Describes key network elements and interfaces of LTE architecture. The steps of LTE/EPC Attach procedure are also illustrated. Video at: https://www.youtube.com/playlist?list=PLgQvzsPaZX_bimBc5Wu4m6-cVD4bZDav9

1. LTE & EPC Architecture
LTE Attach Procedure
Version: 3.0 (March 2013)
Irfan Ali 1

2. 3GPP Network Architecture
Network
+ Radio Access
Network (RAN)
Core Network (CN)
Mobile
(U)SIM Equipment (ME)
Radio Resource Management Security, IP connectivity, Mobility
User Equipment (UE) or
Mobile Station (MS)
SIM Subscriber Identity Module
USIM Universal Subscriber Identity Module
Irfan Ali
Irfan Ali 2 2

3. LTE Network Architecture
Internet
HSS
P-GW
S6a
S5
S11 S-GW
Evolved Packet Core
(EPC)
S-GW
MME
S1-MME
S1-U
Evolved Universal Terrestrial Radio Access Network
(E-UTRAN)
X2 X2
eNB eNB eNB
LTE-Uu eNB Enhanced Node B
MME Mobility Management Entity
S-GW Serving Gateway
P-GW Packet data network Gateway
HSS Home Subscriber System
Irfan Ali
Irfan Ali 3 3

4. HSS P-GW
LTE Network Architecture
UE IP address
Authenticator Allocation
Inter SGW Mobility
Anchoring
IMS Internet Subscription
S5
S6a
HSS MME S-GW
P-GW
NAS Security Inter eNB Mobility
S6a Anchoring
S5 Idle Mode
Mobility Mgmt
S11
S-GW EPS Bearer Control
S-GW
MME
S1-MME
S1-MME S1-U
S1-U
eNB
RB Control Inter Cell RRM
Radio Admission Connected Mode
Control Mobility Mgmt
X2
eNB eNB eNB eNB Measurement
Scheduler
OAM
LTE-Uu Control-Plane
Functional Entity Radio Bearer
Transmission
User-Plane (L1/L2/L3)
Functional Entity
Irfan Ali
Irfan Ali 4 4

5. Block Diagram example: LTE
Architecture
HSS
Interfaces
Reference Points
S1-MME S6a
MME
Operators IP
S11
Services
S10
SGi
S1u Serving S5
UE eNB PDN GW SGi
Internet
GW
LTE-Uu
X2
Functional Entity
Logical Entity
Network Entity
eNB Enhanced Node B
MME Mobility Management Entity
S-GW Serving Gateway
PDN GW Packet data network GW
HSS Home Subscriber System
Irfan Ali
Irfan Ali 5 5

6. LTE Architecture Key Concepts
 All radio related functions are pushed down to the eNB
• There is no centralized radio resource management element
like the RNC.
 In the core network, there is control-plane and user-plane
separation
• MME is the control-plane entity
• SGW and PGW are the user-plane entity
• To allow independent scaling of the control-plane and the
user-plane.
 LTE is a PS (Packet Switch) only system
• No CS (Circuit switch) domain support
Irfan Ali
Irfan Ali 6 6

7. Architecture Concept: Access Stratum vs Non-Access Stratum
• On the signaling plane, the UE
IMS Internet communicates with two entities
in the infrastructure:
HSS
P-GW
 (a) the eNB and
 (b) the MME (via the eNB).
• Access-stratum (AS): UE <->
S-GW eNB.
 AS consists of both user-
S-GW
MME plane and control-plane.
The user-plane protocol is
Non-Access PDCP and control-plane
Stratum protocol is RRC.
(NAS)
• Non-access Stratum (NAS):
UE <-> MME.
eNB
eNB eNB
 NAS is only in the control-
Radio Resource Control plane. The protocol is
(RRC)
called the NAS protocol.
UE Access Stratum
Irfan Ali
Irfan Ali 7 7

8. Protocol Stacks: Control Plane
NAS NAS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
PDCP PDCP SCTP SCTP UDP UDP UDP UDP
RLC RLC IP IP IP IP IP IP
MAC MAC L2 L2 L2 L2 L2 L2
PHY PHY L1 L1 L1 L1 L1 L1
UE LTE-Uu S1-MME S11 S5
eNB MME S-GW P-GW
Non-Access Stratum (NAS): The key control interface
between MME and UE
Radio Resource Control (RRC): The main control
interface between eNB and UE
Packet Data Convergence Protocol (PDCP): Duplicate
detection, ROHC S1-AP S1 Application protocol
SCTP Stream Control Transport Protocol
Radio Link Control (RLC): Segmentation/re-assembly, GTP-C GPRS Tunneling Protocol-Control Plane
ARQ, acknowledge mode (AM)/ un- GTP-U GPRS Tunneling protocol- User Plane
acknowledged mode (UAM), etc
Medium Access Control (MAC): Access the channel
Physical Layer (PHY): Radio layer, eg modulation etc.
Irfan Ali
Irfan Ali 8 8

9. Protocol Stacks: Control Plane & User Plane
NAS NAS
RRC RRC S1-AP S1-AP GTP-C GTP-C GTP-C GTP-C
PDCP PDCP SCTP SCTP UDP UDP UDP UDP
RLC RLC IP IP IP IP IP IP
MAC MAC L2 L2 L2 L2 L2 L2
PHY PHY L1 L1 L1 L1 L1 L1
UE LTE-Uu S1-MME S11 S5
eNB MME S-GW P-GW
Application Application
TCP/UDP TCP/UDP
IP IP IP
GTP-U GTP-U GTP-U GTP-U
PDCP PDCP UDP UDP UDP UDP
RLC RLC IP IP IP IP
MAC MAC L2 L2 L2 L2
PHY PHY L1 L1 L1 L1
S5
LTE Uu S1-U
UE eNB S-GW P-GW End Host
Irfan Ali
Irfan Ali 9 9

10. User Identifier in the Network
• Two important identifiers
 International Mobile Subscriber Identifier (IMSI)
• Embedded in SIM card
• Stored in subscription data of HLR
• Used to index UE’s information in most network nodes
• Format on the next page
 Mobile Station Integrated Services Digital Network Number (MSISDN)
• Your phone number
• Number used to identify a subscriber when making a call or sending an SMS
• The mapping between IMSI and MSISDN is stored in HLR
 MSISDN is not required to be stored in the (U)SIM
• MSISDN is typically not needed in the LTE system
Irfan Ali
Irfan Ali 10 10

11. (International Mobile Subscriber Identifier) IMSI -
Structure
World 3 digits
MCC: Mobile Country Code
MCC
310
Country
286 404
US Turkey India PLMN
2-3 digits
MCC MNC MNC: Mobile Network Code
Operator
01 02 03 Identifies an operator
Turkcell Vodafone Avea
9-10 digits
MCC MNC MSIN MSIN: Mobile
Subscriber
Subscriber
Max 15 digits Identification Number
Irfan Alper Erol
Uniquely identifies a subscriber
Source for MCC and MNC codes:
http://en.wikipedia.org/wiki/Mobile_Network_Code
http://en.wikipedia.org/wiki/Mobile_Country_Code
Irfan Ali
Irfan Ali 11 11

12. Operator Identity
 A mobile operator’s network is also known as a Public Land Mobile
Network (PLMN).
 The identity used for an operator’s network is called the PLMN-
Identity (PLMN-ID) and consists of the Mobile Country Code and the
Mobile Network Code.
 An operator may be identified by more than one PLMN-ID
World 3 digits
MCC: Mobile Country Code
MCC
310
Country
286 404
US Turkey India PLMN
2-3 digits
MCC MNC MNC: Mobile Network Code
Operator
01 02 03 Identifies an operator
Turkcell Vodafone Avea
PLMN ID = MCC + MNC
Irfan Ali
Irfan Ali 12 12

13. MSISDN – Structure
World 1-3 digits
CC CC: Country Code
1 90 91
Country
US Turkey India
2-3 digits
CC NDC NDC: National Destination Code
533, 540, 505, 212,216,
Operator
… … … Identifies an operator
Turk
Turkcell Vodafone Avea
Telecom 9-10 digits
CC NDC SN SN: Subscriber
123 4567 123 4568
Subscriber
Number
Max 15 digits
Irfan Alper Erol
+90 533 123 4567
Uniquely identifies a subscriber
List of country calling codes:
Source for MCC and MNC codes: www.wikipedia.org
http://en.wikipedia.org/wiki/List_of_country_calling_codes
Irfan Ali
Irfan Ali 13 13

14. Identities and Plumbing for LTE
IMSI IMSI IMSI
GUTI GUTI
C-RNTI C-RNTI
SRB-0 HSS
SRB-1 S1-MME
MME
SRB-2 NAS
GTPC-1
SRB Identity
GTPC-1
Data Radio Bearer 10
GTP-U-10 GTP-U-10
EPS Bearer Identity
IMSI IMSI
UE eNB S-GW P-GW
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity
Irfan Ali
Irfan Ali
GUTI
14 14
Globally Unique Temporary Identity

15. Identities in LTE
• IMSI (International Mobile Subscription • C-RNTI (Cell Radio Network
Identity) Temporary Identity)
 Permanent identity of UE in SIM  Is created by eNB and only used to
(MCC+MNC+MSIN), where identify a UE within the scope of an
MCC+MNC = Home PLMN of eNB and provided to the UE during
subscriber. random access process and setup of
 Kept secret from eNB. RRC connection.
 Max 15 digits  C-RNTI is 16 bits long.
• GUTI (Globally unique temporary
identity)
 Created by the MME for the UE.
 Used between MME and UE instead of
IMSI.
 GUTI may be seen by eNB if NAS
message is sent un-encrypted, eg
when UE has moved to a new area
and needs to be served by a new
MME.
 56 bits + MCC and MNC
Irfan Ali
Irfan Ali 15 15

16. LTE Attach Procedure
Irfan Ali 16

17. Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
address to communicate with
P-GW
outside world.
• During the process of “attach”
S-GW  The UE is authenticated and
authorized to use send/receive
S-GW data.
MME
 Data path created beteween UE<-
>eNB<->S-GW<->PGW
 UE Context created in all the
nodes in the network
 UE is provided an IP address
X2
eNB eNB
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
C-RNTI Cell- Radio Network Temporary Identity
Bearer Setup at end of the Attach Procedure
Irfan Ali
Irfan Ali 17 17

18. Objective of UE Attach Procedure
Internet • The goal of “attaching” to the
UE’s IP address
network is to obtain an IP
HSS
UE Context:
KEY: IMSI
address to communicate with
UE Context: P-GW
KEY: IMSI ….. outside world.
…..
S6a
• During the process of “attach”
UE Context:
KEY: IMSI
S-GW …..  The UE is authenticated and
authorized to use send/receive
S-GW data.
MME
 Data path created beteween UE<-
S1-MME
>eNB<->S-GW<->PGW
 UE Context created in all the
UE Context:
S1 Cntxt: S1AP nodes in the network
TEID(key)…..
RB Cntxt: C-RNTI(key),..  UE is provided an IP address
X2
eNB eNB
SRB Signalling Radio Bearer
DRB Data Radio Beaer
TEID Tunnel Endpoint Identifier
GTP GPRS Tunneling Protocol
Bearer Setup at end of the Attach Procedure C-RNTI Cell- Radio Network Temporary Identity
Irfan Ali
Irfan Ali 18 18

19. UE Performs attach – Part 1 of 4
UE HSS
eNB MME SGW
PGW
0. UE has synchronized to the downlink frame of the eNB and hence knows
o Interne
0. UE has the DL frame boundaries. The UE has read the MIB and from there the
selected eNB SIB2 of the eNB and knows when the random access channel (RACH)
slots are in the uplink direction.
1. UE transmits a specific preamble sequence (RAPID) in a RACH slot. The
RACH Random subframe (0-9) in which the UE transmits is the RA-RNTI of the UE. Since
1. Random Access Access multiple UEs could have transmitted on the same subframe and same
Preamble RA-RNTI, RAPID Procedure RAPID, the UE listens on the downlink shared (DL-SCH) common control
channel (CC) to see if the UE’s preamble has been accepted by the eNB.
PDCCH/PDSCH
2. Random Access 2. The eNB transmits (a) (echoes) the RAPID and RA-RNTI received in Step
Preamble RA-RNTI, RAPID, 1. (b) temporary identity (C-RNTI ), (c) the timing correction that the UE
Temporary C-RNTI should use. (d) scheduling grant when the UE should transmit in the next
Temporary C-RNTI message in UL direction. UE listens for RA-RNTI in the PDCCH channel.
UL-SCH: SRB0
3. RRC Connection 3. The UE checks the RA-RNTI in PDCCH, and the RAPID in PDSCH to
Request what it transmitted. If so, it knows the UL Radio Bearers to transmit the
DL-SCH: Common CCH RRC connection request. The UE includes the Temporary C-RNTI.
RRC Setup
4. Contention Resolution ID Procedure 4. The eNB echoes the Temporary C-RNTI and the contents of message 3
C-RNTI to the UE. When the UE receives its own transmitted message (unique)
5. RRC Connection Setup and C-RNTI, the contention resolution process is complete.
5. The eNB now transmits RRC Connection Setup message including the C-
UL-SCH: SRB1 RNTI that was received from the UE. This step resolves any contention
that could have occurred due to two UEs using the same preamble
6. RRC Connection Complete sequence in RACH access step.
NAS Msg Attach
Request, IMSI 6. The UE now transmits a message to the MME in the time-slot allocated in
NAS Msg PDN
the previous step. The UE also includes its IMSI in the message.
Connect Req
RNTI Radio Network Temporary Identity
Irfan Ali
Irfan Ali 19 19
RA-RNTI
C-RNTI
Random Access RNTI
Cell RNTI
RAPID Random Access Preamble ID

20. UE Performs Attach – Part 2 of 4
HSS
UE eNB MME SGW
eNB selects PGW
MME
Interne
S1-MME
7. Initial UE Message
S6a
8. Auth Info Request
NAS Msg: Attach
IMSI, ..
Request, IMSI, ..
NAS Msg PDN
User
9. Auth Info Answer
Connect Req Kasme, AUTN, RAND,XRES Authentication
DL-SCH:CCH SRB1 Procedure
10. DL NAS Xport
11. DL Info Xfer Authn Request
Authn Request: MME Compares
AUTN, RAND, RES with XRES.
If same, AKA
12. UL Info Transport successful
13. UL NAS Xport
Authn Response
Authn Response:
RES
UL-SCH: SRB1
DL-SCH:CCH SRB1 14. DL NAS Xport
15. DL Info Transport
Security Mode Command
Security Mode Command NAS Security
Setup Procedure
16. UL Info Transport
17. UL NAS Xport
Security Mode
SMC Complete
Complete
UL-SCH: SRB1 18. Location Update Request Authorization
IMSI, …
NAS Security 19. Location Update Response
Subscription Data Encrypted Info
Irfan Ali
Irfan Ali 20 20
AKA: Authentication and Key Agreement
Integrity Protected
Info

21. UE Performs Attach – Part 3 of 4
HSS
UE eNB MME SGW
NAS Security PGW Interne
GTPC
20. Create Session GTPC
Request (IMSI, TEIDs, 21. Create Session
PGW IP,…) Request (IMSI, TEIDs,
…)
S1-MME 22. Create Session
23. Create Session
DL-SCH:CCH SRB1 Response (IMSI, TEIDs)
24. Initial Context Setup Request Response(IMSI, TEIDs)
25. RRC Security Mode
(UE Context Info, TEIDs)
Command, AS Algorithm NAS: Attach Accept
NAS: Activate Bearer Setup
UL-SCH: SRB1 default bearer req Procedure Start
26. RRC Security Mode GTPC Session GTPC-1 Session
Complete
GTP-U-10 Tunnel
SRB-2
AS Security Setup
AS Security Procedure
27. Obtain UE’s Radio
Capability
DL-SCH:CCH SRB2
28. RRC Connection
Reconfiguration NAS1 Attach Completion
NAS2 Data Radio Bearer Setup
UL-SCH: SRB2
29. RRC Reconfig Complete 30. Initial Context Setup
Complete (S1U TEIDs)
31. UL Information Transfer GTPC
32. UL NAS Xport Bearer Setup
NAS1 NAS2 33. Modify Bearer Req.
NAS: Attach Complete Procedure Completion
SRB-0 (IMSI, TEIDs…)
NAS: Activate
SRB-1 default bearer acpt 34. Modify Bearer Resp
(IMSI,…) Encrypted Info
SRB-2
Irfan Ali
Irfan Ali
Data Radio Bearer-10 GTPU-10 Tunnel
21 21 Integrity Protected
Info

22. UE Performs Attach – Part 4 of 4 DHCP
HSS Server
UE eNB MME SGW
SRB-0 PGW Internet
SRB-1
SRB-2 S1-MME GTPC Session GTPC-1 Session
Data Radio Bearer-10 GTPU-10 Tunnel GTP-U-10 Tunnel
DHCP DHCP DHCP DHCP
Data Radio Bearer-10 GTPU-10 Tunnel DHCP Messages GTP-U-10 Tunnel
Client Server Client Server
IP address
of the UE is
routed to this
interface
Irfan Ali
Irfan Ali 22 22

23. Architecture key Concept: Roaming
• 3GPP architecture from early days has supported a subscriber going
to a foreign network and still getting service
 Home PLMN: Subscriber’s home network (eg. Turkcell)
 Visited PLMN: Foreign/Roamed-to network (eg. Orange)
• What does roaming require:
 Ability from VPLMN to identify the HPLMN of the subscriber
 Ability to authenticate the subscriber from VPLMN
 Sharing of revenue between VPLMN and HPLMN (roaming charges)
PLMN Public Land Mobile Network
VPLMN Visited PLMN
HPLMN Home PLMN
Irfan Ali
Irfan Ali 23 23

24. Roaming Concept HPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
HSS
IMS Internet IMS Internet
HSS
P-GW P-GW
S6a S6a
S5 S5
S11 S-GW S11 S-GW
S-GW S-GW
MME MME
S1-MME S1-MME
S1-U S1-U
HPLMN VPLMN
Domain = epc.mnc01.mcc286.pub.3gppnetwork.org
Domain = epc.mnc01.mcc404.pub.3gppnetwork.org
X2 X2 X2
X2 eNB
eNB eNB eNB eNB eNB
LTE-Uu LTE-Uu
Non-Roaming Roaming IMSI = 286 + 01 + 1234567890
IMSI = 286 + 01 + 1234567890 Turkey Turkcell
Turkey Turkcell HPLMN Home PLMN
VPLMN Visited PLMN
Irfan Ali
Irfan Ali Turkcell subscriber in Turkey 24 24 Turkcell subscriber in India

25. General:
LTE/EPC Specifications 23.003 Identifiers
29.303 DNS
33.401 Security Stage 2&3
24.301 NAS HSS SPR PCC Stage 2: 23.203
Charging Stage 2: 32.240
S6a Unspecified Sp
29.214
S1-MME 29.272
PCRF Rx
36.410 General MME Operator
36.411 Layer 1
36.412 (Sig xport)
S11 29.212
S9 Services
S10 29.213 Sig Flow
36.413 (S1AP) Gx 29.215
36.133 RRM Reqds 29.274 GTPC
S1u Serving S5 SGi
UE eNB PDN GW Internet
GW
LTE-Uu 29.274 GTPC 29.061
36.304 Idle X2 36.410 General 29.281 GTPU Gz/Rf
36.306 Capability 36.411 Layer 1 Gy/Ro
36.314 Measurement 36.414 (Data xport) 32.251
23.122 Idle-NAS 29.281 GTPU Online Offline Bx Billing
36.420 General Charging Charging
Domain
36.201,211,213,214 PHY 36.421 Layer 1 Function Function
32.251
36.321 MAC 36.422 (Sig xport)
36.322 RLC 36.424 (Data xport)
36.323 PDCP 36.423 (X2AP)
36.331 RRC 29.281 GTPU
E-UTRAN Stage-2: Evolved Packet Core Stage 2: 23.401
36.300 Stage-3 Specification
Stage-2 Specification
Stage-1 Specification
Stage-1: 22.278
Link to get latest 3GPP specs per release: ftp://ftp.3gpp.org/Specs/latest
Link to find out what a spec covers: http://www.3gpp.org/Specification-Numbering
Irfan Ali
Irfan Ali 25 25