create bearer request is piggybacked to create session response
Modify bearer request is piggybacked to create bearer response
Attach accept is always sent first, before activate dedicated bearer request


2.Non-Piggybacked -


If the request is not sent piggybacked, i.e. if it is sent after attach, before attach complete has been sent, MME shall wait for completion of attach and then send out activate dedicated bearer request.
In other words, it would be like a normal non-piggybacked dedicated bearer creation



Reference :
3gpp  23.401
5.4.1 and Annex F



Tuesday, April 3, 2012

4G/LTE Attach



1. The UE initiates the Attach procedure by the transmission, to the eNodeB, of an Attach Request (IMSI or old
GUTI, last visited TAI (if available), UE Core Network Capability, UE Specific DRX parameters, Attach Type,
ESM message container (Request Type, PDN Type, Protocol Configuration Options, Ciphered Options Transfer
Flag), KSIASME, NAS sequence number, NAS-MAC, additional GUTI, P-TMSI signature) message together with
RRC parameters indicating the Selected Network and the old GUMMEI. The old GUTI may be derived from a
P-TMSI and RAI. IMSI shall be included if the UE does not have a valid GUTI or a valid P-TMSI available. The
UE stores the TIN in detached state. If the UE's TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds
a valid GUTI then the old GUTI indicates this valid GUTI. If the UE's TIN indicates "P-TMSI" and the UE holds
a valid P-TMSI and related RAI then these two elements are indicated as the old GUTI. Mapping a P-TMSI and
RAI to a GUTI is specified in TS 23.003 [9]. If the UE holds a valid GUTI and the old GUTI indicates a GUTI
mapped from a P-TMSI and RAI, then the UE indicates the GUTI as additional GUTI. If the old GUTI indicates
a GUTI mapped from a P-TMSI and RAI and the UE has a valid P-TMSI signature associated to it, the P-TMSI
signature shall be included.
If available, the last visited TAI shall be included in order to help the MME produce a good list of TAIs for any
subsequent Attach Accept message. Selected Network indicates the PLMN that is selected for network sharing
purposes. The RRC parameter "old GUMMEI" takes its value from the "old GUTI" contained in the Attach
Request. UE Network Capability is described in UE capabilities, see clause 5.11.
If the UE has valid security parameters, the Attach Request message shall be integrity protected by the NASMAC
in order to allow validation of the UE by the MME. KSIASME, NAS sequence number and NAS-MAC are
included if the UE has valid EPS security parameters. NAS sequence number indicates the sequential number of
the NAS message. If the UE does not have a valid EPS security association, then the Attach Request message is
not integrity protected. In this case the security association is established in step 5a. The UE network capabilities
indicate also the supported NAS and AS security algorithms. PDN type indicates the requested IP version (IPv4,
IPv4/IPv6, IPv6). Protocol Configuration Options (PCO) are used to transfer parameters between the UE and the
PDN GW, and are sent transparently through the MME and the Serving GW. The Protocol Configuration
Options may include the Address Allocation Preference indicating that the UE prefers to obtain an IPv4 address
only after the default bearer activation by means of DHCPv4. If the UE intends to send PCO which require
ciphering (e.g., PAP/CHAP usernames and passwords) or send an APN, or both, the UE shall set the Ciphered
Options Transfer Flag and send PCO or APN or both only after authentication and NAS security setup have been
completed (see below). If the UE has UTRAN or GERAN capabilities, it shall send the NRSU in the PCO to
indicate the support of the network requested bearer control in UTRAN/GERAN. Request Type is included in
the ESM message container and indicates "Handover" when the UE has already an activated PDN GW/HA due
to mobility with non-3GPP accesses. Attach Type indicates whether it is an EPS attach or a combined EPS/IMSI
attach or an Emergency Attach.
For an Emergency Attach the UE shall set both the Attach Type and the Request Type to "Emergency" and the
IMSI shall be included if the UE does not have a valid GUTI or a valid P-TMSI available. The IMEI shall be
included when the UE has no IMSI, no valid GUTI and no valid P-TMSI.


2. The eNodeB derives the MME from the RRC parameters carrying the old GUMMEI and the indicated Selected
Network. If that MME is not associated with the eNodeB or the old GUMMEI is not available, the eNodeB
selects an MME as described in clause 4.3.8.3 on "MME selection function". The eNodeB forwards the Attach
Request message to the new MME contained in a S1-MME control message (Initial UE message) together with
the Selected Network, CSG access mode, CSG ID, and TAI+ECGI of the cell from where it received the
message to the new MME. CSG ID is provided if the UE attaches via a CSG cell or hybrid cell. CSG access
mode is provided if the UE attaches via a hybrid cell. If the CSG access mode is not provided but the CSG ID is
provided, the MME shall consider the cell as a CSG cell.
If the MME is not configured to support Emergency Attach the MME shall reject any Attach Request that
indicates Attach Type "Emergency".

3. If the UE identifies itself with GUTI and the MME has changed since detach, the new MME uses the GUTI
received from the UE to derive the old MME/SGSN address, and send an Identification Request (old GUTI,
complete Attach Request message) to the old MME/SGSN to request the IMSI. If the request is sent to an old
MME, the old MME first verifies the Attach Request message by NAS MAC and then responds with
Identification Response (IMSI, MM Context). If the request is sent to an old SGSN, the old SGSN first verifies
the Attach Request message by the P-TMSI signature and then responds with Identification Response (MM
Context). If the UE is not known in the old MME/SGSN or if the integrity check or P-TMSI signature check for
the Attach Request message fails, the old MME/SGSN responds with an appropriate error cause. The MM
context contains security related information as well as other parameters (including IMSI) as described in
clause 5.7.2 (Information Storage for MME).
The additional GUTI in the Attach Request message allows the new MME to find any already existing UE
context stored in the new MME when the old GUTI indicates a value mapped from a P-TMSI and RAI.
For an Emergency Attach if the UE identifies itself with a temporary identity that is not known to the MME the
MME immediately requests the IMSI from the UE. If the UE identifies itself with IMEI, the IMSI request shall
be skipped.
NOTE 7: A SGSN always responds with the UMTS security parameters and the MME may store it for later use.


4. If the UE is unknown in both the old MME/SGSN and new MME, the new MME sends an Identity Request to
the UE to request the IMSI. The UE responds with Identity Response (IMSI).


5a If no UE context for the UE exists anywhere in the network, if the Attach Request (sent in step 1) was not
integrity protected, or if the check of the integrity failed, then authentication and NAS security setup to activate
integrity protection and NAS ciphering are mandatory. Otherwise it is optional. If NAS security algorithm is to
be changed, the NAS security setup is performed in this step. The authentication and NAS security setup
functions are defined in clause 5.3.10 on "Security Function".
If the MME is configured to support Emergency Attach for unauthenticated IMSIs and the UE indicated Attach
Type "Emergency" the MME skips the authentication and security setup or the MME accepts that the
authentication may fail and continues the attach procedure.
After step 5a, all NAS messages shall be protected by the NAS security functions (integrity and ciphering)
indicated by the MME unless the UE is emergency attached and not successfully authenticated.


5b. The ME Identity shall be retrieved from the UE. The ME identity shall be transferred encrypted unless the UE
performs Emergency Attach and cannot be authenticated.
For an Emergency Attach, the UE may have included the IMEI in the Emergency Attach. If so, the ME Identity
retrieval is skipped.
In order to minimise signalling delays, the retrieval of the ME Identity may be combined with NAS security
setup in step 5a. The MME may send the ME Identity Check Request (ME Identity, IMSI) to the EIR. The EIR
shall respond with ME Identity Check Ack (Result). Dependent upon the Result, the MME decides whether to
continue with this Attach procedure or to reject the UE.
For an Emergency Attach, the IMEI check to the EIR may be performed. If the IMEI is blocked, operator
policies determine whether the Emergency Attach procedure continues or is stopped.


6. If the UE has set the Ciphered Options Transfer Flag in the Attach Request message, the Ciphered Options i.e.
PCO or APN or both, shall now be retrieved from the UE.
In order to handle situations where the UE may have subscriptions to multiple PDNs, if the Protocol
Configuration Options contains user credentials (e.g. user name/password within PAP or CHAP parameters) then
the UE should also send the APN to the MME.


7. If there are active bearer contexts in the new MME for this particular UE (i.e. the UE re-attaches to the same
MME without having properly detached before), the new MME deletes these bearer contexts by sending Delete
Session Request (LBI) messages to the GWs involved. The GWs acknowledge with Delete Session Response
(Cause) message. If a PCRF is deployed, the PDN GW employs an IP-CAN Session Termination procedure to
indicate that resources have been released.


8. If the MME has changed since the last detach, or if there is no valid subscription context for the UE in the MME,
or if the ME identity has changed, or if the UE provides an IMSI or the UE provides an old GUTI which doesn't
refer to a valid context in the MME, the MME sends an Update Location Request (MME Identity, IMSI, ME
Identity, MME Capabilities, ULR-Flags, Homogeneous Support of IMS Over PS Sessions) message to the HSS.
The MME capabilities indicate the MME's support for regional access restrictions functionality. ULR-Flags
indicates "Initial-Attach-Indicator" as this is an Attach procedure. Homogenous Support of IMS Over PS
Sessions indicates whether or not "IMS Voice over PS Sessions" is supported homogeneously in all TAs in the
serving MME.
For an Emergency Attach in which the UE was not successfully authenticated, the MME shall not send an
Update Location Request to the HSS.


9. The HSS sends Cancel Location (IMSI, Cancellation Type) to the old MME. The old MME acknowledges with
Cancel Location Ack (IMSI) and removes the MM and bearer contexts. If the ULR-Flags indicates "Initial-
Attach-Indicator" and the HSS has the SGSN registration, then the HSS sends Cancel Location (IMSI,
Cancellation Type) to the old SGSN. The Cancellation Type indicates the old MME/SGSN to release the old
Serving GWresource.


10. If there are active bearer contexts in the old MME/SGSN for this particular UE, the old MME/SGSN deletes
these bearer contexts by sending Delete Session Request (LBI) messages to the GWs involved. The GWs return
Delete Session Response (Cause) message to the old MME/SGSN. If a PCRF is deployed, the PDN GW
employs an IP-CAN Session Termination procedure as defined in TS 23.203 [6] to indicate that resources have
been released.


11. The HSS acknowledges the Update Location message by sending an Update Location Ack (IMSI, Subscription
data) message to the new MME. The Subscription Data contain one or more PDN subscription contexts. Each
PDN subscription context contains an 'EPS subscribed QoS profile' and the subscribed APN-AMBR (see
clause 4.7.3). The new MME validates the UE's presence in the (new) TA. If due to regional subscription
restrictions or access restrictions (e.g. CSG restrictions) the UE is not allowed to attach in the TA or due to
subscription checking fails for other reasons, the new MME rejects the Attach Request with an appropriate
cause. If all checks are successful then the new MME constructs a context for the UE. If the APN provided by
the UE is not allowed by subscription, or the Update Location is rejected by the HSS, the new MME rejects the
Attach Request from the UE with an appropriate cause.
The Subscription Data may contain CSG subscription information.
For an Emergency Attach the MME shall not check for access restrictions, regional restrictions or subscription
restrictions (e.g. CSG restrictions). For an Emergency Attach, the MME shall ignore any unsuccessful Update
Location Response from HSS and continue with the Attach procedure.


12. For an Emergency Attach the MME applies the parameters from MME Emergency Configuration Data for the
emergency bearer establishment performed in this step and any potentially stored IMSI related subscription data
are ignored by the MME.
If the UE performs Initial or Handover Attach via a CSG cell and there is no subscription for that CSG or the
CSG subscription is expired the MME shall reject the Attach Request with an appropriate cause. If the UE has
this CSG ID on its Allowed CSG list the UE shall remove the CSG ID from the list when receiving this reject
cause.
If a subscribed PDN address is allocated for the UE for this APN, the PDN subscription context contains the
UE's IPv4 address and/or the IPv6 prefix and optionally the PDN GW identity. If the PDN subscription context
contains a subscribed IPv4 address and/or IPv6 prefix, the MME indicates it in the PDN address. For Request
Type indicating "Initial request", if the UE does not provide an APN, the MME shall use the PDN GW
corresponding to the default APN for default bearer activation. If the UE provides an APN, this APN shall be
employed for default bearer activation. For Request Type indicating "Handover", if the UE provides an APN, the
MME shall use the PDN GW corresponding to the provided APN for default bearer activation, If the UE does
not provide an APN, and the subscription context from HSS contains a PDN GWidentity corresponding to the
default APN, the MME shall use the PDN GWcorresponding to the default APN for default bearer activation.
The case where the Request Type indicates "Handover" and the UE does not provide an APN, and the
subscription context from HSS does not contain a PDN GWidentity corresponding to the default APN
constitutes an error case. If the Request Type indicates "Initial request" and the selected PDN subscription
context contains no PDN GW identity the new MME selects a PDN GWas described in clause 4.3.8.1 on PDN
GW selection function (3GPP accesses). If the PDN subscription context contains a dynamically allocated PDN
GW identity and the Request Type does not indicate "Handover" the MME may select a new PDN GW as
described in clause PDN GW selection function, e.g. to allocate a PDN GWthat allows for more efficient
routing.

The new MME selects a Serving GW as described in clause 4.3.8.2 on Serving GW selection function and
allocates an EPS Bearer Identity for the Default Bearer associated with the UE. Then it sends a Create Session
Request (IMSI, MSISDN, MME TEID for control plane, PDN GW address, PDN Address, APN, RAT type,
Default EPS Bearer QoS, PDN Type, APN-AMBR, EPS Bearer Identity, Protocol Configuration Options,
Handover Indication, ME Identity, User Location Information (ECGI), User CSG Information, MS Info Change
Reporting support indication, Selection Mode, Charging Characteristics, Trace Reference, Trace Type, Trigger
Id, OMC Identity, Maximum APN Restriction, Dual Address Bearer Flag, the Protocol Type over S5/S8,
Serving Network) message to the selected Serving GW. User CSG Information includes CSG ID, access mode
and CSG membership indication.
If the Request Type indicates "Emergency", Maximum APN restriction control shall not be performed.
For emergency attached UEs IMSI is included if available and if the IMSI cannot be authenticated then the IMSI
shall be marked as unauthenticated.
The RAT type is provided in this message for the later PCC decision. The subscribed APN-AMBR for the APN
is also provided in this message. The MSISDN is included if provided in the subscription data from the HSS.
Handover Indication is included if the Request Type indicates handover. Selection Mode indicates whether a
subscribed APN was selected, or a non-subscribed APN sent by the UE was selected. Charging Characteristics
indicates which kind of charging the bearer context is liable for. The MME may change the requested PDN type
according to the subscription data for this APN as described in clause 5.3.1.1. The MME shall set the Dual
Address Bearer Flag when the PDN type is set to IPv4v6 and all SGSNs which the UE may be handed over to
are Release 8 or above supporting dual addressing, which is determined based on node pre-configuration by the
operator. The Protocol Type over S5/S8 is provided to Serving GW which protocol should be used over S5/S8
interface.
The charging characteristics for the PS subscription and individually subscribed APNs as well as the way of
handling Charging Characteristics and whether to send them or not to the P-GWis defined in TS 32.251 [44].
The MME shall include Trace Reference, Trace Type, Trigger Id, and OMC Identity if S-GW and/or P-GWtrace
is activated. The MME shall copy Trace Reference, Trace Type, and OMC Identity from the trace information
received from the HLR or OMC.
The Maximum APN Restriction denotes the most stringent restriction as required by any already active bearer
context. If there are no already active bearer contexts, this value is set to the least restrictive type (see clause 15.4
of TS 23.060 [7]). If the P-GWreceives the Maximum APN Restriction, then the P-GW shall check if the
Maximum APN Restriction value does not conflict with the APN Restriction value associated with this bearer
context request. If there is no conflict the request shall be allowed, otherwise the request shall be rejected with
sending an appropriate error cause to the UE.


13. The Serving GW creates a new entry in its EPS Bearer table and sends a Create Session Request (IMSI,
MSISDN, APN, Serving GW Address for the user plane, Serving GW TEID of the user plane, Serving GW
TEID of the control plane, RAT type, Default EPS Bearer QoS, PDN Type, PDN Address, subscribed APNAMBR,
EPS Bearer Identity, Protocol Configuration Options, Handover Indication, ME Identity, User Location
Information (ECGI), User CSG Information, MS Info Change Reporting support indication, Selection Mode,
Charging Characteristics, Trace Reference, Trace Type, Trigger Id, OMC Identity, Maximum APN Restriction,
Dual Address Bearer Flag, Serving Network) message to the PDN GW indicated by the PDN GW address
received in the previous step. After this step, the Serving GW buffers any downlink packets it may receive from
the PDN GW without sending a Downlink Data Notification message to the MME until it receives the Modify
Bearer Request message in step 23 below. The MSISDN is included if received from the MME.
If the Request Type indicates "Emergency", Maximum APN restriction control shall not be performed.
For emergency attached UEs IMSI is included if available and if the IMSI cannot be authenticated then the IMSI
shall be marked as unauthenticated.


14. If dynamic PCC is deployed and the Handover Indication is not present, the PDN GW performs an IP-CAN
Session Establishment procedure as defined in TS 23.203 [6], and thereby obtains the default PCC rules for the
UE. This may lead to the establishment of a number of dedicated bearers following the procedures defined in
clause 5.4.1 in association with the establishment of the default bearer, which is described in Annex F.

The IMSI, APN, UE IP address, User Location Information (ECGI), Serving Network, RAT type, APN-AMBR,
Default EPS Bearer QoS are provided to the PCRF by the PDN GW if received by the previous message. The
User Location Information is used for location based charging. For emergency attached UEs which are
unauthenticated the PDN GWprovides the IMEI as the UE Identity instead of IMSI, to the PCRF.
The PCRF may modify the APN-AMBR and the QoS parameters (QCI and ARP) associated with the default
bearer in the response to the PDN GWas defined in TS 23.203 [6].
If the PCC is configured to support emergency services and if dynamic PCC is deployed, the PCRF, based on the
emergency APN, sets the ARP of the PCC rules to a value that is reserved for emergency services and the
authorization of dynamic PCC rules as described in of TS 23.203 [6]. If dynamic PCC is not deployed, the PDN
GW uses the ARP of the default emergency EPS bearer for any potentially initiated dedicated emergency EPS
bearer. The P-GW determines that emergency services are requested based on the emergency APN received in
Create Session Request message.
NOTE 8: While the PDN GW/PCEF may be configured to activate predefined PCC rules for the default bearer, the
interaction with the PCRF is still required to provide e.g. the UE IP address information to the PCRF.
NOTE 9: If the IP address is not available when the PDN GWperforms the IP-CAN Session Establishment
procedure with the PCRF, the PDN GWinitiates an IP-CAN Session Modification procedure to inform
the PCRF about an allocated IP address as soon as the address is available. In this version of the
specification, this is applicable only to IPv4 address allocation.
If dynamic PCC is deployed and the Handover Indication is present, the PDN GW executes a PCEF Initiated
IP-CAN Session Modification procedure with the PCRF as specified in TS 23.203 [6] to report the new IP-CAN
type. Depending on the active PCC rules, the establishment of dedicated bearers for the UE may be required. The
establishment of those bearers shall take place in combination with the default bearer activation as described in
Annex F. This procedure can continue without waiting for a PCRF response. If changes to the active PCC rules
are required, the PCRF may provide them after the handover procedure is finished.
In both cases (Handover Indication is present or not), if dynamic PCC is not deployed, the PDN GWmay apply
local QoS policy. This may lead to the establishment of a number of dedicated bearers for the UE following the
procedures defined in clause 5.4.1 in combination with the establishment of the default bearer, which is
described in Annex F.
If the CSG information reporting triggers are received from the PCRF, the PDN GWshould set the CSG
Information Reporting Action IE accordingly.


15. The P-GW creates a new entry in its EPS bearer context table and generates a Charging Id. The new entry allows
the P-GW to route user plane PDUs between the S-GWand the packet data network, and to start charging. The
way the P-GWhandles Charging Characteristics that it may have received is defined in TS 32.251 [44].
The PDN GWreturns a Create Session Response (PDN GWAddress for the user plane, PDN GWTEID of the
user plane, PDN GWTEID of the control plane, PDN Type, PDN Address, EPS Bearer Identity, EPS Bearer
QoS, Protocol Configuration Options, Charging Id, Prohibit Payload Compression, APN Restriction, Cause, MS
Info Change Reporting Action (Start) (if the PDN GW decides to receive UE's location information during the
session), CSG Information Reporting Action (Start) (if the PDN GW decides to receive UE's User CSG
information during the session), APN-AMBR) message to the Serving GW. The PDN GWtakes into account the
received PDN type, the Dual Address Bearer Flag and the policies of operator when the PDN GW selects the
PDN type to be used as follows. If the received PDN type is IPv4v6 and both IPv4 and IPv6 addressing is
possible in the PDN but the Dual Address Bearer Flag is not set, or only single IP version addressing for this
APN is possible in the PDN, the PDN GW selects a single IP version (either IPv4 or IPv6). If the received PDN
type is IPv4 or IPv6, the PDN GW uses the received PDN type if it is supported in the PDN, otherwise an
appropriate error cause will be returned. The PDN GWallocates a PDN Address according to the selected PDN
type. If the PDN GWhas selected a PDN type different from the received PDN Type, the PDN GW indicates
together with the PDN type IE a reason cause to the UE why the PDN type has been modified, as described in
clause 5.3.1.1. PDN Address may contain an IPv4 address for IPv4 and/or an IPv6 prefix and an Interface
Identifier. If the PDN has been configured by the operator so that the PDN addresses for the requested APN shall
be allocated by usage of DHCPv4 only, or if the PDN GWallows the UE to use DHCPv4 for address allocation
according to the Address Allocation Preference received from the UE, the PDN Address shall be set to 0.0.0.0,
indicating that the IPv4 PDN address shall be negotiated by the UE with DHCPv4 after completion of the
Default Bearer Activation procedure. For external PDN addressing for IPv6, the PDN GW obtains the IPv6
prefix from the external PDN using either RADIUS or Diameter client function. In the PDN Address field of the
Create Session Response, the PDN GW includes the Interface Identifier and IPv6 prefix. The PDN GW sends
Router Advertisement to the UE after default bearer establishment with the IPv6 prefix information for all cases.
If the PDN address is contained in the Create Session Request, the PDN GW shall allocate the IPv4 address
and/or IPv6 prefix contained in the PDN address to the UE. The IP address allocation details are described in
clause 5.3.1 on "IP Address Allocation". The PDN GW derives the BCM based on the NRSU and operator
policy. Protocol Configuration Options contains the BCM as well as optional PDN parameters that the P-GW
may transfer to the UE. These optional PDN parameters may be requested by the UE, or may be sent unsolicited
by the P-GW. Protocol Configuration Options are sent transparently through the MME.
When the Handover Indication is present, the PDN GWdoes not yet send downlink packets to the S-GW; the
downlink path is to be switched at step 23a.


16. If the MS Info Change Reporting Action (Start) and/or the CSG Information Reporting Action (Start) are
received for this bearer context, then the S-GWshall store this for the bearer context and the S-GW shall report
to that P-GW whenever a UE's location and/or User CSG information change occurs that meets the P-GW
request, as described in clause 15.1.1a of TS 23.060 [7].
The Serving GWreturns a Create Session Response (PDN Type, PDN Address, Serving GWaddress for User
Plane, Serving GW TEID for User Plane, Serving GWTEID for control plane, EPS Bearer Identity, EPS Bearer
QoS, PDN GW addresses and TEIDs (GTP-based S5/S8) or GRE keys (PMIP-based S5/S8) at the PDN GW(s)
for uplink traffic, Protocol Configuration Options, Prohibit Payload Compression, APN Restriction, Cause, MS
Info Change Reporting Action (Start), CSG Information Reporting Action (Start), APN-AMBR) message to the
new MME.


17. If an APN Restriction is received, then the MME shall store this value for the Bearer Context and the MME shall
check this received value with the stored value for the Maximum APN Restriction to ensure there are no
conflicts between values. If the Bearer Context is accepted, the MME shall determine a (new) value for the
Maximum APN Restriction. If there is no previously stored value for Maximum APN Restriction, then the
Maximum APN Restriction shall be set to the value of the received APN Restriction. MME shall not deactivate
bearer(s) with emergency ARP, if present, to maintain valid APN restriction combination.
The P-GW shall ignore Maximum APN restriction if the request includes the Emergency APN.
If the MS Info Change Reporting Action (Start) and/or the CSG Information Reporting Action (Start) are
received for this bearer context, then the MME shall store this for the bearer context and the MME shall report
whenever a UE's location and/or User CSG information change occurs that meets the request, as described in
clause 15.1.1a of TS 23.060 [7].
The MME determines the UE AMBR to be used by the eNB based on the subscribed UE-AMBR and the
APN-AMBR for the default APN, see clause 4.7.3.
For emergency attach the MME determines the UE-AMBR to be used by the eNB from the APN AMBR
received from the S-GW.
The new MME sends an Attach Accept (APN, GUTI, PDN Type, PDN Address, TAI List, EPS Bearer Identity,
Session Management Request, Protocol Configuration Options, NAS sequence number, NAS-MAC, IMS Voice
over PS session supported Indication, Emergency Service Support indicator, LCS Support Indication) message to
the eNodeB. GUTI is included if the new MME allocates a new GUTI. This message is contained in an
S1_MME control message Initial Context Setup Request. This S1 control message also includes the AS security
context information for the UE, the Handover Restriction List, the EPS Bearer QoS, the UE-AMBR, EPS Bearer
Identity, as well as the TEID at the Serving GW used for user plane and the address of the Serving GWfor user
plane. In the Attach Accept message, the MME does not include the IPv6 prefix within the PDN Address. The
MME includes the EPS Bearer QoS parameter QCI and APN-AMBR into the Session Management Request.
Furthermore, if the UE has UTRAN or GERAN capabilities and the network supports mobility to UTRAN or
GERAN, the MME uses the EPS bearer QoS information to derive the corresponding PDP context parameters
QoS Negotiated (R99 QoS profile), Radio Priority, Packet Flow Id and TI and includes them in the Session
Management Request. If the UE indicated in the UE Network Capability it does not support BSS packet flow
procedures, then the MME shall not include the Packet Flow Id. Handover Restriction List is described in clause
4.3.5.7 "Mobility Restrictions". The MME sets the IMS Voice over PS session supported Indication as described
in clause 4.3.5.8. LCS Support Indication indicates whether the network supports the EPC-MO-LR and/or CSMO-
LR as described in TS 23.271 [57].
If the UE initiates the Attach procedure at a hybrid cell, theMME shall check whether the CSG ID is contained
in the CSG subscription and is not expired. The MME shall send an indication whether the UE is a CSG member
to the RAN along with the S1-MME control message. Based on this information the RAN may perform
differentiated treatment for CSG and non-CSG members.
If the MME or PDN GWhas changed the PDN Type, an appropriate reason cause shall be returned to the UE as
described in clause 5.3.1.1.
For an emergency attached UE, i.e. for UEs that have only emergency EPS bearers established, there is no AS
security context information included in the S1 control messages and there is no NAS level security when the
UE cannot be authenticated. The Emergency Service Support indicator informs the UE that Emergency bearer
services are supported, i.e. the UE is allowed to request PDN connectivity for emergency services.


18. The eNodeB sends the RRC Connection Reconfiguration message including the EPS Radio Bearer Identity to
the UE, and the Attach Accept message will be sent along to the UE. The UE shall store the QoS Negotiated,
Radio Priority, Packet Flow Id and TI, which it received in the Session Management Request, for use when
accessing via GERAN or UTRAN. The APN is provided to the UE to notify it of the APN for which the
activated default bearer is associated. For further details, see TS 36.331 [37]. The UE may provide EPS Bearer
QoS parameters to the application handling the traffic flow(s). The application usage of the EPS Bearer QoS is
implementation dependent. The UE shall not reject the RRC Connection Reconfiguration on the basis of the EPS
Bearer QoS parameters contained in the Session Management Request.
If the attach procedure is initiated by manual CSG selection and occurs via a CSG cell, the UE upon receiving
the Attach accept shall check if the CSG ID of the cell where the UE has sent the Attach Request message is
contained in its Allowed CSG list. If the CSG ID is not in the UE's Allowed CSG list, the UE shall add the CSG
ID to its Allowed CSG list. Manual CSG selection is not supported when an emergency service has been
initiated.
NOTE 10:If the UE receives an Attach Accept message via a hybrid cell, the UE does not add the corresponding
CSG ID to its Allowed CSG list. Adding a CSG ID to the UE's local Allowed CSG list for a hybrid cell is
performed only by OTA or OMA DM procedures.
When receiving the Attach Accept message the UE shall set its TIN to "GUTI" as no ISR Activated is indicated.
If the UE receives an IPv4 address set to 0.0.0.0, it may negotiate the IPv4 address with DHCPv4 as specified in
TS 29.061 [38]. If the UE receives an IPv6 interface identifier, it may wait for the Router Advertisement from
the network with the IPv6 prefix information or it may send a Router Solicitation if necessary.
NOTE 11:The IP address allocation details are described in clause 5.3.1 on "IP Address Allocation".


19. The UE sends the RRC Connection Reconfiguration Complete message to the eNodeB. For further details, see
TS 36.331 [37].

20. The eNodeB sends the Initial Context Response message to the new MME. This Initial Context Response
message includes the TEID of the eNodeB and the address of the eNodeB used for downlink traffic on the S1_U
reference point.


21. The UE sends a Direct Transfer message to the eNodeB, which includes the Attach Complete (EPS Bearer
Identity, NAS sequence number, NAS-MAC) message.


22. The eNodeB forwards the Attach Complete message to the new MME in an Uplink NAS Transport message.
After the Attach Accept message and once the UE has obtained a PDN Address, the UE can then send uplink
packets towards the eNodeB which will then be tunnelled to the Serving GW and PDN GW. If the UE requested
for a dual address PDN type (IPv4v6) to a given APN and was granted a single address PDN type (IPv4 or IPv6)
by the network with a reason cause indicating that only single IP version per PDN connection is allowed sent
together with the PDN type, the UE should request for the activation of a parallel PDN connection to the same
APN with a single address PDN type (IPv4 or IPv6) other than the one already activated. If the UE receives no
reason cause in step 18 in response to an IPv4v6 PDN type and it receives an IPv6 Interface Identifier apart from
the IPv4 address or 0.0.0.0 in the PDN Address field, it considers that the request for a dual address PDN was
successful. It can wait for the Router Advertisement from the network with the IPv6 prefix information or it may
send Router Solicitation if necessary.


23.Upon reception of both, the Initial Context Response message in step 21 and the Attach Complete message in
step 22, the new MME sends a Modify Bearer Request (EPS Bearer Identity, eNodeB address, eNodeB TEID,
Handover Indication) message to the Serving GW.
23a. If the Handover Indication is included in step 23, the Serving GW sends a Modify Bearer Request (Handover
Indication) message to the PDN GWto prompt the PDN GW to tunnel packets from non 3GPP IP access to
3GPP access system and immediately start routing packets to the Serving GW for the default and any dedicated
EPS bearers established.


23b. The PDN GWacknowledges by sending Modify Bearer Response to the Serving GW.


24. The Serving GW acknowledges by sending Update Bearer Response (EPS Bearer Identity) message to the new
MME. The Serving GWcan then send its buffered downlink packets.


25.After the MME receives Modify Bearer Response (EPS Bearer Identity) message, if Request Type does not
indicate handover and an EPS bearer was established and the subscription data indicates that the user is allowed
to perform handover to non-3GPP accesses, and if the MME selected a PDN GW that is different from the PDN
GW identity which was indicated by the HSS in the PDN subscription context, the MME shall send a Notify
Request including the APN and PDN GWidentity to the HSS for mobility with non-3GPP accesses. The
message shall include information that identifies the PLMN in which the PDN GWis located.
For an Emergency Attach the MME shall not send any Notify Request to an HSS.


26. The HSS stores the APN and PDN GWidentity pair and sends a Notify Response to the MME

Friday, October 28, 2011

ISR- Idle state Signalling Reduction

What is ISR ?
Idle state Signalling Reduction

Why ISR ?
1. To reduce the frequency of signalling between UE and Network and also Context transfer between networks
2. Prevent Ping-Pong effect

Requirements -

SGW should support ISR
ISR Mandatory for 4G UEs that support GERAN/UTRAN and whereas for network it's optional
Release 8 SGSN and above


Procedure -

Lets assume UE is in 4G coverage area,
UE attaches to E-UTRAN and sets TIN to GUTI

Now if UE has moved to an area where it receives a stronger 3G signal and reselects GERAN/UTRAN,it will initiate RAU. This is when ISR is activated.As TIN is set to GUTI,UE maps P-TMSI from GUTI and sends the same in RAU Request

After the SGSN receives the context from MME,both CN nodes keep the context depending on if SGW would have indicated ISR supported to MME

RAU accept indicates ISR activation as a result UE stores both GUTI,received during the attach and P-TMSI,received during 3G RAU as registered and sets TIN as 'RAT related TMSI'
MME and SGSN are both registered to HSS and both have connection to SGW

Once this is done,there is no need for UE to update the network [E-UTRAN or UTRAN ] as long as it is within the TA/RA s which it has registered to.

Any context transfer that involves RAU/TAU can be the point where this ISR activation may take place.

If UE is camped on to UTRAN,TAU initiated ISR [ First attach to 3G and then moving to 4G ] works in similar way as RAU initiated ISR


#################### Downlink Data ####################
Downlink data is sent to SGW.If ISR is activated,the SGW has connection to both MME and SGSN and sends notification to both nodes.MME and SGSN page in their respective TA/RA
Depending on from where UE responds,the connection is established and data transfer begins


#################### ISR deactivation ###################
Depending on indication in RAU or TAU Accept,the ISR will be deactivated. If there is no explicit indication of ISR activated,then it means it is deactivated
UE sets TIN to GUTI or P-TMSI in this case depending on whether it is connected to U-TRAN or E-UTRAN

If UE performs a RAU with a Gn/Gp SGSN of any standards release as these SGSNs never indicates "ISR Activated" to the UE.








Abbreviations -

ISR : Idle mode Signalling Reduction
TIN : Temporary Identification used in Next update
GUTI : Globally Unique Temporary Identifier
CN : Core Network

Sunday, September 25, 2011

EPS Mobility Management and Connection Management

Difference between EMM and ECM


EMM [EPS Mobility Management ]

There are two states :
1.Registered
2.DeRegistered

1.Registered :
Ue can enter into this state by,
a.Attach
b.I-RAT[Inter RAT ] TAU
In this state UE atleast has 1 active PDN connection and EPS security context
The UE location is known in the MME to at least an accuracy of the tracking area list allocated to that UE
2.DeRegistered :
Ue can enter into this state by,
a.Attach Reject
b.TAU Reject
c.On Detach
d.On successful I-Rat Handover
In this case Routing info is not available to MME and UE is not reachable
In the EMM-DEREGISTERED state, some UE context can still be stored in the UE and MME, e.g. to avoid running an AKA procedure during every Attach procedure

ECM [EPS Connection Management]

There are two states :
1.IDLE
2.Connected
1.IDLE :
A UE is in ECM-IDLE state when no NAS signalling connection between UE and network exists.
There is no S1_MME and no S1_U connection for the UE in the ECM-IDLE state.
The signalling connection is made up of two parts: an RRC connection and an S1_MME connection.
The UE shall enter the ECM-IDLE state when its signalling connection to the MME has been released or broken.
The S1 release procedure changes the state at both UE and MME from ECM-CONNECTED to ECM-IDLE.

In the EMM-REGISTERED and ECM-IDLE state, the UE shall
a.Do a periodic TAU to notify EPC that UE is available
b.Do a TAU when the current TA is not in the list of TAs received when UE was registered
c.When RRC connection was release with 'LOAD Balancing TAU required' cause
d.Send Service request when it wants to send uplink user data or upon receiving paging
e.Do TAU when change of the UE's Core Network Capability information

Initial NAS messages that initiate a transition from ECM-IDLE to ECM-CONNECTED state are Attach Request, Tracking Area Update Request, Service Request or Detach Request
2.Connected
Here UE's location is known to the accuracy of serving ENB
There exists s1-MME connection and RRC connection
 
ECM-UE
                                                                      





ECM-MME








EMM-MME







EMM-UE