doc8-lte workshop tun session7 air link setup
TRANSCRIPT
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
ITU/BDT Arab Regional Workshop onITU/BDT Arab Regional Workshop onLTE Systemy
Session 7 : Air Link SetupSession 7 : Air Link Setup
LTE/SAE Procedures/
Speakers M. Lazhar BELHOUCHETM Hakim EBDELLIM. Hakim EBDELLI
Date 27 – 29 January 2010
www.cert.nat.tn1 1Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Agenda
• Attach
• S1 Release
• DetachDetach
• Service Request
• Tracking Area Update
• Dedicated SAE Bearer ActivationDedicated SAE Bearer Activation
• Inter eNB handover
www.cert.nat.tn2 Air Link Setup LTE/SAE Procedures 2
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Attach (1/2)MME HSSUE new Serving PDNMME HSSPCRF
UE eNBnewMME Gateway
(SGW)
PDNGateway
EMM_Deregistered
RRC C d
Attach Request
S-TMSI/IMSI,old TAI, IP address allocation
RRC_Connected
ECM C t d
Authentication Request
Authentication Response
Authentication Vector Request (IMSI)
Authentication Vector Respond
ECM_Connected
pUpdate Location
Insert Subscriber Data
IMSI, subscription data = default APN, tracking area restrictions, …IMSI, subscription data default APN, tracking area restrictions, …Insert Subscriber Data Ack
Update Location Ack
www.cert.nat.tn3 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Attach (2/2)HSSPCRFUE eNB
new ServingGateway PDN
MME HSSPCRFUE eNB MME Gateway(SGW) Gateway
select SAE GWCreate Default Bearer Request
IMSI RAT type default QoS PDN address infoCreate Def. Bearer Req.
Create Def Bearer Rsp
IMSI, RAT type, default QoS, PDN address info
IMSI, …, IP/TEID of SGW-S5PCRF Interaction
Includes Attach AcceptS-TMSI, security info, PDN address, …,IP/TEID
Create Def. Bearer Rsp.
IP/TEID of SGW-S1u,PDN address, QoS, …
Create Def. Bearer Rsp.
PDN address, IP/TEID of PDN GW,QoS according PCRF
Attach Accept RB Est. Req.
Includes Attach Complete
Update Bearer Response
Update Bearer RequestIP/TEID of eNB for S1u
Attach Complete
IP/TEID of eNB for S1u
RB Est. Resp. of SGW-S1u (only for eNB)
EMM_DeregisteredUpdate Bearer Response
UL/DL Packet Data via Default EPS Bearer
_ g
ECM_Connected
www.cert.nat.tn4
UL/DL Packet Data via Default EPS Bearer
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
S1 ReleaseAfter attach UE is in EMM_Registered state.The default Bearer has been allocated (RRC_connected + ECM_connected) even it may not transmit or receive dataIf there is a longer period of inactivity by this UE, then we should free these admission control resources (RRC_idle + ECM_idle)The trigger for this procedure can come from eNB or from MME.
MME ServingGateway(SGW)
PDNGateway
EMM_Registered
S1 Release Requestcause
Update Bearer Request
release of eNB S1u resources
(SGW)ECM_Connected
RRC Connection Release
release of eNB S1u resourcesUpdate Bearer Response
S1 Release Commandcause
RRC Connection Release Ack
S1 Release Complete
RRC Connection Release Ack
S1 Signalling Connection ReleaseEMM_Registered
ECM Idl
www.cert.nat.tn5
ECM_Idle
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Detach Can be triggered by UE or by MME.gg y yDuring the detach procedure all SAE bearers with their associated tunnels and radio bearers will be deleted.Note: Detach procedure initiated by UE
MMEEMM-RegisteredServingGateway(SGW)
PDNGateway
Note: Detach procedure initiated by UE.
Delete Bearer Request
(SGW)
NAS Detach Requestswitch off flag Delete Bearer Request
RRC_Connected
ECM Connected
NAS: Detach AcceptedDelete Bearer Response
Delete Bearer Response
PCRF
ECM_Connected
S1 Signalling Connection ReleaseEMM-Deregistered
www.cert.nat.tn6
RRC_Connected + ECM Idle
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Detach
Note: Detach procedure initiated by MME.
Serving PDNMMEEMM-Registered
gGateway(SGW)
Gateway
NAS Detach Request
RRC_Connected
Delete Bearer Request
Delete Bearer Response
NAS Detach Requestswitch off flag Delete Bearer Request
Delete Bearer ResponseECM_Connected
NAS: Detach AcceptedDelete Bearer Response
PCRF
S1 Signalling Connection ReleaseS1 Signalling Connection Release
EMM-Deregistered
RRC Connected + ECM Idle
www.cert.nat.tn7
RRC_Connected + ECM Idle
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Service Request (1/2) From time to time a UE must switch from ECM_Idle to ECM_connectedThe reasons for this might be UL data is available, UL signaling is pending (e.g. tracking area update, detach) or a paging from the network was received.
MMEServingGateway(SGW)
PDNGateway
RRC_Idle+ ECM_Idle
PagingS-TMSI, TAI/TAI-list
DL Packet DataDL Packet NotificationPagingS-TMSI
RRC Connected
Service RequestS-TMSI, TAI, service type
ECM_Connected
RRC_Connected
Authentication Requestauthentication challengeAuthentication ResponseAuthentication response
www.cert.nat.tn8
u e ca o espo se
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Service Request (2/2)
MMEServingGateway(SGW)
PDNGateway
Initial Context Setup Req.
( )
SGW-S1 IP/TEID, QoSRB Establishment Req.
Update Bearer Request
RB Establishment Rsp.Initial Context Setup Rsp.
eNB-S1 IP/TEID Update Bearer Request
eNB-S1 IP/TEIDUpdate Bearer Response
eNB S1 IP/TEID, ..
www.cert.nat.tn9 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Tracking Area Update (TAU)
Tracking area (TA) is similar to Location/Routing area in 2G/3G .Tracking Area Identity = MCC (Mobile Country Code), MNC (Mobile Network Code)
d TAC (T ki A C d )and TAC (Tracking Area Code).When UE is in ECM-Idle, MME knows UE location with Tracking Area accuracy.
www.cert.nat.tn10 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Tracking Area Update (1/2) ld ld
MME HSSeNB newMME MME
oldMME
newServingGateway(SGW)
PDNGateway
oldServingGateway(SGW)UEEMM_Registered
RRC_Idle + ECM_Idle
Tracking Area Update Request
Context RequestS-TMSI/IMSI,old TAI, PDN (IP) address allocation
RRC_Connected
ECM ConnectedS-TMSI/IMSI,old TAIContext Responsemobility/context dataAuthentication Request
authentication challengeAuthentication Response
C _Co ec ed
Authentication ResponseAuthentication response
Create Bearer RequestIMSI bearer contexts
Context AcknowledgeS-TMSI/IMSI,old TAI
Update Bearer Requestnew SGW S5 IP/TEIDIMSI, bearer contexts new SGW-S5 IP/TEID
Create Bearer Responsenew SGW-S1 IP/TEID
Update Bearer ResponsePDN GW IP/TEID
www.cert.nat.tn11 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Tracking Area Update (2/2) MME
HSSeNBnewMME MME
oldMME
newServing PDN
oldServingMME
Gateway(SGW)
GatewayUpdate Locationnew MME identity, IMSI, …
Cancel Location
Gateway(SGW)
IMSI, cancellation type = update
Cancel Location Ack
Delete Bearer RequestTEID
Delete Bearer Response
Update Location AckpTracking Area Update Accept
new S-TMSI, TA/TA-list
Tracking Area Update Complete
EMM_Registered
RRC_Idle + ECM_Idle
www.cert.nat.tn12 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
“Multi Tracking Area Registration” Concept
• UE only triggers TAU when moving to a cell belongingto a cell belonging to a TA not in the TA list for that UE.
www.cert.nat.tn13 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
LTE/SAE Handover
– When the UE is in ECM_Connected state, mobility handling takes place via network controlled handovers with UE assistance.
– UE assistance here simply means that the UE sends measurements and reports to the eNB to assist in the handover decision.
– Currently it is planned that neighbour cells are based on the UE’s cellCurrently it is planned that neighbour cells are based on the UE s cell detection capabilities rather than on a network supplied neighbour cell list.
/ k d– Intra LTE/SAE Network Handover Types:• 1.Intra eNB handover.
• 2.Inter eNB handover with X2 interface and without CN node relocation
• 3.Inter eNB handover without X2 Interface (with or without CN node relocation).
www.cert.nat.tn14 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Handover Procedure: Inter eNB Handover with X2 Interface and without CN Relocation
Before handover
Handover preparation Radio handover Late path
switching
SAE GW
MME
SAE GW
MME
SAE GW
MME
SAE GW
MME
Source eNB
Target eNB
= Data in radio= Signalling in radio
= GTP tunnel= GTP signalling
= S1 signalling= X2 signalling
www.cert.nat.tn15
= Signalling in radio = GTP signalling = X2 signalling
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
User plane switching in Handover
www.cert.nat.tn16 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Inter eNB Handover with X2 interface & without CN Relocation (1/2)Relocation (1/2)
MMEECM Connected
ServingGateway(SGW)
sourceeNB
targeteNB
RRC: Measurement Control
_
Packet Data
RRC: Measurement Report
O f
X2AP: Handover Requesttarget cell, serving MME & SAE GW, …
RRC: Measurement Report
HO DecisionAdmission Control: allocatesresources for incoming UEX2AP: Handover Request Ack
HO-command, X2 data forwarding tunnel, …RRC: Handover Commandtarget cell description, C-RNTI,…
detach source cell
sync. target cell
forward bufferedDL packets
buffering of DLpackets from old eNB
DL Packet Data
www.cert.nat.tn17
sync. target cell
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Inter eNB Handover with X2 interface & without CN Relocation (2/2)
MMEServingGateway(SGW)
sourceeNB
targeteNB
Synchronization
Update Bearer Request
S1AP: Handover CompletePath Switch Requesttarget eNB IP/TEID, …
UL Allocation + timing advance
RRC: Handover Confirm
Update Bearer Response
target eNB IP/TEID, …
switch DLPath
S1AP: Handover Complete Ack
Packet Data forwards DL packetsand accepts UL
packets
Update Bearer Responsenew SGW-S1 IP/TEID, …
pPath Switch Req. Ack.
new SGW-S1 IP/TEID, … X2AP: Release Resources
flush DL buffers DL Packet Data
release resources
Packet Data
www.cert.nat.tn18 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
LTE/SAE Security: EPS Authentication and Key Agreement (AKA) g
• EPS Authentication and Key Agreement (EPS AKA) shall be based on UMTS AKA.
• UMTS Authentication and Key Agreement is a protocol designed to support d f hroaming and fast re‐authentication.
• It was originally designed to achieve maximum compatibility with 2G security mechanisms.
• The requirements on EPS AKA are:– EPS AKA shall be based on USIM and extensions to UMTS AKA
– Access to E‐UTRAN with 2G SIM shall not be granted. R99 USIM will be accepted.
– EPS AKA shall produce keys that are the basis of C‐plane and U‐plane protection
– UMTS AKA achieves mutual authentication between the user and the network by demonstrating knowledge of a pre‐shared secret key K which is only known by the USIM and the AUC in the user’s HSS.
www.cert.nat.tn19 Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
EPS Authentication Procedure
MME HSS
NAS: attach RequestUser Id, UE Capabilities, etc. Authentication Data Request
Authentication Vectors: RAND(i), KASME(i), XRES(i)
Authentication Data Response
, p ,
( ) ASME( ) ( )NAS: USER Authentication Request
KASME(i), RAND(i)
NAS: USER Authentication ResponseIf RES(i) XRES(i)
UE uses KASME to verify
the Network
RAND is a random value
RES(i)If RES(i)=XRES(i)
Authentication successful
RAND is a random valueKASME is an authentication parameter used, among other tasks, for network authentication XRES is the UE expected result of the authentication computation
www.cert.nat.tn20
XRES is the UE expected result of the authentication computation
Air Link Setup LTE/SAE Procedures
ITU/BDT Arab Regional Workshop on “4G Wireless Systems” -Tunisia 2010
Thanks for your AttentionThanks for your Attention
www.cert.nat.tn21 Air Link Setup LTE/SAE Procedures