ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

ITU/BDTArabRegionalWorkshopon ITU/BDT Arab Regional Workshop on LTESystem y Session7:AirLinkSetup Session 7 : Air Link Setup
LTE/SAEProcedures /
Speakers Date M.Lazhar BELHOUCHET M.HakimEBDELLI M Hakim EBDELLI 27 29January 2010

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn 1

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Agenda
Attach S1Release Detach Detach ServiceRequest TrackingAreaUpdate DedicatedSAEBearerActivation Dedicated SAE Bearer Activation IntereNBhandover
2 AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn 2

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Attach(1/2)
UE eNB

MME

new MME

Serving Gateway (SGW)

PDN Gateway

PCRF

HSS

EMM_Deregistered RRC_Connected RRC C d Attach Request S-TMSI/IMSI,old TAI, IP address allocation ECM_Connected ECM C t d Authentication Request Authentication Response p Update Location Insert Subscriber Data IMSI, subscription data = default APN, tracking area restrictions, Insert Subscriber Data Ack Update Location Ack Authentication Vector Request (IMSI) Authentication Vector Respond

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Attach(2/2)
UE eNB

MME

new MME

Serving Gateway (SGW)

PDN Gateway

PCRF

HSS

select SAE GW

Create Default Bearer Request IMSI, IMSI RAT type default QoS PDN address info type, QoS, Create Def. Bearer Req. IMSI, , IP/TEID of SGW-S5 PCRF Interaction Create Def Bearer Rsp Def. Rsp.

RB Est. Req. Includes Attach Accept RB Est. Resp. Includes Attach Complete

PDN address, IP/TEID of PDN GW, QoS according PCRF S-TMSI, security info, IP/TEID of SGW-S1u, PDN address, QoS, PDN address, ,IP/TEID of SGW-S1u (only for eNB) Attach Complete

Attach Accept

Create Def. Bearer Rsp.

Update Bearer Request IP/TEID of eNB for S1u IP/TEID of eNB for S1u EMM_Deregistered _ g Update Bearer Response ECM_Connected UL/DL Packet Data via Default EPS Bearer

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

S1Release
After attach UE is in EMM_Registered state. The default Bearer has been allocated (RRC_connected + ECM_connected) even it may not transmit or receive data If there is a longer period of inactivity by this UE, then we should free these admission control resources (RRC_idle + ECM_idle) The trigger for this procedure can come from eNB or from MME. MME
EMM_Registered ECM_Connected Serving PDN Gateway Gateway (SGW)

S1 Release Request cause

Update Bearer Request release of eNB S1u resources Update Bearer Response

S1 Release Command cause RRC Connection Release Ack S1 Release Complete

EMM_Registered ECM_Idle ECM Idl

RRC Connection Release

S1 Signalling Connection Release

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Detach
Can be triggered by UE or by MME. gg y y During the detach procedure all SAE bearers with their associated tunnels and radio bearers will be deleted.
Note: Detach procedure initiated by UE UE.
EMM-Registered RRC_Connected NAS Detach Request switch off flag ECM_Connected ECM Connected NAS: Detach Accepted
PCRF

MME

Serving Gateway (SGW)

PDN Gateway

Delete Bearer Request Delete Bearer Request Delete Bearer Response Delete Bearer Response

S1 Signalling Connection Release EMM-Deregistered

RRC_Connected + ECM Idle 6 AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Detach
Note: Detach procedure initiated by MME.
MME
Serving g Gateway (SGW) PDN Gateway

EMM-Registered RRC_Connected NAS Detach Request switch off flag ECM_Connected

Delete Bearer Request Delete Bearer Request Delete Bearer Response Delete Bearer Response

NAS: Detach Accepted

PCRF

S1 Signalling Connection Release

EMM-Deregistered RRC_Connected RRC Connected + ECM Idle

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

ServiceRequest(1/2)
From time to time a UE must switch from ECM_Idle to ECM_connected The reasons for this might be UL data is available, UL signaling is pending (e.g. tracking area update, detach) or a paging from the network was received.
MME
RRC_Idle+ ECM_Idle Paging S-TMSI RRC_Connected RRC Connected Service Request S-TMSI, TAI, service type ECM_Connected Authentication Request authentication challenge Authentication Response Authentication response u e ca o espo se Paging S-TMSI, TAI/TAI-list DL Packet Notification DL Packet Data
Serving Gateway (SGW) PDN Gateway

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

ServiceRequest(2/2)
MME
Serving Gateway ( (SGW) ) PDN Gateway

Initial Context Setup Req. RB Establishment Req. RB Establishment Rsp. Initial Context Setup Rsp. eNB S1 IP/TEID eNB-S1 IP/TEID, .. Update Bearer Request eNB-S1 IP/TEID Update Bearer Response SGW-S1 IP/TEID, QoS

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

TrackingAreaUpdate(TAU)
Tracking area (TA) is similar to Location/Routing area in 2G/3G . Tracking Area Identity = MCC (Mobile Country Code), MNC (Mobile Network Code) and TAC (T ki A d (Tracking Area C d ) Code). When UE is in ECM-Idle, MME knows UE location with Tracking Area accuracy.

10

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

TrackingAreaUpdate(1/2)
eNB

MME

new MME

MME

old ld MME

EMM_Registered UE RRC_Idle + ECM_Idle RRC_Connected Tracking Area Update Request S-TMSI/IMSI,old TAI, PDN (IP) address allocation Context Request ECM_Co ec ed C Connected S-TMSI/IMSI,old TAI Context Response Authentication Request mobility/context data authentication challenge Authentication Response Context Acknowledge Authentication response S-TMSI/IMSI,old TAI Create Bearer Request IMSI, IMSI bearer contexts Create Bearer Response new SGW-S1 IP/TEID

new Serving Gateway (SGW)

old ld Serving PDN Gateway Gateway (SGW)

HSS

Update Bearer Request new SGW-S5 IP/TEID SGW S5 Update Bearer Response PDN GW IP/TEID

11

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

TrackingAreaUpdate(2/2)
eNB

MME

new MME

MME

old MME

Update Location new MME identity, IMSI,

new Serving Gateway (SGW)

old Serving PDN Gateway Gateway (SGW)

HSS

Cancel Location IMSI, cancellation type = update Cancel Location Ack Delete Bearer Request TEID Delete Bearer Response Update Location Ack p Tracking Area Update Accept new S-TMSI, TA/TA-list Tracking Area Update Complete EMM_Registered RRC_Idle + ECM_Idle

12

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

MultiTrackingAreaRegistrationConcept
UEonlytriggers TAUwhenmoving toacellbelonging to a cell belonging toaTAnotintheTA listforthatUE.

13

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

LTE/SAEHandover
WhentheUEisinECM_Connected state,mobilityhandlingtakesplace vianetworkcontrolledhandoverswithUEassistance. UEassistanceheresimplymeansthattheUEsendsmeasurements andreportstotheeNB toassistinthehandoverdecision. Currently it is planned that neighbour cells are based on the UEs cell CurrentlyitisplannedthatneighbourcellsarebasedontheUE s cell detectioncapabilitiesratherthanonanetworksuppliedneighbour celllist. IntraLTE/SAENetworkHandoverTypes: / k d
1.IntraeNB handover. 2.IntereNB handoverwithX2interfaceandwithoutCNnoderelocation 3.IntereNB handoverwithoutX2Interface(withorwithoutCNnode relocation).

14

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

HandoverProcedure:IntereNBHandoverwithX2 InterfaceandwithoutCNRelocation
Before handover SAE GW MME Handover preparation SAE GW MME Radio handover SAE GW MME Late path switching SAE GW MME

Source eNB

Target eNB

= Data in radio = Signalling in radio

15

= GTP tunnel = GTP signalling

AirLinkSetupLTE/SAEProcedures

= S1 signalling = X2 signalling

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

UserplaneswitchinginHandover

16

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

IntereNB HandoverwithX2interface&withoutCN Relocation(1/2) Relocation (1/2)

source eNB ECM_Connected RRC: Measurement Control Packet Data RRC: Measurement Report HO Decision X2AP: Handover Request target cell, serving MME & SAE GW, Admission Control: allocates resources for incoming UE X2AP: Handover Request Ack HO-command, X2 data f O forwarding tunnel, target eNB

MME

Serving Gateway (SGW)

RRC: Handover Command target cell description, C-RNTI, detach source cell forward buffered DL packets sync. target cell

DL Packet Data

buffering of DL packets from old eNB

17

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

IntereNB HandoverwithX2interface&withoutCN Relocation(2/2)

source eNB Synchronization UL Allocation + timing advance RRC: Handover Confirm S1AP: Handover Complete Path Switch Request Update Bearer Request target eNB IP/TEID, target eNB IP/TEID, forwards DL packets and accepts UL switch DL packets Path S1AP: Handover Complete Ack Update Bearer Response p Path Switch Req. Ack. new SGW-S1 IP/TEID, new SGW-S1 IP/TEID, target eNB

MME

Serving Gateway (SGW)

Packet Data

X2AP: Release Resources flush DL buffers release resources Packet Data DL Packet Data

18

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

LTE/SAESecurity:EPSAuthenticationandKey Agreement(AKA) g
EPSAuthenticationandKeyAgreement(EPSAKA)shallbebasedonUMTSAKA. UMTSAuthenticationandKeyAgreementisaprotocoldesignedtosupport roamingandfastreauthentication. df h Itwasoriginallydesignedtoachievemaximumcompatibilitywith2Gsecurity mechanisms. TherequirementsonEPSAKAare:
EPSAKAshallbebasedonUSIMandextensionstoUMTSAKA AccesstoEUTRANwith2GSIMshallnotbegranted.R99USIMwillbeaccepted. EPSAKAshallproducekeysthatarethebasisofCplaneandUplaneprotection UMTSAKAachievesmutualauthenticationbetweentheuserandthenetworkby demonstratingknowledgeofapresharedsecretkeyKwhichisonlyknownbytheUSIM andtheAUCintheusersHSS.

19

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

EPSAuthenticationProcedure
MME
NAS: attach Request User Id, UE Capabilities, etc. , p , Authentication Data Request Authentication Data Response Authentication Vectors: RAND(i), KASME(i), XRES(i) () () () NAS: USER Authentication Request KASME(i), RAND(i) NAS: USER Authentication Response RES(i) If RES(i) XRES(i) RES(i)=XRES(i) Authentication successful

HSS

UE uses KASME to verify the Network

RAND is a random value KASME is an authentication parameter used, among other tasks, for network authentication XRES is the UE expected result of the authentication computation
20 AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn

ITU/BDT Arab Regional Workshop on 4G Wireless Systems -Tunisia 2010

Thanks for your Attention foryour

21

AirLinkSetupLTE/SAEProcedures

www.cert.nat.tn