Lte Sig+Prot Ran+Ue v1.201

LTE
Signaling & Protocol Analysis

Focus: E-UTRAN and UE
INACON GmbH Kriegsstrasse 154 76133 Karlsruhe Germany www.inacon.com e-mail: inacon@inacon.de
Cover design by Stefan Kohler 1999 - 2010 INACON GmbH Kriegsstrasse 154 76133 Karlsruhe All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in the preparation of this publication, the publisher and authors assume no responsibility for errors or omissions. Neither is any liability assumed for damages resulting from the use of the information contained herein. For more information, contact INACON GmbH at www.inacon.com.
Legend:
All INACON publications use the same color codes to distinguish mandatory from optional or conditional parts in frame formats or optional from mandatory data blocks or signaling messages in scenarios. The different color codes are explained underneath:
Color Codes in Frame Formats:
Color Codes in Scenarios:
Foreword of the Publisher:

Dear Reader: Note that this book is primarily a training document because the primary business of INACON GmbH is the training and consulting market for mobile communications. As such, we are proud to providing high-end training courses to many clients worldwide, among them operators like AT&T, Mobilkom Austria, SWISSCOM, T-MOBILE or VSNL (India) and equipment suppliers like ALCATEL-LUCENT, ERICSSON and SONY-ERICSSON, MOTOROLA, NOKIA-SIEMENS and RIM. INACON GmbH is not one of the old-fashioned publishers. With respect to time-tomarket, form-factor, homogeneous quality over all books and most importantly with respect to after-sales support, INACON GmbH is moving into a new direction. Therefore, INACON GmbH does not leave you alone with your issues and this book but we offer you to contact the author directly through e-mail (inacon@inacon.de), if you have any questions. All our authors are employees of INACON GmbH and all of them are proven experts in their area with usually many years of practical experience. The most important assets and features of the book in front of you are: Extreme degree of detailed information about a certain technology. Extensive and detailed index to allow instant access to information about virtually every parameter, timer and detail of this technology. Incorporation of several practical exercises. If applicable, incorporation of examples from our practical field experiences and real life recordings. References to the respective standards and recommendations on virtually every page.
Finally, we again like to congratulate you to the purchase of this book and we like to wish you success in using it during your daily work. Sincerely,
Gunnar Heine / President & CEO of INACON GmbH
Table of Content
Table of Content
Revisiting important Details of the EPS.................................1
1.1 Architecture Overview..............................................................2
1.1.1 Evolved Packet Core in Context..................................................2
1.1.1.1 EPC vs. EPS...................................................................................2 1.1.1.2 Non-3GPP Access Networks (trusted / non-trusted).......................3
1.1.2 Zoom into the EPS......................................................................4

1.1.2.1 Functional Overview of Core Network Elements within the EPC....5
1.1.3 Network Elements and their Functions within the EPC...............6

1.1.3.1 Mobility Management Entity (MME).................................................6 1.1.3.1.1 Characteristics........................................................................6 1.1.3.1.2 Identification............................................................................6 1.1.3.1.3 Interfaces & Protocols.............................................................8 1.1.3.1.4 Tasks & Functions of the MME.............................................10
1.1.3.1.4.1 NAS-Signaling towards the UE..................................................10 1.1.3.1.4.2 S1-Signaling towards the eNodeB.............................................10 1.1.3.1.4.3 S-GW and P-GW Selection........................................................12 1.1.3.1.4.4 Other Selection Functions..........................................................13 1.1.3.1.4.5 Local Breakout...........................................................................14 1.1.3.1.4.5 IMS and Local Breakout.............................................................14
1.1.3.2 Serving Gateway (S-GW)..............................................................16 1.1.3.2.1 Characteristics......................................................................16 1.1.3.2.2 Identification..........................................................................16 1.1.3.2.3 Interfaces & Protocols...........................................................18 1.1.3.2.4 Tasks & Functions of the S-GW............................................20
1.1.3.2.4.1 Packet Routing / Relaying..........................................................20 1.1.3.2.4.2 Legal Interception.......................................................................20 1.1.3.2.4.3 QCI-based Packet Tagging........................................................20 1.1.3.2.4.4 Accounting..................................................................................20
1.1.3.3 PDN Gateway (P-GW or PDN-GW)..............................................22 1.1.3.3.1 Characteristics......................................................................22 1.1.3.3.2 Identification..........................................................................22 1.1.3.3.3 Interfaces & Protocols...........................................................24 1.1.3.3.4 Tasks & Functions of the P-GW............................................26
1.1.3.3.4.1 UE IP Address Allocation...........................................................26 1.1.3.3.4.2 QCI-based Packet Tagging........................................................26 1.1.3.3.4.3 Policy Enforcement....................................................................26 1.1.3.3.4.4 Legal Interception.......................................................................27 1.1.3.3.4.5 Home Agent Function.................................................................27
1.1.3.4 enhanced Packet Data Gateway (ePDG)......................................28 1.1.3.4.1 Characteristics......................................................................28 1.1.3.4.2 Identification..........................................................................28 1.1.3.4.3 Interfaces & Protocols...........................................................30 1.1.3.4.4 Tasks & Functions of the ePDG............................................32
1.1.3.4.4.1 ESP-Tunnel Mgmt towards UE's................................................32 1.1.3.4.4.2 QoS-specific Packet Tagging in UL-Direction............................32 1.1.3.4.4.3 Legal Interception.......................................................................32 1.1.3.4.4.4 MAG-Function for PMIPv6.........................................................32
1.2 Protocol Stacks......................................................................34

1.2.1 Control Plane / E-UTRAN - EPC...............................................34
INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200
-i-
LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.2.2 User Plane E-UTRAN EPC (S5/S8 GTP-based)....................36 1.2.3 User Plane E-UTRAN EPC (S5/S8 PMIPv6/GRE-based)......38
1.3 Security Architecture..............................................................40

1.3.1 Overview & Introduction............................................................40
1.3.1.1 Essentials......................................................................................41 1.3.1.2 EPS-AKA.......................................................................................41 1.3.1.3 Security is performed independently in two protocol layers..........41 1.3.1.4 Algorithms......................................................................................41
1.3.2 Operation of UMTS-AKA...........................................................42 1.3.3 Key Derivation Function (KDF)..................................................44

1.3.3.1 Comprehension Check & Practical Exercise: The KDF S(10) for K(ASME).....................................................................46 1.3.3.1.1 Input Parameters..................................................................48
1.3.4 EPS-AKA in Operation during Initial Attach Procedure.............50 1.3.5 Use of the different Security Algorithms....................................52
The Non-Access-Stratum: EMM & ESM................................55

2.1.1 Important EMM-Procedures......................................................56
2.1.1.1 Common Procedures.....................................................................57 2.1.1.2 Specific Procedures.......................................................................57 2.1.1.3 Connection Management Procedures...........................................57
2.1.2 State Machine...........................................................................58

2.1.2.1 Relationship between EMM and ECM...........................................58
2.1.3 Network Operation Modes.........................................................60 2.1.4 Message Format.......................................................................62

2.1.4.1 Security Header.............................................................................62
2.1.5 Important EMM-Scenarios.........................................................64

2.1.5.1 Attachment through E-UTRAN / new MME...................................64 2.1.5.2 Comprehension Check & Practical Exercise: Building your own EMM: ATT_REQ-Message........................................................................72 2.1.5.3 Tracking Area Update (Inter-MME / with new S-GW)....................76 2.1.5.3.1 Initial Conditions....................................................................76 2.1.5.3.2 Detailed Description..............................................................78 2.1.5.4 Comprehension Check & Practical Exercise: EMM-Message Decode......................................................................................................84
2.2.1 Important ESM-Procedures.......................................................86

2.2.1.1 MME-initiated.................................................................................87 2.2.1.2 UE-initiated....................................................................................87
2.2.2 State Machine...........................................................................88 2.2.4 Message Format.......................................................................90

2.2.4.1 Security Header.............................................................................92 2.2.4.2 Procedure Transaction Identity......................................................92
2.3.5 Dedicated EPS Bearer Establishment.......................................94

2.3.5.1 Network Initiated (IMS triggered during Call Establishment) ........94 2.3.5.1.1 Initial Conditions....................................................................94 2.3.5.1.2 Detailed Description..............................................................94 2.3.5.1.2 Detailed Description..............................................................98 - ii INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200
Table of Content
Radio Resource Control.......................................................101
3.1 Overview..............................................................................102
3.1.1 Transmission of broadcast information...................................103 3.1.2 Establish and maintain services..............................................103 3.1.3 QoS control.............................................................................103 3.1.4 Transfer of dedicated control information................................103
3.2 State Characteristics of RRC...............................................104

3.2.1 RRC_IDLE..............................................................................104 3.2.2 RRC_CONNECTED................................................................104
3.3 Signaling Radio Bearers (SRB)............................................106

3.3.1 Overview.................................................................................106
3.3.1.1 SRB0...........................................................................................106 3.3.1.2 SRB1...........................................................................................106 3.3.1.3 SRB2...........................................................................................106
3.3.2 Mapping of RRC-Messages to SRB's and to Channels..........108

3.3.2.1 Messages on BCCH (MIB and SIB)............................................108 3.3.2.2 Messages on PCCH and DL-CCCH............................................110 3.3.2.3 Messages on DL-DCCH and DL-DTCH......................................112 3.3.2.4 Messages on UL-CCCH, UL-DCCH and UL-DTCH....................114
3.4 Message Encoding through ASN.1 PER-unaligned..............116

3.4.1 Example: The ASN.1-Code of RRC_CONN_REQ .................116 3.4.2 and the compiled Message Structure (Tree View)..............118 3.4.3 Important Encoding Rules of ASN.1 PER-unaligned...............120
3.4.3.1 Handling of optional IE's..............................................................120 3.4.3.2 Selection among Options (CHOICE / ENUMERATED)...............122 3.4.3.3 Handling of IE's with variable Length..........................................124
3.4.4 Comprehension Check & Practical Exercise: Encoding an RRC_CONN_REQ-Message......................................126
3.5 RRC Procedures..................................................................128

3.5.1 System Information Broadcast................................................128
3.5.1.1 Overview......................................................................................128 3.5.1.2 Overview of Functions of the System Information Blocks...........130 3.5.1.3 Example of an MIB......................................................................132 3.5.1.4 Example of an SIB1.....................................................................134 3.5.1.5 Example of an SIB2.....................................................................136 3.5.1.6 Example of an SIB3.....................................................................138
3.5.2 Connection Management Related Procedures........................140

3.5.2.1 Paging Procedure........................................................................140 3.5.2.2 RRC Connection Establishment Procedure................................142 3.5.2.2.1 SRB1 Default Configuration................................................144 3.5.2.2.2 Physical Layer Default Configuration..................................146 3.5.2.3 UE Capability Transfer Procedure...............................................148 3.5.2.4 RRC Initial Security Activation Procedure...................................150 3.5.2.5 RRC Connection Reconfiguration Procedure..............................152
- iii -

3.5.2.5.1 SRB2 Default Configuration................................................154 3.5.2.6 Counter Check Procedure...........................................................156 3.5.2.7 RRC Connection Reestablishment Procedure............................158 3.5.2.8 RRC Connection Release Procedure..........................................160
3.5.3 Inter RAT RRC Procedures.....................................................162 3.5.4 E-UTRAN Measurements........................................................164

3.5.4.1 Overview......................................................................................164 3.5.4.2 Definition of Measurements in E-UTRAN....................................166 3.5.4.3 Measurement Events in E-UTRAN..............................................168 3.5.4.4 Measurement Definition in the Standard Measurement Object170 3.5.4.5 Measurement Definition in the Standard Report Configuration and Measurement ID...............................................................................172 3.5.4.6 Structure Measurement Report...................................................174
3.5.5 Other RRC Procedures...........................................................176 3.5.6 RRC Procedure Delay.............................................................178

3.5.6.1 Introduction..................................................................................178 3.5.6.1 Values..........................................................................................180
3.5.7 Idle Mode Procedures Neighbor Cell Monitoring & Cell Reselection......................................................................................182
3.5.7.1 Priority-Based Cell Reselection of Multi-RAT UE's.....................182 3.5.7.1.1 SPID - Subscriber Profile ID for RAT/Frequency priority....183 3.5.7.1.2 E-UTRAN priority-based Cell Reselection Details..............184 3.5.7.1.3 UTRAN priority-based Cell Reselection Details..................184 3.5.7.1.4 GERAN priority-based Cell Reselection Details.................185 3.5.7.2 Cell Selection in E-UTRAN..........................................................186 3.5.7.2.1 PLMN selection in E-UTRAN..............................................188 3.5.7.2.2 Cell Selection and Reselection...........................................188 3.5.7.2.3 Cell Selection Process........................................................188 3.5.7.2.4 Cell Selection Criterion.......................................................189 3.5.7.3 Cell Reselection Evaluation Process in E-UTRAN......................190 3.5.7.3.1 Reselection Priorities Handling...........................................190 3.5.7.3.2 Measurement Rules for Cell Re-Selection..........................192 3.5.7.3.3 Mobility States in E-UTRAN................................................194 3.5.7.3.4 Scaling Rules based on Mobility State...............................196 3.5.7.4 E-UTRAN Inter-Freq and IRAT Cell Reselection Criteria............198 3.5.7.5 Intra-Freq and equal Priority Inter-Freq Reselection Criteria......200 3.5.7.5.1 Cell Ranking Criterion in E-UTRAN for equal Priority interFreq and intra-Freq............................................................................202 3.5.7.6 Cell Reselection towards lower Priority E-UTRAN Freq or IRAT Freq than Serving Freq............................................................................204
3.6 GERAN to E-UTRAN Cell Reselection.................................206

3.6.1 IRAT Measurements when camping in GSM or GPRS...........206 3.6.2 IRAT Cell Reselection based on Priority 2G to 3G / LTE.....208
3.6.2.1 Cell Reselection Criteria's...........................................................208 3.6.2.2 Cell Reselection from GERAN towards higher prioritized IRAT Frequency................................................................................................212 3.6.2.3 Cell Reselection from GERAN towards lower prioritized IRAT Frequency................................................................................................214
Lower Layers of the Uu-Interface: MAC, RLC & PDCP.....217

- iv INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200
Table of Content
4.1 Features of MAC..................................................................218
4.1.1 Overview.................................................................................218
4.1.1.1 Data transfer logical channels transport channels..............218 4.1.1.2 Radio resource allocation............................................................218 4.1.1.3 Special procedures......................................................................219
4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN...220

4.1.2.1 Usage of RNTI's..........................................................................220 4.1.2.1 RNTI Values................................................................................222
4.1.3 MAC Random Access Procedure............................................224

4.1.3.1 Contention Based Random Access Procedure...........................224 4.1.3.2 Non-contention based random access procedure.......................228
4.1.4 Structure of MAC-PDU............................................................230

4.1.4.1 MAC control element...................................................................231 4.1.4.2 Normal (non-transparent) MAC SDU...........................................231 4.1.4.3 Transparent MAC SDU................................................................231
4.1.5 MAC Control Elements............................................................232

4.1.5.1 Contention resolution ID..............................................................233 4.1.5.2 Timing Advance...........................................................................233 4.1.5.3 DRX.............................................................................................233 4.1.5.4 Padding.......................................................................................233 4.1.5.5 Power headroom report...............................................................233 4.1.5.6 C-RNTI........................................................................................233 4.1.5.7 Short, long and truncated buffer status reports...........................233
4.1.6 Practical Exercise: MAC Operation.........................................234 4.1.7 Practical Exercise: DL MAC PDU Construction.......................236 4.1.8 MAC Configuration..................................................................238
4.1.8.1 MAC Configuration in the Standard ............................................238
4.2 Features of RLC...................................................................240

4.2.1 Overview.................................................................................240
4.2.1.1 Data transfer................................................................................240 4.2.1.2 Error detection and recovery.......................................................240 4.2.1.3 Reset...........................................................................................241
4.2.2 Structure of RLC PDU.............................................................242 4.2.3 Structure of RLC AM with PDCP PDU Segments...................244 4.2.4 RLC Configuration...................................................................246
4.2.4.1 RLC Configuration in the Standard..............................................246
4.3 Features of PDCP................................................................248

4.3.1 Overview.................................................................................248
4.3.1.1 RoHC...........................................................................................248 4.3.1.2 Numbering of PDCP PDUs.........................................................248 4.3.1.3 In-sequence delivery of PDUs....................................................248 4.3.1.4 Duplicate deletion........................................................................248 4.3.1.5 Encryption....................................................................................249 4.3.1.6 Integrity Protection.......................................................................249
4.3.2 Structure of PDCP PDU..........................................................250 4.3.3 PDCP Configuration................................................................252

4.3.3.1 PDCP Configuration in the Standard...........................................252
-v-

4.4 How a TCP/IP MTU is reaching the UE / the Internet...........254
4.4.1 TCP/IP layer............................................................................254 4.4.2 PDCP layer.............................................................................254 4.4.3 RLC layer................................................................................254 4.4.4 MAC layer...............................................................................255 4.4.5 PHY layer................................................................................255
X2- and S1-Interfaces: X2AP- and S1-AP-Protocols.........257

5.1 The X2AP Protocol...............................................................258
5.1.1 Protocol Stack on the X2-interface..........................................258 5.1.2 Tasks & Functions...................................................................260
5.1.2.1 Mobility Management..................................................................260 5.1.2.2 Load Management.......................................................................260 5.1.2.3 X2-Interface Management...........................................................260
5.1.3 X2-based Handover Scenario.................................................262

5.1.3.1 Initial Conditions..........................................................................262 5.1.3.2 Detailed Description....................................................................264
5.2 The S1-AP Protocol.............................................................266

5.2.1 Overview & Introduction..........................................................266 5.2.2 S1-based Handover Scenario.................................................268
5.2.2.1 Initial Conditions..........................................................................268 5.2.2.2 Detailed Description....................................................................270
- vi -
Revisiting important Details of the EPS
Chapter 1:
Objectives
Some of your questions that will be answered during this session How does the architecture of the LTE-network look like? What are the tasks and functions of the new network elements? How does security operate in LTE?
-1-
1.1 Architecture Overview

1.1.1 Evolved Packet Core in Context
The objective of this section is to depict the EPC as new network cloud in context to the legacy and new network clouds.
Image Description The image is split into two parts: in the upper part, the image illustrates the legacy network parts and clouds which already exist with 3GPP Rel. 6 and 7. These network parts and clouds are illustrated in gray color. In the lower part, the new network clouds with Rel. 8 are depicted. They have been colorized to provide for a better distinction from the legacy network clouds. I-WLAN IP access from non-3GPP non-trusted access network may be achieved either directly (lower option) or through the packet-switched core network domain (upper option).
1.1.1.1 EPC vs. EPS The two terms EPC and EPS can be distinguished as illustrated: The EPC represents the core component of the EPS. The EPS contains the EPC and the E-UTRAN (LTE) access network. However, it does not contain the other access networks.
[3GTS 23.401, 3GTS 23.402]
-2-
1.1.1.2 Non-3GPP Access Networks (trusted / non-trusted) In the legacy part (gray) the image illustrates the so called non-3GPP non trusted access networks which have been supported by 3GPP-recommendations since Rel. 6.
New with Rel. 8 and SAE are the so called trusted non-3GPP access networks. Those trusted non-3GPP access networks comply to an EPC-operator's security requirements [3GTS 33.402 (4.2)] and are therefore granted direct access to the EPC. Whether a non-3GPP access network is trusted or untrusted is ... 1. either pre-configured in the UE or ... 2. the UE learns the trust relationship during EAP-AKA authentication through that access network from its home-PLMN. 3. Yet another option is that the selected access network does not at all support EAP-AKA authentication in which case the UE determines that it camps on an untrusted non-3GPP access network. The major difference for the UE with respect to the trust relationship of the selected non-3GPP access network is that in "untrusted case" the UE must establish an IPsec-tunnel through IKEv2 with an ePDG in the EPC [3GTS 33.402 (8)]. The illustrated IPsec-tunnel through the non-3GPP trusted access network is only necessary in case the S2c-interface is used and it comes without interface name. Abbreviations of this Section:
Authentication and key agreement (3GTS 33.102) IKEv2 IPsec Internet Key Exchange protocol / version 2 (RFC 4306) Internet Protocol / secure (RFC 4301) Long Term Evolution (of UMTS) Public Land Mobile Network
AKA
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EAP EAP-AKA Extensible Authentication Protocol (RFC 3748) Extensible Authentication Protocol method for 3rd generation Authentication and Key Agreement (RFC 4187) Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Evolved Packet System Interworking WLAN (Wireless Local Area Network) (3GTS 23.234)
LTE PLMN
EPC EPS I-WLAN
SAE UE UTRAN
System Architecture Evolution User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
-3-
1.1.2 Zoom into the EPS
The objectives of this section are to: 1.Illustrate the inner structure of the EPC and the E-UTRAN. 2. Point out the "one-to-many" nature of the interconnections within the EPS. Key point of this section is that there is no more RNC or BSC within the access network.
Image Description The image depicts another time the two network clouds EPC and E-UTRAN and illustrates the physical interconnections (black lines) of the various network elements to the two IP-backbone networks. [3GTS 23.401 (5.3.2)]
-4-
1.1.2.1 Functional Overview of Core Network Elements within the EPC The MME or Mobility Management Entity takes care of various control plane functions like mobility management and session management. The S-GW or Serving Gateway is the peer of the MME within the user plane and its functions evolve around packet data routing and forwarding. The PDN-Gateway has similar functions as the Serving Gateway but it remains the anchor during a packet data connection even if MME and S-GW are swapped. It is feasible to assume that GGSN's will typically be upgraded into PDN-GW's.
S-GW and PDN-GW may easily be integrated into a single box in order to save hardware and latency. A combination of MME and S-GW is probably less appealing because the MME is a very slim hardware box. The ePDG is required to interconnect non-trusted non-3GPP networks to the EPC. Its functions evolve around tunnel termination towards the UE and the nontrusted non-3GPP access network. Abbreviations of this Section:
Base Station Controller MME PDN-GW Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Network Gateway (part of EPC) Public Land Mobile Network Radio Network Controller Serving Gateway (3GTS 23.401) User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
BSC
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network eNB EPC ePDG EPS GGSN Enhanced Node B Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) evolved Packet Data Gateway (3GTS 23.402) Evolved Packet System Gateway GPRS Support Node
PLMN RNC S-GW UE UTRAN
IP
Internet Protocol (RFC 791)
-5-
1.1.3 Network Elements and their Functions within the EPC 1.1.3.1 Mobility Management Entity (MME) 1.1.3.1.1 Characteristics
The objective of this section is to illustrate the most important characteristics of the MME.
Image Description The MME is a network element that takes care of control plane tasks. The MME may physically be part of an SGSN or S-GW or it may be setup as a stand-alone network element.
MME's are typically organized in pool areas (S1Flex) to provide for load balancing among the MME's which belong to the same pool. All eNodeB's which belong to the related E-UTRAN pool areas shall have access to the MME's belonging to this MME-pool area(s). [3GTS 23.002 (4.1.4.1), 3GTS 23.401 (4.4.2)] 1.1.3.1.2 Identification Each MME is identified by using an MME Group ID (MMEGI), and an MME Code (MMEC). Both parameters together form the MMEI [3GTS 23003 (19.4.2.4)].
-6-
Room for your Notes:
Abbreviations of this Section:

3rd Generation Technical Specification MMEC MMEGI MME Code MME Group Identity
3GTS
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EPC GW ID Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Gateway Identity
MMEI SGSN UTRAN
MME Identity Serving GPRS Support Node UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
MME
Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards)
-7-
1.1.3.1.3 Interfaces & Protocols
The objectives of this section are to illustrate the MME, its interfaces towards other network elements and the protocol stacks used on these interfaces.
Image Description The green color used for the interfaces indicates the control plane relationship of a protocol or an interface. The interface towards the UE is depicted to illustrate the NAS-protocol involvement of the MME. Obviously, this interface is realized over S1-AP and Uu. The S102-interface towards the cdma2000 access network is only necessary in case of circuit-switched fallback for cdma2000-networks and it is also required to support SRVCC. The Sv-interface is required to support the SRVCC-feature. The Sv-interface is described in more detail in 3GTS 29.280.
[3GTS 23.401 (5.1)]
-8-

1x Circuit Switched Interworking Solution Function (3GTS 29.277) Successor of the RADIUS protocol Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network Equipment Identity Register EPS Mobility Management (3GTS 24.301) Enhanced Node B Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) EPS Session Management (3GTS 24.301) GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane Gateway HSS Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Mobile Services Switching Center
1xCSIWS
DIAMETER E-UTRAN
MME MSC
EIR EMM eNB EPC ESM GTP GTP-C GW
MSC-S NAS S1-AP SCTP SGSN TCP UDP UTRAN
MSC-Server Non-Access-Stratum S1 Application Part Stream Control Transmission Protocol (RFC 2960) Serving GPRS Support Node Transmission Control Protocol User Datagram Protocol (RFC 768) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
-9-
1.1.3.1.4 Tasks & Functions of the MME 1.1.3.1.4.1 NAS-Signaling towards the UE
The objective of this section is to illustrate the MME as peer of the eNodeB and the UE for different signaling tasks.
The MME and the UE use the physical resources of the LTE-Uu-interface and the S1-interface to exchange NAS-signaling [3GTS 24.301] which relates to EMM and ESM. 1.1.3.1.4.2 S1-Signaling towards the eNodeB MME and eNodeB use the S1-AP-protocol for various tasks as stated in the image. [3GTS 36.413]
- 10 -

3rd Generation Technical Specification EPS Mobility Management (3GTS 24.301) EPS Session Management (3GTS 24.301) Long Term Evolution (of UMTS) MME NAS S1-AP UE Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum S1 Application Part User Equipment
3GTS EMM ESM LTE
- 11 -
1.1.3.1.4.3 S-GW and P-GW Selection
The objective of this section is to illustrate the responsibility of the different network elements to select specific entities inside their pools to become responsible for a certain UE.
Image Description It is the eNodeB that selects the MME out of an MME-pool. The selection of the S-GW is done based on O&M-constraints. Nevertheless, if the possibility is there to select an S-GW which is integrated with the selected P-GW, the MME shall prefer this choice. The selection of the P-GW is either predefined through a decision of the HSS of the registering UE or the MME may apply route optimizing decisions, e.g. by selecting a local P-GW in the V-PLMN in case of roaming. The aforementioned route optimization is frequently called local breakout. [3GTS 23.882 (7.2)] [3GTS 23.401 (4.3.8)]
- 12 -
1.1.3.1.4.4 Other Selection Functions In addition to the aforementioned selection functions the MME is also responsible to select the new MME in case of a handover with MME-change. Besides, the MME will select the SGSN in case of inter-RAT handovers to GSM or UMTS, if the packet-switched core network in the 2G/3G-domain supports the IuFlex-feature.

3rd Generation Technical Specification Global System for Mobile Communication Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Operation and Maintenance Public Land Mobile Network RAT SGSN UE Radio Access Technology (e.g. GERAN, UTRAN, ...) Serving GPRS Support Node User Equipment
3GTS GSM HSS
MME O&M PLMN
UMTS V-PLMN
Universal Mobile Telecommunication System Visited PLMN
- 13 -
1.1.3.1.4.5 Local Breakout
The objective of this section is to explain the term "local breakout". Key point of this section is to bear in mind that local breakout basically relates to "route optimization" in case of roaming.
Local breakout requires the UE to using two IP-addresses because traffic from outside needs an unambiguous route to the UE and previously to two separate PDN-gateways. It is obvious that local breakout will save latency and bandwidth, because the blue link to the server is essentially shorter than the red link. 1.1.3.1.4.5 IMS and Local Breakout Local breakout is particularly interesting in case of roaming and IMS-access. In that case, it may be desirable to allow the user data traffic to "breakout" locally in the V-PLMN whereas the SIP-signaling must in any case be routed to the IMS in the H-PLMN (according to the IMS-rules).
[3GTR 23.882 (7.2)]
- 14 -

3rd Generation Technical Report IMS IP Internet Protocol Multimedia Core Network Subsystem (Rel. 5 onwards) Internet Protocol (RFC 791)
3GTR
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EPC H-PLMN HSS Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Home PLMN Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5
PLMN SIP UTRAN
Public Land Mobile Network Session Initiation Protocol (RFC 3261) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network Visited PLMN
V-PLMN
- 15 -
1.1.3.2 Serving Gateway (S-GW) 1.1.3.2.1 Characteristics
The objective of this section is to illustrate the most important characteristics of the S-GW.
[23.002 (4.1.4.2.1), 23.401 (4.4.3.3)] Image Description The S-GW represents the user plane side of the MME Although the S-GW is logically a separate network element from the PDN-GW , the two network elements may physically be integrated into a single network element (e.g. to save on latency). S-GW's are typically organized into S-GW pools to provide for load balancing among the S-GW's which belong to the same service area. All eNodeB's which belong the related E-UTRAN pool areas shall have access to the S-GW's belonging to this S-GW service area.
1.1.3.2.2 Identification An S-GW has no EPS-specific identifiers and is identified by means of IPaddresses and URL's.
- 16 -

S-GW Serving Gateway (3GTS 23.401)
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EPS MME PDN Evolved Packet System Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Network
SGSN URL UTRAN
Serving GPRS Support Node Uniform Resource Locator (RFC 1738) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 17 -
The objectives of this section are to illustrate the S-GW, its interfaces towards other network elements and the protocol stacks used on these interfaces.
Image Description The green color of an interface indicates the control plane relationship of a protocol or an interface. Likewise, orange color indicates user plane relationship. Note that on S5 and S8 interface it is an operator choice to implement either GTP or PMIPv6 together with GRE. Irrespective of this choice, the S-GW must support GTP on various other interfaces like for example towards MME, eNodeB or RNC. [3GTS 23.401 (5.1), 23.402 (5.1)]
- 18 -

MME PCRF Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Policy and Charging Rules Function (3GTS 23.203) Packet Data Network Public Land Mobile Network Proxy Mobile IPv6 Radio Network Controller Serving Gateway (3GTS 23.401) Stream Control Transmission Protocol (RFC 2960) Serving GPRS Support Node Transmission Control Protocol User Datagram Protocol (RFC 768) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
DIAMETER Successor of the RADIUS protocol E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network Enhanced Node B Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Generic Routing Encapsulation (RFC 2784) GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane GTP User Plane Home PLMN
eNB EPC GRE GTP GTP-C GTP-U H-PLMN HSGW IP
PDN PLMN PMIPv6 RNC S-GW SCTP SGSN
HRPD Serving Gateway (cdma2000 TCP term) Internet Protocol (RFC 791) UDP UTRAN
- 19 -
1.1.3.2.4 Tasks & Functions of the S-GW
The objective of this section is to illustrate the tasks and functions of the SGW.
1.1.3.2.4.1 Packet Routing / Relaying 1.1.3.2.4.2 Legal Interception 1.1.3.2.4.3 QCI-based Packet Tagging When the S-GW receives IP-packets in uplink or downlink direction it will check the related QCI-value based on the relationship of the packet to a certain service data flow and handle the packet accordingly, e.g. relay it to the responsible GTP-tunnel or GRE-tunnel. 1.1.3.2.4.4 Accounting [3GTS 23.401 (4.4.3.2), 23.402 (4.3.3.2)]
- 20 -

3rd Generation Technical Specification Generic Routing Encapsulation (RFC 2784) GPRS Tunneling Protocol (3GTS 29.060) IP QCI S-GW Internet Protocol (RFC 791) QoS Class Identifier Serving Gateway (3GTS 23.401)
3GTS GRE GTP
- 21 -
1.1.3.3 PDN Gateway (P-GW or PDN-GW) 1.1.3.3.1 Characteristics
The objective of this section is to illustrate the most important characteristics of the P-GW.
Image Description The home agent function is only applicable if the UE accesses the P-GW through one of the interfaces S2a, S2b or S2c. It may make sense to build only combined S-GW / P-GW nodes in order to save latency. However, this requires interconnection points to the external PDN at the location of every S-GW.
1.1.3.3.2 Identification A P-GW is identified by means of IP-addresses and URL's. In addition and by means of specific DNS-resolution, a P-GW is logically identified through APN's which refer to a specific service (PDN-access) that a given P-GW can provide (see section 2.1.2.1.1).
[23.002 (4.1.4.2.2), 23.401 (4.3.3.3), 23402 (4.4.3.3)]
- 22 -

Access Point Name (Reference to a GGSN) Domain Name System Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Gateway GPRS Support Node Home Address Local Mobility Anchor (RFC 5213) Mobile IP Version 4 P-GW PDN PDN-GW PMIPv6 S-GW URL Packet Data Network Gateway (part of EPC) Packet Data Network Packet Data Network Gateway (part of EPC) Proxy Mobile IPv6 (RFC 5213) Serving Gateway (3GTS 23.401) Uniform Resource Locator (RFC 1738)
APN DNS EPC GGSN HoA LMA MIPv4
- 23 -
The objectives of this section are to illustrate the P-GW, its interfaces towards other network elements and the protocol stacks used on these interfaces.
Image Description The green color indicates the control plane relationship of a protocol or an interface. Likewise, orange color indicates user plane relationship. The ESP-tunnel over S2c has been established using EAP-AKA over IKEv2.
The protocol layer Application comprises among others http, SIP, RTP (with voice or video). [3GTS 23.401 (5.1), 23.402 (5.1)] DSMIPv6
- 24 -

Authentication, Authorization and Accounting MIPv4 NAT P-GW PCRF Mobile IP Version 4 Network Address Translation (RFC 1631) Packet Data Network Gateway (part of EPC) Policy and Charging Rules Function (3GTS 23.203)
AAA
DIAMETER Successor of the RADIUS protocol DSMIPv6 EAP-AKA Dual Stack Mobile IPv6 Extensible Authentication Protocol method for 3rd generation Authentication and Key Agreement (RFC 4187)
EPC ESP GRE GTP GTP-C GTP-U IKEv2 IMS
Evolved Packet Core (3GTS 23.401) PLMN (Rel. 8 onwards) Encapsulating Security Payload (RFC 4303) PMIPv6
Public Land Mobile Network Proxy Mobile IPv6 (RFC 5213) Real-time Transport Protocol (RFC 3550, RFC 3551) Stream Control Transmission Protocol (RFC 2960) Reference Point in LTE Session Initiation Protocol (RFC 3261) Transmission Control Protocol User Datagram Protocol (RFC 768)
Generic Routing Encapsulation (RFC RTP 2784) GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane GTP User Plane Internet Key Exchange protocol / version 2 (RFC 4306) Internet Protocol Multimedia Core Network Subsystem (Rel. 5 onwards) Internet Protocol (version 4) SCTP SGi SIP TCP UDP
IPv4
V-PLMN
Visited PLMN
- 25 -
1.1.3.3.4 Tasks & Functions of the P-GW
The objective of this section is to present the tasks and functions of the PGW.
1.1.3.3.4.1 UE IP Address Allocation 1.1.3.3.4.2 QCI-based Packet Tagging The P-GW performs this task as part of the classification and according to the installed QoS-policy. Based on the installed DL-TFT, the QCI is determined and traffic handling rules are determined.
1.1.3.3.4.3 Policy Enforcement Traffic shaping: Delay data packet transmission until resources become available. Traffic policing: Discard packet if no resources to transmit them are available.
- 26 -
1.1.3.3.4.4 Legal Interception Question No 1: Why does the P-GW perform legal interception and the S-GW and, as you will see, the ePDG, too?
1.1.3.3.4.5 Home Agent Function [3GTS 23.401 (4.4.3.3), 23.402 (4.3.3.3)]

3rd Generation Technical Specification Downlink PMIPv6 QCI QoS S-GW TFT UE Proxy Mobile IPv6 (RFC 5213) QoS Class Identifier Quality of Service Serving Gateway (3GTS 23.401) Traffic Flow Template User Equipment
3GTS DL
DSMIPv6 Dual Stack Mobile IPv6 GW IP LMA P-GW Gateway Internet Protocol (RFC 791) Local Mobility Anchor (RFC 5213) Packet Data Network Gateway (part of EPC)
- 27 -
1.1.3.4 enhanced Packet Data Gateway (ePDG) 1.1.3.4.1 Characteristics
The objective of this section is to illustrate the most important characteristics of the ePDG.
Image Description The ePDG is an enhanced PDG as defined in Release 6. Please recall that a PDG usually was physically broken down into two parts: one inside the GGSN and one inside the TTG [3GTS 23.234]. The selection of an ePDG through the UE occurs either through static configuration or dynamically [3GTS 23.402 (4.5.4)].
1.1.3.4.2 Identification An ePDG has no EPS-specific identifiers and is identified by means of IPaddresses and URL's.
[3GTS 23.402 (4.3.4)]
- 28 -

3rd Generation Technical Specification Evolved Packet System Gateway GPRS Support Node Internet Protocol (RFC 791) Mobile Access Gateway (RFC 5213) PDG TTG UE URL Packet Data Gateway Tunnel Termination Gateway User Equipment Uniform Resource Locator (RFC 1738)
3GTS EPS GGSN IP MAG
- 29 -
The objectives of this section are to illustrate the ePDG, its interfaces towards other network elements and the protocol stacks used on these interfaces.
Image Description The green color indicates the control plane relationship of a protocol or an interface. Likewise, orange color indicates user plane relationship. The black lines represent physical links which are used to piggyback the SWu-interface. The ESP-tunnel over S2c has been established using EAP-AKA over IKEv2.
The Gxb-interface as depicted in the image is currently not specified. [3GTS 23.401 (5.1), 23.402 (5.1)]
- 30 -

Authentication, Authorization and Accounting Authentication and key agreement (3GTS 33.102) Successor of the RADIUS protocol Extensible Authentication Protocol (RFC 3748) Extensible Authentication Protocol method for 3rd generation Authentication and Key Agreement (RFC 4187) Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) evolved Packet Data Gateway (3GTS 23.402) Encapsulating Security Payload (RFC 4303) GRE IKEv2 IP PCRF PMIPv6 Generic Routing Encapsulation (RFC 2784) Internet Key Exchange protocol / version 2 (RFC 4306) Internet Protocol (RFC 791) Policy and Charging Rules Function (3GTS 23.203) Proxy Mobile IPv6 (RFC 5213)
AAA AKA DIAMETER EAP EAP-AKA
EPC ePDG ESP
SCTP TCP UDP
Stream Control Transmission Protocol (RFC 2960) Transmission Control Protocol User Datagram Protocol (RFC 768)
- 31 -
1.1.3.4.4 Tasks & Functions of the ePDG
The objective of this section is to present the tasks and functions of the ePDG.
1.1.3.4.4.1 ESP-Tunnel Mgmt towards UE's The allocated IP-address is just relayed by the ePDG. It stems from the P-GW. 1.1.3.4.4.2 QoS-specific Packet Tagging in UL-Direction 1.1.3.4.4.3 Legal Interception 1.1.3.4.4.4 MAG-Function for PMIPv6 [3GTS 23.402 (4.3.4)]
- 32 -

3rd Generation Technical Specification evolved Packet Data Gateway (3GTS 23.402) Encapsulating Security Payload (RFC 4303) Gateway Internet Protocol (RFC 791) Mobile Access Gateway (RFC 5213) P-GW PMIPv6 QoS UE UL Packet Data Network Gateway (part of EPC) Proxy Mobile IPv6 (RFC 5213) Quality of Service User Equipment Uplink
3GTS ePDG ESP GW IP MAG
- 33 -
1.2 Protocol Stacks

1.2.1 Control Plane / E-UTRAN - EPC
The objectives of this section are to depict the protocols which are related to the control plane between UE, MME and HSS and to highlight whether these protocols are E-UTRAN-specific, EPC-specific or generic.
Image Description The ESM- and EMM-protocols are referred to as NAS-protocols. Since ESM-messages may be piggybacked inside EMM-messages, the ESMprotocol has been depicted as illustrated above.
- 34 -

PDCP PHY Packet Data Convergence Protocol Physical Layer
DIAMETER Successor of the RADIUS protocol E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EPS Mobility Management (3GTS 24.301)
EMM EPC ESM HSS
RLC
Radio Link Control Radio Resource Control S1 Application Part Stream Control Transmission Protocol (RFC 2960) Transmission Control Protocol User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
Evolved Packet Core (3GTS 23.401) RRC (Rel. 8 onwards) EPS Session Management (3GTS 24.301) S1-AP
Home Subscriber Server [3GTS SCTP 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Internet Protocol (RFC 791) Medium Access Control Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum TCP UE UTRAN
IP MAC MME
NAS
- 35 -
1.2.2 User Plane E-UTRAN EPC (S5/S8 GTP-based)
The objectives of this section are to depict the protocols which are related to the user plane between UE and PDN-GW in case that GTP is applied on S5/ S8 and to highlight whether these protocols are E-UTRAN-specific, EPCspecific of generic.
- 36 -

Successor of the RADIUS protocol Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane GTP User Plane Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Internet Protocol (RFC 791) Medium Access Control PDCP PDN-GW Packet Data Convergence Protocol Packet Data Network Gateway (part of EPC) Physical Layer Radio Link Control Serving Gateway (3GTS 23.401) S1 Application Part Stream Control Transmission Protocol (RFC 2960) Transmission Control Protocol User Datagram Protocol (RFC 768) User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
DIAMETER E-UTRAN
EPC GTP GTP-C GTP-U HSS
PHY RLC S-GW S1-AP SCTP
IP MAC MME NAT
TCP UDP
Mobility Management Entity (3GTS UE 23.401) (Rel. 8 onwards) Network Address Translation (RFC 1631) UTRAN
- 37 -
1.2.3 User Plane E-UTRAN EPC (S5/S8 PMIPv6/GRE-based)
The objectives of this section are to depict the protocols which are related to the user plane between UE and PDN-GW in case that GRE is applied on S5/ S8 and to highlight whether these protocols are E-UTRAN-specific, EPCspecific of generic.
- 38 -

PDN Packet Data Network
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EPC GRE GTP GTP-U HSS Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Generic Routing Encapsulation (RFC 2784) GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Internet Protocol (RFC 791) Medium Access Control Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Network Address Translation (RFC 1631) Packet Data Convergence Protocol
PDN-GW PHY PMIPv6 RLC S-GW
Packet Data Network Gateway (part of EPC) Physical Layer Proxy Mobile IPv6 (RFC 5213) Radio Link Control Serving Gateway (3GTS 23.401)
IP MAC MME NAT PDCP
SCTP TCP UDP UE UTRAN
Stream Control Transmission Protocol (RFC 2960) Transmission Control Protocol User Datagram Protocol (RFC 768) User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 39 -
1.3 Security Architecture

1.3.1 Overview & Introduction
The objective of this section is to introduce the most important characteristics of the EPS security architecture.
- 40 -
1.3.1.1 Essentials Please note that eNodeB also includes home eNodeB's. 1.3.1.2 EPS-AKA 1.3.1.3 Security is performed independently in two protocol layers Question No 2: What are the reasons from your perspective to introduce security on two different layers?
1.3.1.4 Algorithms Abbreviations of this Section:

Advanced Encryption Standard / Cipher Key Lengths: 128 bit, 192 bit or 256 bit Access Security Management Entity Authentication Token (3GTS 33.102) Ciphering Key (3GTS 33.102) Data Radio Bearer EPS Encryption Algorithm (3GTS 33.401) EPS Integrity Protection Algorithm (3GTS 33.401) EPS Mobility Management (3GTS 24.301) Evolved Packet SystemAuthentication and Key Agreement (3GTS 33.401) EPS Session Management (3GTS 24.301) Home Location Register Keyed Hashing for Message Authentication (RFC 2104) HSS Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Integrity Key (3GTS 33.102) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum Packet Data Convergence Protocol Random Number Response Radio Resource Control Secure Hash Algorithm
AES
ASME AUTN CK DRB EEA EIA EMM EPS-AKA
IK MME NAS PDCP RAND RES RRC SHA
ESM HLR HMAC
SRB UE UMTS USIM
Signaling Radio Bearer User Equipment Universal Mobile Telecommunication System Universal Subscriber Identity Module
- 41 -
1.3.2 Operation of UMTS-AKA
The objective of this section is to depict the operation of the UMTS-AKA. Key point of this section is that the illustrated algorithms f1 f5 are operator specific.
[3GTS 33.102]
- 42 -

3rd Generation Technical Specification Anonymity Key (3GTS 33.102) Authentication and key agreement (3GTS 33.102) Authentication management field (3GTS 33.102) Authentication Token (3GTS 33.102) Ciphering Key (3GTS 33.102) IK MAC RAND SQN UMTS XRES Integrity Key (3GTS 33.102) Message Authentication Code Random Number Sequence number (used in UMTSsecurity architecture / 3GTS 33.102) Universal Mobile Telecommunication System Expected Response (3GTS 33.102)
3GTS AK AKA AMF AUTN CK
- 43 -
1.3.3 Key Derivation Function (KDF)
The objective of this section is to illustrate the principles of the key derivation function used within the EPS-environment.
[3GTS 33.401 (A.1.1)]
- 44 -

3rd Generation Technical Specification Evolved Packet System Keyed Hashing for Message Authentication (RFC 2104) KDF SHA Key Derivation Function (3GTS 33.401) Secure Hash Algorithm
3GTS EPS HMAC
- 45 -
1.3.3.1 Comprehension Check & Practical Exercise: The KDF S(10) for K(ASME)
The objective of this section is to illustrate to the student how the key K(ASME) is derived from concatenated information elements and the CK and IK derived from the UMTS-AKA.
Question No 3: Fill in the input parameters to derive K(ASME) applying the S(10) key derivation function. to be continued on the next page
- 46 -

Access Security Management Entity Ciphering Key (3GTS 33.102) Keyed Hashing for Message Authentication (RFC 2104) Integrity Key (3GTS 33.102) KDF SHA UMTSAKA Key Derivation Function (3GTS 33.401) Secure Hash Algorithm Universal Mobile Telecommunication System - Authentication and Key Agreement (3GTS 33.102)
ASME CK HMAC
IK
- 47 -
1.3.3.1.1 Input Parameters The secret input parameters are IK and CK with a length of 16 octets each. They stem from a previous run of UMTS-AKA [3GTS 33.102]. Other input parameters are the serving network identity (MCC + MNC) and SQN (xor) AK which also stems from the previous run of UMTS-AKA. Although CK and IK together provide a key length of 256 bits and although the length of K(ASME) is 256 bit, the efficient key length is ultimately restricted by the subscriber key Ki with a length of only 128 bit. [3GTS 33.401 (A.2)]
- 48 -

3rd Generation Technical Specification Anonymity Key (3GTS 33.102) Access Security Management Entity Ciphering Key (3GTS 33.102) IK MCC MNC SQN UMTSAKA Integrity Key (3GTS 33.102) Mobile Country Code [ITU-T E.212] Mobile Network Code Sequence number (used in UMTSsecurity architecture / 3GTS 33.102) Universal Mobile Telecommunication System - Authentication and Key Agreement (3GTS 33.102)
3GTS AK ASME CK
- 49 -
1.3.4 EPS-AKA in Operation during Initial Attach Procedure
The objective of this section is to illustrate how the MME, the eNodeB and the UE determine the different security keys which are required within the EPS.
- 50 -
Question No 4: Fill in the missing keys (<=> K(xyz)) into the image.

Access Security Management Entity Authentication Token (3GTS 33.102) Ciphering Key (3GTS 33.102) Cyclic Redundancy Check Diameter Protocol (RFC 3588, RFC 3589) EPS Mobility Management (3GTS 24.301) Enhanced Node B Evolved Packet System Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Integrity Key (3GTS 33.102) NAS PLMN PS RAND RES RRC S1-AP UE UL Non-Access-Stratum Public Land Mobile Network Packet Switched Random Number Response Radio Resource Control S1 Application Part User Equipment Uplink
ASME AUTN CK CRC DIA EMM eNB EPS HSS
IK
UMTSAKA USIM XRES
Universal Mobile Telecommunication System - Authentication and Key Agreement (3GTS 33.102) Universal Subscriber Identity Module Expected Response (3GTS 33.102)
IMSI MME
International Mobile Subscriber Identity Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards)
- 51 -
1.3.5 Use of the different Security Algorithms
The objective of this section is to illustrate where which security algorithms are applied within the EPS. Key point of this section is that there is no integrity protection done for user plane data.
- 52 -

Cyclic Redundancy Check Downlink EPS Encryption Algorithm (3GTS 33.401) EPS Mobility Management (3GTS 24.301) Enhanced Node B Evolved Packet System ESM MME NAS PDCP RRC UL EPS Session Management (3GTS 24.301) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum Packet Data Convergence Protocol Radio Resource Control Uplink
CRC DL EEA EMM eNB EPS
- 53 -
Lessons Learned / Conclusions
- 54 -
The Non-Access-Stratum: EMM & ESM
Chapter 2:
2
Objectives
Some of your questions that will be answered during this session What are important EMM- and ESM-specific procedures? What is the format of EMM- and ESM-messages? How are important scenarios like attachment and tracking area updating performed?
- 55 -
2.1 EPS Mobility Management (EMM)

2.1.1 Important EMM-Procedures
2
The objective of this section is to illustrate the different EMM-procedures.

Procedures can be combined with each other. Example: The authentication procedure is typically part of the attachment procedure. [3GTS 24.301 (5.1.2)]
- 56 -
2.1.1.1 Common Procedures Common procedures are typically embedded into a given specific procedure. 2.1.1.2 Specific Procedures 2.1.1.3 Connection Management Procedures

Evolved UMTS Terrestrial Radio Access EPS Mobility Management (3GTS 24.301) Evolved Packet Switched GUTI NAS UE Global Unique Terminal Identity (3GTS 23.003) Non-Access-Stratum User Equipment
E-UTRA EMM EPS
- 57 -
2.1.2 State Machine
The objective of this section is to illustrate the different EMM-states and their relationship.
[3GTS 24.301 (5)] EMM and ESM are linked with each other [3GTS 24.301 (4.2)]. This relates particularly to the piggybacked default EPS-bearer establishment when the UE attaches to the EPC. 2.1.2.1 Relationship between EMM and ECM In general, ECM relates to the presence of an S1-bearer plus RRC-connection. As long as both are present, the UE is in ECM-CONNECTED mode. Upon release, the UE switches to ECM-IDLE mode. Therefore, the UE may well be EMM-registered but still be ECM-idle. While the UE is in ECM-CONNECTED state, the network is in charge to control the UE-mobility. While the UE is in ECM-CONNECTED mode, the location of the UE is known with the granularity of a cell inside an eNodeB. While the UE is in ECM-IDLE mode, the location of the UE is known with the granularity of a tracking area. Within ECM-IDLE mode, the UE shall perform autonomous cell reselection and tracking area update procedures.
[3GTS 36.300 (A.2), 3GTS 24.301 (5.1.3.2.2.4)]
- 58 -

3rd Generation Technical Specification EPS Connection Management (3GTS 24.301) EPS Mobility Management (3GTS 24.301) ESM RRC UE EPS Session Management (3GTS 24.301) Radio Resource Control User Equipment
3GTS ECM EMM
- 59 -
2.1.3 Network Operation Modes
The objective of this section is to illustrate the different network operation modes of the UE.
[3GTS 24.301 (4.3)]
- 60 -

3rd Generation Technical Specification Circuit Switched EPS Mobility Management (3GTS 24.301) Evolved Packet Switched EPS PS UE Evolved Packet System Packet Switched User Equipment
3GTS CS EMM EPS
- 61 -
2.1.4 Message Format
The objective of this section is to illustrate the message format that is used for EMM-messages. Key points of this section are: 1. The security header is not necessarily present. 2. The protocol discriminator as part of the first octet repeats inside the plain EMM-message if a security header is present.
2.1.4.1 Security Header The presence of the security header is conditional as indicated through the yellow color. It shall be present as soon as security in the form of integrity protection and possibly encryption have been negotiated. The security header is put upfront the plain NAS message and uses the same protocol discriminator value 7. The related security header type partially acts as a message type as there are specific settings for certain messages. Primarily, the security header type identifies whether a message is a plain NAS message (security header type = 0), whether it is just integrity protected or integrity protected and ciphered.
[3GTS 24.301 (9.3.1)]
- 62 -

3rd Generation Technical Specification EPS Mobility Management (3GTS 24.301) Non-Access-Stratum Octet PD PD 8 bit Protocol Discriminator Packet Data
3GTS EMM NAS
- 63 -
2.1.5 Important EMM-Scenarios 2.1.5.1 Attachment through E-UTRAN / new MME

2
The objective of this section is to illustrate the first part of an attach scenario [3GTS 23.401 (5.3.2), 24.301 (5.5.1)] through E-UTRAN end-to-end and with all related messages. Key point of this section is that the indicated procedure illustrates one possible straight forward case but does not depict all possible options.
Question No 5: Please fill in the missing interface names. The eNodeB selects the MME at this time, if necessary. Possibly, the MMEI which is included in the ATT_REQ-message relates to an MME which is available to the eNodeB in which case no MME-selection is necessary. Note that the EMM: ATT_REQ-message also contains the ESM: PDN_CONN_REQmessage. To be continued on the next page
- 64 -

Diameter Protocol (RFC 3588, RFC 3589) IMSI MME International Mobile Subscriber Identity Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Mobility Management Entity Identity (3GTS 23.003) Radio Resource Control S1 Application Part User Equipment
DIA
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EMM eNB GTP HSS EPS Mobility Management (3GTS 24.301) Enhanced Node B GPRS Tunneling Protocol (3GTS 29.060) Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5
MMEI RRC S1-AP UE
- 65 -
The S1-AP: INITIAL_UE_MSG includes the parameter eNB UE S1AP ID which shall serve as unique identifier for S1-AP-messages sent by this eNodeB to that MME for that particular UE. This parameter has been assigned by the eNodeB.
We assume in this case that the MME is unable to determine or connect to the previous MME and therefore requests the UE to convey its IMSI. Otherwise, at this time we would see GTP-messages to retrieve the UE-context from the previous MME. The S1-AP: DL_NAS_TRANSPORT message includes the parameter MME UE S1AP ID which shall serve as unique identifier for S1-AP-messages sent by the MME to that eNodeB for that particular UE. This parameter has been assigned by the MME. The EMM: SEC_MODE_CMD-message is integrity protected but not ciphered. This message initiated NAS-based security which means that EMM- and ESM-messages shall be integrity protected and possibly encrypted after this message has been transmitted. The subscription data contain, among others, relationships to specific PDN's, information about PDN-GW to be selected (if applicable) and APN-restrictions. RRC-connection establishment: [3GTS 36.331 (5.3.3)] RRC downlink information transfer: [3GTS 36.331 (5.6.1)] RRC uplink information transfer: [3GTS 36.331 (5.6.2)] RRC connection reconfiguration [3GTS 36.331 (5.3.5)] S1-AP initial UE-message: [3GTS 36.413 (8.6.2.1)] S1-AP initial context setup: [3GTS 36.413 (8.3.1)] S1-AP downlink NAS transport: [3GTS 36.413 (8.6.2.2)] S1-AP uplink NAS transport: [3GTS 36.413 (8.6.2.3)] DIAMETER: AIR, AIA, ULR, ULA [3GTS 29.272]
- 66 -

3rd Generation Technical Specification Access Point Name (Reference to a GGSN) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum Packet Data Network PDN-GW RRC S1-AP UE Packet Data Network Gateway (part of EPC) Radio Resource Control S1 Application Part User Equipment
3GTS APN MME NAS PDN
- 67 -
2.1.5.1 Attachment through E-UTRAN / new MME (continued)
The objective of this section is to continue and conclude the attach scenario from the previous section. Key point of this section is to appreciate the embedding of ESM- into EMMmessages which in turn are embedded into RRC-messages. This is new with SAE.
Question No 6: Please fill in the missing interface names. Not depicted is a possible interaction between the PDN-GW and the PCRF. The UE may be equipped with both, an IPv4 and an IPv6 address. Please recall that an IPv6-address is typically generated from the H-PLMN's IPv6 network prefix (64 bit) and the UE's MAC-address (EUI-64). To be continued on the next page
- 68 -

Access Point Name (Reference to a GGSN) Data Radio Bearer MAC MME P-GW Medium Access Control Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Network Gateway (part of EPC) Policy and Charging Rules Function (3GTS 23.203) Packet Data Network Packet Data Network Gateway (part of EPC) Public Land Mobile Network
APN DRB
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EMM EPS ESM EUI-64 EPS Mobility Management (3GTS 24.301) Evolved Packet System EPS Session Management (3GTS 24.301) Extended Unique Identifier - 64 bit long (IEEE / the "other 64 bit" of an IPv6-address, following the IPv6network prefix and generated from the MAC-address of a device) Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane Global Unique Terminal Identity (3GTS 23.003) Home PLMN Information Element Internet Protocol (version 4) Internet Protocol (version 6)
PCRF PDN PDN-GW PLMN
F-TEID GTP GTP-U GUTI H-PLMN IE IPv4 IPv6
RRC S-GW S1-AP SAE SRB TAI TEID UE
Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part System Architecture Evolution Signaling Radio Bearer Tracking Area Identity (3GTS 24.301) Tunnel Endpoint Identifier (GTP / 3GTS 29.060) User Equipment
- 69 -

Note the final IE F-TEID of S-GW user plane. This information must be relayed to the eNodeB to enable a communication between S-GW and eNodeB. Please note that the S1-AP: INITIAL_CX_SETUP_REQ-message contains the security key K(eNB) which is used by the eNodeB to derive the keys needed for integrity protection and encryption on PDCP-layer. Having received this information, the eNodeB can trigger the security procedures on PDCP-layer by sending an RRC: SEC_MODE_CMD-message to the UE. GTP Create Session Request: [3GTS 29.274 (7.2.1)] GTP Create Session Response: [3GTS 29.274 (7.2.2)] S1-AP: Initial Context Setup: [3GTS 36.213 (8.3.1)] GTP Modify Bearer Request: [3GTS 29.274 (7.2.7)] GTP Modify Bearer Response: [3GTS 29.274 (7.2.8)] EMM Attach Accept message: [3GTS 24.301 (8.2.1)] ESM Activate Default EPS Bearer Context Request message: [3GTS 24.301 (8.3.6)]
- 70 -

3rd Generation Technical Specification EPS Mobility Management (3GTS 24.301) Evolved Packet System EPS Session Management (3GTS 24.301) Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) GPRS Tunneling Protocol (3GTS 29.060) IE PDCP RRC S-GW S1-AP TEID Information Element Packet Data Convergence Protocol Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Tunnel Endpoint Identifier (GTP / 3GTS 29.060)
3GTS EMM EPS ESM F-TEID GTP
- 71 -
2.1.5.2 Comprehension Check & Practical Exercise: Building your own EMM: ATT_REQ-Message
2
The objectives of this section are to: 1. learn using the EMM-specification 3GTS 24.301 2. understand which contents are inside an EMM: ATT_REQ-message.
Question No 7: Fill in the missing octets (in hex) into the ATT_REQ-message. Consider the following constraints:
Constraints are stated on the next page
- 72 -
- 73 -
Constraints: Use enclosure 1 to resolve this exercise. Apply the section in which the EMM-message format has been presented. The protocol discriminator of EMM equals "7(hex)". The message shall be sent neither integrity protected nor encrypted (<=> security header type). The UE shall perform an "EPS only" attachment. The UE has a cached security context and the NAS-KSI(ASME) = "3(dec)". The UE shall use a GUTI to identity itself to the network. The UE comes from Germany (MCC = 262(hex)) and the operator's MNC = 01(hex). The third digit of the MNC is not used by that operator. The digit numbering of MCC and MNC is straightforward: MCC = 2 (<= digit 1) 6 (<=> digit 2) 2 (<=> digit 3) / MNC = 0 (<=> digit 1) 1 (<=> digit 2). The MMEI = "08 15 00(hex)" with the MME-code being the "00". The UE still has an M-TMSI = "C0 12 34 56(hex)" and therefore does not use its IMSI to identity itself to the network. The UE supports all mandatory required integrity protection and ciphering algorithms. For the ESM-message format (ESM: PDN_CONN_REQ) please use section 2.2.4. The protocol discriminator of ESM = "2(hex)" but there has no EPS-bearer identity been assigned yet. The UE assigns a procedure transaction identity of "01". The UE shall perform an "initial attach" as request type. The UE asks for both; an IPv4 and an IPv6 address. The UE shall request an APN = "www.inacon.com" (you may write the APN in plain text, without translation into ASCII-code).
- 74 -
- 75 -
2.1.5.3 Tracking Area Update (Inter-MME / with new S-GW)
The objective of this section is to illustrate a tracking area update procedure which involves two MME's.
Question No 8: Please fill in the missing interface names.
2.1.5.3.1 Initial Conditions The UE is in RRC-idle mode and has just reselected its serving eNodeB. The stored list of tracking area identities does not contain the TAI as broadcast by the new serving cell. Accordingly, the UE initiates a tracking area update procedure.
To be continued on the next page
- 76 -

Access Security Management Entity Authentication Token (3GTS 33.102) EPS Mobility Management (3GTS 24.301) Enhanced Node B Evolved Packet System GPRS Tunneling Protocol (3GTS 29.060) Global Unique Terminal Identity (3GTS 23.003) International Mobile Subscriber Identity KEy Set Identifier (3GTS 33.401) MME NAS RAND RES RRC S-GW S1-AP TA TAI Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum Random Number Response Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Tracking Area Tracking Area Identity (3GTS 24.301)
ASME AUTN EMM eNB EPS GTP GUTI IMSI KSI
- 77 -
2.1.5.3.2 Detailed Description The EMM: TA_UPD_REQ-message contains and indicates (among others): whether the UE wants to perform a combined TA/LA-update procedure with or w/ o IMSI-attachment (for circuit-switched fallback). the UE-identity in the form of an already assigned GUTI. Note that the GUTI also contains the identification of the MME which assigned it.
Note that the EMM: TA_UPD_REQ-message is typically integrity protected because the UE will already possess valid security information when it performs a tracking area update procedure. At this time, the eNodeB selects the new MME to serve the UE from within an MMEpool and relays the EMM: TA_UPD_REQ-message to the new MME embedded in an S1-AP: INITIAL_UE_MSG. After the reception of the TA_UPD_REQ-message, the receiving MME recognizes that another MME allocated the GUTI. Accordingly, the new MME must identify that MME based on MME-code and MME-group Id and it must determine the IP-address of that former MME, possibly by means of some DNS-resolution process or through internal mapping tables. Finally, the new MME will send a GTP-C: Context-Requestmessage to the former MME. If the former MME can identify the UE it shall relay all necessary information to the new MME by transmitting a GTP-C: Context-Response message. The indicated EMM-context contains information such as authentication vectors, DRX-parameters and UE-network capabilities. The EPS bearer context(s) contain(s) information about the bearer contexts themselves (e.g. QoS-related information) as well as such important information as the P-GW's IP-address and TEID for the control plane on the S5-interface as well as the formerly assigned S-GW's IP-address and TEID for the control plane on the S11-interface. Authentication is only conducted if deemed necessary by the MME. Authentication is mandatory if the integrity check on the initial EMM: TA_UPD_REQ-message failed. Note that the MME did receive the security information from the former MME and is therefore able to conduct authentication. NAS-KSI(ASME) is a simple integer that is used as pointer to the active security suite (AUTN, K(ASME), etc.). The UE will include it in future initial NAS-messages (e.g. TA_UPD_REQ and the network may skip authentication and immediately enable integrity protection (and encryption) if NAS-KSI(ASME) received from the UE matches the value stored in the MME. After authentication, the MME will probably activate NAS-related security procedures by sending an EMM: SEC_MODE_CMD-message to the UE. The UE will reply an EMM: SEC_MODE_CMP-message which shall be integrity protected and, if ordered, also be encrypted on NAS-layer (not by the PDCP-layer). RRC-connection establishment: [3GTS 36.331 (5.3.3)] RRC downlink information transfer: [3GTS 36.331 (5.6.1)] RRC uplink information transfer: [3GTS 36.331 (5.6.2)] S1-AP initial UE-message: [3GTS 36.413 (8.6.2.1)]
- 78 -

GTP-C Context-Request: [3GTS 29.274 (7.3.5)] GTP-C Context-Response: [3GTS 29.274 (7.3.6)] GTP-C Context-Acknowledge: [3GTS 29.274 (7.3.7)] S1-AP downlink NAS transport: [3GTS 36.413 (8.6.2.2)] S1-AP uplink NAS transport: [3GTS 36.413 (8.6.2.3)] EMM: SEC_MODE_CMD: [3GTS 24.301 (8.2.20)]

Domain Name System Discontinuous Reception EPS Mobility Management (3GTS 24.301) Evolved Packet System GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane Global Unique Terminal Identity (3GTS 23.003) International Mobile Subscriber Identity Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) NAS P-GW PDCP QoS RRC S-GW S1-AP TA TEID Non-Access-Stratum Packet Data Network Gateway (part of EPC) Packet Data Convergence Protocol Quality of Service Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Tracking Area Tunnel Endpoint Identifier (GTP / 3GTS 29.060)
DNS DRX EMM EPS GTP GTP-C GUTI IMSI MME
- 79 -
2.1.5.2 Tracking Area Update (Inter-MME / with new S-GW) (continued)

2
The objective of this section is to continue and conclude the presentation of the tracking area update procedure between two MME's and involving the allocation of a new S-GW.
Question No 9: Please fill in the missing interface names. This is the time when the new MME has to decide whether the indicated S-GW may continue to serving the UE or whether the S-GW needs to be changed. This decision is based on constraints such as accessibility of the former S-GW from the new eNodeB and from the new MME. It may also take into account routing optimization issues. The new MME continues the procedure by sending a GTP: Create-SessionRequest message to the new selected S-GW. The IE bearer context contains, among others, the uplink and downlink TFT's but it does not contain the eNodeB's FTEID for the user plane because the new eNodeB did not yet assign such an F-TEID. Then the new S-GW informs the already assigned P-GW about the bearer modification and both nodes exchange their F-TEID's for the user plane.
- 80 -

Finally, the new MME must update the HSS with respect to the tracking area update procedure. It uses the DIA: ULR-message to do so. The HSS will then cancel the location towards the former MME, using the DIA: CLR- / CLA-message exchange. DIAMETER: ULR, ULA, CLR, CLA [3GTS 29.272]

Diameter Protocol (RFC 3588, RFC 3589) Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) GPRS Tunneling Protocol (3GTS 29.060) Gateway Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 Information Element MME P-GW S-GW TEID TFT Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Network Gateway (part of EPC) Serving Gateway (3GTS 23.401) Tunnel Endpoint Identifier (GTP / 3GTS 29.060) Traffic Flow Template
DIA F-TEID GTP GW HSS
IE
UE
User Equipment
- 81 -
2.1.5.2 Tracking Area Update (Inter-MME / with new S-GW) (continued)

2
The objective of this section is to continue and conclude the presentation of the tracking area update procedure between two MME's and involving the allocation of a new S-GW.
Question No 10: Please fill in the missing interface names. Finally, the MME sends the EMM: TA_UPD_ACC-message through the eNodeB to the UE. Note that in this case, there is no establishment of additional radio bearers as was shown during the attachment scenario. GTP-C Delete-Session-Request: [3GTS 29.274 (7.2.9.1)] GTP-C Delete-Session-Response: [3GTS 29.274 (7.2.10.1)] EMM: TA_UPD_ACC: [3GTS 24.301 (8.2.26)] EMM: TA_UPD_COM: [3GTS 24.301 (8.2.27)]
- 82 -

Data Radio Bearer GUTI IE Global Unique Terminal Identity (3GTS 23.003) Information Element
DRB
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network EMM eNB EPS F-TEID GTP GTP-U EPS Mobility Management (3GTS 24.301) Enhanced Node B Evolved Packet System Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane
MME RRC S-GW S1-AP TEID UE
Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Tunnel Endpoint Identifier (GTP / 3GTS 29.060) User Equipment
- 83 -
2.1.5.4 Comprehension Check & Practical Exercise: EMM-Message Decode

2
The objective of this section is to decode an EMM: ATT_REQ-message.
Question No 11: Please decode the embedded hexadecimal ATT_REQ-message, using enclosure 1. Which problems do you encounter?
- 84 -
- 85 -
2.2 EPS Session Management (ESM)

2.2.1 Important ESM-Procedures
2
The objective of this section is to present the important ESM-procedures. Key point of this section is that the actual activation, deactivation or modification of an EPS-bearer must be initiated and conducted by the network. This is a major difference to previous releases where PDP-context activation had to be triggered by the UE.
- 86 -
2.2.1.1 MME-initiated
2.2.1.2 UE-initiated [3GTS 24.301 (6.4), (6.5)]

3rd Generation Technical Specification Evolved Packet Switched EPS Session Management (3GTS 24.301) MME PDP UE Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Protocol User Equipment
3GTS EPS ESM
- 87 -
2.2.2 State Machine
The objectives of this section are to illustrate the state machine of ESM and the different ways to migrate between the two states.
[3GTS 24.301 (6)]
- 88 -

Evolved Packet Switched EPS Session Management (3GTS 24.301) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) PDN UE Packet Data Network User Equipment
EPS ESM MME
- 89 -
2.2.4 Message Format
The objective of this section is to illustrate the message format that is used for ESM-messages. Key points of this section are: 1. The security header is not necessarily present. 2. The protocol discriminator as part of the first octet repeats inside the plain ESM-message if a security header is present.
[3GTS 24.301 (9.1)] If an ESM-message is embedded into an EMM-message it is represented as plain NAS-message w/o individual security header.
to be continued on the next page
- 90 -

EPS Mobility Management (3GTS 24.301) Evolved Packet System EPS Session Management (3GTS 24.301) Non-Access-Stratum 8 bit PD PTI SM UE Protocol Discriminator Procedure Transaction Identity Session Management (3GTS 23.060, 3GTS 24.008) User Equipment
EMM EPS ESM NAS Octet
- 91 -
2.2.4.1 Security Header The presence of the security header is conditional as indicated through the yellow color. It shall be present as soon as security in the form of integrity protection and possibly encryption have been negotiated. The security header is put upfront the plain NAS message and uses the same protocol discriminator value 2. The related security header type partially acts as a message type as there are specific settings for certain messages. Primarily, the security header type identifies whether a message is a plain NAS message (security header type = 0), whether it is just integrity protected or integrity protected and ciphered.
[3GTS 24.301 (9.3.1)] 2.2.4.2 Procedure Transaction Identity The PTI is used to distinguish network initiated and UE-originated transactions. If the network reacts upon a UE-initiated transaction request (e.g. ESM: PDN_CONN_REQ), it shall use the UE-assigned PTI-value also within network originating ESM-messages.
[3GTS 24.007 (11.2.3.1a)]
- 92 -

EPS Session Management (3GTS 24.301) Non-Access-Stratum PTI UE Procedure Transaction Identity User Equipment
ESM NAS
- 93 -
2.3.5 Dedicated EPS Bearer Establishment 2.3.5.1 Network Initiated (IMS triggered during Call Establishment)
2
The objective of this section is to illustrate the dedicated EPS bearer establishment.
2.3.5.1.1 Initial Conditions The UE changed into ECM-CONNECTED state some time before to be able to exchange the SIP-messages with the IMS, supposedly over the already established default EPS-bearer. We can see the SIP-signaling inside the different pipes EPS-bearer and S5bearer. When the SDP-descriptors within the SIP-messages indicate that a real-time bearer is required, the P-CSCF inside the IMS will communicate with the PCRF to authorize the QoS-request and to trigger the establishment of that real-time bearer (DIA: AAR-message).
2.3.5.1.2 Detailed Description Having received the DIA: AAR-message, the PCRF will trigger the PDN-GW to initiate the dedicated EPS-bearer activation procedure by sending a DIA: RARmessage to it.
DIAMETER: AAR, AAA: [3GTS 29.214] DIAMETER: RAR: [3GTS 29.212 (5.6.4)]
- 94 -

Diameter Protocol (RFC 3588, RFC 3589) PCRF PDN-GW QoS SDP SIP UE Policy and Charging Rules Function (3GTS 23.203) Packet Data Network Gateway (part of EPC) Quality of Service Session Description Protocol (RFC 2327, RFC 3266, RFC 3264) Session Initiation Protocol (RFC 3261) User Equipment
DIA
DIAMETER Successor of the RADIUS protocol ECM eNB EPS IMS EPS Connection Management (3GTS 24.301) Enhanced Node B Evolved Packet System Internet Protocol Multimedia Core Network Subsystem (Rel. 5 onwards) Proxy Call Session Control Function (SIP)
P-CSCF
VoIP
Voice over IP
- 95 -
2.3.5.1 Network Initiated (IMS triggered during Call Establishment)
The objective of this section is to continue and conclude the presentation of network initiated dedicated EPS bearer setup.
Question No 14: Please fill In the two bearer types of EPS-bearer context establishment.
To be continued on the next page GTP Create-Bearer-Request / Response: [3GTS 29.274 (7.2.3), (7.2.4)] S1-AP E-RAB Setup: [3GTS 36.413 (8.2)] ESM Dedicated EPS Bearer Context Request [3GTS 24.301 (6.4.3) RRC Connection Reconfiguration [3GTS 36.331 (2.3.5.5)] ESM Dedicated EPS Bearer Context Accept [3GTS 24.301 (6.4.1) DIAMETER: RAA: [3GTS 29.212 (5.6.5)]
- 96 -

Diameter Protocol (RFC 3588, RFC 3589) Successor of the RADIUS protocol Enhanced Node B EPS Session Management (3GTS 24.301) Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane Internet Protocol Multimedia Core Network Subsystem (Rel. 5 onwards) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) P-GW PCRF QoS RAB RRC S-GW S1-AP TEID Packet Data Network Gateway (part of EPC) Policy and Charging Rules Function (3GTS 23.203) Quality of Service Radio Access Bearer Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Tunnel Endpoint Identifier (GTP / 3GTS 29.060) Traffic Flow Template
DIA DIAMETER eNB ESM F-TEID GTP GTP-U IMS
MME
TFT
- 97 -
2.3.5.1.2 Detailed Description The PDN-GW will send a GTP: Create-Bearer-Request-message to the S-GW. This message contains, among others, the linked bearer Id which relates to the related default EPS-bearer Id. The message also conveys the GTP TEID of the new bearer from the P-GW to the S-GW. The S-GW will relay the also included bearer description to the MME. Of course, the S-GW has to include the GTP TEID of its user plane to allow the MME to relay this information to the eNodeB.The MME will build two messages: An ESM: DED_EPS_BEARER_CX_REQ-message and an S1-AP: E-RAB_SETUP_REQmessage. The ESM-message contains the NAS-description of the new bearer while the S1-AP-message serves as carrier for the ESM-message and it contains the radio resource description of the new bearer for the eNodeB. The eNodeB will take the ESM-message and will embed it into an RRC_CONN_RECONF-message that is also used to convey the radio resource related information of the new bearer to the UE. The UE shall setup the new bearer and shall confirm this to the eNodeB by sending RRC_CONN_RECONF_CMP. Similarly, the ESM-layer shall build an ESM: DED_EPS_BEARER_CX_ACCmessage which will be transparently sent to the eNodeB which in turn will transparently relay it to the MME. Only after having received this ESM-message, the MME shall confirm EPSbearer establishment to the S-GW and this message also includes the GTP-U TEID of the eNodeB for the new bearer. Finally, the S-GW confirms bearer establishment to the P-GW. The P-GW must still respond to the PCRF's DIA: RAR-message by sending DIA: RAA with a successful result code. In turn, the PCRF shall confirm bearer setup to the IMS (precisely to the PCSCF). What we did not include is the continuing SIP-signaling for call setup for which the voice data will be sent on the newly established bearer.
GTP Create-Bearer-Request / Response: [3GTS 29.274 (7.2.3), (7.2.4)] S1-AP E-RAB Setup: [3GTS 36.413 (8.2)] ESM Dedicated EPS Bearer Context Request [3GTS 24.301 (6.4.3) RRC Connection Reconfiguration [3GTS 36.331 (2.3.5.5)] ESM Dedicated EPS Bearer Context Accept [3GTS 24.301 (6.4.1) DIAMETER: RAA: [3GTS 29.212 (5.6.5)]
- 98 -

Diameter Protocol (RFC 3588, RFC 3589) P-GW PCRF PDN PDN-GW RAA RAB RRC Packet Data Network Gateway (part of EPC) Policy and Charging Rules Function (3GTS 23.203) Packet Data Network Packet Data Network Gateway (part of EPC) RE-Auth-Answer command (Diameter BASE, RFC 3588) Radio Access Bearer Radio Resource Control Serving Gateway (3GTS 23.401) S1 Application Part Session Initiation Protocol (RFC 3261) Tunnel Endpoint Identifier (GTP / 3GTS 29.060) User Equipment
DIA
DIAMETE Successor of the RADIUS protocol R EPS ESM GTP GTP-U Evolved Packet System EPS Session Management (3GTS 24.301) GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane
IMS MME NAS P-CSCF
Internet Protocol Multimedia Core S-GW Network Subsystem (Rel. 5 onwards) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum Proxy Call Session Control Function (SIP) S1-AP SIP TEID UE
- 99 -
- 100 -
Radio Resource Control
Chapter 3:
Objectives
Some of your questions that will be answered during this session How are RRC-messages encoded using ASN.1 PER? How can I determine the message types that RRC uses for the different RRC-messages? How are the different RRC-messages mapped to logical channels, transport channels and physical channels? How System Information Blocks are organized? How an RRC connection is managed with RRC messages? How measurements are defined and how a measurements report looks like? Why there are fixed time setting for the RRC procedures? How cell selection and cell reselection are performed in the idle mode?
- 101 -
3.1 Overview
The objective of this section is to introduce the key features of the radio resource control layer. Key point of this section is that the tasks of the RRC stay mostly the same as UMTS and HSPA, but since the air interface is different there are significant changes in the implementation.
- 102 -
3.1.1 Transmission of broadcast information Here is it very important to know that only the MIB is transmitted on the BCH. All the other SIBs are grouped in SUs according to their transmission periodicity and are transmitted on the DL-SCH. 3.1.2 Establish and maintain services Here the basic concepts are very different. The RRC connection setup procedure has been extended to the initial context setup procedure. RRC and NAS link are established in parallel. Moreover since there is a new air interface technology (OFDMA and SC-FDMA) used the message contents are different. Another very significant change is the drastic reduction of RRC states mentioned earlier. 3.1.3 QoS control Nothing to add to what is stated in the picture. 3.1.4 Transfer of dedicated control information Nothing to add to what is stated in the picture. [3GTR 25.813 (5.4), 3GTS 36.300 (7), 3GTS 36.331 (4.4)] Abbreviations of this Section:
3GTR 3GTS BCH DL DL-SCH EPC FDMA HSPA MIB 3rd Generation Technical Report 3rd Generation Technical Specification Broadcast Channel Downlink Downlink Shared Channel Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Frequency Division Multiple Access NAS OFDMA QoS RRC Non-Access-Stratum Orthogonal Frequency Division Multiple Access Quality of Service Radio Resource Control
SC-FDMA Single Carrier Frequency Division Multiple Access SIB SU System Information Block Scheduling Unit User Equipment Universal Mobile Telecommunication System
High Speed Packet Access (operation UE of HSDPA and HSUPA) Master Information Block UMTS
- 103 -
3.2 State Characteristics of RRC
The objective of this section is to introduce the key features of the radio resource control states. Key point of this section is that there are only 2 RRC states in LTE.
Image description The picture shows the RRC states in LTE and their main characteristics. It focuses on the processes of the E-UTRAN.
3.2.1 RRC_IDLE During RRC_IDLE the UE can be paged and will listen to the PCH and the BCH, but it is not known by the eNB it will perform cell reselections. In order to do the cell reselections it will perform neighbor cell measurements according to the system information in the BCCH but will not report these measurements to the infrastructure. Keep also in mind that this state will also assumed once the UE is switched on during initial cell search. Once the UE has found a cell it will go RRC_CONNECTED to register with the core network and to establish a radio bearer and will then go RRC_IDLE again. 3.2.2 RRC_CONNECTED Here the UE is fully connected to the eNB. That means it has a C-RNTI and it is known on cell level. It will do neighbor cell measurements and handover. This state is also assumed to be used for MBMS services. [3GTR 25.813 (5.4.2), 3GTS 36.300 (7.2)]
- 104 -
Room for your Note

3GTR 3GTS BCCH BCH C-RNTI LTE 3rd Generation Technical Report 3rd Generation Technical Specification Broadcast Control Channel Broadcast Channel Cell Radio Network Temporary Identifier Long Term Evolution (of UMTS) RACH RNTI RRC Random Access Channel Radio Network Temporary Identifier Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED RRC_IDL E RRC_MB MS_CON NECTED UE UTRAN RRC state RRC state in E-UTRA for UEs with MBMS service only User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network Enhanced Node B
MBMS NAS
Multimedia Broadcast / Multicast Service Non-Access-Stratum
PCH
Paging Channel
eNB
- 105 -
3.3 Signaling Radio Bearers (SRB)

3.3.1 Overview
The objective of this section is to illustrate the characteristics and differences of the different SRB's.
3.3.1.1 SRB0 3.3.1.2 SRB1 3.3.1.3 SRB2 [3GTS 36.331 (4.2.2)]
- 106 -

3rd Generation Technical Specification Acknowledged Mode operation Dedicated Control Channel Non-Access-Stratum RLC RRC SRB TM Radio Link Control Radio Resource Control Signaling Radio Bearer Transparent Mode operation
3GTS AM DCCH NAS
- 107 -
3.3.1.1 Review of eNB DL Channels
The objective of this section is to provide a summary review of the channels used in LTE in downlink direction from the view of the eNodeB.
- 108 -
- 109 -
3.3.1.2 Review of eNB UL Channels
The objective of this section is to provide a summary review of the channels used in LTE in uplink direction from the view of the eNodeB.
- 110 -
- 111 -
3.3.2 Mapping of RRC-Messages to SRB's and to Channels 3.3.2.1 Messages on BCCH (MIB and SIB)
The objective of this section is to illustrate how MIB and SIB's are mapped to logical channels, transport channels and physical channels.
Question No 15: Please fill I n the SRB-number (if applicable) as well as the RLC-operation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport channel type and physical channel type.
The UE shall not only listen to the BCCH in RRC_IDLE also in RRC_CONNECTED the UE needs to listen the system information of the own cell (SIB1 will indicate a change) and to the system information on the neighbor cells in oder to verify the neighbor cell ID during neighbor cell measurements.
- 112 -

Broadcast Control Channel Dedicated Control Channel Master Information Block Radio Link Control Radio Resource Control RRC_IDL E RRC state
BCCH DCCH MIB RLC RRC
RRC_CO RRC state in E-UTRA NNECTED SIB SRB UM System Information Block Signaling Radio Bearer Unacknowledged Mode operation
- 113 -
3.3.2.2 Messages on PCCH and DL-CCCH
The objective of this section is to illustrate how PCCH- and DL-CCCHmessages are mapped to logical channels, transport channels and physical channels.
Question No 16: Please fill in the SRB-number (if applicable) as well as the RLCoperation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport channel type and physical channel type.
Question No 17: Is the PCCH in need to be listened to in the RRC_CONNECTED mode?.
- 114 -

Common Control Channel Dedicated Control Channel Downlink Medium Access Control Paging Control Channel Packet Data Convergence Protocol PHY RLC RRC Physical Layer Radio Link Control Radio Resource Control
CCCH DCCH DL MAC PCCH PDCP
RRC_CO RRC state in E-UTRA NNECTED SRB UM Signaling Radio Bearer Unacknowledged Mode operation
- 115 -
3.3.2.3 Messages on DL-DCCH and DL-DTCH
The objective of this section is to illustrate how DL-DCCH-messages and IPpackets are mapped to logical channels, transport channels and physical channels.
Question No 18: Please fill in the SRB-number (if applicable), radio bearer number as well as the RLC-operation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport channel type and physical channel type.
- 116 -

Dedicated Control Channel Downlink Data Radio Bearer Dedicated Traffic Channel Internet Protocol (RFC 791) Medium Access Control Non-Access-Stratum PDCP PHY RLC RRC SRB UM Packet Data Convergence Protocol Physical Layer Radio Link Control Radio Resource Control Signaling Radio Bearer Unacknowledged Mode operation
DCCH DL DRB DTCH IP MAC NAS
- 117 -
3.3.2.4 Messages on UL-CCCH, UL-DCCH and UL-DTCH
The objective of this section is to illustrate how UL-DCCH-messages and IPpackets are mapped to logical channels, transport channels and physical channels.
Question No 19: Please fill in the SRB-number (if applicable), radio bearer number as well as the RLC-operation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport channel type and physical channel type.
- 118 -

Common Control Channel Dedicated Control Channel Data Radio Bearer Dedicated Traffic Channel Internet Protocol (RFC 791) Medium Access Control Non-Access-Stratum PDCP PHY RLC RRC SRB UL UM Packet Data Convergence Protocol Physical Layer Radio Link Control Radio Resource Control Signaling Radio Bearer Uplink Unacknowledged Mode operation
CCCH DCCH DRB DTCH IP MAC NAS
- 119 -
3.4 Message Encoding through ASN.1 PER-unaligned

3.4.1 Example: The ASN.1-Code of RRC_CONN_REQ ...
The objective of this section is to present the ASN.1-code of the RRC_CONN_REQ-message.

[3GTS 36.331 (6.2.2)]
- 120 -

3rd Generation Technical Specification Abstract Syntax Notation 1 (ITU-T X.680 / X.681) PER Packed Encoding Rules (ITU-T X.691)
3GTS ASN.1
- 121 -
3.4.2 and the compiled Message Structure (Tree View)
The objective of this section is to confront the student or reader with the fact that ASN.1 PER will add binary marks into the message sequence to distinguish among different options.
[http://www.inacon.de/protocolhelp/index.php/]
- 122 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) PER Packed Encoding Rules (ITU-T X.691)
ASN.1
- 123 -
3.4.3 Important Encoding Rules of ASN.1 PER-unaligned 3.4.3.1 Handling of optional IE's
The objective of this section is to illustrate how the ASN.1-object type sequence is binary encoded using the unaligned PER.
Image Description If an IE consists of the object type sequence and contains one or more optional IEs and IEs with default values, then a bitmap at the beginning of the packed ASN.1output for the sequence type IE shall indicate whether or not an optional IE is present. In our example, the bitmap consists of only 2 bit which indicate whether or not the optional parameters DEF and/or JKL are present. [ITU-T X.680, X.681, X691]
- 124 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) Information Element ITU-T PER International Telecommunication Union - Telecommunication Sector Packed Encoding Rules (ITU-T X.691)
ASN.1 IE
- 125 -
3.4.3.2 Selection among Options (CHOICE / ENUMERATED)
The objective of this section is to illustrate how the ASN.1-object types choice / enumerated are binary encoded using the unaligned PER.
Image Description If there are only 8 different values defined for a given IE, why waste 8 bit as the minimum length of the value field? PER will evaluate how many values are defined for any given IE. If possible, the reserved number of bits will be reduced to the absolute minimum. The graphics illustrates the unaligned PER-encoding of the IE Initial UE Identity. Since there are only 8 different possibilities defined, 3 bit are sufficient to identify which of the different UE-IDs is used. If IMSI is used, the encoding will be {000 IMSI} If TMSI + LAI is used, the encoding will be {001 TMSI LAI} and so on. [ITU-T X.691]
- 126 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) Identity Information Element International Mobile Subscriber Identity ITU-T LAI PER TMSI International Telecommunication Union - Telecommunication Sector Location Area Identification (LAI = MCC + MNC + LAC) [3GTS 23.003] Packed Encoding Rules (ITU-T X.691) Temporary Mobile Subscriber Identity
ASN.1 ID IE IMSI
- 127 -
3.4.3.3 Handling of IE's with variable Length
The objective of this section is to illustrate how the ASN.1 PER treats information elements with variable lengths.
Image Description If an information element comes with a variable length, PER need to provide for a possibility to identify the current length of this IE. A simple example is illustrated above: The MNC may be 2 or 3 digits long. Each digit consists of 4 bit. The flexible length of 2 or 3 digits is translated into a choice which consequently needs two options and therefore adds another bit in front of the 2 or 3 digits of the MNC. [ITU-T X.691]
Question No 20: Considering the aforementioned: How many prefix bits are necessary if the number of digits can vary between 5 and 68?
- 128 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) Information Element International Telecommunication Union MNC PER Mobile Network Code Packed Encoding Rules (ITU-T X.691)
ASN.1 IE ITU
- 129 -
3.4.4 Comprehension Check & Practical Exercise: Encoding an RRC_CONN_REQ-Message
The objective of this section is to practice the ASN.1 / PER-based encoding which is used by the RRC-protocol.
Question No 21: Please encode the RRC_CONN_REQ-message that the UE was sending to the eNodeB when performing the initial attach scenario from the previous section. Please assume that the smallest RACH container which has a MAC PDU of just 56 bit inside is used. 8 bit of MAC header have to be anticipated. All necessary information can be obtained from there and from the tree view in the previous section.
Please note that there is a difference in between the EMM and the RRC protocol the EMM is organized in a way that the IE's chain up one after the other in the correct order once the octets are written from right to left and the RRC protocol, which is working with unaligned PER, is bit oriented such that the IE's chain up in the correct order once the bits are written from left to right.
- 130 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) EPS Mobility Management (3GTS 24.301) Information Element PER RRC UE Packed Encoding Rules (ITU-T X.691) Radio Resource Control User Equipment
ASN.1 EMM IE
- 131 -
3.5 RRC Procedures

3.5.1 System Information Broadcast 3.5.1.1 Overview
3
The objective of this section is to present the most important information about the system information blocks in LTE.
SIB2 is automatically included in the first scheduled system information message in SIB1 and thus needs not to be scheduled explicitly.
- 132 -

Long Term Evolution (of UMTS) Master Information Block Physical Broadcast Channel Physical Downlink Shared Channel PHICH PLMN SFN SIB Physical HARQ Acknowledgement Indicator Channel Public Land Mobile Network System Frame Number System Information Block
LTE MIB PBCH PDSCH
- 133 -
3.5.1.2 Overview of Functions of the System Information Blocks
The objective of this section is to give an overview about the function of the SIB's. Key point of this section is that most of the SIB's are dealing with neighbor cell description.
SIB2 is automatically included in the first scheduled system information message in SIB1 and thus needs not to be scheduled explicitly.
- 134 -
BCCH BCH CDMA CSG DL DL-SCH ETWS GERAN
Broadcast Control Channel Broadcast Channel Code Division Multiple Access Closed Subscriber Group Downlink Downlink Shared Channel Earthquake and Tsunami Warning System GSM EDGE Radio Access Network
ID MIB OP PLMN SIB UE UL UTRAN
Identity Master Information Block Optional Public Land Mobile Network System Information Block User Equipment Uplink UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
HNB
Home Node B
- 135 -
3.5.1.3 Example of an MIB
The objective of this section is to illustrate the format and content of a master information block (MIB).
- 136 -

MIB Master Information Block PHICH Physical HARQ Acknowledgement Indicator Channel
- 137 -
3.5.1.4 Example of an SIB1
The objective of this section is to illustrate the format and content of a system information block 1 (SIB1).
- 138 -

SIB System Information Block
- 139 -
The objective of this section is to illustrate the format and content of a system information block 2 (SIB2).
- 140 -

BCCH MO PCCH PDSCH PRACH PRACH Broadcast Control Channel Mobile Originated Paging Control Channel Physical Downlink Shared Channel Physical Random Access Channel Packet Random Access Channel PUCCH PUSCH RACH RS SIB Physical Uplink Control Channel Physical Uplink Shared Channel Random Access Channel Reference Signal System Information Block
- 141 -
The objective of this section is to illustrate the format and content of a system information block3 (SIB3).
- 142 -

EUTRA SF Evolved UMTS Terrestrial Radio Access SIB System Information Block
Speed dependent Scaling Factor
- 143 -
3.5.2 Connection Management Related Procedures 3.5.2.1 Paging Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the Paging Procedure. Key point of this section is that paging is not only used for mobile terminated service establishment / data arrival but also for notification of system information change and disaster control.
- 144 -

Once there is a mobile terminated service establishment / data arrival and the UE does not react there will be a retry. Once there are system information changed this cannot be retried for a particular UE. In order to cover the error scenario these indications need to be repeated several times to make sure all the UE's concerned got them.

3

eNB ETWS RRC Enhanced Node B Earthquake and Tsunami Warning System Radio Resource Control RRC_IDL E SIB SRB UE RRC state System Information Block Signaling Radio Bearer User Equipment
RRC_CO RRC state in E-UTRA NNECTED
- 145 -
3.5.2.2 RRC Connection Establishment Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the RRC Connection Establishment Procedure. Key points of this section are that the RRC Connection Setup Procedure is only establishing SRB1 but that it is - in contrast to UMTS - allowing already the transmission of a NAS message.
- 146 -

Note that the transmission of an IMSI is not foreseen here any more.

eNB EPC ID IMSI MMEI NAS PLMN RRC Enhanced Node B Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Identity International Mobile Subscriber Identity MME Identity Non-Access-Stratum Public Land Mobile Network Radio Resource Control RRC_CO RRC state in E-UTRA NNECTED RRC_IDL E S-TMSI SRB TMSI UE UMTS RRC state SAE Temporary Mobile Subscriber Identity Signaling Radio Bearer Temporary Mobile Subscriber Identity User Equipment Universal Mobile Telecommunication System
- 147 -
3.5.2.2.1 SRB1 Default Configuration
The objective of this section is to give the default configuration for SRB1. Key point of this section is that the SRB1 default configuration allows for very short RRC Connection Setup messages.
All times are in ms.
- 148 -

IE PDU Information Element Protocol Data Unit or Packet Data Unit RLC SRB Radio Link Control Signaling Radio Bearer
- 149 -
3.5.2.2.2 Physical Layer Default Configuration
The objective of this section is to give the physical layer default configuration for all RB's. Key point of this section is that the physical layer default configuration allows for very short RRC Connection Setup messages.
- 150 -

ACK CQI PDSCH PUCCH RB Acknowledgement Channel Quality Indicator Physical Downlink Shared Channel Physical Uplink Control Channel Radio Bearer RI RRC RS SRS UE Rank Indicator Radio Resource Control Reference Signal Sounding Reference Signal User Equipment
- 151 -
3.5.2.3 UE Capability Transfer Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the UE Capability Exchange Procedure. Key point of this section is that this procedure will only be used once the QoS settings for a service exceed the capabilities of UE Category 1.
- 152 -

CDMA Code Division Multiple Access RRC Radio Resource Control
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network eNB GERAN QoS Enhanced Node B GSM EDGE Radio Access Network Quality of Service
RRC_CO RRC state in E-UTRA NNECTED SRB UE UTRAN Signaling Radio Bearer User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 153 -
3.5.2.4 RRC Initial Security Activation Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the RRC Initial Security Activation Procedure. Key point of this section is that without this procedure no services can be established.
- 154 -
AS eNB NAS
Access Stratum (UMTS) Enhanced Node B Non-Access-Stratum
RRC
RRC_CO RRC state in E-UTRA NNECTED SRB Signaling Radio Bearer
- 155 -
3.5.2.5 RRC Connection Reconfiguration Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the RRC Connection Reconfiguration Procedure. Key point of this section is that this is the most mighty procedure in EUTRAN. Without this procedure no orderly mobile radio operation is possible.
- 156 -

ACK C-RNTI DRB Acknowledgement Cell Radio Network Temporary Identifier Data Radio Bearer NAS RLC RNTI RRC Non-Access-Stratum Radio Link Control Radio Network Temporary Identifier Radio Resource Control
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network eNB ID MAC-I Enhanced Node B Identity Message Authentication Code, MSB's of extended PDCP Sequence Number
SRB UE UTRAN
Signaling Radio Bearer User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 157 -
3.5.2.5.1 SRB2 Default Configuration
The objective of this section is to give the default configuration for SRB2. Key point of this section is that the SRB2 default configuration allows for very short RRC Connection Reconfiguration messages.
All times are in ms.
- 158 -

IE PDU RLC Information Element Protocol Data Unit or Packet Data Unit Radio Link Control RRC SRB Radio Resource Control Signaling Radio Bearer
- 159 -
3.5.2.6 Counter Check Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the Counter Check Procedure. Key point of this section is that this procedure needs not to be done once the operator has enough confidence in its encryption mechanisms.
- 160 -

COUNT DL DRB eNB MSB Extended Sequence Number in PDCP Downlink Data Radio Bearer Enhanced Node B Most Significant Bit RRC Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED SRB UL Signaling Radio Bearer Uplink
- 161 -
3.5.2.7 RRC Connection Reestablishment Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the RRC Connection Reestablishment Procedure. Key point of this section is that this procedure recovers SRB1 only.
This procedure shall not be performed once the UE has no AS security context.
- 162 -

AS C-RNTI E-UTRA eNB ID MAC-I MMEI NAS Access Stratum (UMTS) Cell Radio Network Temporary Identifier Evolved UMTS Terrestrial Radio Access Enhanced Node B Identity Message Authentication Code, MSB's of extended PDCP Sequence Number MME Identity Non-Access-Stratum PLMN RNTI RRC Public Land Mobile Network Radio Network Temporary Identifier Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED RRC_IDL E SRB UE UTRA RRC state Signaling Radio Bearer User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access
- 163 -
3.5.2.8 RRC Connection Release Procedure
The objective of this section is to give an overview about the use, the messages involved and the follow up resulting from the RRC Connection Release Procedure. Key point of this section is that there is no response from the UE required.
- 164 -

eNB RAT RRC Enhanced Node B Radio Access Technology (e.g. GERAN, UTRAN, ...) Radio Resource Control RRC_IDL E SRB UE RRC state Signaling Radio Bearer User Equipment
RRC_CO RRC state in E-UTRA NNECTED
- 165 -
3.5.3 Inter RAT RRC Procedures
The objective of this section is to give an overview about the messages relating to inter RAT mobility. Key point of this section is that the CDMA2000 system is that different from 3GPP's RAT such that the handover to CDMA2000 needs to be tailored with many extra messages.
- 166 -

3GPP Third Generation Partnership Project (Collaboration between different standardization organizations (e.g. ARIB, ETSI) to define advanced mobile communications standards, responsible for UMTS) The 3G Standard 3GPP2 Circuit Switched Fall Back Evolved UMTS Terrestrial Radio Access NACC Network Assisted Cell Change (3GTS 44.060)
CDMA20 00 CSFB E-UTRA
RAT RRC UE UL
Radio Access Technology (e.g. GERAN, UTRAN, ...) Radio Resource Control User Equipment Uplink
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network GERAN GSM EDGE Radio Access Network
UTRA
UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
GPRS
General Packet Radio Service
UTRAN
- 167 -

HO Handover
3.5.4 E-UTRAN Measurements 3.5.4.1 Overview
The objective of this section is to give an overview about the messages performed by the UE in E-UTRAN. Key point of this section is that measurements are not only communicated in measurement reports.
- 168 -
ACK CGI DCCH DL E-UTRA
Acknowledgement Cell Global Identification Dedicated Control Channel Downlink Evolved UMTS Terrestrial Radio Access
RAT RI RRC RSRP RSRQ UE
Radio Access Technology (e.g. GERAN, UTRAN, ...) Rank Indicator Radio Resource Control Reference Signal Received Power Reference Signal Received Quality User Equipment
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network MAC NACK PMI Medium Access Control Negative Acknowledgement Precoding Matrix Indicator
UL UL-SCH UTRA
Uplink Uplink Shared Channel UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
PUCCH
Physical Uplink Control Channel
UTRAN
PUSCH
Physical Uplink Shared Channel
- 169 -
3.5.4.2 Definition of Measurements in E-UTRAN
The objective of this section is to give an overview of the measurement definition strategy in E-UTRAN. Key point of this section is Measurement Objects and Report Configurations can be combined in Measurement ID's.
- 170 -
CDMA
Code Division Multiple Access
RAT RSRP
Radio Access Technology (e.g. GERAN, UTRAN, ...) Reference Signal Received Power
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network GERAN GSM EDGE Radio Access Network
UTRAN
UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
ID
Identity
- 171 -
3.5.4.3 Measurement Events in E-UTRAN
The objective of this section is to give an overview of the measurement event definition strategy in E-UTRAN. Key point of this section is that in E-UTRAN there are only 2 kinds of events.
- 172 -

AND E-UTRAN Both conditions need to be fulfilled. Logical Function. Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network One condition need to be fulfilled. Logical Function. RAT UTRAN Radio Access Technology (e.g. GERAN, UTRAN, ...) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
OR
- 173 -
3.5.4.4 Measurement Definition in the Standard Measurement Object
The objective of this section is to give an overview about the IE's relating to the Measurement Objects. Key point of this section is that each RAT has its own Measurement Objects.
- 174 -


CGI EUTRA Cell Global Identification Evolved UMTS Terrestrial Radio Access IE RAT Information Element Radio Access Technology (e.g. GERAN, UTRAN, ...)
- 175 -
3.5.4.5 Measurement Definition in the Standard Report Configuration and Measurement ID
The objective of this section is to give an overview about the IE's relating to the Measurement Report configuration and the Measurement ID. Key point of this section is that regardless whether periodical measurements or events are reported the RSRP and/or RSRQ needs to be reported.
- 176 -

EUTRA ID IE Evolved UMTS Terrestrial Radio Access Identity Information Element RSRP RSRQ Reference Signal Received Power Reference Signal Received Quality
- 177 -
3.5.4.6 Structure Measurement Report
The objective of this section is to give an overview about the IE's relating to Measurement Reports. Key point of this section is that in a Measurement Report there are no events visible even though an event might be reported.
- 178 -


CDMA20 00 CGI EUTRA GERAN ID The 3G Standard 3GPP2 Cell Global Identification Evolved UMTS Terrestrial Radio Access GSM EDGE Radio Access Network Identity IE PLMN RSRP RSRQ UTRA Information Element Public Land Mobile Network Reference Signal Received Power Reference Signal Received Quality UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access
- 179 -
3.5.5 Other RRC Procedures
The objective of this section is to give an overview on the UL and DL Information Transfer procedures. Key point of this section is that these procedures do not change with respect to UTRAN.
Please keep in mind that the initial NAS message is sent with the RRC Connection Setup Complete message.
- 180 -

DL eNB EPC NAS Downlink Enhanced Node B Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) Non-Access-Stratum RRC UE UL UTRAN Radio Resource Control User Equipment Uplink UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 181 -
3.5.6 RRC Procedure Delay 3.5.6.1 Introduction
The objective of this section is to show the timing constraints of RRC Procedures. Key point of this section is that since the UL is using a shared channel the UL resources have to be scheduled at a well defined time in order to ensure an efficient operation.
- 182 -

DL eNB Downlink Enhanced Node B RRC UL Radio Resource Control Uplink
- 183 -
3.5.6.1 Values
The objective of this section is to give an overview on the RRC procedure delays. Key point of this section is that some RRC procedures cannot have a timing defined because the reaction from the UE side is either linked with a random access procedure or is running across RAT's or it is depending on events.
- 184 -

CDMA20 00 E-UTRA RAT The 3G Standard 3GPP2 Evolved UMTS Terrestrial Radio Access Radio Access Technology (e.g. GERAN, UTRAN, ...) Radio Bearer RRC UE UTRA Radio Resource Control User Equipment UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access
RB
- 185 -
3.5.7 Idle Mode Procedures Neighbor Cell Monitoring & Cell Reselection 3.5.7.1 Priority-Based Cell Reselection of Multi-RAT UE's
The objective of this section is to show that priority-based cell reselection is a novel principle adopted/possible in Rel. 8 in order to improve the performance of cell reslection in the presence of of multiple RAT's which may co-exist in the same geographical location. Key point of this section are that 1. Priority-based reselection reduces the need for a UE to monitor all the available intra-system frequency layers and inter-RAT carriers by monitoring them according to a set of priority rules provided to the UE. 2. Common (through SIB's resp. Sys_Info) and/or dedicated priority's (via dedicated RRC or RR messages) for the indvidual frequency layers can be signaled to the UE, however, dedicated priorities always take precedence over common priorities.
Image Descrition The RRM in the respective RAN (E-UTRAN, GERAN, UTRAN) maps SPID parameters received via the S1-interface or A/Gb-interface or Iu-interface to a locallydefined configuration in order to apply specific RRM strategies (e.g., to define RRC_IDLE mode priorities and control inter-RAT/inter-frequency handover in RRC_CONNECTED mode). SPID is an index referring to user information such as mobility profile and service usage profile. The SPID information is UE-specific and applies to all of its radio bearers. For simplicity reason the CDMA2000 is not explicitly mentioned nor shown in above picture, but allows also for priority-based reselection. The SIB's or Sys_Infos broadcast common priorities of the various neighbor frequencies resp. IRAT frequency layer's.
- 186 -

Beside common priorities for cell reselection the UE can be provided with dedicated (= individual) priorities based on vendor-specific RRM (radio resource management algorithms for the serving RAT and inter-RAT frequency layer's.
The various different RAN's have their specific dedicated RR resp. RRC message's and broadcast information in order to convey dedicated (= individual) and/or common priorities governing UE's reselection behavior. At inter-RAT cell reselection, the MS shall inherit valid individual priority information from the source RAT. The MS shall also inherit valid individual priority information from the source RAT upon cell selection that results in a change of RAT. In this case the mobile station shall start a guard timer T (depending on the source RAT) with the timeout value set to the remaining validity time of the corresponding timer from the source RAT (i.e. T320 in E-UTRA, T322 in UTRA or T3230 in GERA). NOTE: The network may provide individual priorities information for inter-RAT frequencies not configured by system information. Importantly, riorities between different frequencies or RAT's provided to the UE by system information or dedicated signalling are not used in the cell selection process but these dedicated priorities are kept in UE's memory and used lateron in the cell reselection process! 3.5.7.1.1 SPID - Subscriber Profile ID for RAT/Frequency priority The Subscriber Profile ID IE for RAT/Frequency Selection Priority is used to define camp priorities in Idle mode and to control inter-RAT/inter-frequency handover in Active mode. The core network like MME (EPS/SAE) or MSC/SGSN(2G/3G-core) sends to the respective RAN the optional SPID parameter in order to control e.g. service based handover and IRAT-HO as well UE's idle mode cell reselection based on prioritizing certain RAT's against other RAT's. The RAT prioritization may be a result of the service type(s) the user requests and/or load/overload conditions in the RAN's and/or core network. In the simplest case it could be like this: a UE/user which is just doing voice calls only might be best served by GSM radio access network (RAN). Or a UE/user which just does some simple web-browsing from time to time or just receives push-emails is best served by UMTS/HSPA (precondition is that the UE supports several different RAT's). [3GTS 48.008 (3.2.2.108), 48.018 (11.3.105), 25.413 (9.2.1.86), 36.413 (9.2.1.39)]

CSG E-UTRA GERA Closed Subscriber Group Evolved UMTS Terrestrial Radio Access GSM/EGPRS Radio Access RAT RRC TA Radio Access Technology (e.g. GERAN, UTRAN, ...) Radio Resource Control Tracking Area
- 187 -

3.5.7.1.2 E-UTRAN priority-based Cell Reselection Details First of all upon reception of RRC Connection Setup message (going into dedicated mode), the UE shall discard the cell reselection priority information provided by the IE idleModeMobilityControlInfo or inherited from another RAT. [3GTS 36.331 (5.3.3.4)] The RRC Connection Release message can include the IE idleModeMobilityControlInfo which forces the UE to go for priority-based cell reselection governed by the details of IE idleModeMobilityControlInfo; and if the t320 is included, UE shall set and start timer T320, with the value provided. In case of missing IE idleModeMobilityControlInfo the UE shall apply the cell reselection priority information broadcast in the system information. If T320 expires, the UE shall discard the cell reselection priority information provided by IE idleModeMobilityControlInfo or inherited from another RAT (if stored); and apply the cell reselection priority information broadcast in the system information. [3GTS 36.331 (5.3.8.3, 5.3.8.4)] RRC Connection Release message parameters/IE's encoding RedirectedCarrierInfo OPTIONAL, -- Need ON IdleModeMobilityControlInfo OPTIONAL, -- Need OP RedirectedCarrierInfo ::= CHOICE { eutra ARFCN-ValueEUTRA, geran CarrierFreqsGERAN, utra-FDD ARFCN-ValueUTRA, <snip>}
IdleModeMobilityControlInfo ::= SEQUENCE { FreqPriorityListEUTRA OPTIONAL, -- Need ON FreqsPriorityListGERAN OPTIONAL, -- Need ON FreqPriorityListUTRA-FDD OPTIONAL, -- Need ON <snip> t320 {5, 10, 20, 30, 60, 120, 180} min OPTIONAL, -- Need OR
FreqPriorityListEUTRA ::= SEQUENCE (SIZE (1..maxFreq)) OF FreqPriorityEUTRA SEQUENCE {ARFCN-ValueEUTRA, CellReselectionPriority } FreqsPriorityListGERAN ::= SEQUENCE (SIZE (1..maxGNFG)) OF FreqsPriorityGERAN {CarrierFreqsGERAN, CellReselectionPriority } FreqPriorityListUTRA-FDD ::= SEQUENCE (SIZE (1..maxUTRA-FDD-Carrier)) OF FreqPriorityUTRA-FDD {, ARFCN-ValueUTRA, CellReselectionPriority } CellReselectionPriority (Range: 0 7) The IE CellReselectionPriority concerns the absolute priority of the concerned carrier frequency / set of frequencies (in case of GERAN), as used by the cell reselection procedure. It corresponds with parameter "priority" in 3GTS 36.304. Value 0 means: lowest priority and 7 means highest. The UE behavior for the case the priority field is absent, if applicable, is specified in chapter Reselection Priorities Handling. 3.5.7.1.3 UTRAN priority-based Cell Reselection Details System Information Block type 19 Common Priority Information If the "Priority status" equals "dedicated_priority", the UE shall ignore SIB-19 settings for common priority-based reselection and follow dedicated priority-based reselection. Otherwise the UE follows the common priority's for cell reselection broadcast in SIB-19 if no dedicated priority's are present. The UE shall then follow
- 188 -

the parameters in SIB-19: "UTRA priority info list"; or "GSM priority info list" or "EUTRA frequency and priority info list" if present. [3GTS 25.331 (8.1.1.6.19)] UTRAN Mobility Information (UMI) - Dedicated Priority Information The UMI message allows with the IE "Dedicated Priority Information" to configure UE for dedicated priority handling for cell reselection which overrules SIB-19 settings. The UE is then commanded among other things to set the priority per "Radio Access Technology" e.g. {UTRA FDD, E-UTRA or GSM} etc. If the "T322" is configured via UMI, the UE shall start timer T322 using the value signaled. T322 Range: {5, 10, 20, 30, 60, 120, 180} minutes. When the timer T322 expires the UE should revert to using the priorities signaled in system information SIB-19. Note that the absence of this T322 means that the configured dedicated priorities are valid until the next update. [3GTS 25.331 (8.6.7.23), (10.3.2.7)] 3.5.7.1.4 GERAN priority-based Cell Reselection Details Inter-RAT cell re-selection based on priority information The network may provide priority information to enable priority-based cell reselection (see 3GTS 45.008). Inter-RAT cell reselection based on priority information applies only in case of autonomous cell reselection. Two sets of priorities are defined for inter-RAT cell re-selection based on priority information: common priorities and individual (= dedicated) priorities. A mobile station shall consider the latest received common priorities as valid if the mobile does not have any valid individual (= dedicated) priorities. Provision of individual (= dedicated) priorities information A mobile station may receive individual priorities information via the RR CHANNEL RELEASE message. The mobile station shall use these parameters for inter-RAT cell reselection. If the T3230 timeout value is provided the mobile station shall set timer T3230 to the value received and start timer T3230 (or restart timer T3230 with the timeout value provided if already running). Individual priorities shall be considered valid by the mobile station until either: - a PLMN selection is performed and results in a change of PLMN which is not an equivalent PLMN, see 3GTS 23.122; or - the mobile station is switched off; or - a RR CHANNEL RELEASE message is received with an indication that the individual priorities shall be deleted; or - new individual priorities are received in which case the MS shall delete all previously assigned individual priorities and consider the new ones as valid; or - timer T3230 expires. [3GTS 44.018 (3.2.3)] Abbreviations of this Section:
RR Radio Resource in GSM [3GTS 44.018] Radio Resource Control in UTRAN or E-UTRAN [3GTS 25.331 resp. 36.331] T320 E-UTRAN guard timer for dedicated priority-based reselection in UE received by eNB UTRAN guard timer for dedicated priority-based reselection in UE received by SRNC GERAN guard timer for dedicated priority-based reselection in UE received by BSC.
RRC
T322
T3230
- 189 -
3.5.7.2 Cell Selection in E-UTRAN
The objective of this section is to illustrate the PLMN and cell selection criteria and therefore being separated into three parts. Key point of this section are that for cell selection procedure 1. Only the RSRP is of relevance. 2. This process allows the UE to select a suitable cell where to camp on in order to access available services. In this process the UE can use stored information (Stored information cell selection) or not (Initial cell selection).
The Q-RxlevMinOffset has to be used only once the UE is in a V-PLMN. This ensures that H-PLMN's enjoy an advantage once it comes to cell selection at the country boundary.
- 190 -

Reference Signal Received Power (RSRP) RSRP is defined as the linear average over the power contributions (in [W]) of the resource elements that carry cell-specific reference signals within the considered measurement frequency bandwidth. For RSRP determination the cell-specific reference signals R0 according 3GTS 36.211 shall be used. If the UE can reliably detect that R1 is available it may use R1 in addition to R0 to determine RSRP. Example: Cell-Bandwidth = 50 Resource Blocks (10 MHz), no TX-Diversity 2 Pilot-RE's x 50 RB's x 2 Pilot-Symbols per RB = 2 x 100 Pilot-SC's as there are 4 Pilot Resource Elements per Resource Block and 2 RE's per Symbol in a RB. RSRP = average power per Pilot subcarrier: e.g. 20 W att / 100 SC's = 0.2 Watt /SC In comparison, RSRQ is the power per RB RSRQ = RSRP / RSSI Example: for 50 RB's and no inter-cell interference and an idle cell: 100 SC-Power / 200 SC-Power = - 3 dB RSRQ Note that the power of Pilot RE's per Symbol per RB must be added up and then averaged over the total amount of RB's in order to obtain RSRP. [3GTS 36.214 (5.1.1)] A UE which is not equipped with a valid USIM (i.e. no UICC or SIM only), or which shall consider the USIM as invalid for EPS services as defined in [3GTS 24.301] and [3GTS 24.008] (e.g. due to a Location Registration reject cause #3, #6, #7, #8) shall disable all its E-UTRAN capabilities until switching off or the UICC containing the USIM is removed. Note: This is because Rel-8 E-UTRAN/EPC does not support USIM-less emergency calls according to [3GTS 36.304 (4.1)].

E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network H-PLMN PLMN RSRP Home PLMN Public Land Mobile Network Reference Signal Received Power RB Resource Block typically comprises of 12 Subcarrier with 15 kHz frequency spacing 180 kHz Resource Element considers 1 x Subcarrier per OFDM-Symbol System Information Block Visited PLMN
RE SIB VPLMN
- 191 -
3.5.7.2.1 PLMN selection in E-UTRAN On request of the NAS the Access Stratum shall perform a search for available PLMN's and report them to NAS (non access stratum) ~ higher layer in UE. The UE shall scan all RF channels in the E-UTRA bands according to its capabilities to find available PLMN's. On each carrier, the UE shall search for the strongest cell and read its system information, in order to find out which PLMN(s) the cell belongs to. If the UE can read one or several PLMN identities in the strongest cell, each found PLMN (see the PLMN reading in [3GTS 36.331]) shall be reported to the NAS as a high quality PLMN (but without the RSRP value), provided that the following high quality criterion is fulfilled: For an E-UTRAN cell, the measured RSRP value shall be greater than or equal to -110 dBm. Found PLMN's that do not satisfy the high quality criterion, but for which the UE has been able to read the PLMN identities are reported to the NAS together with the RSRP value. The quality measure reported by the UE to NAS shall be the same for each PLMN found in one cell. 3.5.7.2.2 Cell Selection and Reselection UE shall perform measurements of found/scanned cell's for cell selection and serving & neighbor cells for reselection purposes as specified in System Info's and defined by 3GTS 36.133. The NAS can control the RAT(s) in which the cell selection should be performed, for instance by indicating RAT(s) associated with the selected PLMN, and by maintaining a list of forbidden registration area(s) and a list of equivalent PLMNs. The UE shall select a suitable cell based on idle mode measurements and cell selection criteria. In order to speed up the cell selection process, stored information for several RATs may be available in the UE. When camped on a cell, the UE shall regularly search for a better cell according to the cell reselection criteria. If a better cell is found, that cell is selected. The change of cell may imply a change of RAT. Details on performance requirements for cell reselection can be found in [36.133]. The NAS is informed if the cell selection and reselection results in changes in the received system information relevant for NAS. For normal service, the UE shall camp on a suitable cell, tune to that cell's control channel(s) so that the UE can: Receive system information from the PLMN; and receive registration area information from the PLMN, e.g., tracking area information; and receive other AS and NAS Information; and -if registered: receive paging and notification messages from the PLMN; and initiate transfer to connected mode. 3.5.7.2.3 Cell Selection Process The UE shall use one of the following two cell selection procedures: a) Initial Cell Selection This procedure requires no prior knowledge of which RF channels are E-UTRA carriers. The UE shall scan all RF channels in the E-UTRA bands according to its capabilities to find a suitable cell. On each carrier frequency, the UE need only search for the strongest cell. Once a suitable cell is found this cell shall be selected. b) Stored Information Cell Selection
- 192 -

This procedure requires stored information of carrier frequencies and optionally also information on cell parameters, from previously received measurement control information elements or from previously detected cells. Once the UE has found a suitable cell the UE shall select it. If no suitable cell is found the Initial Cell Selection procedure shall be started. Note: Priorities between different frequencies or RAT's provided to the UE by system information or dedicated signaling are not used in the cell selection process. [3GTS 36.304 (5.2.3)] 3.5.7.2.4 Cell Selection Criterion The cell selection criterion S is fulfilled when: S(rxlev) > 0 S(rxlev) = Q(rxlevmeas) [Q(rxlevmin) Q(rxlevminoffset)] Pcompensation Where: the signaled value QrxlevminOffset is only applied when a cell is evaluated for cell selection as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN [3GTS 23.122]. During this periodic search for higher priority PLMN the UE may check the S criteria of a cell using parameter values stored from a different cell of this higher priority PLMN. S(rxlev) Q(rxlevmeas) Q(rxlevmin) Q(rxlevminoffset) Cell Selection RX level value (dB) Measured cell RX level value (RSRP) Minimum required RX level in the cell (dBm) Offset to the signalled Qrxlevmin taken into account in the Srxlev evaluation as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN max(PEMAX_H P(PowerClass), 0) [dB] Maximum TX power level an UE may use when transmitting on the uplink in the cell (dBm) defined as PEMAX_H in [3GTS 36.101] Maximum RF output power of the UE (dBm) according to the UE power class as defined in [3GTS 36.101]
Pcompensation P(EMAX_H)
P(PowerClass)
The CSG (closed subscriber group) Cell Selection is disregarded here in this chapter. Nevertheless here some details: Allowed CSG list: A list stored in the USIM containing all the CSG identities of the CSGs to which the subscriber belongs. Closed Subscriber Group (CSG): A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the PLMN but which have restricted access (CSG cells). CSG cell: A cell, part of the PLMN, broadcasting a CSG indication that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group for that CSG identity. CSG identity: An identifier broadcast by a CSG cell or cells and used by the UE to facilitate access for authorised members of the associated Closed Subscriber Group. Abbreviations of this Section:
PEMAX_H Max uplink TX Power of UE
- 193 -
3.5.7.3 Cell Reselection Evaluation Process in E-UTRAN 3.5.7.3.1 Reselection Priorities Handling
Absolute priorities of different E-UTRAN Freq's or IRAT Freq's may be provided to the UE through 3
- System Infos (SIB type 3, 4, 5, 6, 7, 8) and/or - RRC Connection Release message or by - inheriting from another RAT at IRAT Cell (re)Selection - The UE shall only perform Cell Reselection evaluation for EUTRAN Freq's & IRAT Freq's listed in System Information for which the UE were provided with a priority (either through dedicated signaling or via System Info broadcast) - If priorities are provided in dedicated signaling, the UE shall ignore all the priorities provided in System Information
The objective of this section is to point out that in an overlaid multi-RAT environment the cell reselection based on priorities is of importance for efficient network operation and crucial for UE's battery life. Key point of this section is that particular cell re-selection could be used to determine which RAT should be used for which service-purpose of the UE so that the utility of the network resources is balanced and optimum while providing high quality of service (QoS) to the UE and especially avoiding IRAT-handover as much as possible.
Image description The UE can be informed about absolute priorities for cell reselection through System Information broadcast and/or RRC Connection Release message (= dedicated signaling). Moreover the UE can inherit priorities from other RAT's at Inter-RAT cell (re-)selection.
Depending on Radio Resource Management algorithms in RAN and/or Core, the dedicated priorities for Inter-Freq and IRAT reselection can be optimized to suit the subscribers traffic pattern resp. behavior. However, the algorithm for setting dedicated priorities and also command the UE in Inter-Feq and/or IRAT-Freq redirections depend on RAN/Core vendor. [3GTS 36.304 (5.2.4.1)] Absolute priorities of different E-UTRAN frequencies or inter-RAT frequencies may be provided to the UE in the system information, in the RRC Connection Release message, or by inheriting from another RAT at inter-RAT cell (re)selection.
- 194 -

In the case of system information, an E-UTRAN frequency or inter-RAT frequency may be listed without providing a priority (i.e. the field cellReselectionPriority is absent for that frequency). If priorities are provided in dedicated signalling, the UE shall ignore all the priorities provided in system information. If UE is in camped on any cell state, UE shall only apply the priorities provided by system information from current cell, and the UE preserves priorities provided by dedicated signalling unless specified otherwise. When the UE in camped normally state, has only dedicated priorities other than for the current frequency, the UE shall consider the current frequency to be the lowest priority frequency (i.e. lower than the eight network configured values). While the UE is camped on a suitable CSG cell, the UE shall always consider the current frequency to be the highest priority frequency (i.e. higher than the eight network configured values), irrespective of any other priority value allocated to this frequency. The UE shall delete priorities provided by dedicated signalling when: the UE enters RRC_CONNECTED state; or the optional validity time of dedicated priorities (T320) expires; or a PLMN selection is performed on request by NAS [3GTS 23.122]. Note: Equal priorities between RATs are not supported. The UE shall only perform cell reselection evaluation for E-UTRAN frequencies and inter-RAT frequencies that are given in system information and for which the UE has a priority provided. The UE shall not consider any black listed cells as candidate for cell reselection. The UE shall inherit the priorities provided by dedicated signalling and the remaining validity time (i.e., T320 in E-UTRA, T322 in UTRA and T3230 in GERAN), if configured, at inter-RAT cell (re)selection. Note: The network may assign dedicated (also known as individual) cell reselection priorities for frequencies not configured by system information.
Room for your Notes

BCH PLMN RAN Broadcast Channel Public Land Mobile Network Radio Access Network (e.g. UTRAN, GERAN or E-UTRAN) SIB SIM UTRAN System Information Block Subscriber Identity Module UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 195 -
3.5.7.3.2 Measurement Rules for Cell Re-Selection
The objective of this section is to explain that the UE in LTE needs to evaluate up to 5 conditions (see color coding in above picture) when collecting measurements on any neighbor resp. frequency-layer. The key points of this section are that 1. The serving cell's S-criterion needs to be evaluated by the UE in order to determine measurements on the same frequency and other frequencies. 2. Beside the S-criterion, the serving cell's absolute priority and the priority of Inter-Freq and IRAT Freq's needs to be taken into account when to start measurement collection considering the reception level in the servingCell.
Image Description Q(rxlevmin): This specifies the minimum required Rx level in the serving cell in dBm; e.g.: -110 dBm. S(intraSearch): This specifies the threshold (in dB) for intra-frequency measurements relative to Q(rxlevmin); e.g. 40 dB RSRP = -110 dBm + 40 dB = - 70 dBm. This means, as long as the RSRP > -70 dBm the UE does not have to perform intra-frequency measurements. This saves battery power in UE. Note that the priority for Intra-Freq neighbor cells should be same as the serving cell. S(non-IntraSearch): This specifies the threshold (in dB) for E-UTRAN interfrequency and inter-RAT measurements relative to Q(rxlevmin); e.g. 20 dB RSRP = -110 dBm + 20 dB = - 90 dBm. This means, as long as the RSCP > -90 dBm the UE does not have to perform measurements on equal or lower prioritized E-UTRAN inter-Freq's or IRAT Freq's.
- 196 -

S(servingCell) [dB] = RSRP [dBm] Q(rxlevmin) [dBm] Example: RSRP = -80 dBm S(servingCell) = -80 - (-110) = + 30 dB S(non-ServingCell,x) is the S(rxlev)-value of other cells, either inter-Freq or IRATneighbor cells or intra-Freq neighbor cell's. Again following calcuation needs to be done: RSCP(non-ServingCell,x) Q(rxlevmin,x) = S(nonservingCell,x) in [dB]
Detailed Description When evaluating for reselection purposes cell selection criterion or S(nonServingCell,x), the UE shall use parameters provided by the serving cell in SIB type 3. Following rules are used by the UE to limit needed measurements: - If S(intraSearch) is sent in the serving cell and S(servingCell) > S(intraSearch), UE may choose to not perform intra-frequency measurements. - If S(servingCell) <= S(intraSearch), or S(intraSearch) is not sent in the serving cell UE shall perform intra-frequency measurements. - The UE shall apply the following rules for E-UTRAN inter-frequencies and inter-RAT frequencies which are indicated in system information and for which the UE has priority provided as defined in previous section Reselection Priorities Handling: For an E-UTRAN inter-frequency or inter-RAT frequency with a reselection priority higher than the reselection priority of the current E-UTRA frequency the UE shall perform measurements of higher priority E-UTRAN interfrequency or inter-RAT frequencies. For an E-UTRAN inter-frequency with an equal or lower reselection priority than the reselection priority of the current E-UTRA frequency and for interRAT frequency with lower reselection priority than the reselection priority of the current E-UTRAN frequency: If S(non-Intrasearch) is sent in the serving cell and S(servingCell) > S(non-IntraSearch) UE may choose not to perform measurements of E-UTRAN inter-frequencies or inter-RAT frequency cells of equal or lower priority. If S(servingCell) <= S(non-IntraSearch) or S(non-IntraSearch is not sent in the serving cell the UE shall perform measurements of EUTRAN inter-frequencies or inter-RAT frequency cells of equal or lower priority.
Where S(servingCell) is the S(rxlev)-value of the serving cell. [3GTS 36.304 (5.2.4.2)] Lessons learned from UMTS Rel. 99 Hierarchical Cell Structure: The HCS-feature effects UE's battery life. Note: Without HCS, the UE will not search for any neighbors until S(intraSearch_UTRAN) is reached. So if the Ec/N0 of the serving cell is good, power consumption in UE is very low. But With HCS, the UE will constantly search for neighbors with a higher HCS priority regardless of the Ec/N0 of the serving cell. What Operator have noticed is that these searches (every DRX cycle) consume quite a bit of power especially if the neighbors are on another FDD frequency. Moreover, due to peculiar Femto cell deployment every UMTS macro cell has by default Femto neighbor relations even if no Femtos exist in that area. This process has to be this way, as the Operator does not know where Femtos will be powered on by the subscriber's. So the UE will constantly scan for these neighbors every DRX cycle trying to detect and measure them. Abbreviations of this Section:
- 197 -
3.5.7.3.3 Mobility States in E-UTRAN
The objective of this section is to explain that LTE uses similar UE speed detection method like UMTS defined in Rel. 5 (note that in UMTS of Rel. 99 the speed detection was only possible with Hierarchical Cell Structure activated and then the UE reselected based on mobility/speed certain Frequency Layer). The key points of this section are: 1. The mobility detection of either Normal, Medium or High just influences the scaling of the timer for Reselection (Treselection) but does not favor a particular reselection behavior towards certain Frequency Layers (having certain priorities). One could have specified that the UE in High Mobility State preferably reselects Macro-cells which then the operator needs to prioritize in order to reduce the amount of cell changes/reselections, but this was not standardized in LTE but rather the case in UMTS of Rel. 99. 2. The UE needs to have a mechanism in place to track the number of reselections in a certain period, e.g. sliding window mechanism or a ringbuffer where the UE logs the time-stamp when a reselection happens as well counts the occurred reselections within T(CR_max) and T(CR_maxHyst) time.
Note that the eNB is not aware about UE's mobility state when UE is in Idle state. In connected state the eNB can determine UE's speed by counting the # of HO's in a period of time and may decide on different RRM resp. Handover algorithms.
- 198 -
Image Description 1. The UE is considered in High Mobility State as it changes within 60 s more than 12 cells. 2. The UE has to consider itself in Medium Mobility as it changes within 60 s more 8 cells but less than 12 cells. 3. During a time of 120 s the UE has less than 8 cell reselections performed and must therefore itself consider as slow moving Normal Mobility. Besides Normal-mobility state a High-mobility and a Medium-mobility state are applicable if the parameters (T(CR_max), N(CR_H), N(CR_M) and T(CR_maxHyst) are sent in the SIB type 3 (and also contained in IE 'MeasConfig' of RRC Connection Reconfiguration message) in broadcast of the serving cell. 3GTS 36.304 (5.2.4.3)] State detection criteria: Medium-mobility state criteria: - If number of cell reselections during time period T(CR_max) exceeds N(CR_M) and not exceeds N(CR_H) High-mobility state criteria: - If number of cell reselections during time period T(CR_max) exceeds N(CR_H)
The UE shall not count consecutive reselections between same two cells into mobility state detection criteria if same cell is reselected just after one other reselection.
State transitions: The UE shall: - if the criteria for High-mobility state is detected: - enter High-mobility state. - else if the criteria for Medium-mobility state is detected: - enter Medium-mobility state. - else if criteria for either Medium- or High-mobility state is not detected during time period T(CR_maxHyst): - enter Normal-mobility state. If the UE is in High- or Medium-mobility state, the UE shall apply the speed dependent scaling rules as defined in next section Scaling Rules. Abbreviation of this Section:
N(CR_H) N(CR_M) Number of cell reselections High Number of cell reselections Medium T(CR_max) T(CR_max Hyst) Timer for guarding cell reselections Hysteresis timer for guarding cell reselections
- 199 -
3.5.7.3.4 Scaling Rules based on Mobility State
The objective of this section is to highlight that additional to Medium- and High mobility detection the UE can be optional configured to apply a reduction of the Treselection timer and/or an increase of the hysteresis for the LTE serving cell in order to lift up serving cell's ranking value R(s). The key points of this section are: 1. The scaling resp. reduction of the Treselection timer can be configured RAT-specific (e.g. individual for E-UTRAN-, UTRAN- or GERAN- Freqlayer's) 2. In order to reduce the fading effects of moving UE's having a high velocity in E-UTRAN, the LTE serving cell can be promoted by different hysteresis values depending on Medium- and High- Mobility state. An increased hysteresis reduces Ping-Pong reselections in fast changing radio environment.
Image Description The scaling resp. reduction of Treselection timer (~ RAT-specific scaling) is done independently of the neighbors RAT and priority. On the other side the hysteresis is only used in the cell ranking for serving cell and for neighbor cells of intra-Freq and
- 200 -

equal priority inter-Freq neighbors. Thus the increase of hysteresis has no effect in reselection conditions e.g. between LTE and GERAN or LTE and UTRAN as ranking is not used between RAT's! For IRAT reselections (and reselections between different prioritized LTE Freq-layers) thresholds and priority of IRAT and Inter-Freq neigbhors are only considered. This is explained in the next sections. UE shall apply the following scaling rules: If neither Medium- nor High-mobility state is detected: - no scaling is applied. If High-mobility state is detected: - Add the sf-High of "Speed dependent ScalingFactor for Qhyst to Qhyst if sent via SI (= System Info) - For E-UTRAN cells multiply Treselection_EUTRA by the sf-High of "Speed dependent ScalingFactor for Treselection_EUTRA if sent via SI - For UTRAN cells multiply Treselection_UTRA by the sf-High of "Speed dependent ScalingFactor for Treselection_UTRA if sent via SI - For GERAN cells multiply Treselection_GERA by the sf-High of "Speed dependent ScalingFactor for Treselection_GERA state if sent via SI <snip>
If Medium-mobility state is detected: - Add the sf-Medium of "Speed dependent ScalingFactor for Q(hyst) for medium mobility state" to Q(hyst) if sent on system information - For E-UTRAN cells multiply Treselection_EUTRA by the sf-Medium of "Speed dependent ScalingFactor for Treselection_EUTRA" if sent on SI - For UTRAN cells multiply Treselection_UTRA by the sf-Medium of "Speed dependent ScalingFactor for Treselection_UTRA" if sent via SI - For GERAN cells multiply Treselection_GERA by the sf-Medium of "Speed dependent ScalingFactor for Treselection_GERA" if sent via SI <snip> Note that the scaling of Treselection for CDMA_HRPD and CDMA_1XRTT is skipped on purpose for simplicity reasons and not shown in the picture. Note: In case scaling is applied to any Treselection_'RAT' parameter the UE shall round up the result after all scalings to the nearest second. [3GTS 36.304 (5.2.4.3.1), 3GTS 36.331 (6.3.1)] Abbreviation of this Section:
1XRTT 1 times Radio Transmission Technology, with same RF bandwidth as IS-95: a duplex pair of 1.25 MHz Enhanced UMTS Terrestrial Radio Access GERAN Radio Access High rate packet data Hyst Hysteresis
E-UTRA GERA HRPD
RAT SI SF
Radio Access Technology Here: System Information Scaling Factor
- 201 -
3.5.7.4 E-UTRAN Inter-Freq and IRAT Cell Reselection Criteria
The objective of this section is to highlight that LTE's Inter-Freq and IRAT cell reselection is not based, compared to UMTS, on cumbersome ranking among different neighbors of various RAT's and Frequencies but just on the simple RX-level threshold's individual set for Inter-Freq and IRAT neighbor's. The key points of this section are: 1. Inter-Freq & IRAT-neighbors of higher priority are reselected by UE if their RSCP (UTRAN neighbor) or RXLEV (GSM/EGPRS neighbor) or RSRP (LTE neighbor) exceed an absolute value of Q(rxlevmin,x) + Thresh(x,high). 2. The UE gets informed when camping in LTE about minimum required RXlevel's [in case of UMTS-FDD also Q(qualmin)] of other RAT's or other LTE Frequencies via the relevant SIB's: SIB-type 5, SIB-type 6, SIB-type 7 and SIB-type 8 broadcast the respective Q(rxlevmin) per RAT/Frequency. 3. The UE gets through the same E-UTRAN SIB's informed about the required threshold's(x,high) per RAT and LTE-Freq which must be exceeded by the RAT or LTE-Freq specific Q(rxlev,x) for time-period of Treselection_RAT ; only then reselection towards RAT/Freq-x is allowed.
- 202 INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200

Details on Inter-Freq and IRAT Cell Reselection For GERAN, UTRAN, and E-UTRAN, S(non-ServingCell,x) is the S(rxlev)-value of an evaluated cell; Q(rxlevmeas) is the measured reception level in RAT- or Freq-x. S(non-ServingCell,x) = Q(rxlevmeas,x) Q(rxlevmin,x) For UTRAN FDD, there is an additional condition to be fulfilled for cell reselection. The measured Ec/No must be above an minimum value:
3
UMTS-FDD: S(qual) > 0 S(qual) = Q(qualmin) Q(qualmeas). Note that Q(qualmeas) is the measured Ec/No-value in UTRA. The parameter Q(qualmin) is broadcast in SIB-3 on BCCH to the UE's. In all the above criteria the value of T(reselection_RAT) [range 0...7 s] is scaled when the UE is in the medium or high mobility state as explained in previous section. If more than one cell meets the above criteria, the UE shall reselect a cell ranked as the best cell among the cells meeting the criteria on the highest priority frequencies or the highest priority RAT; and if the highest priority RAT is E-UTRA according to criteria defined in section Intra-Frequency and equal Priority Inter-Freq Reselection Criteria. [3GTS 36.304 (5.2.4.5)] The IE ReselectionThreshold [= Thresh(x,high)] is broadcast per Frequency Layer to enforce an RSRP or RSCP or RXLEV-threshold defined by the operator. With such level-thresholds it is easier to control the idle-traffic and have the UE pushed already on the preferred Freq-layer avoiding handover later-on in connectedmode. Note that in urban dense area's the UE receives signals of up to 3 RAT's and via more than 3 Frequencies as UMTS may use 2 FDD-Freq's. Reselection Condition for higher prioritized RAT's or Freq's: Criteria 1: the S(non-ServingCell,x) of a cell on evaluated frequency is greater than Thresh(x, high) during a time interval T(reselection_RAT). Cell reselection to a cell on a higher priority E-UTRAN frequency or interRAT frequency than serving frequency shall be performed if: A cell of a higher priority E-UTRAN frequency or inter-RAT frequency fulfills criteria 1; and more than 1 second has elapsed since the UE camped on the current serving cell.
Abbreviation of this Section:

S(nonServing,x) S(qual) Q(qualmin) RAT- or Freq-x specific value above Q(rxlevmin,x) UMTS-FDD specific quality value based on Ec/No Min required Ec/No-value in UMTS-FDD broadcast by LTE RAT- or Freq-x specific measured reception level Q(rxlevmin ,x) S(rxlev,x) Thresh(x, high) x RAT- or Freq-x-specific min required RX-level RAT- or Freq-x specific value in dB above minimum required value RAT- or Freq-x specific threshold to be exceeded for priority reselection Inter-RAT Neighbor or LTE-Inter Frequency Neighbor
Q(rxlevmeas, x)
- 203 -
3.5.7.5 Intra-Freq and equal Priority Inter-Freq Reselection Criteria
The objective of this section is firstly to state that there is a specific ranking for LTE's intra- and inter-frequency neighbors having the same priority and secondly to demonstrate how cell ranking criterion R(s) for serving cell and R(n) for neighboring cells is defined. Key point of this section are: 1. Neighbor cells belonging to different RAT's or Frequencies are not ranked against each other as they must have different priority's! 2. Neighbor cells of equal Priority like serving cell are only allowed within the same RAT, e.g. all E-UTRAN neighbors , even on different frequencies can be set by the operator to same Priority or all UMTS-FDD neighbor's can have the same Priority or all GERAN neighbor cells can be configured with the same Priority. 3. If several higher prioritized neighbor cells fulfilling criteria 1 (see previous section), there will be also a ranking done among these higher prioritized cells only according to their S(rxlev).
Image Description Intra LTE cell reselection (reselection among cells on the same frequency or different
- 204 -

frequency but same priority like serving cell) is based on calculating an so called Ranking value. The UE adds to measured RSRP-value Q(meas,s) of the LTE-serving cell a hysteresis value Q(hyst) broadcast in SIB type 3. 36.331 (6.3.1): q-Hyst range = {dB0, dB1, dB2, dB3, dB4, , dB20, dB22, dB24} The hysteresis promotes the serving cell against all other LTE intra-frequency and inter-frequency neighbor's having the same priority as the serving cell. The hysteresis thus helps to reduce Ping-Pong reselections which are particular not desire-able if they occur on Tracking Area boundaries. Another advantage of the hysteresis is that just the serving cell needs to be optimized with a certain high dB-value compared to the alternative which is to specify for every LTE-neighbor cell an Offset-value. However, the Q(Offset,n) allows an optimized or guided reselection from serving cell to certain LTE-neighbor cell's as the Offset_s,n is per neighbor relationship configurable in SIB type 4. Q(offset,n) is also possible per inter-frequency! 36.331 (6.3.1):IntraFreqNeighCellList ::= 1..maxCellIntra)) OF IntraFreqNeighCellInfo IntraFreqNeighCellInfo ::= { physCellId (= PCI ~ scrambling code),q-OffsetCell} q-OffsetCell = Q-OffsetRange Q-OffsetRange is used to indicate a cell or frequency specific offset to be applied when evaluating candidates for cell re-selection or when evaluating triggering conditions for measurement reporting. Value range {-24dB, -20dB-6dB, -5dB... +4dB, +5dB, +6dB, +8dB... + 24dB} Further Details: i) Q(offset(s,n)) refers to the offset between serving and neighbor cell a) for intra-freq: Q(offset) = Q(offset_s,n) b) for inter-freq: Q(offset) = Q(offset_s,n) + Q(offset_freq) ii) Q(offset(freq)) refers to freq-specific offset for equal priority E-UTRAN freqs LTE-Frequency specific Q(offset_freq) in SIB type 5 36.331 (6.3.1): q-OffsetFreq = Q-OffsetRange DEFAULT= dB0, This means that for equal prioritized LTE inter-frequency neighbor cells the operator has the option firstly to promote or discourage reselections by a negative or positive Q(offset_freq) value. In simple words idle traffic can be shuffled from serving freq to another LTE-freq. Secondly the operator can again define by Q(offset_s,n) per interfrequency neighbor cell a specific offset to promote or discourage certain reselections. Note that the frequency specific offset Q(offset_freq) and neighbor ship specific offset Q(offset_s,n) refer to the same ASN.1 parameter: Q-OffsetRange. Abbreviations of this Section: Q(hyst) q-Hyst Q(meas) Q(meas,s) q-OffsetCell Q(offset,n)
hysteresis value for ranking of the serving cell [dB] Same as Q(hyst), ASN.1 name RSRP-value resp. Q(rxlevmeas)
q-OffsetFreq
Same as Q(offset_freq), ASN.1 name in 36.331
Q(offset_freq) Frequency specific offset [dB] QOffsetRange

ASN.1 parameter name for neighbor or frequency offset Offset per neighbor ship Receive Signal Ref Power
[dBm]
RSRP-value of serving cell [dBm] Q(offset_s,n) Neighbor cell specific offset [dB] Neighbor or frequency offset
RSRP
- 205 -
3.5.7.5.1 Cell Ranking Criterion in E-UTRAN for equal Priority inter-Freq and intra-Freq
The objective of this section is to illustrate the ranking formula for serving cell and neighbor cells having the same priority. The ranking of the neighbor cells can be distinguished by intra-frequency and inter-frequency. Key point of this section are: 1. Intra-frequency and inter-frequency neighbor's have same priority as the serving cell. Only then the above depicted ranking criterion applies. 2. Equal priorities between different RAT's is not supported resp. allowed. 3. The Q(offset) of inter-frequency = Q(offset_s,n) + Q(offset_freq) whereas the Q(offset) for intra-frequency = Q(offset_s,n).
Image Description The cell-ranking criterion R(s) for serving cell and R(n) for neighbouring cells is defined by: I) R(s) = Q(meas,s) + Q(Hyst) II) R(n) = Q(meas,n) + Q(offset) where:
- 206 -

Q(meas): Q(offset): RSRP measurement quantity used in cell reselections. For intra-frequency: Equals to Q(offset_s,n, if Q(offset_s,n) is valid, otherwise this equals to zero. For inter-frequency: Equals to Q(offset_s,n) plus Q(offset_freq), if Q(offset_s,n) is valid, otherwise this equals to Q(offset_freq).
The UE shall perform ranking of all cells that fulfill the cell selection criterion S, which is defined in earlier sections of this chapter, but may exclude all CSG cells that are known by the UE to be not allowed. The cells shall be ranked according to the R criteria specified above, deriving Q(meas,n) and Q(meas,s) and calculating the R values using averaged RSRP results. If a cell is ranked as the best cell the UE shall perform cell reselection to that cell. If this cell is found to be not-suitable, the UE shall behave according to Highest ranked cells with cell reservations, access restrictions or unsuitable for normal camping being described in 3GTS 36.304 (5.2.4.4). This subject is skipped here for simplicity reasons! In all cases, the UE shall reselect the new cell, only if the following conditions are met:
the new cell is better ranked than the serving cell during a time interval Treselection_RAT; more than 1 second has elapsed since the UE camped on the current serving cell. [3GTS 36.304 (5.2.4.6)]

E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network RSRP Reference Signal Received Power SIB System Information Block
UTRAN
UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
- 207 -
3.5.7.6 Cell Reselection towards lower Priority E-UTRAN Freq or IRAT Freq than Serving Freq
The objective of this section is to give the characteristics of the cell reselection procedure with special emphasis on lower prioritized E-UTRAN Freq or IRAT Freq neighbors than serving frequency/cell. Key points of this section are 1. Four conditions need to be fulfilled in order to let an UE camping on an LTE frequency/cell reselect towards lower prioritized IRAT frequency or lower prioritized other E-UTRAN frequency. 2. The ReselectionThresholds for serving cell and neighbor cell are based on the S-criteria and therefore based on Q(rxlevmin) values of serving cell and neighbor cell. 3. The S(ServingCell) corresponds to the S(rxlev)-value of the serving cell and the S(non-servingCell,x)-value corresponds to the S(rxlev)-value of neighbor cell 'x'.
- 208 -

Image Description Cell reselection to a cell on a lower priority E-UTRAN frequency or inter-RAT frequency than serving frequency shall be performed if: No neighbor cell on a higher priority E-UTRAN frequency or inter-RAT frequency than serving frequency fulfills the criteria 1 (mentioned in previous section); and No neighbor cell on serving frequency or on an equal priority E-UTRAN frequency fulfills the ranking criteria R(n) > R(s) for Treselection_RAT; and S(ServingCell) < Thresh(serving, low) and the S(non-ServingCell,x) of a cell of a lower priority E-UTRAN frequency or inter-RAT frequency is greater than Thresh(x, low) during a time interval Treselection_RAT; and more than 1 second has elapsed since the UE camped on the current serving cell.
For GERAN, UTRAN, and E-UTRAN, S(non-ServingCell,x) is the S(rxlev)-value of an evaluated cell. For UTRAN FDD, S(qual) is higher than 0, as defined in [3GTS 25.304]. For cdma2000 RAT's, S(non-ServingCell,x) is equal to -FLOOR(-2 x 10 x log10 Ec/Io) in units of 0.5 dB, with Ec/Io referring to the value measured from the evaluated cell. For cdma2000 RAT's, Thresh(x, high) and Thresh(x, low) are equal to -1 times the values signaled for the corresponding parameters in the system information. In all the above criteria the value of Treselection_RAT is scaled when the UE is in the medium or high mobility state (explained before in earlier section). If more than one cell meets the above criteria, the UE shall reselect a cell ranked as the best cell among the cells meeting the criteria on the highest priority frequencies or the highest priority RAT. [3GTS 36.304 (5.2.4.5)]
Room for your Notes

R(n) R(s) Ranking value of neighbor cell Ranking value of serving cell S(rxlev) Q(rxlev min,s) S-criterion of a cell:
Q(rxlevmeas) - Q(rxlevmin)
Min required reception level in serving cell for camping and cell selection Min required reception level in neighbor cell for cell reselection
S(nonS-criterion of neighbor cell 'x' in Q(rxlev ServingCell,x) other RAT or different frequency min,n) S(ServingCell) S-criterion of serving cell
- 209 -
3.6 GERAN to E-UTRAN Cell Reselection

3.6.1 IRAT Measurements when camping in GSM or GPRS
The objective of this section is to highlight that priority-based IRAT neighbor search also exist in GERAN. The BSS/PCU broadcast IRAT neighbor lists (UTRAN and/or E-UTRAN) in SI-2quater. The key points of this section are: 1. The UE can inherit priorities from other RAT when reselecting to GSM. These priorities are so called dedicated (also known as individual) priorities). Theses dedicated priorities take precedence over common priorities broadcast via SI-2quater. 2. The network takes care either through dedicated signaling or through broadcast that UE's in GERAN have received their priorities for every supported RAT in the network.
For a multi-RAT MS supporting E-UTRA, E-UTRAN frequencies may be included in the E-UTRAN Neighbor Cell list (SI-2quater). The network controls the measurements for reselection of E-UTRA cells by the parameter THRESH_priority_search broadcast on BCCH via System Info 2quater. The parameter THRESH_priority_search also controls measurement of inter-RAT cells or frequencies included in the 3G Cell Reselection list when the inter-RAT cell reselection algorithm based on priority information is used.
- 210 -
When RLA_C of the serving cell is below THRESH_priority_search, the mobile station shall monitor cells of inter-RAT frequencies of lower priority than the serving cell. When RLA_C of the serving cell is above the threshold, the mobile station is allowed not to monitor cells of inter-RAT frequencies of lower priority than the serving cell.
The MS shall perform the measurement processes for E-UTRAN and other access technologies in parallel when applicable. The mobile station shall monitor cells of inter-RAT frequencies of higher priority than the serving cell at least once every (60*Nhpf) seconds, where Nhpf is the number of inter-RAT frequencies of higher priority. Definition of RLC_C Note: For the purposes of cell selection and reselection, the MS is required to maintain an average of received signal levels for all monitored frequencies. These quantities termed the "received level averages" (RLA_C), shall be unweighted averages of the received signal levels measured in dBm. The accuracy of the received signal level measurements for idle mode tasks shall be the same as for radio link measurements. [3GTS 45.008 (6.1)] Maximum number of UTRAN and E-UTRAN neighbors to be monitored when in GSM A multi-RAT MS shall be able to monitor cells from other radio access technologies, divided into (depending on the MS capability): UTRAN FDD cells on up to 3 FDD frequencies, with a maximum of 32 cells per frequency; and/or UTRAN TDD cells on up to 3 TDD frequencies with a maximum of 32 cells per frequency; and/or E-UTRAN FDD cells on up to 3 FDD frequencies; and/or
E-UTRAN TDD cells on up to 3 TDD frequencies. The total number of monitored UTRAN cells shall not exceed 64. [3GTS 45.008 (6.6.4)] At inter-RAT cell reselection from UTRAN or E-UTRAN to GERAN, the MS shall inherit valid individual priority information from the source RAT. In this case the mobile station shall start timer T3230 with the timeout value set to the remaining validity time of the corresponding timer from the source RAT (i.e. T320 in E-UTRA, T322 in UTRA). If more than one valid individual priority applied for GERAN frequencies while in the source RAT then, following inter-RAT reselection to GERAN, the mobile station shall apply, as GERAN individual priority, only the one applicable to the BCCH carrier of the GERAN cell that was reselected, for as long as it is valid and the mobile station remains in GERAN. In this case the mobile station shall not apply the other GERAN individual priority(ies) until a further inter-RAT reselection from GERAN occurs. NOTE: The network may provide individual priorities information for inter-RAT frequencies not configured by system information.
- 211 -
3.6.2 IRAT Cell Reselection based on Priority 2G to 3G / LTE 3.6.2.1 Cell Reselection Criteria's
The objective of this section is to describe the three possible cases for IRAT reselection from GERAN to UTRAN/E-UTRAN based on priority. The key points of this section are: 1. A MS involved in a CS-voice call will never be handed over towards EUTRAN even the UE is DTM with simultaneous Voice and PS bearer: So IRAT changes from GSM towards LTE can only take place in Idle mode. 2. Of course once the MS has just a PS-connection (TBF) the MS can either reselect autonomously ( network control order 0) or controlled through PCU (NC-2) known as network controlled cell reselection (NCCR) or through NACC (network assisted cell change from (E)GPRS to UTRAN or E-UTRAN.
A MS supporting E-UTRAN shall support priority based IRAT cell reselection towards all RATs. The Network shall provide Priority Info if E-UTRAN Freqs are included in the neighbor cell list!
- 212 -

The algorithm for cell reselection in this section shall be used for inter-RAT cell reselection if priority information is available to the MS and threshold information is provided by the network, and if the MS supports priority based inter-RAT cell reselection. A mobile station supporting E-UTRAN shall support priority based interRAT cell re-selection towards all the supported RAT's. A MS not supporting EUTRAN and supporting UTRAN and supporting priority based reselection from UTRAN to GERAN shall support priority based inter-RAT cell re-selection towards UTRAN. The network shall provide priority information if E-UTRAN frequencies are included in the neighbor cell list; the network may provide priority information if only UTRAN frequencies are included in the neighbor cell list. If priority information is available to the mobile station, the algorithm in this section shall be used for inter-RAT reselection towards all RAT's. The rules regarding which set of priorities is valid at any given time are defined in 3TS 44.018 (3.2.3) Inter-RAT cell re-selection based on priority information. NOTE 1:Priority information means information related to each UTRAN or EUTRAN frequency (e.g. THRESH_UTRAN_high, THRESH_E-UTRAN_high) and information related to the serving cell (e.g. GERAN_PRIORITY). NOTE 2:Throughout the specification, the phrase neighbor cell list will include also the E-UTRAN Neighbor Cell list where appropriate. The MS shall then reselect a suitable (see 3GPP TS 25.304 for UTRAN and 3GPP TS 36.304 for E-UTRAN) cell of another radio access technology if the criteria below are satisfied. S_non-serving_XXX is the measurement quantity of a non-serving inter-RAT cell and XXX indicates the other radio access technology/mode and is defined as follows: for a UTRAN cell, is the measured RSCP value for the cell minus UTRAN_QRXLEVMIN for the cells frequency;
for a E-UTRAN cell, is the measured RSRP value for the cell minus EUTRAN_QRXLEVMIN for the cells frequency. For a GSM cell, S_GSM is defined as the C1 value for the cell. To be continued on next page Abbreviations of this Section: to be defined.
- 213 -
Cell Reselection Criteria in details Cell reselection to a cell of another inter-RAT frequency shall be performed if any of the conditions below (to be evaluated in the order shown) is satisfied: 1) The S_non-serving_XXX of one or more cells of a higher priority inter-RAT frequency is greater than THRESH_XXX_high during a time interval T_reselection; in that case, the mobile station shall consider the cells for reselection in decreasing order of priority and, for cells of the same inter-RAT frequency, in decreasing order of S_non-serving_XXX, and reselect the first cell that satisfies the conditions above; 2) The value of S_GSM is lower than THRESH_GSM_low for the serving cell and all measured GSM cells during a time interval T_reselection; in this case, the mobile station shall consider for reselection the inter-RAT cells in the following order, and reselect the first one that satisfies the following criteria: 2a) cells of a lower priority inter-RAT frequency whose S_non-serving_XXX is greater than THRESH_XXX_low during a time interval T_reselection; these cells shall be considered in decreasing order of priority and, for cells of the same RAT, in decreasing order of S_non-serving_XXX;
2b) if no cells satisfy the criterion above, inter-RAT cells for which, during a time interval T_reselection, S_non-serving_XXX is higher than S_GSM for the serving cell by at least a specific hysteresis H_PRIO; these cells shall be considered in decreasing order of S_non-serving_XXX. A UTRAN FDD cell shall only be reselected if, in addition to the criteria above, its measured Ec/No value is equal to or greater than FDD_Qmin FDD_Qmin_Offset. [3GTS 45.008 (6.6.6)] Cell reselection to a cell of another radio access technology (e.g. UTRAN or EUTRAN) shall not occur within 5 seconds after the MS has reselected a GSM cell from an inter-RAT cell if a suitable GSM cell can be found. If the mobile station applies common priorities and priority information for the serving cell is missing, the mobile station shall consider any GSM cell (including the serving cell) to have lowest priority (i.e. lower than the eight network configured values). If the mobile station applies individual priorities received through dedicated signaling and priority information is available only for some inter-RAT frequencies, cells belonging to frequencies for which no individual priority is available or no threshold is provided by the serving cell shall not be considered for measurement and for cell reselection. Note that in the next two sections the case 1) and then case 2a) and case 2b) are shown in greater detail!
- 214 -
Room for your Notes
Abbreviations of this Section: to be defined.
- 215 -
3.6.2.2 Cell Reselection from GERAN towards higher prioritized IRAT Frequency
The objective of this section is to describe how the various parameters broadcast in SI-2quater influence the reselection from GSM/GRPS towards E-UTRAN and UTRAN cells of higher priority than 2G's priority's. Here we show the IRAT reselection case 1) stated in previous section! The key points of this section are: 1. The parameter 'THRESH_priority_search' is the threshold for the GSM serving cell that controls measurement on inter-RAT cells or frequencies of lower priority and is based on absolute RXLEV values in dBm. Once the RXELV of the serving cell falls below this threshold the UE is forced to search and measure lower prioritized IRAT neighbors. 2. The UE must always search and measure higher prioritized IRAT neighbors if configured via SI-2quater.
Image Description Event-1: The signal strength of a higher prioritized IRAT neighbor (e.g. UTRAN or EUTRAN) exceeds the THRESH_XXX_high. From this moment on the UE starts the Treselection timer. Treselection timer delays the reselection for minimum of 5sec this adds some hysteresis and avoids ping-pong reselections.
- 216 -

Event-2: The signal strength of the higher prioritized IRAT neighbor is above threshold TRESH_XXX_high for at least Treselection time. This means the condition for reselection towards that higher prioritized IRAT neighbor is fulfilled and the UE shall re-select that IRAT neighbor now. Event-3: The signal strength of the higher prioritized IRAT neighbor drops below THRESH_XXX_low. This means that the IRAT neighbor is not longer a preferred candidate for reselection. The MS would only reselect towards such a weak IRATneighbor in case the C1-value of GSM falls additional below TRESH_GSM_low which means that GSM-overage is pretty bad. RXLEV_ACCESS_MIN: Minimum received signal level at the MS, required for access to the GSM system; range: 0 63 (relative applied to -110 dBm) THRESH_GSM_low: A threshold below which the MS is allowed to reselect to lower priority layers; range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, , 13 = 26 dB, 14 = 28 dB, 15 = 'infinite' (always). THRESH_priority_search: A threshold for the serving cell that controls measurement of inter-RAT cells or frequencies of lower priority when the prioritybased cell reselection algorithm is used; range: 0 = -98 dBm, 1 = -95 dBm, 2 = -92 dBm, , 13 = -59 dBm, 14 = -56 dBm, 15 = 'infinite' (always). GERAN_PRIORITY: Priority of GSM cells, range: 0 = lowest priority, , 7 = highest priority. UTRAN_QRXLEVMIN: Minimum required RX level for cells on the target UTRAN frequency (dBm), range: 0 = -119 dBm, 1 = -117 dBm, 2 = -115 dBm, , 30 = -59 dBm, 31 = -57 dBm. Default value = -119 dBm. THRESH_UTRAN_FDD_high, THRESH_UTRAN_FDD_low: Reselection thresholds towards UTRAN FDD cells, range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, 3 = 6 dB, , 30 = 60 dB, 31 = 62 dB. Default of THRESH_UTRAN_FDD_low = value of THRESH_UTRAN_FDD_high. UTRAN_PRIORITY: Priority of a UTRAN frequency layer, 0 = lowest priority, , 7 = highest priority. E-UTRAN_QRXLEVMIN: Minimum required RX level for cells on the target EUTRAN frequency (dBm), range: 0 = -140 dBm, 1 = -138 dBm, 2 = -136 dBm, , 30 = -80 dBm, 31 = -78 dBm. Default value = -140 dBm. THRESH_E-UTRAN_high, THRESH_E-UTRAN_low: Reselection thresholds towards E-UTRAN FDD or TDD cells, range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, 3 = 6 dB, , 30 = 60 dB, 31 = 62 dB. Default value of THRESH_E-UTRAN_low = value of THRESH_E UTRAN_high. E-UTRAN_PRIORITY: Priority of a E-UTRAN frequency layer, 0 = lowest priority, , 7 = highest priority. [3GTS 45.008 (9)] Abbreviations of this Section: to be defined.
- 217 -
3.6.2.3 Cell Reselection from GERAN towards lower prioritized IRAT Frequency
The objective of this section is to show the IRAT reselection case 2a) and case 2b) towards lower prioritized neighbors of e.g. UTRAN or E-UTRAN. The key points of this section are: 1. The MS must follow an order in its IRAT reselection based on signal strength of the IRAT-neighbor's when the coverage resp. C1 value of GSM serving and neighbor cells is below the threshold THRESH_GSM_low. At first the IRAT-neighbors whose S-criteria S(non-serving_XXX) is above threshold THRESH_XXX_low will be considered for reselection case 2a). 2. If no suitable IRAT-neighbor is available (as their S(rxlev)-value is below THRESH_XXX_low and the coverage of GSM is still below threshold THRESH_GSM_Low, then the MS should reselect the better cell when the neighbor cell is stronger by a hysteresis value of H_PRIO for Treselection time. case 2b)
Image Description Event-1: The GSM coverage drops below critical threshold defined THRESH_GSM_Low but no suitable strong IRAT neighbor is available.
by
- 218 -

Event-4: IRAT Reselection case 2b) is shown here. The GSM coverage is bad and below threshold THRESH_GSM_Low and at the same time no IRAT-neighbor has a signal strength which is above threshold THRES_XXX_high. But for a period of time Treselection the IRAT-neighbor's S(non-ServingCell,x) exceeds S(GSM,serv) by hysteresis value H_PRIO. Event-2: Here the signal of the lower prioritized IRAT neighbor cell 'x' takes a different trend. The S(rxlev) of the lower prioritized IRAT neighbor exceeds threshold TRESH_XXX_low. Event-3: IRAT Reselection case 2a) is shown. The GSM coverage expressed by S_GSM (= C1-value) is below threshold THRESH_GSM_low but the S(rxlev) of an IRAT neighbor cell is above minimum required signal strength expressed by threshold THRESH_XXX_low for Treselection time. The UE shall reselect in either case 2a) or in case 2b) the IRAT neighbor 'x'. H_PRIO: Hysteresis used in the priority reselection algorithm, range: 0 = infinite (rule disabled), 1 = 5 dB, 2 = 4 dB, 3 = 3 dB. T_reselection: Time hysteresis in the reselection algorithm, range: 0 = 5 sec, 1 = 10 sec, 2 = 15 sec, 3 = 20 sec. Qsearch_C_E-UTRAN_Initial: Indicates the Qsearch value to be used in dedicated / dual transfer mode before Qsearch_C_E-UTRAN is received, Search for E-UTRAN cells if signal level below threshold (0-7): - 98, - 94, , - 74 dBm, infinite (always) or above threshold (8-15): - 78, - 74, , - 54 dBm, infinite (never) [3GTS 45.008 (9)] Abbreviations of this Section: to be defined.
- 219 -
- 220 -
Lower Layers of the Uu-Interface: MAC, RLC & PDCP
Chapter 4:
Objectives
Some of your questions that will be answered during this session What are tasks and functions of MAC, RLC and PDCP? Which format do MAC- RLC- and PDCP-PDU's use? How does random access procedure look like in LTE MAC? How are MAC, RLC, and PCDP configured? How is a TCP/IP frame traveling trough the L2 protocol stacks?
- 221 -
4.1 Features of MAC

4.1.1 Overview
The objective of this section is to introduce the key features of the medium access control layer. Key point of this section is that for the MAC the chance has been taken to tune many concepts such that they fit to PS services from the start.
4.1.1.1 Data transfer logical channels transport channels This function is similar to HSPA. The big difference it that two TBs per UE can be transferred at the same time. 4.1.1.2 Radio resource allocation For the radio resource allocation there is a very significant change for the RACH. Here there is not the possibility to map user plane data on the RACH. For HARQ the basic concepts of HSPA are retained however the HARQ is a lot faster then in HSPA. Also the parameters and implementation details will differ. For the priority concept a quite similar approach than in HSPA will be taken. However detains are not specified yet.
- 222 -
4.1.1.3 Special procedures Special procedures like timing advance and DRX are also handled by. The DRX procedure works with two DRX cycles. Once the UE does not get any scheduling for a certain time the short DRX cycle is applied and once it is not getting any scheduling for another certain time a long DRX cycle is applied. MAC is able force the UE into DRX at any time (once configured). [3GTR 25.813 (5.3.1), 3GTS 36.300 (6.1), 3GTS 36.321 (4.4)]
Room for your Notes

4

3GTR 3GTS DRX HARQ HSPA 3rd Generation Technical Report 3rd Generation Technical Specification Discontinuous Reception Hybrid ARQ MAC PS QoS RACH Medium Access Control Packet Switched Quality of Service Random Access Channel Transport Block
High Speed Packet Access (operation TB of HSDPA and HSUPA)
- 223 -
4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN 4.1.2.1 Usage of RNTI's
The objective of this section is to illustrate the usage of the different RNTI's in E-UTRAN. Key point of this section is that besides the normal scheduling the RNTI's also facilitate MAC and physical layer control procedures.
- 224 -

C-RNTI CCCH DCCH DL DL-SCH DTCH Cell Radio Network Temporary Identifier Common Control Channel Dedicated Control Channel Downlink Downlink Shared Channel Dedicated Traffic Channel PUCCH PUSCH RA-RNTI RNTI SI-RNTI TPC TPCPUCCHRNTI TPCPUSCHRNTI TX UL UL-SCH UTRAN Physical Uplink Control Channel Physical Uplink Shared Channel Random Access Radio Network Temporary Identifier Radio Network Temporary Identifier System Information Radio Network Temporary Identifier Transmit Power Command Transmit Power Control Physical Upling Control CHannel Radio Network Temporary Identifier Transmit Power Control Physical Upling Shared CHannel Radio Network Temporary Identifier Transmit Uplink Uplink Shared Channel UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network MAC Medium Access Control
P-RNTI PCCH PCH PDCCH
Paging Radio Network Temporary Identifier Paging Control Channel Paging Channel Physical Downlink Control Channel
- 225 -
4.1.2.1 RNTI Values
The objective of this section is to show what RNTI can assume what values. Key point of this section is that some RNTI's are preconfigured by the standard and some others are configured by SIB2.
- 226 -

C-RNTI P-RNTI RA-RNTI Cell Radio Network Temporary Identifier Paging Radio Network Temporary Identifier Random Access Radio Network Temporary Identifier Radio Network Temporary Identifier SI-RNTI SIB TPCPUCCHRNTI TPCPUSCHRNTI System Information Radio Network Temporary Identifier System Information Block Transmit Power Control Physical Upling Control CHannel Radio Network Temporary Identifier Transmit Power Control Physical Upling Shared CHannel Radio Network Temporary Identifier
RNTI
- 227 -
4.1.3 MAC Random Access Procedure 4.1.3.1 Contention Based Random Access Procedure
The objective of this section is to show the contention based random access procedure from the MAC perspective. Key point of this section is that the contention based random access procedure can be used for all purposes: Initial access, handover, RRC connection reestablishment and initiation of transmission of data in RRC_CONNECTED .
- 228 -
Image description This picture is visualizing the contention based random access procedure. In case the treatment is different in the different access cases the colors are different from black.
Room for your Notes

AS C-RNTI DL DL-SCH eNB ID MAC RA-RNTI Access Stratum (UMTS) Cell Radio Network Temporary Identifier Downlink Downlink Shared Channel Enhanced Node B Identity Medium Access Control Random Access Radio Network Temporary Identifier RRC Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED TA TX UE UL UL-SCH Timing Advance Transmit User Equipment Uplink Uplink Shared Channel
- 229 -

Here collisions are possible because the UE decides when and how exactly a random access is initiated. Then it is possible that two UEs transmit the same preamble at the same time. The chosen preamble is 1 out of 64 preambles and is thus encoding 6 bits. The cluster of the chosen preamble signals the length of the following scheduled transmission in the UL. As well the UE might chose from different RACH resources on different RB's and different subframes within a radio frame. 3 ms after the final subframe of a PRACH preamble (keep in mind that a PRACH preamble might take more than 1 ms!) the Random Access Response Window begins. In this window the eNB might transmit its random access response. It is 2, 3, ..., 8, 10 ms long. The RA-RNTI gives information about the referred subframe for the PRACH preamble, and the used RB's of the PRACH preamble. Inside the random access response there is an identifier for the referred PRACH preamble, the adjusted TA, an UL-grant and a temporary C-RNTI. This C-RNTI becomes permanent once the procedure is succeeding for the case of initial access. As for all UL scheduling the scheduled TX has to happen 4 ms after the scheduling indication (here random access response) has started. In case of the initial access the UE will include its NAS-UE ID in the RRC connection establishment request message. This can be only an S-TIMSI or an 4 bit random number - an IMSI cannot be transmitted here. Other scenarios include a C-RNTI either in the MAC-PDU or in the RRC messages. Once a C-RNTI is given by the UE this will replace the temporary C-RNTI issued in the random access response. After the scheduled TX the UE will wait for a some time (8, 16, , 64 ms) for the contention resolution response. Once two UE's have sent their scheduled TX it has to be decided which one if any is prevailing. Contention resolution is performed regardless whether connectivity to the core has been achieved before or not. Contention resolution can be achieved in two ways: Either the C-RNTI (coming from the UE) is used to schedule the DL transmission or the MAC-PDU is containing the NAS-UE ID. Once the UE has not received a contention resolution in the given time it will reattempt another random access procedure. Once the UE is RRC connected and assumed not to be synchronized any more (e.g. timer expires) a random access procedure has to be performed before data is transmitted. This is as well the case once the scheduling request procedure is failing or not configured.
[3GTS 36.300 (10.1.5), 3GTS 36.321 (5.1)]
- 230 -
Room for your Notes

3GTS AS C-RNTI DL DL-SCH eNB ID IMSI MAC NAS 3rd Generation Technical Specification Access Stratum (UMTS) Cell Radio Network Temporary Identifier Downlink Downlink Shared Channel Enhanced Node B Identity International Mobile Subscriber Identity Medium Access Control Non-Access-Stratum RA-RNTI RB RRC Random Access Radio Network Temporary Identifier Resource Block Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED S-TMSI TA TX UE UL UL-SCH SAE Temporary Mobile Subscriber Identity Timing Advance Transmit User Equipment Uplink Uplink Shared Channel
- 231 -
4.1.3.2 Non-contention based random access procedure
The objective of this section is to show the contention free random access procedure from the MAC perspective. Key point of this section is that the contention free random access procedure can be used only for network trigged purposes: handover and initiation of transmission of DL data in RRC_CONNECTED.
Image description This picture is visualizing the contention free random access procedure. In case the treatment is different in the different access cases the colors are different from black.
- 232 -

The difference to the contention based random access procedure is that the UE gets assigned a specific random access preamble and a random access resource (RB's and subframes in a radio frame) (e.g. during handover, etc.). Then the UE will use the preamble assigned and will get an UL grant related to its service directly together with its TA. Here, of course, a contention resolution is not necessary. The UE will have a C-RNTI already. The difference in timing in-between PDCCH orders and RRC connection reconfigurations is that a reconfiguration has a the timer T304 giving the procedure 50,100, 150, 200, 500, 1000, 2000 ms time to succeed with with possible multiple tries. The PDCCH order allocates only one attempt and has no timer attached.
4
[3GTS 36.300 (10.1.5), 3GTS 36.321 (5.1)]
Room for your Notes

3GTS C-RNTI DL DL-SCH eNB MAC PDCCH RA-RNTI 3rd Generation Technical Specification Cell Radio Network Temporary Identifier Downlink Downlink Shared Channel Enhanced Node B Medium Access Control Physical Downlink Control Channel Random Access Radio Network Temporary Identifier RB RRC Resource Block Radio Resource Control
RRC_CO RRC state in E-UTRA NNECTED TA TX UE UL UL-SCH Timing Advance Transmit User Equipment Uplink Uplink Shared Channel
- 233 -
4.1.4 Structure of MAC-PDU
The objective of this section is to provide the structure of the MAC PDU. Key point of this section is that the LTE MAC PDU does usually only contain 1 SDU per logical channel.
Image description This picture is visualizing the structure of the header and the sequence of SDUs in the MAC PDU. The non-transparent MAC PDU is transmitting with its SDUs one or several RLCPDUs at a time. Unlike in UMTS standards (prior to R7) the size of the RLC PDU is flexible such that it can fit the size of the MAC PDU it is mapped to. Since both MAC and RLC are located in the eNB,
- 234 -

the MAC knows the size of the TB it can transmit (transmission opportunity). In case there are more than one logical channel active for the corresponding user, the MAC has to multiplex the different logical channels on the TB. Most likely it could e.g. map the highest priority logical channels SDU on the TB. For this it will ask for an SDU with fitting size such that no or only minimum padding is necessary. In case the RLC cannot fill the TB fully the MAC will add the next lower priority logical channel on the TB and so forth until the TB is full. The structure of the MAC PDU and its header are accomplishing this function. First the MAC header is structured in sub headers in order to indicate several MAC SDUs. Since MAC in LTE is also fulfilling control functions there are two sub-header formats and SDU structures: 4.1.4.1 MAC control element Some LCIDs are reserved for control elements and 1 LCID is indicating padding. The MAC control elements are explained in the next section. None and more then 1 MAC Control field are also possible. 4.1.4.2 Normal (non-transparent) MAC SDU In order to do transport normal MAC PDUs the MAC sub header has triplets of information elements: 1. There are two reserved bits. 2. The E (End) field which is indicating the end of the MAC header (1) or more triplets following (0). 3. The LCID (Logical Channel ID) which is indicating the logical channel used in a similar fashion than the C/T field in UMTS (4 bits). Once there is no padding the last normal MAC SDU will not generate the following two header fields: 4. The F field is indicating the length of the following length field (7 or 15 bit) 5. The L (Length) field indicating the length of the corresponding SDU. F and L field are very close to RLC PDU in UMTS. Padding will only be used if no further SDU can be filled in or if no more RLC data is ready to be transmitted and there is still space in the TB. In order to avoid unnecessary extensive padding MAC may reduce the TB size in order to reduce interference in the network. 4.1.4.3 Transparent MAC SDU For the BCCH and the PCCH there is also a transparent MAC PDU defined. [3GTS 36.321 (6)] Abbreviations of this Section:
3GTS LCID LTE MAC PDU 3rd Generation Technical Specification Logical Channel ID Long Term Evolution (of UMTS) Medium Access Control Protocol Data Unit or Packet Data Unit RLC SDU TB UMTS eNB Radio Link Control Service Data Unit (the payload of a PDU) Transport Block Universal Mobile Telecommunication System Enhanced Node B
- 235 -
4.1.5 MAC Control Elements
The objective of this section is to provide different kinds of MAC control elements. Key point of this section is functions like RACH response, buffer status report and timing advance are dealt with in MAC control elements.
Image description These two tables are showing the MAC control elements in UL and DL. Part of the LCIDs are reserved for MAC control elements which are serving physical layer or MAC functions. The length of some MAC control elements is still under discussion but the purpose is quite clear. Please keep in mid that some LCIDs are to be reserved for yet unknown MAC control elements.
- 236 -
4.1.5.1 Contention resolution ID This is the response of the Random Access Burst sent by the UE. It contains the NAS ID of the UE. 4.1.5.2 Timing Advance This MAC control element is used for timing advance updates. 4.1.5.3 DRX With this MAC control element the DRX is configured similar like in the HS-DSCH orders in UMTS R7. Since only DRX is to be commanded here this MAC control element contains no data. Just a header field is used here. Once the DRX field is present the UE goes to DRX unconditionally (DRX needs to be configured). 4.1.5.4 Padding Padding is no MAC control element but is also indicated with a special LCID value. 4.1.5.5 Power headroom report This is the margin the transmission power can still be increased until the maximum transmission power of the UE is reached. 4.1.5.6 C-RNTI This is the temporary CRNTI during the contention based random access procedure. 4.1.5.7 Short, long and truncated buffer status reports Here the UE can report the occupancy of its UL buffer. There are two formats long and short buffer reports. With the long buffer report multiple logical channel groups buffer status is reported. [3GTS 36.321 (6)] Abbreviations of this Section:
3GTS DL DRX 3rd Generation Technical Specification Downlink Discontinuous Reception MAC RACH UE UL Medium Access Control Random Access Channel User Equipment Uplink
HS-DSCH High Speed Downlink Shared Transport Channel (3GTS 25.211, 25.212, 25.308) ID LCID Identity Logical Channel ID
UL-SCH UMTS
Uplink Shared Channel Universal Mobile Telecommunication System
- 237 -
4.1.6 Practical Exercise: MAC Operation
The objective of this section is to repeat the MAC operation in detail using the RRC Connection Establishment Procedure.
- 238 -

Question No 22: The picture shows the RRC Connection Establishment Procedure on MAC level. Please fill out the blanks.
The first line of an arrow contains the name of the Logical (Transport or Physical) channel. Then in case of a logical channel the RB. Then in brackets the message or indication.
The second line contains the time in ms. In case there is a time span possible take the shortest possible time. Assume that a L3 reaction cannot be faster than a L1 reaction (4 ms).
4
The third and fourth line contain the content of the message or MAC PDU.
Abbreviations of this Section: SRB

ACK C-RNTI CCCH DCCH DL-SCH eNB ID L1 L3 MAC MMEI NAS Acknowledgement Cell Radio Network Temporary Identifier Common Control Channel Dedicated Control Channel Downlink Shared Channel Enhanced Node B Identity Layer 1 (physical layer) Layer 3 (network layer) Medium Access Control MME Identity Non-Access-Stratum PDCCH PDU PHICH PLMN PRACH RA-RNTI RB RRC SRB TA UE UL-SCH Physical Downlink Control Channel Protocol Data Unit or Packet Data Unit Physical HARQ Acknowledgement Indicator Channel Public Land Mobile Network Physical Random Access Channel Random Access Radio Network Temporary Identifier Radio Bearer Radio Resource Control Signaling Radio Bearer Timing Advance User Equipment Uplink Shared Channel
- 239 -
4.1.7 Practical Exercise: DL MAC PDU Construction
The objective of this section is to repeat the structure of the MAC PDU.
Question No 23: In the above picture a DL MAC PDU needs to be constructed. Please fill in the bits of the MAC header, count the bytes used and name the logical channel being transmitted. Do not forget the MAC control elements. In the payload section please enter the number of bytes for what logical channel being transmitted. Below you find how the RB's that are configured and what data / information is waiting for transmission. Mark which fields are not used (header and payload). LCH LCID Bit to TX Use DCCH 1 1 200 SRB1 DCCH 2 2 0 SRB2 DTCH 1 3 0 Default EPS Bearer for IMS DTCH 2 4 320 Dedicated EPS Bearer for VoIMS DTCH 3 5 0 Default EPS Bearer for Internet DTCH 4 6 416 Dedicated EPS Bearer for Internet DTCH 5 7 10000 Default EPS Bearer for email The eNB would like to transmit a TA update to the UE. The eNB is congested and has decided to put the UE in DRX. The eNB has a transmission opportunity of for a 1000 bit TB.
- 240 -
Abbreviations of this Section: SRB

DCCH DL DRX DTCH eNB EPS IMS LCH LCID Dedicated Control Channel Downlink Discontinuous Reception Dedicated Traffic Channel Enhanced Node B Evolved Packet Switched MAC PDU RB SRB TA TX Medium Access Control Protocol Data Unit or Packet Data Unit Radio Bearer Signaling Radio Bearer Timing Advance Transmit User Equipment Voice over IMS
Internet Protocol Multimedia Core UE Network Subsystem (Rel. 5 onwards) Logical CHannel Logical Channel ID VoIMS
- 241 -
4.1.8 MAC Configuration 4.1.8.1 MAC Configuration in the Standard
The objective of this section is to give an overview about the IE's relating to the MAC configuration. Key point of this section is that the default config. saves message space.
- 242 -


BSR DL DRX HARQ IE Buffer Status Report Downlink Discontinuous Reception Hybrid ARQ Information Element MAC PHR TTI TX UL-SCH Medium Access Control Power Headroom Report Transmission Time Interval Transmit Uplink Shared Channel
- 243 -
4.2 Features of RLC

4.2.1 Overview
The objective of this section is to introduce the key features of the radio link control layer. Key point of this section is the RLC stays intact to the most part once it is compared to HSPA operation.
4.2.1.1 Data transfer At the first glance the RLC is only not altered very significantly. However that the second glace it could be noticed that for RLC the ciphering is missing and that compared the HSPA LTE can provide TM data transmission again. Another special point is the duplicate deletion in case of a handover. During the handover the received buffer is exchanged in-between source and target eNB (AM only). In HSPA duplicates for the UL are deleted in MAC-es whereas the duplicates are deleted as well in the RLC for the legacy UMTS traffic. The variable RLC PDU size has to be mentioned here again. 4.2.1.2 Error detection and recovery There is nothing to be added to what is stated in the picture.
- 244 -
4.2.1.3 Reset There is nothing to be added to what is stated in the picture. [3GTR 25.813 (5.3.2), 3GTS 36.300 (6.2), 3GTS 36.322 (4.4)]
Room for your Notes

3GTR 3GTS AM ARQ HSPA LTE MAC MAC-es 3rd Generation Technical Report 3rd Generation Technical Specification Acknowledged Mode operation Automatic Repeat Request PDCP RLC TM UL Packet Data Convergence Protocol Radio Link Control Transparent Mode operation Uplink Unacknowledged Mode operation Universal Mobile Telecommunication System Enhanced Node B
High Speed Packet Access (operation UM of HSDPA and HSUPA) Long Term Evolution (of UMTS) Medium Access Control MAC-E-DCH SRNC (3GTS 25.321) UMTS eNB
- 245 -
4.2.2 Structure of RLC PDU
The objective of this section is to provide the structure of the RLC PDU. Key points of this section are that the LTE RLC PDU can contain segmented PDCP PDUs and that the RLC PDU size fits to the individual TB size to be transmitted.
Image description This picture is visualizing the structure of the header and the sequence of SDUs in the RLC PDU. Like in UMTS there are 3 transmission modes for the RLC: TM, UM, and AM. For the TM the structure of the RLC PDU is simple: It is transparent for the PDCP data. For the UM and AM mode there is a header and one or more PDCP PDUs being the RLC SDUs. Note here that the PDCP PDUs can be segmented in the RLC. Optionally, like in UMTS for AM only, a Status PDU cannot be at the end of the RLC PDU.
- 246 -

The header comprises the following information elements: 1. The D/C field is a reserved bit in UM. In AM it is indicating the presence of a RLC control PDU (status report). A status report must not be piggy backed at the end of the RLC PDU. 2. The RF field is a reserved bit in UM. In AM it is indicating the presence of re-segmentation. This occurs once an already segmented PDCP PDU is in need to be retransmitted and further segmented. 3. The polling flag is a reserved bit in UM. In AM it is encouraging the RLC of the receiver side to sent status PDUs. 4. In case of a 5 bit SN version UM PDU the first 3 fields are missing. 5. The FI filed exists in both AM and UM. It is indicating the presence of PDCP PDU segment in the RLC PDU. In case of the presence of segments and AM the header is extended by two bytes as described in the next section. 6. The SN (Sequence Number) which is indicating the RLC sequence number of the RLC PDU. The length of this field can be the same in AM and UM. However there is also an UM mode with 1 byte header and 5 bit SN filed and no reserved bits. 7. An E field (Extension) which is indicating with (0) that data is following and with (1) that an extension of LI (Length Indicator) and another E filed is following. 8. The LI field (Length Indicator) of yet unknown length is indicating the length of the PDCP PDU. Please note since there is also a length indication in the MAC PDU one LI field in the RLC PDU is redundant. 9. Padding in the header is necessary since the E and LI field to not fill two bytes. In case of an even number of RLC SDUs 4 bit padding is needed to fill up the RLC header to the byte boundary. [3GTS 36.322 (6)] Abbreviations of this Section:
3GTS AM FI LI LTE MAC PDCP 3rd Generation Technical Specification Acknowledged Mode operation Framing Info Length Indicator Long Term Evolution (of UMTS) Medium Access Control Packet Data Convergence Protocol RF RLC SDU SN TB TM UM Radio Frequency Radio Link Control Service Data Unit (the payload of a PDU) Sequence Number Transport Block Transparent Mode operation Unacknowledged Mode operation
- 247 -
4.2.3 Structure of RLC AM with PDCP PDU Segments
4
The objective of this section is to provide the structure of the RLC AM PDU with a segment header. Key point of this section is that only in case of PDU segments in the first RLC SDU the header is extended for carrying the additional information about RLC PDU segments.
Image description This picture is visualizing the structure of the header and SDU in the RLC AM PDU segment PDU. In case the first RLC SDU is a segment the RLC AM PDU is containing two additional header information elements: 1. The LSF (Last Segment Flag) is set once the PDCP PDU segment is the last segment of the PDCP PDU. 2. The SO (Segment Offset) is determining the offset in the PDCP PDU segment inside the PDCP PDU. [3GTS 36.322 (6)]
Room for your Notes
- 248 -
Room for your Notes

3GTS AM ARQ LSF LTE PDCP 3rd Generation Technical Specification Acknowledged Mode operation Automatic Repeat Request Last Segment Flag Long Term Evolution (of UMTS) Packet Data Convergence Protocol PDU RLC SN SDU SO Protocol Data Unit or Packet Data Unit Radio Link Control Sequence Number Service Data Unit (the payload of a PDU) Segment Offset
- 249 -
4.2.4 RLC Configuration 4.2.4.1 RLC Configuration in the Standard
The objective of this section is to give an overview about the IE's relating to the RLC configuration. Key point of this section is that the default config. saves message space.
- 250 INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200


AM DL IE PDU RLC Acknowledged Mode operation Downlink Information Element Protocol Data Unit or Packet Data Unit Radio Link Control SN SRB UL UM Sequence Number Signaling Radio Bearer Uplink Unacknowledged Mode operation
- 251 -
4.3 Features of PDCP

4.3.1 Overview
The objective of this section is to introduce the key features of the packet data convergence protocol. Key point of this section is that encryption and PDCP for the control plane are the functions which have been added to the PDCP compared to UMTS.
4.3.1.1 RoHC Dependent on the used packet data protocol different schemes will be deployed. 4.3.1.2 Numbering of PDCP PDUs The numbering of the PDCP PDUs is very important because during the handover it is the PDCP which will forward the data in the buffer to the target eNB. 4.3.1.3 In-sequence delivery of PDUs Once the data is forwarded during handover it can happen that data is coming in already in the target eNB and there might still come some data in form the source eNB. The data is then not in sequence and there might be some duplicates in the buffer of the PDCP. 4.3.1.4 Duplicate deletion See above.
- 252 -
4.3.1.5 Encryption The encryption algorithms have been located in the MAC and in the RLC for UMTS and HSPA operation. In LTE they are transferred to the PDCP. This is due to the fact that every eNB is equipped with its own keys and that the PDCP has to combine the packets coming in from the other eNBs during handover. 4.3.1.6 Integrity Protection This is a feature only valid for the control plane in UTRA this was in the RRC layer. This involves to calculate the MAC according the same principle but possibly with a different algorithm. [3GTR 25.813 (5.3.3), 3GTS 36.300 (6.3), 3GTS 36.323 (4.4)]
Room for your Notes

3GTR 3GTS HSPA LTE MAC 3rd Generation Technical Report 3rd Generation Technical Specification RLC RRC Radio Link Control Radio Resource Control Robust Header Compression Universal Mobile Telecommunication System UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Enhanced Node B
High Speed Packet Access (operation RoHC of HSDPA and HSUPA) Long Term Evolution (of UMTS) Message Authentication Code UMTS UTRA
PDCP PDU
Packet Data Convergence Protocol Protocol Data Unit or Packet Data Unit
eNB
- 253 -
4.3.2 Structure of PDCP PDU
The objective of this section is to provide the structure of the PDCP PDU. Key point of this section is that the LTE PDCP PDU can also carry control plane information.
Image description This picture is visualizing the structure of the header and the sequence of SDUs in the PDCP PDU. In contrast to UMTS the PDCP is also existing in the control plane. Consequently also for control plane the PDCP PDU has to be defined. For both control plane and user plane the PDCP PDU is exhibiting a SN (Sequence Number) and an SDU field. For the user plane there can be optionally a RoHC (Robust Header Compression) which is compressing the e.g. 40 byte header to a 2-3 byte compressed header. In order to control RoHC in the user plane, user plane PDCP PDU contain a D/C field indicating control or data. For the control plane for integrity protection purposes the MAC field might be added at the end. The MAC field is calculated according to similar guidelines as the MAC in UMTS.
- 254 -

[3GTS 36.323 (6)]
Room for your Notes

3GTS LTE MAC PDCP PDU 3rd Generation Technical Specification Long Term Evolution (of UMTS) Message Authentication Code Packet Data Convergence Protocol Protocol Data Unit or Packet Data Unit RoHC SDU SN UMTS Robust Header Compression Service Data Unit (the payload of a PDU) Sequence Number Universal Mobile Telecommunication System
- 255 -
4.3.3 PDCP Configuration 4.3.3.1 PDCP Configuration in the Standard
The objective of this section is to give an overview about the IE's relating to the PDCP configuration. Key point of this section is there is no default configuration for PDCP.
- 256 -

AM IE PDCP RLC Acknowledged Mode operation Information Element Packet Data Convergence Protocol Radio Link Control RoHC SN UM Robust Header Compression Sequence Number Unacknowledged Mode operation
- 257 -
4.4 How a TCP/IP MTU is reaching the UE / the Internet
The objective of this section is to show the stations and the transformations of a TCP/IP MTU in the LTE network until it reaches the UE. Key point of this section is that with respect to the very high data rate for LTE and the protocol development from the scratch there are a few differences to HSPA.
Image description The picture is showing the CDD case: two transmission antennas are received by one receive antenna. It is shown how the UE can resolve the two signals.
4.4.1 TCP/IP layer A TCP/IP MTU can have up to 1500 byte including 40 byte header. 4.4.2 PDCP layer In the PDCP first RoHC can be applied this would reduce 40 byte TCP/IP header to typically 3 byte header. In the user plane PDCP needs 2 byte own header. 4.4.3 RLC layer According to the transport block size the RLC can assume variable RLC PDU size. Either the TB is so small that the PDCP PDU needs to be segmented or it is that big that multiple PDCP PDUs fir in. For the RLC header it can be configured to have 1 or 2 byte in UM. - 258 INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited and will be prosecuted to the full extent of German and international laws. Version Number 1.200

For AM and 1 RLC SDU the header size is 2 byte in case of no segmentation and 4 byte in case of segmentation. For RLC AM each additional RLC SDU will add 1.5 byte header. In case a byte header is not filled completely 4 bit header padding has to be added. Flexible RLC PDUs and multiple RLC SDUs are new to LTE and are not used in UMTS RLC until. R7 4.4.4 MAC layer In case the MAC is transporting only 1 MAC SDU the header length will be 1 byte only in case more MAC SDUs are transmitted the header will increase by 2-3 byte. Please also take into account that padding and MAC Control Elements will be unavoidable. The use of MAC control elements is new in LTE. 4.4.5 PHY layer The physical layer has to deal with very huge TBs. TBs of 150000 bit cannot be protected with a single CRC check any more. This is why there is a own 3 byte CRC foreseen for every of the up to 6144 bit long Code Block Segments.
Room for your Notes

AM CDD CRC HSPA LTE MAC MTU PDCP PDU Acknowledged Mode operation Cyclic Delay Diversity Cyclic Redundancy Check PHY RLC RoHC Physical Layer Radio Link Control Robust Header Compression Service Data Unit (the payload of a PDU) Transport Block Transmission Control Protocol over IP User Equipment Unacknowledged Mode operation Universal Mobile Telecommunication System
High Speed Packet Access (operation SDU of HSDPA and HSUPA) Long Term Evolution (of UMTS) Medium Access Control Maximum Transmit Unit (IP) Packet Data Convergence Protocol TB TCP/IP UE UM
Protocol Data Unit or Packet Data Unit UMTS
- 259 -
- 260 -
X2- and S1-Interfaces: X2AP- and S1-AP-Protocols
Chapter 5:
Objectives
Some of your questions that will be answered during this session What are the tasks and functions of S1-AP and X2AP? How are handover procedures performed over the X2- and the S1-interface?
- 261 -
5.1 The X2AP Protocol

5.1.1 Protocol Stack on the X2-interface
The objective of this section is to illustrate the protocol stack of the control and user plane on the X2-interface. The X2-interface is an open interface which is not vendor-specific, because otherwise only S1-based handover is possible.
The illustrated X2AP-protocol is specific to the X2-interface and has been specified in the recommendation 3GTS 36.423. [3GTS 36.422, 3GTS 36.424]
- 262 -

L2 Layer 2 (data link layer)
E-UTRAN Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network eNB GTP GTP-U Enhanced Node B GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane
SCTP UDP UTRAN
Stream Control Transmission Protocol (RFC 2960) User Datagram Protocol (RFC 768) UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network X2-interface Application Part protocol (3GTS 36.423) X2-interface Application Part protocol (3GTS 36.423)
IP L1
Internet Protocol (RFC 791) Layer 1 (physical layer)
X2-AP X2AP
- 263 -
5.1.2 Tasks & Functions
The objective of this section is to depict the tasks and functions of the X2APprotocol.
[3GTS 36.423] 5.1.2.1 Mobility Management 5.1.2.2 Load Management 5.1.2.3 X2-Interface Management
- 264 -

3rd Generation Technical Specification Enhanced Node B Sequence Number SN UE X2AP Symbol Number or SNDCP User Equipment X2-interface Application Part protocol (3GTS 36.423)
3GTS eNB SN
- 265 -
5.1.3 X2-based Handover Scenario
The objective of this section is to illustrate the operation of an X2-based handover scenario [3GTS 23.401 (5.5.1.1.2)].
5.1.3.1 Initial Conditions The UE has setup an RRC-connection with the eNodeB and the eNodeB has setup an S1-connection towards an MME. E-RAB's may be setup and are relayed by the eNodeB towards the S-GW. The "former" eNodeB determines at this time (e.g. after receiving a measurement report from the UE) that a handover to the "new" eNodeB is necessary. The "new" eNodeB has an X2-connection to the former eNodeB and therefore, an X2-based handover becomes possible. Question No 24: Please fill In the missing interface names.
to be continued on the next page
- 266 -

Gateway Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Radio Access Bearer RRC S-GW UE Radio Resource Control Serving Gateway (3GTS 23.401) User Equipment
GW MME RAB
- 267 -
5.1.3.2 Detailed Description To initiate the X2-based handover, the former eNodeB will send an X2AP: HND_REQ-message towards the new eNodeB. The new eNodeB will build the related handover command message (which is actually an RRC: RRC_CONN_RECONF-message) and will relay it to the former eNodeB embedded in an X2AP: HND_REQ_ACK-message. This message also contains the GTP-U TEID that the new eNodeB opened so that the former eNodeB can relay still incoming DL-data to the new eNodeB. The former eNodeB will extract the RRC: RRC_CONN_RECONF-message and will transmit it to the UE. The UE will react upon the received reconfiguration information and switch to the new serving cell. The UE shall perform a random access procedure in the new cell. Finally, the UE shall transmit a handover confirmation message to the new eNodeB which is actually an RRC: RRC_CONN_RECONF_CMP-message. All UL-data is now received by the new eNodeB but must be buffered because the new eNodeB does not yet possess the GTP-U TEID for uplink data of the SGW. Having received this confirmation from the UE, the new eNodeB will ask the MME for a switch of the downlink GTP-U tunnel from the S-GW to the new eNodeB. Accordingly, the new eNodeB will send an S1-AP: PATH_SWITCH_REQmessage to the MME. The MME will send a GTP: UPD_UP_REQ-message to the S-GW which most importantly contains the new eNodeB's GTP-U downlink TEID. The S-GW will update its downlink GTP-U tunnel accordingly and will stop transmitting data to the former eNodeB. It will confirm the switch by sending a GTP: UPD_UP_RSP-message to the MME. The MME will confirm the path switch by sending S1-AP: PATH_SWITCH_REQ_ACK-message to the new eNodeB. Finally, the data link has been entirely switched to the new eNodeB and therefore, the new eNodeB can instruct the former eNodeB to release the existing resources by sending an X2AP: UE_RES_REL-message. This procedure is a class 2procedure and is not responded by the former eNodeB.
- 268 -

Downlink GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Radio Resource Control S-GW S1-AP TEID UL X2AP Serving Gateway (3GTS 23.401) S1 Application Part Tunnel Endpoint Identifier (GTP / 3GTS 29.060) Uplink X2-interface Application Part protocol (3GTS 36.423)
DL GTP GTP-U MME RRC
- 269 -
5.2 The S1-AP Protocol

5.2.1 Overview & Introduction
The objective of this section is to introduce the students into the most important aspects of the S1-AP protocol which is used between the MME and the eNodeB.
[3GTS 36.413]
- 270 -

Abstract Syntax Notation 1 (ITU-T X.680 / X.681) Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) NodeB Application Part (3GTS 25.433) RNSAP S1-AP UE Radio Network Subsystem Application Part (3GTS 25.423) S1 Application Part User Equipment Universal Mobile Telecommunication System
ASN.1 MME NBAP PER
Packed Encoding Rules (ITU-T X.691) UMTS
- 271 -
5.2.2 S1-based Handover Scenario
The objective of this section is to illustrate the operation of an S1-based handover scenario [3GTS 23.401 (5.5.1.2)].
5.2.2.1 Initial Conditions The UE has setup an RRC-connection with the eNodeB and the eNodeB has setup an S1-connection towards an MME. E-RAB's may be setup and are relayed by the eNodeB towards the former S-GW. The "former" eNodeB determines at this time (e.g. after receiving a measurement report from the UE) that a handover to another" eNodeB is necessary to which an X2-based handover is impossible. Question No 25: Please fill In the missing interface names. to be continued on the next page
- 272 -

3rd Generation Technical Specification Gateway Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Radio Access Bearer RAB RRC S-GW UE Random Access uplink Burst Radio Resource Control Serving Gateway (3GTS 23.401) User Equipment
3GTS GW MME RAB
- 273 -
5.2.2.2 Detailed Description Having received the S1-AP: HND_RQD-message, the former MME needs to determine and select the target MME. The S1-AP: HND_REQ-message [3GTS 36.413 (9.1.5.4)] contains also the GTPU TEID that the target S-GW allocated to receive uplink data from the target eNodeB. The GTP: Create-Indirect-Data-Forwarding-Tunnel-Request-message [3GTS 29.274 (7.2.18)] does not only convey all necessary information to setup a tunnel between target and source S-GW. This message also contains the TEID that the target eNodeB allocated before and this is needed by the target S-GW to forward DL-data to the target eNodeB. The availability of the related TEID's at the target S-GW and at the target eNodeB enables the new data link in uplink and downlink direction. The indirect data forwarding tunnel is necessary to relay PDCP-PDU's between the two S-GW's during the transient time when data is received and transmitted over both eNodeB's.
[3GTS 23.401 (5.5.1.2)]
- 274 -

Downlink GPRS Tunneling Protocol (3GTS 29.060) GTP User Plane Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Convergence Protocol PDU S-GW S1-AP TEID Protocol Data Unit or Packet Data Unit Serving Gateway (3GTS 23.401) S1 Application Part Tunnel Endpoint Identifier (GTP / 3GTS 29.060)
DL GTP GTP-U MME PDCP
- 275 -
5.2.2 S1-based Handover Scenario (continued)
The objective of this section is to continue and conclude the operation of an S1-based handover scenario [3GTS 23.401 (5.5.1.2)].
5.2.2.2 Detailed Description The former MME (source) will finally relay the RRC: RRC_CONN_RECONFmessage to the former eNodeB which will send it to the UE. The UE connects to the new cell and the new eNodeB notifies the new MME about the successful handover (S1-AP: HND_NOTIFY [3GTS 36.413 (9.1.5.7)]. Note that at this time, there is new e2e data path through both S-GW's. Finally, the new S-GW updates the P-GW about the S-GW relocation and the PGW will update its data tunnels accordingly. After the handover, the UE must trigger a tracking area update procedure, if the new eNodeB belongs to a new tracking area for which the UE holds no TAI.
[3GTS 23.401 (5.5.1.2)]
- 276 -

3rd Generation Technical Specification End-to-End Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) Packet Data Network Gateway (part of EPC) Radio Resource Control S-GW S1-AP TAI UE Serving Gateway (3GTS 23.401) S1 Application Part Tracking Area Identity (3GTS 24.301) User Equipment
3GTS e2e MME P-GW RRC
- 277 -
- 278 -
Solutions
Solutions
Q&A-Sessions: Answer for Question No 1: In case of roaming and particularly when using local breakout the different types of traffic may use different ways. Therefore, it is desirable to be able to perform legal interception at the access router (e.g. S-GW) and at the edge router (PDNGW). Answer for Question No 2: Security is introduced on two different layers (<=> PDCP and NAS) to make sure that NAS-messages are already integrity protected and possibly ciphered, if security has not yet been enabled on PDCP-layer. This condition applies in particular when the UE transmits EMM: ATT_REQ- or TA_UPD_REQ-messages. Another reason is to protect at least the NAS-messaging even if home base stations with or w/o security capabilities are used. Answer for Question No 3: The complete sequence of input parameters is depicted underneath.
- 279 -
Answer for Question No 4:
- 280 -
Solutions
Answer for Question No 5: The missing interface names are (from left to right): LTE-Uu, S1-MME, S6a Answer for Question No 6: The missing interface names are (from left to right): LTE-Uu, S1-MME, S11, S5 or S8 (depending on whether the PDN-GW is part of the current PLMN or not). Answer for Question No 7: The complete EMM: ATT_REQ-message is illustrated underneath:
Answer for Question No 8: The missing interface names are (from left to right): LTE-Uu, S1-MME, S10 Answer for Question No 9: The missing interface names are (from left to right): S11, S5 or S8 (depending on whether the PDN-GW is part of the current PLMN or not), S6a, S6a. Answer for Question No 10: The missing interface names are (from left to right): LTE-Uu, S1-MME, S11, S11 Answer for Question No 11: The ATT_REQ-message starts within the hex string and consists of the sequence 07: plain NAS-message (no security header type) / protocol discriminator 7 = EMM 41: message type of ATT_REQ 41: NAS key set identifier (4) / EPS attach type (1) => EPS only attach 0C: length of mobile identity => 12(dec) not including the length indicator itself 23: ??? / no correct decoding possible, type of identity should be 001(bin) or 110(bin) but not 011(bin).
- 281 -

F0 27 20 01 C1 05 F0 00 00 00 02: remaining identity digits (according to length indication). 03 20 23 F0 27 20 01 C1 42 02 00 00 2B 06 00: further content octets Answer for Question No 12: The missing interface names are (from left to right): S5, SGi, Rx (between IMS and PCRF), Gx (between PCRF and P-GW) Answer for Question No 13: The missing interface names are (from left to right): S11, S5, Rx (between IMS and PCRF), Gx (between PCRF and P-GW), S5 (between S-GW and P-GW) and S1-U (between eNodeB and S-GW). Answer for Question No 14: The bearers are the already existing EPS-bearer and the new real-time EPSbearer for the voice call data.
- 282 -
Solutions
Answer for Question No 15: The figure underneath illustrates the complete mapping:
- 283 -
Answer for Question No 17: No because there are only PS services no paging type 1 or paging type 2 messages are received during RRC_RONNECTED mode. Still the paging channel has to be listened to.
- 284 -
Solutions
- 285 -
Answer for Question No 20: The number of prefix bits depends on the number of options. In the described case, the number of options is 68 5 +1 = 64 options. Accordingly, a number of 6 bits is required in front of the information to indicate the number of digits. Examples: 000000 digit-1 digit-2 digit-3 digit-5 <=> in case of a length of 5 digits ... 000101 digit-1 digit-2 digit-3 digit-10 <=> in case of a length of 10 digits ... 111111 digit-1 digit-2 digit-3 digit-68 <=> in case of a length of 68 digits Answer for Question No 21: The complete RRC Connection Establishment Request-Message is illustrated underneath:
- 286 -
Solutions
Answer for Question No 22: The complete RRC Connection Establishment Procedure on MAC level is illustrated underneath:
- 287 -
Answer for Question No 23: The complete RRC Connection Establishment Request-Message is illustrated underneath:
Answer for Question No 24: The missing interface names are (from left to right): X2, S1-MME, S11 Answer for Question No 25: The missing interface names are (from left to right) Top-line: S1-MME, S11, S5/S8; Middle line: S1-MME, S11, S5/S8; Bottom-line: S10
- 288 -
Solutions
Intentionally left blank
- 289 -
- 290 -
Solutions
- 291 -
- 292 -
List of Acronyms
List of Acronyms
Term (V)ASSI 16-APK 16-PPM 16-QAM 16VSB 1xCS IWS 1xCSIWS 1xEV-DO 1xEV-DV 2-GFSK 2B1Q 3G 3GPP Explanation Visited Alias Short Subscriber Identity 16 symbols Amplitude Phase Keying 16 position Pulse Position Modulation 16 symbols Quadrature Amplitude Modulation 16-level vestigial sideband modulation Circuit Switched Fallback Interworking solution Function for 3GPP2 1xCS (3GTS 23.272) 1x Circuit-Switched Interworking Solution Function (3GTS 29.277) One Carrier (1.25 MHz) Evolution - Data Only (cdma2000) One Carrier (1.25 MHz) Evolution - Data and Voice 2 symbols Gaussian Frequency Shift Key or Keying Two Binary One Quaternary (Line Coding used on the ISDN UInterface) 3rd Generation ... Third Generation Partnership Project (Collaboration between different standardization organizations (e.g. ARIB, ETSI) to define advanced mobile communications standards, responsible for UMTS) Third Generation Partnership Project 2 (similar to 3GPP, but consisting of ANSI, TIA and EIA-41, responsible for cdma2000, EvDO and EVDV) 3rd Generation Technical Report 3rd Generation Technical Specification 4 symbols Gaussian Frequency Shift Key or Keying 4 symbols Pulse Amplitude Modulation 4 position Pulse Position Modulation 4th Generation ... 64 symbols Quadrature Amplitude Modulation 8 Symbol Phase Shift Keying 8-level Vestigial Sideband Modulation (ATSC) Acknowledgement Request Bit (used in LLC-protocol Logical Link Control) Audio / Video Applications & Services domain or server Anonymous Access
3GPP2
3GTR 3GTS 4-GFSK 4-PAM 4-PPM 4G 64-QAM 8-PSK 8VSB A-Bit A/V A&S AA
- 293 -

AAA AAA AACH AACH-Q AAD AAL AAL-2 AAL-5 AAR AAS ABM ABNF AC AC ACC ACCH ACELP ACK ACM ACS ADCH ADDBA ADDTS ADM ADPCM ADSL2 AES AESA AF AFC AFH AG AGA AGC Authorize Authenticate Answer (DIAMETER message type) Authentication, Authorization and Accounting Access Assignment CHannel Access Assignment CHannel, QAM Additional Authentication Data ATM-Adaption Layer ATM Adaptation Layer 2 (for real-time services) (ITU-T I.363.2) ATM-Adaptation Layer 5 (non-real time) (ITU-T I.363.5) Authorize Authenticate Request (DIAMETER message type) Adaptive Antenna Systems Asynchronous Balanced Mode Augmented Backus Naur Form (RFC 2234) Alternate Current Access Class Access Control Class (3GTS 22.011) Associated Control Channel (GSM / can be an SACCH or an FACCH) Algebraic Codebook Excited Linear Prediction Acknowledgement Address Complete Message (ISUP-message type) Active Codec Set Associated Dedicated Channel (3GTS 45.902) Add Block Acknowledgment Add Traffic Stream Asynchronous Disconnected Mode Adaptive Differential Pulse Code Modulation Asynchronous Digital Subscriber Line 2 (ITU-T G.992.3) Advanced Encryption Standard / Cipher Key Lengths: 128 bit, 192 bit or 256 bit ATM End System Address Assured Forwarding (DiffServ Term) Automatic Frequency Control Adaptive Frequency Hopping Absolute Grant (3GTS 25.309) Air - Ground - Air service Automatic Frequency Control
- 294 -
List of Acronyms
AGCH AGS AGV AH AI AI AICH AID AIFS AIFSN AIPN AJAX AK AK AKA AKD AL AL ALC ALCAP ALG AM AM AMBR AMC AMD AMF AMI AMPS AMR AMR_HR AMR-WB AMR-WB+ ANDSF Access Grant Channel (GSM) Absolute Grant Scope ('All' or 'Single' HARQ process) Absolute Grant Value (INACTIVE or Zero_Grant or EDPDCH/DPCCH power ratio) Authentication Header (RFC 4302) Air Interface Acquisition Indicator Acquisition Indicator Channel (UMTS Physical Channel) Association Identifier Arbitration InterFrame Space Arbitration InterFrame Space Number All IP Network Asynchronous Javascript and XML Authentication Key (IEEE 802.16) Anonymity Key (3GTS 33.102) Authentication and key agreement (3GTS 33.102) Authentication Key Distribution Ambience Listening Advanced Link Asynchronous Layered Coding Access Link Control Application Part (ITU-T Q.2630.1 / Q.2630.2) Application Layer Gateway Amplitude Modulation Acknowledged Mode operation Aggregated Maximum Bit Rate Adaptive Modulation and Coding Acknowledged Mode Data (UMTS RLC PDU-type) Authentication management field (3GTS 33.102) Alternate Mark Inversion (Line Coding) Advanced Mobile Phone System Adaptive Multirate Encoding (3GTS 26.090) Adaptive Multi Rate with Half-Rate Codec Adaptive Multi-Rate - WideBand speech codec (3GTS 26.273, ITU-T G.722.2) Extended Adaptive Multi-Rate - WideBand speech codec (3GTS 26.304, 26.410, ITU-T G.722.1) Access Network Discovery and Selection Function (3GTS
- 295 -

24.302) ANSI AoD AP AP AP-AICH APCO API API APK APN APP AR ARFCN ARIB ARP ARP ARPU ARQ AS AS AS AS-ILCM AS-OLCM ASC ASCA ASCI ASCII ASIC ASME ASN ASN-GW ASN.1 ASP American National Standards Institute Audio on Demand Access Preamble Access Point (IEEE 802.11, 802.16) CPCH Access Preamble Acquisition Indicator Channel (UMTS Physical Channel) Association of Police Communications Officers Application Programming Interface Access Preamble Acquisition Indicator Amplitude Phase Keying Access Point Name (Reference to a GGSN) A Posteriori Probability (Turbo Decoding) Assured Rate PDB (DiffServ Term) Absolute Radio Frequency Channel Number Association of Radio Industries and Businesses (Japanese) Allocation and Retention Priority Address Resolution Protocol (RFC 826) Average Revenue Per User Automatic Repeat Request application specific (within SDP-bandwidth specification / bline) Application Server Access Stratum (UMTS) Application Server - Incoming Leg Control Model Application Server - Outgoing Leg Control Model Access Service Class Adjacent Subcarrier Allocation Advanced Speech Call Items (GSM-R) American Standard Code for Information Interchange (ANSI X3.4-1986) Application Specific Integrated Circuit Access Security Management Entity Access Service Network Access Service Network-Gateway Abstract Syntax Notation 1 (ITU-T X.680 / X.681) Application Server Process
- 296 -
List of Acronyms
ASSI AT_MAC AT-Command ATCA ATID ATIM ATIS ATM ATSC ATSI AuC AUTN AV AVC AVL AVP AWGN B2BUA B2DA B8ZS BA BAR BAS BAT BB BBERF BBK BC BCAST BCC BCC BCC BCCH BCCH-Q BCD Alias Short Subscriber Identity Message Authentication Code Attention-Command Advanced Telecommunications Computing Architecture Address Type Identifier in Demand Announcement Traffic Indication Message Alliance of Telecommunications Industry Solutions Asynchronous Transfer Mode (ITU-T I.361) Advanced Television System Committee Alias TETRA Subscriber Identity Authentication Center Authentication Token (3GTS 33.102) Authentication Vector (3GTS 33.102) Advanced Video Coding Automatic Vehicle Location Attribute Value Pair (DIAMETER-term / RFC 3588) Additive White Gaussian Noise Back-to-Back User Agent (SIP term / RFC 3261, RFC 3725) Back-to-Back Dynamic Allocation Bipolar with Eight-Zero Substitution (Line Code used at the T1-Rate (1.544 Mbit/s)) Block Ack Block Ack Request Basic rate access ISDN-user interface for single lines (2 Bchannels plus one D-Channel with 16 kbit/s) Bouquet Association Table (MPEG, DVB-SI) Base Band module Bearer Binding and Event Reporting Function (3GTS 23.203) Broadcast BlocK Broadcast Broadcast Broadcast Call Control (3GTS 44.069) Binary Convolutional Coding Base Station Color Code Broadcast Control Channel Broadcast Control CHannel, QAM Binary Coded Decimal
- 297 -

BCH BCMCS BCTP BE BEC BEG BER BFCP BFI BG BGCF BGP BIB BIC BICC BK BKN1 BKN2 BL BLCH BLER BM-IWF BM-SC BMC BN BNCH BNCH-Q BNF BPSC BPSK BQA BQB BQRB BQTF BR BRA Broadcast Channel Broadcast and Multicast Services (CDMA-2000 Rev. D) Bearer Control Tunneling Protocol (ITU-T Q.1990) Best Effort Backward Error Correction BEGin Message (TCAP) Bit Error Rate Binary Floor Control Protocol (draft-ietf-xcon-bfcp-05) Bad Frame Indication Border Gateway Breakout Gateway Control Function Border Gateway Protocol Backward Indicator Bit Blind Interference Cancellation Bearer Independent Call Control (ITU-T Q.1902.1 - Q.1902.6) Background Block Number 1 Block Number 2 Basic Link Base station Linearization CHannel Block Error Rate Broadcast Multicast Interworking Function Broadcast Multicast Service Center (3GTS 23.346) Broadcast / Multicast Control (3GTS 25.324) Bit Number Broadcast Network CHannel Broadcast Network CHannel, QAM Backus Naur Form (RFC 2234) Bits per Sub Carrier Binary or Bipolar Phase Shift Keying Bluetooth Qualification Administer Bluetooth Qualification Body Bluetooth Qualification Review Board Bluetooth Qualification Test Facility Bandwidth Request (WiMAX Term) Bit Rate Adaptation
- 298 -
List of Acronyms
BRAN BS BS_CV_MAX BS_EIRP BSC BSCH BSD BSIC BSN BSS BSS BSSAP BSSAP-LE BSSGP BSSID BSSMAP BTAB BTC BTS BTTI BU BVCI BW C-RNTI C-SAP C/I C/N C/R-Bit C/T-Field CAI CAMEL CAN CAP CAP Broadband Radio Access Network Base Station (IEEE 802.16) Maximum Countdown Value to be used by the mobile station (Countdown Procedure) Base Station Effective Isotropic Radiated Power Base Station Controller Broadcast Synchronization CHannel Berkeley Software Distribution Base Station Identity Code Block Sequence Number (RLC) / Backward Sequence Number (SS7) Basic Service Set Base Station Subsystem Base Station Subsystem Application Part Base Station System Application Part - Location Based Services Extension Base Station System GPRS Protocol Basic Service Set Identification Base Station Subsystem Mobile Application Part (3GTS 48.008) Bluetooth Technical Advisory Board Block Turbo Coding Base Transceiver Station Basic Transmission Time Interval Bad Urban BSSGP Virtual Connection Identifier Bandwidth Cell Radio Network Temporary Identifier Control Service Access Point Carrier-to-Interference Ratio (like SNR) Carrier/Noise power ratio Command / Response Bit logical Channel / Transport channel identification Field Channel Assignment Indicator Customized Applications for Mobile network Enhanced Logic Connectivity Access Network Controlled Access Phase CAMEL Application Part (CCS7)
- 299 -

CAPEX CAT CATV CAZAC CB CBC CBC CBC CBCH CBMS CBPS CC CC CCC CCCH CCF CCH CCH-Q CCIR601 CCITT Capital Expenditure Conditional Access Table (MPEG2-TS PSI) Cable TV Constant Amplitude Zero Autocorrelation Code Control uplink Burst Committed Burst Size Cipher Block Chaining (DES-Operation Mode) Cell Broadcast Center Cell Broadcast Channel (GSM) Convergence of Broadcast and Mobile Services Coded Bits per OFDM Symbol Convolutional Coding Call Control CPCH Control Command Common Control Channel Charging Collection Function Control Channel Control CHannel, QAM Comit consultatif international pour la radio, a forerunner of the ITU-R, specification 601 Comitonsultatif International Tgraphique et Tphonique (International Telegraph and Telephone Consultative Committee) Complementary Code Keying Common Cipher Key Common Channel Management (Protocol Part on the GSM Abis-Interface / 3GTS 48.058) CTR with CBC-MAC Counter with CBC-MAC (RFC 3610) Combined Authentication and Encryption with AES-Algorithm CTR with CBC-MAC Protocol Cell Change Notification (related to Network Assisted Cell Change / 3GTS 44.060) Collocated Care-of-Address Common Control Physical Channel (see also P-CCPCH and SCCPCH) Common Channel Signaling System No. 7 (ITU-T Q-series of specifications, in particular Q.700 - Q.703) Coded Composite Transport Channel (UMTS)
CCK CCK CCM CCM CCM-Mode CCMP CCN CCoA CCPCH CCS7 CCTrCH
- 300 -
List of Acronyms
CCU CD CD/CA-ICH CDCH CDD CDI CDMA CDMA2000 CDR CELL_DCH CELL_FACH CELL_PCH CEO CEPT CESoP CF CFI CFN CFP CG CGF CGI CHAP CI CIC CIC CID CID CIDR CIF CINR CIO CIP CIR CIR Channel Codec Unit Compact Disc Collision Detection / Channel Assignment Indicator Channel (UMTS Physical Channel) Control-plane Dedicated Channel (3GTS 45.902) Cyclic Delay Diversity Collision Detection Indicator Code Division Multiple Access The 3G Standard 3GPP2 Call Detail Record RRC Dedicated State RRC FACH State in UTRA RRC PCH State in UTRA Chief Executive Officer Confrence Europne des Postes et Tcommunications Circuit Emulation Services over Packet Contention Free Control Format Indicator Connection Frame Number Contention Free Period Charging Gateway Charging Gateway Function Cell Global Identification Challenge Handshake Authentication Protocol (RFC 1334) Cell Identity Circuit Identity Code (ISUP) Call Instance Code (BICC) Connection Identifier (WiMAX) Channel Identity (ATM) Classless Inter-Domain Routing (RFC 1519) Common Intermediate Format (352 x 240 pixels / ITU-T H261 / H263) Carrier to Interference and Noise Ratio Cell Individual Offset (3GTS 25.331) Common Indexing Protocol Committed Information Rate Channel Impulse Response
- 301 -

CIR CK CKSN CL CLCH CLCH-Q CMC CMC CMCE CmCH-PI CMD CMI CMIP CMIS/P CMR CMTS CN CNM CNMI CNR CoA COA CODEC COFDM COMSEC CON CONS COO COPS CORBA CoU CP CP CP CPC CPCH Carrier-to-Interference Ratio Ciphering Key (3GTS 33.102) Ciphering Key Sequence Number Controlled Load Common Linearization CHannel Common Linearization CHannel, QAM Connection Mobility Control Codec Mode Command Circuit Mode Control Entity Common Channel Priority Indicator Circuit Mode Data Codec Mode Indication Client Mobile IP Common Management Information System/Protocol Codec Mode Request Cable Modem Termination System Core Network Central Network Management Central Network Management Interface Carrier to Noise Ratio Care of Address (MIP) Change Over Acknowledge message (CCS7) Coder-decoder Coded Orthogonal Frequency Division Multiplexing Communications Security CONtinue Message (TCAP) Connection Orientated Network Service Change Over Order message (CCS7) Common Open Policy Service Protocol (RFC 2748) Common Object Request Broker Class of Usage Cyclic Prefix Control Physical channel Contention Period Continuous Packet Connectivity Common Packet Channel (UMTS Transport Channel) FDD only
- 302 -
List of Acronyms
CPCS CPE CPICH CPICH_Ec/No CPIM CPS CPS CPTI CPU CQI CQICH CRC CRC_HS CRF CRNC CRSC CS CS CS CS CS-X CSCF CSD CSG CSI CSICH CSMA-CA CSN CSN.1 CSPDN CSRC CSS CT CTC CTCH Common Part Convergence Sublayer Customer Premises Equipment Common Pilot Channel (UMTS Physical Channel / see also PCPICH and S-CPICH) Common Pilot Channel Energy per Chip to Noise Radio Common Presence and Instant Messaging (RFC 3862) Common Part Sublayer Coding and Puncturing Scheme Calling Party Type Identifier Central Processing Unit Channel Quality Indicator Channel Quality Indicator Channel Cyclic Redundancy Check CRC of High Speed Channel (HS-DSCH) Charging Rules Function Controlling RNC Contributing Source Convergence Sublayer Coding Scheme Class Selector (DiffServ Term / RFC 2474) Circuit Switched Coding Scheme (1 - 4) Call Session Control Function (SIP) Circuit Switched Data Closed Subscriber Group Channel State Information CPCH Status Indicator Channel (UMTS Physical Channel) Carrier-Sense Multiple Access - Collision Avoidance Connectivity Service Network Code Syntax Notation 1 (3GTS 24.007) Circuit Switched Public Data Network Synchronisation Source (RTP) Carrier Specific Signalling Core Network and Terminal (Technical Specification Group within 3GPP) Convolutional Turbo Coding Common Traffic Channel (Logical) PTM
- 303 -

CTFC CTIA CTR CTS CUB CV CV CVO CW CW cwnd D-CT D-CTT D-MCCTT D-TxAA DA DAB DARP DAS-X DASS DBC dBm Calculated Transport Format Combination (3GTS 25.331) Cellular Telephone Industries Association Counter Mode Clear To Send Control Uplink Burst Countdown Value Constellation Version Clear Voice Override Contention Window Code Word Congestion window Downlink-Continuous Transmission Downlink-Carrier Timesharing Transmission Downlink - Main Control Channel Timesharing Transmission Double Transmit Antenna Array Destination Address Digital Audio Broadcasting Downlink Advanced Receiver Performance (3GTS 45.015, 3GTS 24.008) egprs2 Downlink level A modulation and coding Scheme (x = 5..12) Digital Access Signaling System Dynamic Bearer Control The unit dBm measures a power. The conversion of a power value from Watt [W] to dBm is done in the following way:X [dBm] = 10 x log10(X [W] / 0.001 [W]) Diameter Base Protocol (RFC 3588) Data Bits per OFDM Symbol Dedicated Basic Physical SubCHannel Differential Binary or Bipolar Phase Shift Keying egprs2 Downlink level B modulation and coding Scheme (x = 5..12) Direct Current Distributed Channel Access Dedicated Control Channel Downlink Channel Descriptor (WiMAX Message) Distributed Coordination Function DRM Content Format
DBP DBPS DBPSCH DBPSK DBS-X DC DCA DCCH DCD DCF DCF
- 304 -
List of Acronyms
DCH DCI DCK DCLA DCM DCOMP DCS DDDS DDI DEC DELBA DELTS DEMUX DES DF DF DFS DFT DGNA DHCP DHCPv4 DHCPv6 DIA DIAMETER DIFS Digit DIUC DL DL-MAP DL-SCH DLCI DLFP DLL DLR DLS Dedicated Channel (Transport) Downlink Control Indicator Derived Cipher Key DC Level Adjustment Dedicated Channel Management (Protocol Part on the GSM Abis-Interface / 3GTS 48.058) Data COMpression Protocol Digital Communication System Dynamic Delegation Discovery System (RFC 3401 - RFC 3404) Data Description Indicator (3GTS 25.309, 25.331, 25.321) Decision (COPS message type) Delete Block Acknowledgment Delete Traffic Stream De-Multiplexer Data Encryption Standard Do not Fragment (bit in IPv4 header) Default Forwarding (DiffServ Term / RFC 2474) Dynamic Frequency Selection Discrete Fourier Transformation Dynamic Group Number Assignment Dynamic Host Configuration Protocol (RFC 2131) Dynamic Host Configuration Protocol Version 4 (RFC 2131) Dynamic Host Configuration Protocol Version 6 (RFC 3315) Diameter Protocol (RFC 3588, RFC 3589) Successor of the RADIUS protocol Distributed (coordination function) InterFrame Space 4 bit Downlink Interval Usage Code (WiMAX Term) Downlink Downlink-Medium Access Protocol (MAC-Message in WiMAX / IEEE 802.16) Downlink Shared Channel Data Link Connection Identifier Downlink Frame Prefix Data Link Layer Destination Local Reference (SCCP term) Downloadable Sounds
- 305 -

DLS DMA DMB DMO DMR DNS DOCSIS DoS DPC DPCCH DPCH DPDCH DPDCH_P DPNSS DPSK DQPSK DQPSK DR DRA DRB DRM DRNC DRX DS DS-CDMA DSCA DSCH DSCP DSL DSLAM DSM-CC DSMIP DSMIPv6 DSN DSP Direct Link Setup Division Multiple Access Digital Multimedia Broadcasting Direct Mode Operation Digital Mobile Radio Domain Name System Data Over Cable Service Interface Specification (defined by CableLabs) Denial of Service attack Destination Point Code Dedicated Physical Control Channel (UMTS Physical Channel) Dedicated Physical Channel (UMTS / Term to combine DPDCH and DPCCH) Dedicated Physical Data Channel (UMTS Physical Channel) DPDCH_Power or DPDCH_Pwr: Transmit power of DPDCH Digital Private Network Signaling System Differential Phase Shift Keying Differential Quadrature Phase Shift Keying Differential Quadrature Phase Shift Keying Data Rate Dynamic Resource Allocation Data Radio Bearer Digital Rights Management Drift Radio Network Controller Discontinuous Reception Distribution System Direct Sequence Code Division Multiple Access Diversity / Distributed Subcarrier Allocation Downlink Shared Channel (UMTS Transport Channel) Differentiated Services Code Pointer Digital Subscriber Line Digital Subscriber Line Access Multiplexer Digital Storage Media Call Control Dual-Stack (IPv4/v6) Mobile IP Dual Stack Mobile IPv6 Digital Switching Network Digital Signal Processor
- 306 -
List of Acronyms
DSR DSS DSS DSS1 DSSS DT1 DTAP DTCH DTIM DTM DTMB DTMF DTS DTX DUA DVB DVB-C DVB-H DVB-S DVB-T E_UTRA E-AGCH E-DCH E-DCH-FP E-DPCCH E-DPDCH E-GSM E-HICH E-OTD E-RGCH E-RNTI E-TFC E-TFCI Dual Symbol Rate Downlink sync Sequence Set Distribution System Set Digital Subscriber Signaling System No.1 (also referred to as LAPD-signaling / ITU-T Q.931) Direct Sequence Spread Spectrum Data Form 1 (SCCP message type) Direct Transfer Application Part Dedicated Traffic Channel Delivery Traffic Indication Map Dual Transfer Mode [3GTS 43.055] Digital Terrestrial Multimedia Broadcast Dual Tone Multiple Frequency Decode Time Stamp Discontinuous Transmission DPNSS 1 / DASS 2 User Adaptation Layer (RFC 4129) Digital Video Broadcasting Digital Video Broadcasting - Cable TV Digital Video Broadcasting - Handheld Digital Video Broadcasting - Satellite Digital Video Broadcasting - Terrestrial Evolved UMTS Terrestrial Access E-DCH Absolute Grant Channel Enhanced Uplink Dedicated Transport Channel (3GTS 25.211, 25.309) E-DCH Frame Protocol (Enhanced Dedicated Channel) Enhanced Uplink Dedicated Physical Control Channel (3GTS 25.211) Enhanced Uplink Dedicated Physical Data Channel (3GTS 25.211) Extended GSM (GSM 900 in the Extended Band) E-DCH HARQ Acknowledgement Indicator Channel (3GTS 25.211) Enhanced Observed Time Difference E-DCH Relative Grant Channel (3GTS 25.211) E-DCH Radio Network Temporary Identifier (3GTS 25.401) E-DCH Transport Format Combination (3GTS 25.309) E-DCH Transport Format Combination Identifier (Enhanced Dedicated Channel)
- 307 -

E-UTRA E-UTRAN e2e EAP EAP-AKA EAP-FAST EAP-SIM EAP-TLS EAP-TTLS EAPOL eBM-SC Ec/No ECC ECCH ECM ECN ECSD EDCA EDCAF EDGE EDR EE EEA EF EFR EGAN EGPRS EGPRS2 EGPRS2-A EGPRS2-B eHSPA EIA Evolved UMTS Terrestrial Radio Access Evolved UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network End-to-End Extensible Authentication Protocol (RFC 3748) Extensible Authentication Protocol method for 3rd generation Authentication and Key Agreement (RFC 4187) Extensible Authentication Protocol - Flexible Authentication via Secure Tunneling Extensible Authentication Protocol method for gsm Subscriber Identity Module (RFC 4186) Extensible Authentication Protocol - Transport Layer Security (RFC 2716) Extensible Authentication Protocol - Transport Layer Security EAP encapsulation Over Lan or wlan (IEEE 802.1X) Enhanced Broadcast and Multicast Service Center Received energy per chip / power density in the band Electronic Communications Committee Extended Control CHannel EPS Connection Management (3GTS 24.301) Explicit Congestion Notification Enhanced Circuit Switched Data (HSCSD + EDGE) Enhanced Distributed Channel Access Enhanced Distributed Channel Access Function Enhanced Data Rates for Global Evolution Enhanced Data Rate (more speed with Bluetooth 2.0 (2.0 - 3.0 Mbit/s) Excellent Effort EPS Encryption Algorithm (3GTS 33.401) Expedite Forwarding (DiffServ Term) Enhanced Full Rate speech codec Evolved Generic Access Network Enhanced General Packet Radio Service Enhanced GPRS phase 2 [3GTS 43.064] Enhanced GPRS Phase 2 Level A [3GTS 43.064, 3GTS 44.060] Enhanced GPRS Phase 2 Level B [3GTS 43.064, 3GTS 44.060] Evolved HSPA Electronic Industries Alliance (US-organization to support US industry)
- 308 -
List of Acronyms
EIA EIFS EIR EIRENE EIRP EIT eMLPP EMM EMSK EN eNB END ENUM EOSP EPC ePDG EPS EPS-AKA EPT EQ200 ERO ERP ert-PS ertPS ES ES-Id Es/No ESCR ESG ESM ESN ESP ESS Ethernet EPS Integrity Protection Algorithm (3GTS 33.401) Extended InterFrame Space Equipment Identity Register European Integrated Railway Radio Enhanced Network (GSMR) Equivalent Isotropic Radiated Power Event Information Table (MPEG, DVB-SI) enhanced Multi-Level Precedence and Pre-emption (3GTS 23.067) EPS Mobility Management (3GTS 24.301) Extended Master Session Key European Norm Enhanced Node B END Message (TCAP) E.164-telephone number to URI (Uniform Resource Identifier) translation (RFC 3761) End Of Service Period Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards) evolved Packet Data Gateway (3GTS 23.402) Evolved Packet System Evolved Packet System -Authentication and Key Agreement (3GTS 33.401) ETSI Project TETRA Equalizer Test 200 km/h European Radiocommunications Office Extended Rate Physical Layer Extended Real-Time Polling Service (WiMAX Traffic Class) Extended Real-Time Polling Service (IEEE 802.16 Traffic Class) Elementary Stream Encoding Symbol-Id Energy per symbol / Noise power spectral density Elementary Stream Clock Reference Electronic Service Guide EPS Session Management (3GTS 24.301) Electronic Serial Number (North American Market) Encapsulating Security Payload (RFC 4303) Extended Service Set Layer 2 Protocol for IP (IEEE 802.3)
- 309 -

ETS ETSI EUI-64 EUL EV-DO EV-DV EVM F-DPCH F-TEID FA FACCH FACH FANR FBI FBI FBSS FCB FCC FCCH FCH FCS FDD FDDI FDM FDMA FDPS FDT FEC FER FFH FFRS FFS FFT FH FH-CDMA FHSS European Telecommunication Standard European Telecommunications Standard Institute Extended Unique Identifier - 64 bit long (IEEE / the Enhanced Uplink Evolution Data Only or Evolution Data Optimized (cdma2000) Evolution Data/Voice (cdma2000) Error Vector Magnitude Fractional Dedicated Physical Channel (3GTS 25.211) Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274) Foreign Agent (Mobile IP / RFC 3344) Fast Associated Control Channel (GSM) Forward Access Channel (UMTS Transport Channel) Fast Ack/Nack Reporting Final Block Indicator Feedback Information (UMTS) Fast Base Station Switching Frequency Correction downlink burst Federal Communications Commission Frequency Correction Channel (GSM) Frame Control Header Frame Check Sequence (CRC-Check) Frequency Division Duplex Fiber Distributed Data Interconnect (optical Layer 2) Frequency Division Multiplexing Frequency Division Multiple Access Full-slot Downlink Pilots Set File Delivery Table Forward Error Correction Frame Error Rate Fast Frequency Hopping Fractional Frequency Reuse Scheme For Further Study Fast Fourier Transformation Frequency Hopping Frequency Hopping Code Division Multiple Access Frequency Hopping Spread Spectrum
- 310 -
List of Acronyms
FIB FIPS FiSA FiSB FISU FLO FLUTE FM FMC FN FP FPB FQDN Forward Indicator Bit Federal Information Processing Standard Filler Set A Filler Set B Fill In Signal Unit Flexible Layer 1 (3GTS 45.902) File Delivery over Unidirectional Transport (RFC 3926) Frequency Modulation Fixed Mobile Convergence Frame Number Frame Protocol First Partial Bitmap Fully Qualified Domain Name. Fully qualified domain names consist of a host and a domain name whereas the domain name needs to include a top-level domain (e.g. 'de' or 'org'). Examples: 'www.inacon.de' and 'PC10.inacon.com' are fully qualified domain names. 'www' and 'PC10' represent the host, 'inacon' is the second-level domain, 'de' and 'com' are the top level domain. Fullrate or Frame Relay Frequency Correction Set Frame Reject Frequency Reuse Scheme Frequency Shift Key or Keying Forward Sequence Number File Transfer Protocol (RFC 959) Full-slot Uplink Pilots Set Full Usage of Subchannels Fixed Wireless Access Gateway MSC T-PDU + GTP-Header GERAN Radio Network Temporary Identifier Generic Access (3GTS 43.318) Generic Access - Circuit-Switched Resources (3GTS 43.318) Generic Access - Packet-Switched Resources (3GTS 43.318) Generic Access - Resource Control (3GTS 43.318) Generic Authentication Architecture (3GTS 33.220) Generic Access Network
FR FrCS FRMR FRS FSK FSN FTP FUPS FUSC FWA G-MSC G-PDU G-RNTI GA GA-CSR GA-PSR GA-RC GAA GAN
- 311 -

GANC GBA GBR GCC GCF GCK GEA GERAN GFSK GGSN GHz GI GIAT GIF GITI GK GMK GMLC GMM GMSC GMSC-S GMSK GNU GOP GoS GPCS GPRS GPRS-CSI GPRS-SSF GPS GRA GRE GRX GSM GSM-R GSMS Generic Access Network Controller (3GTS 43.318) Generic Bootstraping Architecture (3GTS 33.220) Guaranteed Bit Rate Generic Call Control General Certification Forum Group Cipher Key GPRS Encryption Algorithm GSM EDGE Radio Access Network Gaussian Frequency Shift Key or Keying Gateway GPRS Support Node Giga Hertz (109 Hertz) Guard Interval Group Identity Address Type Graphics Interchange Format Group Identify Type Identifier Gatekeeper Group Master Key Gateway Mobile Location Center GPRS Mobility Management Gateway MSC Gateway MSC Server Gaussian Minimum Shift Keying recursive acronym for GNU is Not Unix. Today a synonym for free Sourcecode Software. Group of Pictures Grade of Service Generic Packet Convergence Sublayer (IEEE 802.16) General Packet Radio Service GPRS CAMEL Subscription Information GPRS Service Switching Function (CAMEL) Global Positioning System GERAN Registration Area Generic Routing Encapsulation (RFC 2784) GPRS Roaming Exchange (GSM-Association IR.34) Global System for Mobile Communication GSM for Railways GPRS Short Message Service
- 312 -
List of Acronyms
GSN GSSI GTK GTKSA GTP GTP-C GTP-U GTSI GTT GTTP GUMMEI GUP GUTI GW GWCN GZIP H-PLMN H-RNTI HA HARQ HB HBDC HBM HC HC-SDMA HCCA HCF HCS HDB3 HDLC HDTV HE HFC HFC-Network HI GPRS Support Node Group Short Subscriber Identity Group Temporal Key Group Temporal Key Security Association GPRS Tunneling Protocol (3GTS 29.060) GTP Control Plane GTP User Plane Group TETRA Subscriber Identity Global Title Translation (ITU-T Q.714 (2.4)) GPRS Transparent Transport Protocol (3GTS 44.018) Global Unique MME Identity (3GTS 23.003) Generic User Profile Global Unique Terminal Identity (3GTS 23.003) Gateway GateWay Core Network configuration GNU ZIP (compression format) Home PLMN HS-DSCH Radio Network Transaction Identifier (3GTS 25.331, 25.433) Home Agent (Mobile IP / RFC 3344) Hybrid ARQ Heartbeat Happy Bit Delay Condition (3GTS 25.309) Host Based Mobility Hybrid Coordinator High Capacity - Spatial Division Multiple Access HCF Controlled Channel Access Hybrid Coordination Function Hierarchical Cell Structure High Density Bipolar Three (Line Coding used for E1 (PCM 30) High level Data Link Control High Definition Television Header Extension Field Hxbrid Fiber Cable (relates to the layer 1 of CableTVoperators) Hybrid Fiber- / Coaxial-cable HARQ Indicator
- 313 -

HIPERLAN/2 HiperMAN HLR HMAC HMIP HO HoA HOM HOMTC HOT HP HPLMN HR HR HRPD HS HS-DPCCH HS-DSCH HS-HARQ HS-PDSCH HS-SCCH HSCSD HSDPA HSGW HSPA HSPA+ HSR HSS HSUPA HT HT200 HTML HTTP High Performance Radio Local Area Network type 2 High Performance Radio Metropolitan Area Network Home Location Register Keyed Hashing for Message Authentication (RFC 2104) Hierarchical Mobile IPv6 (RFC 5380) Handover Home Address Higher Order Modulation Higher Order Modulation and Turbo Coding Higher Order modulation and Turbo coding for downlink High Priority Path (MPEG, DVB) Home Public Land Mobile radio Network High Rate Halfrate High Rate Packet Data (cdma2000 term) High Speed High Speed Dedicated Physical Control Channel (3GTS 25.211) High Speed Downlink Shared Transport Channel (3GTS 25.211, 25.212, 25.308) High Speed Hybrid Automatic Repeat Request High Speed Physical Downlink Shared Channel (3GTS 25.211) High Speed Shared Control Channel (3GTS 25.211, 25.214) High Speed Circuit Switched Data High Speed Downlink Packet Access (3GTS 25.301, 25.308, 25.401, 3GTR 25.848) HRPD Serving Gateway (cdma2000 term) High Speed Packet Access (operation of HSDPA and HSUPA) Enhanced High Speed Packet Access (operation of enhanced HSDPA and enhanced HSUPA) Higher Symbol Rate Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR with 3GPP Rel. 5 High Speed Uplink Packet Access (3GTS 25.301, 25.309, 25.401, 3GTR 25.896) High Throughput Hilly Terrain 200 km/h Hypertext Markup Language HyperText Transfer Protocol (RFC 2616)
- 314 -
List of Acronyms
HTTPS HUGE HUMAN HUPS HW I-CSCF I-WLAN I+S IAM IANA IBS IBSS iBurst IC ICANN ICH ICIC ICM ICMP ICMPv4 ICMPv6 ICS ICS ICV ID IDEA IDFT IDNNS IE IEC IEEE IETF IF IFFT IFS Hypertext Transfer Protocol Secure Higher Uplink performance for Geran Evolution High-speed Unlicensed Metropolitan Area Network Half-slot Uplink Pilots Set Hardware Interrogating Call Session Control Function (SIP) Interworking WLAN (Wireless Local Area Network) (3GTS 23.234) Information + Supervisory Initial Address Message (ISUP ISDN User Part) Internet Assigned Numbers Authority Integrated Base Station Independent Basic Service Set Data Communication Standards Interference Cancellation Internet Corporation for Assigned Names and Numbers Indicator Channel (UMTS Physical Channel / see also PICH, AICH, CD/CA-ICH) Inter-Cell Interference Coordination Initial Codec Mode Internet Control Message Protocol (RFC 792) Internet Control Message Protocol for IPv4 (RFC 792) Internet Control Message Protocol for IPv6 (RFC 4443) Implementation Conformance Statement IMS Centralized Services (3GTR 22.892) Integrity Check Value Identity International Data Encryption Algorithm Inverse Discrete Fourier Transformation Intra-Domain NAS Node Selector Information Element International Electrotechnical Commission Institute of Electrical and Electronics Engineers Internet Engineering Task Force (www.ietf.org) Intermediate Frequency Inverse Fast Fourier Transformation InterFrame Space
- 315 -

IGMP IHOSS IIR-Filter IK IKE IKEv2 IKMP iLBC ILCM IM IMEI IMEISV IMM IMPI IMPU Internet Group Multicast Protocol (RFC 1112, RFC 2236) Internet Hosted Octet Stream Service Infinite Impulse Response Filter Integrity Key (3GTS 33.102) Internet Key Exchange (RFC 2409) Internet Key Exchange protocol / version 2 (RFC 4306) Internet Key Management Protocol Internet Low Bitrate Codec (RFC 3951 / RFC 3952) Incoming Leg Control Model Instant Messaging International Mobile Equipment Identity International Mobile Equipment Identity - amended by Software Version number IMMediate access parameter IP Multimedia Private Identity; the private user identity of an IMS-subscriber, formatted as an NAI (3GTS 33.203) IP Multimedia Public Identity; the public user identity of an IMS-subscriber, formatted as SIP-URI or TEL-URI (3GTS 33.203) Internet Protocol Multimedia Core Network Subsystem (Rel. 5 onwards) IMS-Access Gateway IP Multimedia Subsystem - Service Switching Function International Mobile Subscriber Identity International Mobile Telecommunications International Mobile Telecommunications for the year 2000 Intelligent Networking Intelligent Network Application Part (CCS7) IP-MAC Notification Table (DVB-H SI) Interoperability (of TETRA equipment) Interference over Thermal noise Input / Offset Variable [3GTS 44.064] Input Offset Variable for I+S and UI-Frames (for ciphering in GPRS) Internet Protocol (RFC 791) Internet Protocol - Connectivity Access Network (e.g. DSL, TVCable, WiMAX, UMTS) IP-Convergence Sublayer IP Bearer Control Protocol (ITU-T Q.1970)
IMS IMS-AG IMS-SSF IMSI IMT IMT-2000 IN INAP INT IOP IoT IOV IOV-I / IOV-UI IP IP-CAN IP-CS IPBCP
- 316 -
List of Acronyms
IPCP IPDC IPDV IPER IPLR IPR IPsec IPTD IPTV IPv4 IPv6 IQ IR IR IS IS-95 ISAKMP ISBN ISC ISCP ISCTI ISDB ISDN ISI ISI ISIM ISM ISO ISP ISPC ISSI ISUA ISUP IT Internet Protocol Control Protocol (RFC 1332) IP Datacast IP-packet delay variation (ITU-T Y.1540) IP-packet error ratio (ITU-T Y.1540) IP-packet loss ratio (ITU-T Y.1540) Intellectual Property Rights Internet Protocol / secure (RFC 4301) IP-packet transfer delay (ITU-T Y.1540) Internet Protocol Television Internet Protocol (version 4) Internet Protocol (version 6) Inphase and Quadrature Infra Red Incremental Redundancy (ARQ II) Interim Standard (ANSI Standard) Interim Standard - 95 (Qualcomm CDMA) Internet Security Association and Key Management Protocol (RFC 2408) International Standard Book Number IP multimedia subsystem Service Control-Interface Interference Signal Code Power (3GTS 25.215 / 3GTS 25.102) Istituto Superiore delle Comunicazioni e delle Tecnologie dell'Informazione Integrated Services Digital Broadcasting Integrated Services Digital Network Inter-System Interface Inter-Symbol Interference IMS capable Subscriber Identity Module Industrial, Scientific and Medical (term for license-free frequencies) International Standardization Organization Internet Service Provider International Signaling Point Code (ITU-T Q.708) Individual Short Subscriber Identity ISDN User Adaptation Layer ISDN User Part (ITU-T Q.761 - Q.765) Information Technology
- 317 -

ITSI ITU ITU-R ITU-T Iu-FP IUA Iub_HS Iub-FP Iur-FP IUT IV JD JPEG K(ASME) kbps KCK KDF KEK KEK kHz KMC KSG KSI L1 L2 L2TP L3 LA LA LAC LACC LAI LAN LANC Individual TETRA Subscriber Identity International Telecommunication Union International Telecommunication Union Radiocommunications International Telecommunication Union - Telecommunication Sector Iu-Frame Protocol (3GTS 25.415) ISDN Q.921 User Adaptation Layer (RFC 4233) Iub Interface with High Speed connection Iub-Frame Protocol (3GTS 25.427 / 25.435) Iur-Frame Protocol (3GTS 25.424, 3GTS 25.425, 25.426, 25.435) Implementation under Test Initialization Vector Joint Detection Joint Picture Expert Group Key (Access Security Management Entity) (3GTS 33.401) kilo-bits per second EAPOL Key Confirmation Key Key Derivation Function (3GTS 33.401) Key Encryption Key (IEEE 802.16) EAPOL Key Encryption Key Kilo Hertz (103 Hertz) Key Management Centres Key Stream Generator Key Set Identifier (3GTS 33.401) Layer 1 (physical layer) Layer 2 (data link layer) Layer 2 Tunneling Protocol (RFC 2661) Layer 3 (network layer) Location Area Link Adaptation Location Area Code Location Area Country Code Location Area Identification (LAI = MCC + MNC + LAC) [3GTS 23.003] Local Area Network Location Area Network Code
- 318 -
List of Acronyms
LAPB LAPD LAPDm LAPV5 LATRED LB LB LBS LCH LCH-Q LCID LCMC-SAP LCP LCR LCS LCT LDAP LDB LDPC LE LEAP LED LER LEX LI LIP LIP-SAP LLC LLME LMA LMDS LMM-SAP LMMSE LMU LNET LNM Link Access Procedure Balanced Link Access Protocol for the ISDN D-Channel Link Access Protocol for the D-Channel / modified for the GSM air interface (3GTS 44.006) Link Access Protocol for V5-interface Latency Reduction (Work item within GERAN-Evolution) Load Balancing Linearization Burst Location Based Service Logical Channel (3GTS 25.321 MAC-ehs) Linearization CHannel, QAM Logical Channel ID Link entity Circuit Mode Control entity - Service Access Point Link Control Protocol (PPP) Low Chip Rate TDD LoCation Service Layered Coding Transport Lightweight Directory Access Protocol (RFC 3928) Linearization Downlink Burst Low Density Parity Check Lower Effort PDB (DiffServ Term) Lightweight Extensible Authentication Protocol Light Emitting Diode Label Edge Router (MPLS) Local Exchange Carrier Length Indicator Location Information Protocol Location Information Protocol - Service Access Point Logical Link Control-Protocol Lower Layer Management Entity Local Mobility Anchor (RFC 5213) Local Multipoint Distribution Services Link entity Mobility Management - Service Access Point Linear Minimum Mean Square Error receiver Location Measurement Unit ORF ATM Network Local Network Management
- 319 -

LOG10 LOS LP LPC LPD LR LS LSB LSF LSI LSP LSR LSSU LTE LTE_ACTIVE LTE_DETACHED LTE_IDLE LTF LTPD-SAP LUPR LZS M-bit M-TMSI M2PA M2UA M3UA MAC MAC MAC-d MAC-e MAC-ehs MAC-es MAC-hs MAG MAN MAP Logarithm of basis 10 Line Of Sight Low Priority Path (MPEG, DVB) Linear Predictive Coding Link Protocol Discriminator Location Register Line Station Least Significant Bit Last Segment Flag Line Station Interface Label Switched Path (MPLS) Label Switch Router (MPLS) Link Status Signal Unit Long Term Evolution (of UMTS) LTE State for active packet transmission LTE State for UE not being registered in the network LTE State for non active packet transmission Long Training Field Link entity TETRA Packet Data - Service Access Point Last User Power Ratio Linearisation downlink Zeroed Set More bit MME - Temporary Mobile Subscriber Identity MTP-2 user Peer-to-Peer Adaptation Layer (RFC 4165) MTP-2 User Adaptation Layer (RFC 3331) MTP-3 User Adaptation Layer (RFC 4666) Message Authentication Code Medium Access Control Medium Access Control for the Dedicated Transport Channel (3GTS 25.321) MAC-E-DCH (3GTS 25.321) MAC-Evolved High Speed MAC-E-DCH SRNC (3GTS 25.321) MAC-High Speed (3GTS 25.321) Mobile Access Gateway (RFC 5213) Metropolitan Area Network Mobile Application Part (3GTS 29.002)
- 320 -
List of Acronyms
MAP-B MAP-X MAR MASF Max [X, Y] MBit MBMS Mobile Application Part - B-interface protocol between MSC and VLR Mobile Application Part - various interface protocols like B-, C-, D-, E-, F- or G-interface Minimum to Average power Ratio Minimum Available Spreading Factor The value shall be the maximum of X or Y, which ever is bigger Mega Bit Multimedia Broadcast / Multicast Service (3GTS 23.246, 3GTS 43.846)
MBMS_RRC_CONN RRC state for E-MBMS in LTE ECTED MBR MBS MBSAT MBSFN MBWA MBZ MCC MCCH MCCH MCH MCM Mcps MCS MCS-X MCU MD MD-X MDHO MDSR ME MEGACO MELPe MER Maximum Bit Rate Multicast Broadcast Services Mobile Broadcast Satellite MBMS Single Frequency Network Mobile Broadband Wireless Access [IEEE 802.20] Must Be Zero Mobile Country Code [ITU-T E.212] Main Control CHannel MBMS point-to-multipoint Control Channel Multicast Channel Minimum Control Mode Mega Chip Per Second Modulation and Coding Scheme Modulation and Coding Scheme (1 - 9) and for HSDPA / HSUPA Multipoint Control Unit (H.323 equipment) Message Digest algorithm (e.g. MD-5) Message Digest Algorithm (MD-2, 4, 5 are defined) (MD-5 RFC 1321) Macro-Diversity Handover Modified Dual Symbol Rate Mobile Equipment (ME + SIM = MS) Media Gateway Control Protocol (ITU-T H.248 incl. Annex F - H and IETF RFC 3015) Mixed Excitation Linear Predictive Message Erasure Rate
- 321 -

MEX MExE MGC MGCF MGCK MGCP MGT MGW MHP MHz MIB MIB MIC MICH MIDI MIH MII MIKEY MIME MIMO MIN Min [X, Y] MINA MIP MIPv4 MISO MitM MLD MLE MLME MLP MLPP MM MMCC MMD Multimedia Exchange Layer Mobile Station Application Execution Environment Media Gateway Controller Media Gateway Control Function Modified Group Cipher key Media Gateway Control Protocol (RFC 2705) MPEG PSI tables for ARIB Media Gateway Multimedia Home Platform Mega Hertz (106 Hertz) Master Information Block Management Information Base Message Integrity Code MBMS Notification Indicator Channel Musical Instrument Digital Interface Media Independent Handover (IEEE 802.21) Ministry of Information Industry Multimedia Internet KEYing (RFC 3830) Multipurpose Internet Mail Extensions Multiple In / Multiple Out (antenna system) Mobile Identity Number (North American Market) The value shall be the minimum of X or Y, which ever is smaller Mobile Internet Network Architecture Mobile IP (RFC 2002, 3344, 3775) Mobile IP Version 4 Multiple In / Single Out (antenna system) Man in the Middle (attack) Multicast Listener Discovery (RFC 2710) Mobile Link Entity MAC Sublayer Management Entity MAC Logical Channel Priority Multi-Level Precedence and Pre-emption (ITU-T Q.85 / Clause 3) Mobility Management Multimedia Call Control IP Multimedia Domain (name of the IMS in 3GPP2)
- 322 -
List of Acronyms
MMDS MME MMEC MMEGI MMEI MMI MMS MN MNC MNI MNP MNRG MO MOBIKE MOC MOCN mod MOPS MORE MOS MP3 MPCC MPDU MPE MPEG MPEG2-TS MPLS MPN MPRACH MRC MRF MRFC MRFP MRU MRW MS Multipoint Microwave Distribution System or Multi-channel Multi-point Distribution System Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards) MME Code MME Group Identity Mobility Management Entity Identity (3GTS 23.003) Man-Machine-Interface Multimedia Messaging Service (3GTS 22.140, 3GTS 23.140) Multiframe Number Mobile Network Code Mobile Network Identity Mobile Number Portability Mobile Not Reachable for GPRS flag Mobile station Originating IKEv2 Mobility and Multihoming Protocol (RFC 4555) Mobile Originating Call Multi-Operator Core Network modulo (base for counting) Million Operations Per second Modulation Order and symbol Rate Enhancement Mean Opinion Score MPEG-1 Audio Layer 3 Multiparty Call Control MAC Protocol Data Unit Multi Protocol Encapsulation (DVB-H) Motion Picture Expert Group MPEG-2 Transport Stream (DVB) Multi Protocol Label Switching Monitoring Pattern Number MBMS Packet Random Access Channel ((E)GPRS) Maximum Ratio Combining Multimedia Resource Function Multimedia Resource Function Controller Multimedia Resource Function Processor Maximum Receive Unit (PPP) Move Receiving Window Mobile Subscriber Station [IEEE 802.16]
- 323 -

MS MS-ISDN MS-PD MSB MSC MSC-S MSCH MSDU MSK MSRD MSRN MSRP MSS MST MSU MT MT0 MT2 MTBF MTC MTCH MTK MTP MTP-3b MTTR MTU MUD MUX MVNO N-PDU N-SAW N(R) N(S) NACC NACK NAF Mobile Station Mobile Subscriber - International Service Directory Number Multislot Packet Data Most Significant Bit Mobile Services Switching Center MSC-Server MBMS point-to-multipoint Scheduling Channel MAC Service Data Unit Master Session Key Mobile Station Receive Diversity Mobile Station Roaming Number Message Session Relay Protocol (draft-ietf-simple-messagesessions-XX) Maximum Segment Size (TCP) Multiple Slot Transmission Message Signal Unit Mobile Terminal or Mobile Terminating Mobile station Termination type 0 Mobile station Termination type 2 Mean Time Between Failure Mobile Terminating Call MBMS point-to-multipoint Traffic Channel MBMS Traffic Key Message Transfer Part (ITU-T Q.701 - Q.709) Message Transfer Part level 3 / broadband (ITU-T Q.2210) Mean Time To Repair Maximum Transmit Unit (IP) Multi-User-Detection unit Multiplex Mobile Virtual Network Operator Network-Protocol Data Unit (IP-Packet, X.25-Frame) N-Channel Stop and Wait (3GTS 25.309, 3GTR 25.848) Received SDU (TL-SDU) Number Sent SDU (TL-SDU) Number Network Assisted Cell Change (3GTS 44.060) Negative Acknowledgement Network Application Function (part of the Generic
- 324 -
List of Acronyms
Authentication Architecture (GAA)) NAI NAP NAPT NAPTR NAS NASS NAT NATO NAV NBAP NBM NBNS NC NC NC NCC NCM NCP NDB NDI NEMO NGMN NGN NI NIC NIT NLOS NMS NMT NNI NOM NPB NPM NRA Network Access Identifier (RFC 2486) Network Access Provider Network Address Port Translation (RFC 3022) Naming Authority Pointer (RFC 2915) Non-Access-Stratum Network Attachment SubSystem (part of the TISPAN NGNarchitecture) Network Address Translation (RFC 1631) North Atlantic Treaty Organisation Network Allocation Vector NodeB Application Part (3GTS 25.433) Network Based Mobility NetBios Name Service Network Control Network Connection Neighbor Cell Network Color Code Normal Control Mode Network Control Protocol (PPP) Normal Downlink Burst New Data Indicator Network Mobility (RFC 3963) Next Generation Mobile Networks Next Generation Networks Network Indicator Network Interface Card Network Information Table (MPEG2-TS PSI, DVB-SI) Non Line Of Sight Network Management Subsystem Nordic Mobile Telephone (analog cellular standard, mainly used in Scandinavia) Network-to-Network Interface Network Operation Mode [3GTS 23.060] Next Partial Bitmap Non-Persistent Mode National Regulatory Administration
- 325 -

NRI NS NS-VC NS-VCG NS-VL NSAP NSAPI NSE NSF NSIS NSLP NSP NSPC NSR NSS NT NTSC NUB NWG O-bit O&M OCNS OCS Octet OFCS OFDM OFDMA OFUSC OLCM OMA OMAC OMAP OMC OoBTC OOK Network Resource Identifier Network Service Network Service - Virtual Connection Network Service - Virtual Connection Group Network Service - Virtual Link Network Service Access Point Network Service Access Point Identifier Network Service Entity NAS Node Selection function Next Steps in Signaling (RFC 4080) NSIS Signaling Layer Protocol (e.g. for resource reservation) Network Service Provider National Signaling Point Code Normal Symbol Rate Network Switching Subsystem Network Termination National Television System Committee (video standard for North America) Normal Uplink Burst Network Working Group (WiMAX Forum) Optional bit Operation and Maintenance Orthogonal Channel Noise Simulator Online Charging System (3GTS 23.203) 8 bit Offline Charging System (3GTS 23.203) Orthogonal Frequency Division Multiplexing Orthogonal Frequency Division Multiple Access Optional FUSC (Full Usage of Subchannels) Outgoing Leg Control Model Open Mobile Alliance (http://www.openmobilealliance.org/) One-Key CBC-MAC (NIST standard: SP 800-38B and http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/) Operation & Maintenance Application Part Operation and Maintenance Center Out of Band Transcoder Control (3GTS 23.153) On OFF Keying
- 326 -
List of Acronyms
OP OPC OPEX OPUSC OPWA ORF OSA OSA-SCS OSCP OSI OSP OSPF OTAR OTDOA OVSF P-CCPCH P-CPICH P-CSCF P-GW P-SCH P-TMSI p/4-DQPSK p/8-D8PSK P/F-Bit P/S PA PA PA PABX PAC PACCH PACQ PACS PAD PAGCH PAL Optional Originating Point Code Operational Expenditure Optional PUSC (Partial Usage of Subchannels) One Pass With Advertising (Term in RSVP) Oesterreichischer Rundfunk Open Service Access Open Service Access - Service Capability Server Online Certificate Status Protocol (RFC 2560) Open System Interconnection Octet Stream Protocol Open Shortest Path First Over The Air Re-keying Observed Time Difference Of Arrival Orthogonal Variable Spreading Factor Primary Common Control Physical Channel (UMTS / used as bearer for the BCH TrCH) Primary Common Pilot Channel (UMTS Physical Channel) Proxy Call Session Control Function (SIP) Packet Data Network Gateway (part of EPC) Primary Synchronization Channel Packet TMSI p/4-shifted Differential Quaternary Phase Shift Keying p/8-shifted Differential 8 Phase Shift Keying Polling/Final - Bit Parallel to Serial Presence Agent (RFC 3856) Power Amplifier Pedestrian A mobile radio channel Private Automatic Branch Exchange Protected Access Credential Packet Associated Control Channel ((E)GPRS) Probability of synchronization burst ACQuisition Personal Access Communication System Packet Assembly Disassembly Packet Access Grant Channel ((E)GPRS) Phase Alternating Line (TV Norm)
- 327 -

PAMR PAN PAP PAPR PAR PAT PB PBCC PBCCH PBCH PBS PC PC PC PC PC PC PCC PCCC PCCCH PCCH PCEF PCF PCFICH PCH PCI PCI PCM PCN PCOMP PCPCH PCR PCRF PCS PCU Public Access Mobile Radio Piggybacked Ack/Nack Password Authentication Protocol (RFC 1334) Peak-to-Average Power Ratio Peak to Average power Ratio Program Assocation Table (MPEG2-TS) Pedestrian B mobile radio channel Packet Binary Convolutional Code Packet Broadcast Control Channel ((E)GPRS) Physical Broadcast Channel Peak Burst Size Protocol Control Protocol Class (SCCP) Power Control Point Coordinator Personal Computer Paging Controller Policy and Charging Control (3GTS 23.203) Parallel Concatenated Convolutional Code (possible Turbo Coding Scheme) Packet Common Control Channel ((E)GPRS) Paging Control Channel Policy and Charging Enforcement Function (3GTS 23.203) Point Coordination Function Physical Control Format Indicator Channel Paging Channel Precoding Control Indication Peripheral Component Interconnect (computer bus standard to interconnect peripherals to the CPU) Pulse Code Modulation Personal Communication Network Protocol COMpression Protocol Physical Common Packet Channel (UMTS Physical Channel) Program Clock Reference (MPEG) Policy and Charging Rules Function (3GTS 23.203) Personal Communication System Packet Control Unit
- 328 -
List of Acronyms
PD PD PDA PDB PDB PDBF PDC PDCCH PDCH PDCP PDF PDF PDG PDH PDN PDN-GW PDO PDP PDS PDS PDSCH PDSN PDTCH PDU PEAP PEI PEP PER PES PES PFC PFI PG PHB PhCH PHICH Protocol Discriminator Packet Data Personal Digital Assistant Per Domain Behavior (DiffServ Term) Packet Delay Budget Profile DataBase Function (TISPAN term / ETSI ES 282 004) Personal Digital Communication (ARIB-Standard) Physical Downlink Control Channel Packet Data Channel Packet Data Convergence Protocol Probability Density Function Policy Decision Function (Part of the IP Multimedia Subsystem) Packet Data Gateway Plesiochronous Digital Hierarchy Packet Data Network Packet Data Network Gateway (part of EPC) Packet Data Optimised Packet Data Protocol Power Density Spectrum Packet Data Subsystem (3GPP2) Physical Downlink Shared Channel Packet Data Support Node (the SGSN in 3GPP2) Packet Data Traffic Channel ((E)GPRS) Protocol Data Unit or Packet Data Unit Protected Extensible Authentication Protocol Peripheral Equipment Interface Policy Enforcement Point (3GTS 23.209) Packed Encoding Rules (ITU-T X.691) Packetised Elementary Stream (DVB) PSTN/ISDN Emulation Subsystem (part of the TISPAN NGNarchitecture) Packet Flow Context Packet Flow Identifier Processing Gain: 10 * LOG10 (3.84 Mcps / user_data_rate) Per Hop Behavior (DiffServ Term) Physical Channel Physical HARQ Acknowledgement Indicator Channel
- 329 -

PHS PHS PHY PHz PI PI PICH PICMG PICS PID PIDF PIFS PIN PIR PIXIT PKCS PKI PKMv2 PL PL PL-SAP PLC PLCP PLmax PLME PLMN PLnon-max PLR PLW PMCH PMD PMI PMIP PMIPv6 PMK Personal Handy phone System Payload Header Suppression (IEEE 802.16) Physical Layer Peta Hertz (1015 Hertz) Priority Indicator Paging Indicator Page Indicator Channel (UMTS Physical Channel) PCI (Peripheral Component Interconnect) Industrial Computer Manufacturers Group (http://www.picmg.org/) Protocol Implementation Conformance Statement Packet Identifier (MPEG2-TS) Presence Information Data Format (RFC 3863) Point (coordination function) InterFrame Space Personal Identification Number Peak Information Rate Protocol Implementation Extra Information for Testing Public Key Cryptography Standard Public Key Infrastructure Privacy Key Management Version 2 Puncturing Limit (3GTS 25.212) Physical Layer Packet link Layer Service Access Point Power Line Communications Physical Layer Convergence Procedure E-DCH maximum Puncturing Limit (3GTS 25.212) Physical Layer Management Entity Public Land Mobile Network Puncturing Limit not requiring maximum physical channels (3GTS 25.212) Packet Loss Rate PDSU Length Word Physical Multicast Channel Physical Medium Dependent Precoding Matrix Indicator Proxy Mobile IP Proxy Mobile IPv6 (RFC 5213) Pairwise Master Key
- 330 -
List of Acronyms
PMKID PMKSA PMM PMR PMR PMT PMTU PN PN PNCH PNG PO PoC PoE POP POP3 POTS PPCH PPDU PPM PPP PRA PRACH PRACH PRACK PRD PRF PRI PRNG PS PS PS PS PS PSC Pairwise Master Key Identity Pairwise Master Key Security Association Packet Mobility Management Professional Mobile Radio Private Mobile Radio Program Map Table (MPEG2-TS) Path MTU Pseudo Noise Packet Number Packet Notification Channel ((E)GPRS) Portable Network Graphics Power Offset Push to talk over Cellular (3GTR 29.979 and various OMAspecifications) Power over Ethernet Post Office Protocol (RFC 1939) Post Office Protocol version 3 Plain Old Telephone Service Packet Paging Channel ((E)GPRS) PLCP Protocol Data Unit Pulse Position Modulation Point-to-Point Protocol (RFC 1661) PCPCH Resource Availability Physical Random Access Channel Packet Random Access Channel Provisional Response Acknowledgement (SIP-method type) Bluetooth Qualification Program Reference Document Pseudo Random Function Primary rate access ISDN-user interface for PABX's (23 or 30 B-channels plus one D-Channel) Pseudo Random Number Generator Puncturing Scheme Program Stream Power Save Physical Slot (IEEE 802.16) Packet Switched Primary Synchronization Code or Primary Scrambling Code
- 331 -

(both used in UMTS) PSD PSDU PSF PSI PSIP PSK PSK PSPDN PSS 1 PSTN PT PTCCH PTCCH/D PTCCH/U PTI PTK PTKSA PTM PTP PTS PTT Power Spectral Density (3GTS 25.215 / 3GTS 25.102) PLCP Service Data Unit PLCP Signaling Field Program Specific Information (MPEG2-TS) MPEG PSI tables for ARIB, similar to DVB-PSI Preshared Key Phase Shift Keying Packet Switched Public Data Network Private integrated Signalling System No. 1 Public Switched Telephone Network Protocol Type (GTP or GTP') Packet Timing Advance Control Channel ((E)GPRS) Packet Timing Advance Control Channel / Downlink Direction ((E)GPRS) Packet Timing Advance Control Channel / Uplink Direction ((E)GPRS) Procedure Transaction Identity Pairwise Transient Key Pairwise Transient Key Security Association Point to Multipoint Point to Point Presentation Time Stamp Post, Telephone & Telegraph (abbreviation for the former government owned organizations that were responsible for all three services) Presence User Agent (RFC 3856) Physical Uplink Control Channel Probability of Undetected Erroneous Message Partial Usage of Subchannels Physical Uplink Shared Channel Permanent Virtual Circuit n symbols Quadrature Amplitude Modulation (n = 16, 32, 64, ...) QoS Assess Point Quality of Service Basic Service Set QoS Class Identifier (3GTS 23.203) Quarter Common Intermediate Format (176 x 144 pixels ITU-T
PUA PUCCH PUEM PUSC PUSCH PVC QAM QAP QBSS QCI QCIF
- 332 -
List of Acronyms
H261 / H263) QE QoS QPSK QSIG QSTA R-GSM RA RA RA RA-RNTI RAA RAB RAB RAC RAC RACC RACH RACS RADIUS RAI RAM RAN RANAP RAND RAR RAT RATSCCH RB RB RB RBB RBC RBPSCH RC4 RCPC Quality Estimate Quality of Service Quadrature Phase Shift Keying Q-interface signaling protocol Quality of Service Station Railways-GSM Routing Area Registered Area Receive Address Random Access Radio Network Temporary Identifier RE-Auth-Answer command (Diameter BASE, RFC 3588) Random Access uplink Burst Radio Access Bearer Routing Area Code Radio Admission Control Routing Area Color Code [3GTS 44.018 (10.5.2.34)] Random Access Channel Resource and Admission Control Subsystem (part of the TISPAN NGN-architecture) Remote Authentication Dial In User Service (RFC 2865) Routing Area Identification Random Access Memory Radio Access Network Radio Access Network Application Part (3GTS 25.413) Random Number RE-Auth-Request command (Diameter BASE, RFC 3588) Radio Access Technology (e.g. GERAN, UTRAN, ...) Robust AMR Traffic Synchronized Control CHannel Resource Block Receive Block Bitmap (EGPRS) Radio Bearer Receive Block Bitmap (GPRS) Radio Bearer Control Shared Basic Physical SubCHannel Rivest Cipher 4 Rate Compatible Punctured Convolutional
- 333 -

RDC RDC-NC RDC-Q RED RED REJ REQ RES RF RFC RFID RG RIP RL RL-TBF RLC RLM RLP RLS RM RM RMS RNC RNL RNR RNS RNSAP RNSN RNTI RoHC ROHC ROI Roope53vISO RoT RPE/LTP Radio Downlink Counter Radio Downlink Counter - Non Conforming channel Radio Downlink Counter, QAM Random Early Detection REduced symbol Duration Reject Request (COPS message type) Response Radio Frequency Request for Comments (Internet Standards) Radio Frequency Identification Relative Grant (3GTS 25.309) Routing Information Protocol Radio Link (3GTS 25.433) Reduced Latency Temporary Block Flow [3GTS 43.064] Radio Link Control Radio Link Management (Protocol Part on the GSM AbisInterface / 3GTS 48.058) Radio Link Protocol (3GTS 24.022) Radio Link Set (3GTS 25.309, 25.433) Reed-Muller Rate Matching Root Mean Square Radio Network Controller Radio Network Layer Receive Not Ready Radio Network Subsystem Radio Network Subsystem Application Part (3GTS 25.423) Radio Network Serving Node Radio Network Temporary Identifier Robust Header Compression Robust Header Compression Return On Invest International Organization for Standardization Rise over Thermal (interference rise relative to zero load) Regular Pulse Excitation / Long Term Prediction (Speech Codec)
- 334 -
List of Acronyms
RPID RPLMN RPR RR RR RRA RRBP RRC Rich Presence Information Data Registered PLMN Resilient Packet Ring (IEEE 802.17) Receive Ready (LAPD/LLC/RLP-Frame Type) Radio Resource Management Radio Resource Agent Relative Reserved Block Period Radio Resource Control
RRC_CONNECTED RRC state in E-UTRA RRC_IDLE RRC state
RRC_MBMS_CONN RRC state in E-UTRA for UEs with MBMS service only ECTED RRC-Filter RRLP RRM RS RSA RSADP RSAEP RSAES-OAEP RSC RSCP RSN RSNA RSRP RSRQ RSSI RST RSTD RSVP RT RTCM RTCP RTG Root Raised Cosine Filter Radio Resource LCS Protocol Radio Resource Management Reference Signal Ron Rivest, Adi Shamir and Leonard Adleman-algorithm (Public Key Encryption / PKCS #1) RSA-Decryption Primitive (RFC 3447 (5.1.2) or PKCS #1 (5.1.2); PKCS = Public Key Cryptography Standard) RSA-Encryption Primitive (RFC 3447 (5.1.1) or PKCS #1 (5.1.1); PKCS = Public Key Cryptography Standard) RSA Encryption Scheme - Optimal Asymmetric Encryption Padding (PKCS #1 / RFC 3447) Recursive Systematic Convolutional Coder (Turbo Coding, 25.212) Received Signal Code Power (3GTS 25.215) Retransmission Sequence Number (3GTS 25.309, 25.212) Robust Security Network Association Reference Signal Received Power Reference Signal Received Quality Received Signal Strength Indicator Running Status Table (DVB-SI) Reference Signal Time Difference Resource Reservation Protocol (RFC 2205) Real Time Radio Technical Commission for Maritime Services Real-time Transport Control Protocol Receive transmit Transition Gap (IEEE 802.16 (3.45)) the time
- 335 -

between an uplink subframe and the subsequent downlink subframe in a TDD-system RTO RTP RTP/AVP RTP/AVPF Retransmission Time Out Real-time Transport Protocol (RFC 3550, RFC 3551) Real-time Transport Protocol / Audio Video Profile (RFC 3551) (used in SDP-descriptions) Real-time Transport Protocol / extended Audio Video Profile for rtcp Feedback (used in SDP-descriptions)(draft-ietf-avt-rtcpfeedback-11.txt) Real-time Transport Protocol / Secure Audio Video Profile (RFC 3711) (used in SDP-descriptions) Request To Send Real Time Streaming Protocol (RFC 2326) Round Trip Time Reduced Transmission Time Interval Round Trip Time Variation Received Total Wideband Power Removable User Identity Module Redundancy and Constellation Version (3GTS 25.212) Receive(r) Receive Secondary Common Control Physical Channel (used as bearer for the FACH and PCH TrCH's / UMTS Physical Channel) Secondary Common Pilot Channel (UMTS Physical Channel) Serving Call Session Control Function (SIP) Serving Gateway (3GTS 23.401) Secondary Synchronization Channel (physical) SAE Temporary Mobile Subscriber Identity Received segment Sequence number Sent segment Sequence number Serial to Parallel S1-interface Application Part protocol (3GTS 36.413) System Architecture Source Address Service Area Security Association Signaling ATM Adaptation Layer - Network Node Interface Service Area Broadcast Set Asynchronous Balanced Mode (Extended for Modulo 128
RTP/SAVP RTS RTSP RTT RTTI RTTVAR RTWP RUIM RV Rx RX S-CCPCH S-CPICH S-CSCF S-GW S-SCH S-TMSI S(R) S(S) S/P S1-AP SA SA SA SA SAAL-NNI SAB SABM(E)
- 336 -
List of Acronyms
operation) (LAPD/LLC/RLP-Frame Type) SABP SACCH SACCH/MD SACK SAE SAI SAIC SANC SAP SAPI SAR SAR SAT SAW SB SB SBC SBLP SBN SBPSCH SC SC SC-FDMA SCCH SCCP SCF SCH SCH SCH-P8/F SCH-P8/HD SCH-P8/HU SCH-Q SCH-Q/D SCH-Q/HU Service Area Broadcast Protocol (3GTS 25.419) Slow Associated Control Channel (GSM) SACCH Multislot Downlink (related control channel of TCH/FD/ GSM) Selective Acknowledgement System Architecture Evolution Service Area Identifier Single Antenna Interference Cancellation Signaling Area Network Code (ITU-T Q.708) Service Access Point Service Access Point Identifier Specific Absorption Rate Segmentation And Reassembly (ATM-sublayer) Satellite Stop and Wait Machine Synchronization downlink Burst Scheduling Block Session Border Controller (SIP term, usually a B2BUA with NAT-function and media gateway) Service Based Local Policy Source Block Number Shared Basic Physical SubCHannel Subcarrier Serving Cell Single Carrier Frequency Division Multiple Access Secondary Control CHannel Signaling Connection Control Part (ITU-T Q.711 - Q.714) Service Control Function (CAMEL) Synchronization Channel Signalling CHannel Signalling CHannel, pi/8-D8PSK, Full size Signalling CHannel, pi/8-D8PSK, Half size Downlink Signalling CHannel, pi/8-D8PSK, Half size Uplink Signalling CHannel, QAM Signalling CHannel, QAM Full size Downlink Signalling CHannel, QAM Half size Uplink
- 337 -

SCH-Q/RA SCH-Q/U SCH/F SCH/HD SCH/HU SCK SCLNS SCN SCP SCR SCTP SD SDCCH SDH SDK SDMA SDP SDS SDT SDTI SDTV SDU SEG SEP SF SF SFBC SFD SFH SFID SFN SFN SFPG SG SG SGCP Signalling CHannel, QAM Random Access Uplink Signalling CHannel, QAM Full size Uplink Signalling CHannel, Full size Signalling CHannel, Half size Downlink Signalling CHannel, Half size Uplink Static Cipher Key Specific ConnectionLess Network Service Switching Control Node Service Control Point (IN) Source Controlled Rate Stream Control Transmission Protocol (RFC 2960) Sample Duration Stand Alone Dedicated Control Channel Synchronous Digital Hierarchy Software Development Kit Space Division Multiple Access Session Description Protocol (RFC 2327, RFC 3266, RFC 3264) Short Data Service Service Description Table (DVB-SI) Short Date Type Identifier Standard Definition TV Service Data Unit (the payload of a PDU) Security Gateway Signaling End Point (CCS7) Spreading Factor Slot Flag Space Frequency Block Codes Start Frame Delimiter Slow Frequency Hopping Service Flow Identity System Frame Number Single Frequency Network Security and Fraud Prevention Group Serving Grant respectively Power Grant (3GTS 25.213, 25.309, 25.321) Security Gateway (IPsec / RFC 2401) Simple Gateway Control Protocol
- 338 -
List of Acronyms
SGi SGLUPR SGsAP SGSN SGW SHA SHCCH SHO SI SI SI SI SIB SIB SIC SICH-Q SICH-Q/D SICH-Q/U SID SID SIE SIF SIFS SIG SIGQ SIGTRAN SIM SIMO SIN SIO SIO SIOS SIP SIP-AS Reference Point in LTE Last Used Power Ratio according to SG table index (3GTS 25.321) SGs-interface Application Part protocol (3GTS 29.118) Serving GPRS Support Node Signaling Gateway Secure Hash Algorithm Shared Channel Control Channel (UMTS Logical Channel / TDD only) Soft Handover (UE is having more than one radio link at the same time and combines them) Service Information Service Indicator Segment Indicator Scheduling Info System Information Block LSSU with status indication busy Serial Interference Cancellation Slot Information CHannel, QAM Slot Information CHannel, QAM Downlink Slot Information CHannel, QAM Uplink Size InDex (3GPP 25.321) Silence Insertion Descriptor LSSU with status indication emergency alignment Signaling Information Field Short InterFrame Space Special Interest Group (e.g. Bluetooth) Signaling Queue Signaling Transport (RFC 2719) Subscriber Identity Module Single In / Multiple Out (antenna system) LSSU with status indication normal alignment Service Information Octet LSSU with status indication out of alignment LSSU with status indication out of service Session Initiation Protocol (RFC 3261) SIP-Application Server
- 339 -

SIP-B SIP-I SIP-T SIPO SIQ SIR SISO SLA SLC SLF SLR SLS SLTA SLTM SM SM-SC SME SME SMG SMI SMIL SMKSA SMLC SMS SMS-G-MSC SMS-IW-MSC SMSCB SMTP SN SN SN-PDU SN-Q SN-SAP SNA SIP for Businesses (abbreviation for a set of PABX-specific SIPextensions) SIP with encapsulated ISUP (ITU-T Q.1912.5) SIP for Telephones (RFC 3372, RFC 3398) LSSU with status indication processor outage Service Information Query Signal to Interference Ratio Single In / Single Out (antenna system) Service Level Agreement Signaling Link Code Subscriber Locator Function Source Local Reference Signaling Link Selection Signaling Link Test Acknowledge Signaling Link Test Message Session Management (3GTS 23.060, 3GTS 24.008) Short Message Service Center Station Management Entity Small and Medium size Enterprises (Type of Business) Special Mobile Group Short Management Identity Synchronized Multimedia Integration Language Station to Station link Master key Security Association Gateway Mobile Location Center Short Message Service (3GTS 24.011, 3GTS 23.040) SMS Gateway MSC (for Short Messages destined to Mobile Station) SMS Interworking MSC (for Short Messages coming from Mobile Station) Short Message Services Cell Broadcast Simple Mail Transfer Protocol (RFC 2821) Symbol Number or SNDCP Sequence Number Segmented N-PDU (SN-PDU is the payload of SNDCP) Symbol Number in QAM SNDCP-Service Access Point Short Number Address
- 340 -
List of Acronyms
SND SNDCP SNEI SNIR SNM SNN SNR SNTM SNTP SNU SO SOAP SOHO SP SPC SPI SPR SQCIF SQN SRB SRES SRF SRNC SRNS SRS SRTP SRTT SRV SRVCC SS SS SS SS7 SSC Sequence Number Downlink (GTP) Subnetwork Dependent Convergence Protocol SNDCP Network Endpoint Identifier Signal to Noise and Interference Ratio Signaling Network Management Protocol (ITU-T Q.704 (3)) SNDCP N-PDU Number Flag Signal to Noise Ratio Signaling Network Test & Maintenance (ITU-T Q.707) Simple Network Time Protocol (RFC 2030) Sequence Number Uplink (GTP) Segment Offset Simple Object Access Protocol (http://www.w3.org/TR/2000/NOTE-SOAP-20000508) Small Office Home Office (Type of Business) Signaling Point Signaling Point Code Security Parameter Index (RFC 2401) Subscription Profile Repository (3GTS 23.203) Semi Quarter Common Intermediate Format (128 x 96 pixels ITU-T H261 / H263) Sequence number (used in UMTS-security architecture / 3GTS 33.102) Signaling Radio Bearer Signed Response Service Resource Function (CAMEL) Serving Radio Network Controller Serving Radio Network Subsystem Sounding Reference Symbol Secure RTP (RFC 3711) Smoothed RoundTrip Time Service Location (DNS-related / RFC 2782) Single Radio Voice Call Continuity (3GTS 23.216) Supplementary Service Subscriber Station (IEEE 802.16) Spatial Stream Signaling System No 7 Secondary Synchronization Code
- 341 -

SSCF SSCF/NNI SSCF/UNI SSCOP SSCOPMCE SSCS SSDT SSF SSI SSID SSN SSN Service Specific Co-ordination Function Service Specific Coordination Function - Network Node Interface Protocol (ITU-T Q.2140) Service Specific Coordination Function - User Network Interface Protocol (ITU-T Q.2130) Service Specific Connection Oriented Protocol (ITU-T Q.2110) Service Specific Connection Oriented Protocol in a Multi-link or Connectionless Environment (ITU-T Q.2111) Service Specific Convergence Sublayer Site Selection Diversity Transmission Service Switching Function (CAMEL) Short Subscriber Identity Service Set Identifier (IEEE 802.11) SubSlot Number Start Sequence Number (related to ARQ-Bitmap in GPRS / EGPRS) or Send Sequence Number (GSM MM and CCProtocols) or Sub-System Number (SCCP) Send Sequence Number (GSM MM and CC-Protocols) Service Switching Point (IN) Contributing Source (RTP) Subscriber Station Receive to transmit Turnaround Gap (IEEE 802.16 (3.53)) Time that the SS needs to switch from receive to transmit. Secondary sync Sequence Set Service Specific Segmentation And Reassembly (ITU-T I.366.1) Slow start threshold (RFC 2001, RFC 2960) Subscriber Station Transmit to receive Turnaround Gap (IEEE 802.16 (3.54)) Time that the SS needs to switch from transmit to receive. Sum Square Vector Error Stuffing Table (DVB-SI) Station Station Key Station Key Security Association Standardisation Agreement (NATO) Space Time Block Coding Space Time Coding Signaling Transport Converter on MTP-3 and MTP-3b (ITU-T Q.2150.1) / Signaling Transport Converter on SSCOP and SSCOPMCE (ITU-T Q.2150.2)
SSN SSP SSRC SSRTG
SSS SSSAR ssthresh SSTTG
SSVE ST STA STAkey STAkeySA STANAG STBC STC STC
- 342 -
List of Acronyms
STCH STF STP STS STTD STUN SU SUA SUERM SUFI SUN SVC SVG SW SWAP SwMI SYNC T-PDU T.38 TA TA TA TA TAC TACS TAF TAI TAI TB TBCP TBF TBS TC TC TCAP STealing CHannel Short Training Field Signaling Transfer Point Space Time Stream Space Time block coding based Transmission Diversity Simple Traversal of UDP through Network Address Translators (RFC 3489) Scheduling Unit SCCP User Adaptation Layer (RFC 3868) Signal Unit Error Rate Monitor (ITU-T Q.703 (10)) Super Field (RLC-Protocol) Originally stood for Stanford University Network Switched Virtual Circuit Scalable Vector Graphics Software Shared Wireless Access Protocol (Home RF) Switching and Management Infrastructure Synchronization protocol in LTE for E-MBMS Payload of a G-PDU which can be user data, i.e. possibly segmented IP-frames, or GTP signaling information (GTP) Fax Specification Transmitter Address Tracking Area Timing Advance Terminal Adapter (ISDN) Tracking Area Code Total Access Communication System Terminal Adopter Function (3GTS 27.001) Tracking Area Identity (3GTS 24.301) Timing Advance Index Transport Block Talk Burst Control Protocol Temporary Block Flow Transport Block Set Turbo Coding (3GTS 25.212) Technical Committee Transaction Capabilities Application Part (Q.771 - Q.773)
- 343 -

TCB TCH TCH-AFS TCH-AHS TCH-P8/10,8 TCH/2,4 TCH/4,8 TCH/7,2 TCH/FD TCH/S TCP TCP/BFCP TCP/IP TCP/RTP/AVP Transmission Control Block Traffic Channel Traffic CHannel Adaptive Full rate Speech Traffic Channel Adaptive Half rate Speech Traffic CHannel, pi/8-D8PSK, net rate = 10,8 kbit/s Traffic CHannel, net rate = 2,4 kbit/s Traffic CHannel, net rate = 4,8 kbit/s Traffic CHannel, net rate = 7,2 kbit/s Traffic Channel / Fullrate Downlink Speech Traffic CHannel Transmission Control Protocol Transmission Control Protocol / Binary Floor Control Protocol (draft-ietf-xcon-bfcp-05.txt) Transmission Control Protocol over IP Real-time Transport Protocol / Audio Video Profile over TCP (used in SDP-descriptions)(draft-ietf-avt-rtp-framing-contrans06.txt) Transmission Control Protocol / Transport Layer Security / Binary Floor Control Protocol (draft-ietf-xcon-bfcp-05.txt) Target Channel Type Field Transport Channel Traffic Volume Time Division Duplex Time Division Multiplexing Time Division Multiple Access Time Difference of Arrival Time and Date Table (DVB-SI) Terminal Equipment TE presenting a TETRA interface TETRA Encryption Algorithm(s) 1,2,3 and 4 Total E-DCH Buffer Status TETRA Enhanced Data Service Terminal Equipment Identity Tunnel Endpoint Identifier (GTP / 3GTS 29.060) Traffic Encryption Key (IEEE 802.16) Explanation Terrestrial Trunked Radio TETRA Voice + Data Transport Format
TCP/TLS/BFCP TCTF TCTV TDD TDM TDMA TDOA TDT TE TE2 TEA1/2/3/4 TEBS TEDS TEI TEID TEK Term TETRA TETRA V+D TF
- 344 -
List of Acronyms
TFC TFCI TFCS TFI TFI TFO TFRC TFRI TFS TFT TFTP TGD TGL TGPRC TGSN TH-CDMA THIG THP THz TI TIA TID TID TIM TIP TIPHON TISPAN Transport Format Combination Transport Format Combination Identifier Transport Format Combination Set Transport Format Indication (UMTS) Temporary Flow Identity ((E)GPRS) Tandem Free Operation (3GTS 22.053) Transport Format and Resource Combination (3GTS 25.308) Transport Format and Resource Indicator (3GTS 25.308, 25.321) Transport Format Set Traffic Flow Template Trivial File Transfer Protocol (RFC 1350) Transmission Gap start Distance (3GTS 25.215) Transmission Gap Length (3GTS 25.215) Transmission Gap Pattern Repetition Count (3GTS 25.215) Transmission Gap Starting Slot Number (3GTS 25.215) Time Hopping Code Division Multiple Access Topology Hiding Inter Network Gateway Traffic Handling Priority (DiffServ Term) Tera Hertz (1012 Hertz) Transaction Identifier Telecommunications Industry Association Tunnel Identifier Traffic Identifier Traffic Indication Map TETRA Interoperability Profile Telecommunications and Internet Protocol Harmonization Over Networks (ETSI Project) Telecoms & Internet converged Services & Protocols for Advanced Networks (ETSI Working Group to define IMS for fixed broadband access networks) Temporal Key Temporal Key Integrity Protocol TETRA LLC TETRA LLC Service Access Point A TETRA LLC Service Access Point B TETRA LLC Service Access Point C TETRA LLC Service Access Point E
TK TKIP TL TLA-SAP TLB-SAP TLC-SAP TLE-SAP
- 345 -

TLLI TLS TLV TM TM TM TM TMA-SAP TMB-SAP TMC-SAP TMD TMD-SAP TMGI TMN TMSI TMV-SAP TN TNCC-SAP TNL TNMM TNP TNSDS-SAP TNSS-SAP TOI ToIP TOM TOM2 TOM8 TOS TOT TP TP-UD TPC Temporary Logical Link Identifier Transport Layer Security (RFC 2246 / RFC 3546 / formerly known as SSL or Secure Socket Layer) Tag / Length / Value Notation Trunked Mode Transparent Mode operation Transmission Modules TETRA MAC TETRA MAC Service Access Point A TETRA MAC Service Access Point B TETRA MAC Service Aaccess Point C Transparent Mode Data (UMTS RLC PDU-type) TETRA MAC Service Aaccess Point D Temporary Mobile Group Identity (3GTS 23.003 (15.2)) Telecommunication Management Network Temporary Mobile Subscriber Identity TETRA MAC Virtual SAP Timeslot Number TETRA Network layer Call Control - Service Access Point Transport Network Layer (3GTS 25.401) TETRA Network Mobility Management TETRA Network Protocol TETRA Network layer Short Data Service - Service Access Point TETRA Network layer Supplementary Services - Service Access Point Transport Object Identifier Text over IP Tunneling Of Messages [3GTS 44.064] Tunneling Of Messages over LLC-SAPI 2 (for high priority signaling messages)[3GTS 44.064] Tunneling Of Messages over LLC-SAPI 8 (for low priority signaling messages)[3GTS 44.064] Type of Service Time Offset Table Traffic Physical channel Transfer Protocol - User Data (in GSM) Transmit Power Control
- 346 -
List of Acronyms
TPC TPS TPTI TQI TRAU TrCH TrFO TrGw TRX TS TS TS TS TSC TSC TSI TSN TSTD TTA TTG TTG Transmit Power Command Transmission Parameter Signaling (DVB-H) Transmitting Party Type Identifier Temporary Queuing Identifier Transcoder and Rate Adaption Unit Transport Channel (UMTS) Transcoder Free Operation Transition Gateway (IPv4 IPv6) (3GTS 23.228 (5.18)) Transmitter / Receiver Transport Stream Traffic Stream Timeslot Time Sharing Training Sequence Code Temporal Key Integrity Protocol Sequence Counter TETRA Subscriber Identity Transmission Sequence Number Time Switched Transmit Diversity Telecommunications Technology Association (South Korean standards organization) Tunnel Termination Gateway Transmit receive Transition Gap (IEEE 802.16 (3.63)) the time between a downlink subframe and the subsequent uplink subframe in a TDD-system Transmission Time Interval Time To Live (IP-Header / RFC 791) TETRA Association Technical Report Typical Urban 50 km/h TCAP User Adaptation Layer Telephone User Part Tile Use of Subchannels Television Transmit(ter) Transmit Transmit Adaptive Arrays Transmission Opportunity Uplink Multiple Slot Transmission
TTI TTL TTR TU50 TUA TUP TUSC TV Tx TX TxAA TXOP U-MST
- 347 -

U-SAP UA UA UAC UARFCN UART UAS UAS-X UBS-X UCD UCI UCS UCS-2 UDCH UDH UDP UDPTL UE UEA UGS UHF UI UIA UICC UIUC UL UL_DTX UL-MAP UL-SCH UM UMA UMAN UMB User Service Access Point User Agent (SIP-Term / RFC 3261) Unnumbered Acknowledgement (LAPD/LLC/RLP-Frame Type) User Agent Client (SIP-Term / RFC 3261) UMTS Absolute Radio Frequency Channel Number Universal Asynchronous Receiver and Transmitter User Agent Server (SIP-Term / RFC 3261) egprs2 Uplink level A modulation and coding Scheme (x = 7..11) egprs2 Uplink level B modulation and coding Scheme (x = 5..12) Uplink Channel Descriptor (WiMAX Message) Uplink Control Indicator Universal Character Set Universal Character Set coded in 2 octets User-plane Dedicated Channel (3GTS 45.902) User Data Header User Datagram Protocol (RFC 768) UDP Transport Layer (used in SDP-description for T.38 faxapplications) User Equipment UMTS Encryption Algorithm (3GTS 33.102) Unsolicited Grant Service (IEEE 802.16 Traffic Class) Ultra High Frequency Unnumbered Information (LAPD) / Unconfirmed Information (LLC) / Frame Type UMTS Integrity Algorithm (3GTS 33.102) Universal Integrated Circuit Card (3GTS 22.101 / Bearer card of SIM / USIM) Uplink Interval Usage Code (WiMAX Term) Uplink Uplink Discontinuous Transmission Uplink-Medium Access Protocol (MAC-Message in WiMAX / IEEE 802.16) Uplink Shared Channel Unacknowledged Mode operation Unlicensed Mobile Access (3GTS 43.318) Unlicensed Mobile Access Network Ultra Mobile Broadband (3GPP2's EV-DO Rev C)
- 348 -
List of Acronyms
UMD UMS UMTS UMTS-AKA UNC UNC-SGW UNI UP UP URA URA_PCH URB URI URL US USA USAT USB USCH USD USF USIM USS USSI UTF-16BE UTF-8 UTRA UTRAN UUI UUS UV UWB
Unacknowledged Mode Data (UMTS RLC PDU-type) User Mobility Server (HSS = HLR + UMS) Universal Mobile Telecommunication System Universal Mobile Telecommunication System - Authentication and Key Agreement (3GTS 33.102) UMA Network Controller UMA Network Controller Security Gateway User-to-Network Interface User Priority Unallocated Physical channel UTRAN Registration Area RRC URA State in UTRA User Radio Bearer Uniform Resource Identifier Uniform Resource Locator (RFC 1738) United States United States of America USIM Application Toolkit Universal Serial Bus Uplink Shared Channel (UMTS Transport Channel TDD only) User Service Description Uplink State Flag Universal Subscriber Identity Module Uplink sync Sequence Set Unexchanged Short Subscriber Identity Unicode Transformation Format serialized as two bytes in BigEndian format Unicode Transformation Format-X (Is an X-bit) lossless encoding of Unicode characters UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access UMTS (Universal Mobile Telecommunication System) Terrestrial Radio Access Network User to User Information User-User-Signaling (3GTS 23.087) Ultra Violet Ultra-Wide Band (IEEE 802.15.3)
- 349 -

UWC V-PLMN V+D V5UA VA VAD VBS VC VCC VCI VCO VCT VDSL VE VGCS VHE VHF VI VLAN VLR VO VoD VoIMS VoIP VPI VPLMN VPN VSI VSRB VW W-AMR W-AMR+ W-APN WAG WAN Universal Wireless Convergence (Merge IS-136 with GSM) Visited PLMN Voice plus Data V5.2-User Adaptation Layer (RFC 3807) Vehicular A mobile radio channel Voice Activity Detector Voice Broadcast Service (GSM-R) Virtual Circuit Voice Call Continuity (3GTS 23.206) Virtual Circuit Identifier (ATM) Voltage Controlled Oscillator MPEG PSI tables for ARIB Very high data rate Digital Subscriber Line (ITU-T G.993.1) Virtual Engine Voice Group Call Service (GSM-R) Virtual Home Environment (3GTS 22.121, 3GTS 23.127) Very High Frequency Video Virtual LAN Visitor Location Register Voice Video on Demand Voice over IMS Voice over IP Virtual Path Identifier (ATM) Visited Public Land Mobile radio Network Virtual Private Network Virtual Socket Interface Variable Sized Radio Blocks Virtual Wire PDB (DiffServ Term) Wideband AMR-Codec (Adaptive Multirate) (3GTS 26.190) Extended Wideband AMR-Codec (Adaptive Multirate) (3GTS 26.290) WLAN-APN (Wireless Local Area Network - Access Point Name) (3GTS 23.234) WLAN (Wireless Local Area Network) Access Gateway Wide Area Network
- 350 -
List of Acronyms
WAP WCDMA WDS WEP WG WI WiBro WiFi WiMAX WINS WLAN WM WMAN WMAX WMM WPA WPA2 WRED WS WSN WWW X-CSCF X2-AP X2AP XHTML XID XMAC XMF XOR XRES XUA XXX_PCH ZF Wireless Application Protocol Wide-band Code Division Multiple Access Wireless Distribution System Wired Equivalent Privacy Working Group Work Item Wireless Broadband, Korean WiMAX Version Wireless Fidelity (www.wi-fi.org) Worldwide Interoperability for Microwave Access (IEEE 802.16) Windows Internet Name Service Wireless Local Area Network (IEEE 802.11) Wireless Medium Wireless Metropolitan Area Network Alliance of IEEE-802.11-Standard Manufacturers WiFi MultiMedia WiFi Protected Access WiFi Protected Access Version 2 Weighted Random Early Detection Window Size Window Size Number World Wide Web Call Session Control Function (any, there is I-CSCF, P-CSCF and X-CSCF) X2-interface Application Part protocol (3GTS 36.423) X2-interface Application Part protocol (3GTS 36.423) Extensible Hypertext Markup Language Exchange Identification (LAPD/LLC-Frame Type) Expected Message Authentication Code Extensible Music Format Exclusive-Or Logical Combination Expected Response (3GTS 33.102) Any User Adaptation Layer (M2UA, M3UA, SUA) RRC States: CELL_PCH or URA_PCH Zero Forcing
- 351 -
- 352 -
Index
Index
A AM..................................................240 B Broadcast information.....................103 H HARQ.............................................218 M MAC................................................218 MAC control element......................232 MAC PDU.......................................230 P PDCP..............................................248 PDCP PDU.....................................250 R RA-RNTI.........................................226 Random access procedure.....224, 228 RLC.................................................240 RLC AM PDU with a segment header ........................................................244 RLC PDU........................................242 RRC................................................102 RRC_CONNECTED.......................104 RRC_IDLE .....................................104 T TCP/IP............................................254 TM...................................................240 U UM..................................................240
- 353 -
- 354 -

Lte Sig+Prot Ran+Ue v1.201

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lte Sig+Prot Ran+Ue v1.201

Uploaded by

Copyright:

Available Formats

LTE

Signaling & Protocol Analysis

Color Codes in Frame Formats:

Color Codes in Scenarios:

Foreword of the Publisher:

Gunnar Heine / President & CEO of INACON GmbH

1.1.2 Zoom into the EPS......................................................................4

1.1.3 Network Elements and their Functions within the EPC...............6

1.2 Protocol Stacks......................................................................34

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.3 Security Architecture..............................................................40

1.3.2 Operation of UMTS-AKA...........................................................42 1.3.3 Key Derivation Function (KDF)..................................................44

The Non-Access-Stratum: EMM & ESM................................55

2.1.2 State Machine...........................................................................58

2.1.3 Network Operation Modes.........................................................60 2.1.4 Message Format.......................................................................62

2.1.5 Important EMM-Scenarios.........................................................64

2.2.1 Important ESM-Procedures.......................................................86

2.2.2 State Machine...........................................................................88 2.2.4 Message Format.......................................................................90

2.3.5 Dedicated EPS Bearer Establishment.......................................94

3.2 State Characteristics of RRC...............................................104

3.3 Signaling Radio Bearers (SRB)............................................106

3.3.2 Mapping of RRC-Messages to SRB's and to Channels..........108

3.4 Message Encoding through ASN.1 PER-unaligned..............116

3.4.4 Comprehension Check & Practical Exercise: Encoding an RRC_CONN_REQ-Message......................................126

3.5 RRC Procedures..................................................................128

3.5.2 Connection Management Related Procedures........................140

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

3.5.3 Inter RAT RRC Procedures.....................................................162 3.5.4 E-UTRAN Measurements........................................................164

3.5.5 Other RRC Procedures...........................................................176 3.5.6 RRC Procedure Delay.............................................................178

3.6 GERAN to E-UTRAN Cell Reselection.................................206

Lower Layers of the Uu-Interface: MAC, RLC & PDCP.....217

4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN...220

4.1.3 MAC Random Access Procedure............................................224

4.1.4 Structure of MAC-PDU............................................................230

4.1.5 MAC Control Elements............................................................232

4.2 Features of RLC...................................................................240

4.3 Features of PDCP................................................................248

4.3.2 Structure of PDCP PDU..........................................................250 4.3.3 PDCP Configuration................................................................252

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

X2- and S1-Interfaces: X2AP- and S1-AP-Protocols.........257

5.1.3 X2-based Handover Scenario.................................................262

5.2 The S1-AP Protocol.............................................................266

Revisiting important Details of the EPS

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.1 Architecture Overview

[3GTS 23.401, 3GTS 23.402]

Revisiting important Details of the EPS

EPC EPS I-WLAN

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.1.2 Zoom into the EPS

Revisiting important Details of the EPS

PLMN RNC S-GW UE UTRAN

Internet Protocol (RFC 791)

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

Revisiting important Details of the EPS

Room for your Notes:

Abbreviations of this Section:

MMEI SGSN UTRAN

Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards)

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.1.3.1.3 Interfaces & Protocols

[3GTS 23.401 (5.1)]

Revisiting important Details of the EPS

Room for your Notes: