doc8-lte workshop tun session7 air link setup

ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010

ITU/BDT Arab Regional Workshop onITU/BDT Arab Regional Workshop onLTE Systemy

Session 7 : Air Link SetupSession 7 : Air Link Setup

LTE/SAE Procedures/

Speakers M. Lazhar BELHOUCHETM Hakim EBDELLIM. Hakim EBDELLI

Date 27 – 29 January 2010

www.cert.nat.tn1 1Air Link Setup LTE/SAE Procedures


Agenda

• Attach

• S1 Release

• DetachDetach

• Service Request

• Tracking Area Update

• Dedicated SAE Bearer ActivationDedicated SAE Bearer Activation

• Inter eNB handover

www.cert.nat.tn2 Air Link Setup LTE/SAE Procedures 2


Attach (1/2)MME HSSUE new Serving PDNMME HSSPCRF

UE eNBnewMME Gateway

(SGW)

PDNGateway

EMM_Deregistered

RRC C d

Attach Request

S-TMSI/IMSI,old TAI, IP address allocation

RRC_Connected

ECM C t d

Authentication Request

Authentication Response

Authentication Vector Request (IMSI)

Authentication Vector Respond

ECM_Connected

pUpdate Location

Insert Subscriber Data

IMSI, subscription data = default APN, tracking area restrictions, …IMSI, subscription data default APN, tracking area restrictions, …Insert Subscriber Data Ack

Update Location Ack

www.cert.nat.tn3 Air Link Setup LTE/SAE Procedures


Attach (2/2)HSSPCRFUE eNB

new ServingGateway PDN

MME HSSPCRFUE eNB MME Gateway(SGW) Gateway

select SAE GWCreate Default Bearer Request

IMSI RAT type default QoS PDN address infoCreate Def. Bearer Req.

Create Def Bearer Rsp

IMSI, RAT type, default QoS, PDN address info

IMSI, …, IP/TEID of SGW-S5PCRF Interaction

Includes Attach AcceptS-TMSI, security info, PDN address, …,IP/TEID

Create Def. Bearer Rsp.

IP/TEID of SGW-S1u,PDN address, QoS, …

Create Def. Bearer Rsp.

PDN address, IP/TEID of PDN GW,QoS according PCRF

Attach Accept RB Est. Req.

Includes Attach Complete

Update Bearer Response

Update Bearer RequestIP/TEID of eNB for S1u

Attach Complete

IP/TEID of eNB for S1u

RB Est. Resp. of SGW-S1u (only for eNB)

EMM_DeregisteredUpdate Bearer Response

UL/DL Packet Data via Default EPS Bearer

_ g

ECM_Connected

www.cert.nat.tn4

UL/DL Packet Data via Default EPS Bearer

Air Link Setup LTE/SAE Procedures


S1 ReleaseAfter attach UE is in EMM_Registered state.The default Bearer has been allocated (RRC_connected + ECM_connected) even it may not transmit or receive dataIf there is a longer period of inactivity by this UE, then we should free these admission control resources (RRC_idle + ECM_idle)The trigger for this procedure can come from eNB or from MME.

MME ServingGateway(SGW)

PDNGateway

EMM_Registered

S1 Release Requestcause

Update Bearer Request

release of eNB S1u resources

(SGW)ECM_Connected

RRC Connection Release

release of eNB S1u resourcesUpdate Bearer Response

S1 Release Commandcause

RRC Connection Release Ack

S1 Release Complete

RRC Connection Release Ack

S1 Signalling Connection ReleaseEMM_Registered

ECM Idl

www.cert.nat.tn5

ECM_Idle



Detach Can be triggered by UE or by MME.gg y yDuring the detach procedure all SAE bearers with their associated tunnels and radio bearers will be deleted.Note: Detach procedure initiated by UE

MMEEMM-RegisteredServingGateway(SGW)

PDNGateway

Note: Detach procedure initiated by UE.

Delete Bearer Request

(SGW)

NAS Detach Requestswitch off flag Delete Bearer Request

RRC_Connected

ECM Connected

NAS: Detach AcceptedDelete Bearer Response

Delete Bearer Response

PCRF

ECM_Connected

S1 Signalling Connection ReleaseEMM-Deregistered

www.cert.nat.tn6

RRC_Connected + ECM Idle



Detach

Note: Detach procedure initiated by MME.

Serving PDNMMEEMM-Registered

gGateway(SGW)

Gateway

NAS Detach Request

RRC_Connected

Delete Bearer Request


NAS Detach Requestswitch off flag Delete Bearer Request

Delete Bearer ResponseECM_Connected

NAS: Detach AcceptedDelete Bearer Response

PCRF

S1 Signalling Connection ReleaseS1 Signalling Connection Release

EMM-Deregistered

RRC Connected + ECM Idle

www.cert.nat.tn7

RRC_Connected + ECM Idle



Service Request (1/2) From time to time a UE must switch from ECM_Idle to ECM_connectedThe reasons for this might be UL data is available, UL signaling is pending (e.g. tracking area update, detach) or a paging from the network was received.

MMEServingGateway(SGW)

PDNGateway

RRC_Idle+ ECM_Idle

PagingS-TMSI, TAI/TAI-list

DL Packet DataDL Packet NotificationPagingS-TMSI

RRC Connected

Service RequestS-TMSI, TAI, service type

ECM_Connected

RRC_Connected

Authentication Requestauthentication challengeAuthentication ResponseAuthentication response

www.cert.nat.tn8

u e ca o espo se



Service Request (2/2)


PDNGateway

Initial Context Setup Req.

( )

SGW-S1 IP/TEID, QoSRB Establishment Req.


RB Establishment Rsp.Initial Context Setup Rsp.

eNB-S1 IP/TEID Update Bearer Request

eNB-S1 IP/TEIDUpdate Bearer Response

eNB S1 IP/TEID, ..



Tracking Area Update (TAU)

Tracking area (TA) is similar to Location/Routing area in 2G/3G .Tracking Area Identity = MCC (Mobile Country Code), MNC (Mobile Network Code)

d TAC (T ki A C d )and TAC (Tracking Area Code).When UE is in ECM-Idle, MME knows UE location with Tracking Area accuracy.



Tracking Area Update (1/2) ld ld

MME HSSeNB newMME MME

oldMME

newServingGateway(SGW)

PDNGateway

oldServingGateway(SGW)UEEMM_Registered

RRC_Idle + ECM_Idle

Tracking Area Update Request

Context RequestS-TMSI/IMSI,old TAI, PDN (IP) address allocation

RRC_Connected

ECM ConnectedS-TMSI/IMSI,old TAIContext Responsemobility/context dataAuthentication Request

authentication challengeAuthentication Response

C _Co ec ed

Authentication ResponseAuthentication response

Create Bearer RequestIMSI bearer contexts

Context AcknowledgeS-TMSI/IMSI,old TAI

Update Bearer Requestnew SGW S5 IP/TEIDIMSI, bearer contexts new SGW-S5 IP/TEID

Create Bearer Responsenew SGW-S1 IP/TEID

Update Bearer ResponsePDN GW IP/TEID



Tracking Area Update (2/2) MME

HSSeNBnewMME MME

oldMME

newServing PDN

oldServingMME

Gateway(SGW)

GatewayUpdate Locationnew MME identity, IMSI, …

Cancel Location

Gateway(SGW)

IMSI, cancellation type = update

Cancel Location Ack

Delete Bearer RequestTEID


Update Location AckpTracking Area Update Accept

new S-TMSI, TA/TA-list

Tracking Area Update Complete

EMM_Registered

RRC_Idle + ECM_Idle



“Multi Tracking Area Registration” Concept

• UE only triggers TAU when moving to a cell belongingto a cell belonging to a TA not in the TA list for that UE.



LTE/SAE Handover

– When the UE is in ECM_Connected state, mobility handling takes place via network controlled handovers with UE assistance.

– UE assistance here simply means that the UE sends measurements and reports to the eNB to assist in the handover decision.

– Currently it is planned that neighbour cells are based on the UE’s cellCurrently it is planned that neighbour cells are based on the UE s cell detection capabilities rather than on a network supplied neighbour cell list.

/ k d– Intra LTE/SAE Network Handover Types:• 1.Intra eNB handover.

• 2.Inter eNB handover with X2 interface and without CN node relocation

• 3.Inter eNB handover without X2 Interface (with or without CN node relocation).



Handover Procedure: Inter eNB Handover with X2 Interface and without CN Relocation

Before handover

Handover preparation Radio handover Late path

switching

SAE GW

MME

SAE GW

MME

SAE GW

MME

SAE GW

MME

Source eNB

Target eNB

= Data in radio= Signalling in radio

= GTP tunnel= GTP signalling

= S1 signalling= X2 signalling

www.cert.nat.tn15

= Signalling in radio = GTP signalling = X2 signalling



User plane switching in Handover



Inter eNB Handover with X2 interface & without CN Relocation (1/2)Relocation (1/2)

MMEECM Connected

ServingGateway(SGW)

sourceeNB

targeteNB

RRC: Measurement Control

_

Packet Data

RRC: Measurement Report

O f

X2AP: Handover Requesttarget cell, serving MME & SAE GW, …

RRC: Measurement Report

HO DecisionAdmission Control: allocatesresources for incoming UEX2AP: Handover Request Ack

HO-command, X2 data forwarding tunnel, …RRC: Handover Commandtarget cell description, C-RNTI,…

detach source cell

sync. target cell

forward bufferedDL packets

buffering of DLpackets from old eNB

DL Packet Data

www.cert.nat.tn17

sync. target cell



Inter eNB Handover with X2 interface & without CN Relocation (2/2)


sourceeNB

targeteNB

Synchronization


S1AP: Handover CompletePath Switch Requesttarget eNB IP/TEID, …

UL Allocation + timing advance

RRC: Handover Confirm

Update Bearer Response

target eNB IP/TEID, …

switch DLPath

S1AP: Handover Complete Ack

Packet Data forwards DL packetsand accepts UL

packets

Update Bearer Responsenew SGW-S1 IP/TEID, …

pPath Switch Req. Ack.

new SGW-S1 IP/TEID, … X2AP: Release Resources

flush DL buffers DL Packet Data

release resources

Packet Data



LTE/SAE Security: EPS Authentication and Key Agreement (AKA) g

• EPS Authentication and Key Agreement (EPS AKA) shall be based on UMTS AKA.

• UMTS Authentication and Key Agreement is a protocol designed to support d f hroaming and fast re‐authentication.

• It was originally designed to achieve maximum compatibility with 2G security mechanisms.

• The requirements on EPS AKA are:– EPS AKA shall be based on USIM and extensions to UMTS AKA

– Access to E‐UTRAN with 2G SIM shall not be granted. R99 USIM will be accepted.

– EPS AKA shall produce keys that are the basis of C‐plane and U‐plane protection

– UMTS AKA achieves mutual authentication between the user and the network by demonstrating knowledge of a pre‐shared secret key K which is only known by the USIM and the AUC in the user’s HSS.



EPS Authentication Procedure

MME HSS

NAS: attach RequestUser Id, UE Capabilities, etc. Authentication Data Request

Authentication Vectors: RAND(i), KASME(i), XRES(i)

Authentication Data Response

, p ,

( ) ASME( ) ( )NAS: USER Authentication Request

KASME(i), RAND(i)

NAS: USER Authentication ResponseIf RES(i) XRES(i)

UE uses KASME to verify

the Network

RAND is a random value

RES(i)If RES(i)=XRES(i)

Authentication successful

RAND is a random valueKASME is an authentication parameter used, among other tasks, for network authentication XRES is the UE expected result of the authentication computation

www.cert.nat.tn20

XRES is the UE expected result of the authentication computation



Thanks for your AttentionThanks for your Attention


doc8-lte workshop tun session7 air link setup

Documents