LTE

Long Term Evolution (LTE) technology is an evolution of UMTS. Long Term Evolution is advancement towards faster and more efficient 4G network. The technology can reach downlink peak rates of 100Mbps and uplink speeds of 50Mbit/s, using variable bandwidth from 20Mhz down to 1.4Mhz. LTE is designed with a full Internet Protocol (IP) network infrastructure. The evolved packet system (EPS) of 3GPP Release 8 specifications consists of:

-          evolved packet core (EPC) and

-          radio network evolution, the evolved UTRAN (E-UTRAN), also known as LTE.

Terminology

The EPC consists of one control- plane node, called a mobility management entity (MME), and two user-plane nodes, called serving gateway (S-GW) and packet-data network gateway (P-GW).

eNodeB: Enhanced Node B. The LTE radio-access network consists of base stations, called enhanced NodeB (eNB), that are connected to each other through the X2 interface and to the EPC through the S1 interface. eNode B is a merger of the RNC and Node-B  from the pre 3GPP2 8.0 days, and this consolidation helps in   reduced latency with fewer hops. This is the only node in the Evolved Universal Terrestrial Radio Access (eUTRAN) and controls all radio related functions in the fixed part of the system. The eNodeB is also responsible for header compression, ciphering and reliable delivery of packets. On the control side, it is responsible for admission control and radio resource management.

MME: Mobility Management Entit.  MME is a signaling entity. User's data IP packets do not go through the MME. Its manages mobility, authentication and authorization, and a few other management functions.

PDN Gateway: Packet Data Network Gateway. It is the edge router between the EPC and external packet data networks. It is the highest level mobility anchor in the system

SGW: Serving Gateway. SGW’s function is tunnel management and switching packets to the PGW. The other function of SGW is in mobility. It is the local mobility anchor, when UEs switches between eNodeBs.

The mobile terminal is called as user equipment (UE). 

Other definitions are as follows:

LTE:                        Long term evolution

eNB:                      Evolved Node B

EPC:                       Evolved packet core

E-UTRAN:            Evolved UMTS terrestrial radio access network

3GPP:                    3rd Generation Partnership Project

Initial Connection Procedure

The NAS procedures, especially the connection management procedures, are fundamentally similar to UMTS. The main change from UMTS is that EPS allows concatenation of some procedures to allow faster establishment of the connection and the bearers.

Once the UE is powered on and connects to the EPS, it performs an “attach” procedure to register itself to the EPS to start a packet data session over the EPS.

Sometime prior to the UE being powered on, the eNodeB executes protocol Setup Procedures of the S1AP (S1 Application Protocol) and connects with the MME using Setup Request and Response messages. Parameters passed are eNodeB ID, MME code and Tracking Area code. Tracking areas are important in the sense that UEs are paged in this zone.

When the UE comes up, it establishes the RRC Connection with the eNodeB. Once this is in place, the UE sends an “Attach Request” piggybacking  the  “PDN connectivity Request” to eNodeB to request for a Bearer connection. eNodeB receives this message and sends S1AP “Initial UE Message / PDN Connectivity Request” to MME to set up a S1 connection to the MME for this UE.  The following things happen inside the LTE network as a result:

As part of the above “Attach” procedures between the UE, eNodeB, and MME, there are multiple messages exchanged between the various entities of the LTE Network. These are as follows:

a)      The MME on receiving the “Attach Request” from the UE/eNodeB, sends a “Authentication Information Request” to the HSS (Home Subscription Server), which responds with “Authentication Information Answer”. Security keys are exchanged as part of UE authentication by the MME/HSS.

b)      The MME then initiates “Update Location” protocol exchange with the HSS, by sending an “Update Location Request” and receiving an “Update Location Answer” from the HSS. The HSS sends back information on the UE, that contains, APN (Access Point Name), PGW Address and “Quality of Service” (QoS) parameters.

c)       Next, “Create Session Request” message is sent on the S11 interface by the MME to the SGW. The SGW was selected based on the TAI (Tracking Area Identity) that the eNodeB was provided during the attach procedure earlier. Note that the SGW selection is based on subscriber location, but the PGW selection is based on the APN, that is provided by HSS during the “Attach” procedure. In the “Create Session Request”, the MME creates a EPS Bearer ID to the bearer.

d)      The SGW contacts the PGW in one of the 2 ways:

a.       via “Proxy Binding Update” and in turn receives a “Proxy binding Acknowledgement”. This process assigns an IPv4 address and a GRE tunnel between the PGW and SGW.

b.      via “Create Session Request” message to the PGW, which in turn sends back a “Create Session Response” with the  (PDN GW Address for the user plane, PDN GW TEID of the user plane, PDN GW TEID of the control plane, PDN Type, PDN Address, EPS Bearer Identity, EPS Bearer QoS, Protocol Configuration Options, Charging Id) etc. The SGW knows the address of the PDN-GW to having obtained it from the MME during the authentication/authorization phase.

e)      The SGW then sends back a “Create Session Response” message back to the MME, that contains the SGW TEID, EBI and Bearer QoS values. The MME sends back these values to eNodeB in the S1AP “ERAB (E-UTRAN Radio Access Bearer) Setup Request Message” piggybacking the “Activate Default EPS Bearer Context Request” Message. This piggybacked message contains the SGW FTIED, EBI and QoS values.

The eNodeB now extracts the SGW FTIED, EBI and QoS values from the “S1AP ERAB Setup Request” message from MME, and sends a  “RRC Connection Reconfig” to the UE. This includes the “Attach Accept ” and it  also piggybacks the “Activate Default EPS Bearer Context Request NAS” message.  Note - The ATTACH ACCEPT message may be sent combined with an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message if the PDN CONNECTIVITY REQUEST message is found in the ATTACH REQUEST message (sent earlier in the steps above). ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message contains the configuration needed to activate the default bearer.

The UE now sends a “RRC Connection Reconfig Complete” message to the eNodeB. This includes the “Attach Complete”, and piggybacks the “Activate Default Bearer Context Accept” message.

The eNodeB in turn sends “S1AP ERAB Setup Response” also called “Initial Context Response”  to the MME.   It contains the “Activate Default EPS Bearer Context Accept”, resulting in a “Modify Bearer Request” and “Response” packet between the MME and SGW. These messages also trigger another Proxy Binding Updte” between the SGW and PGW over the S5 interface, and information on the data tunnel is exchanged. This successfully completes the “attach” procedure.

Simulator Details

The simulator is written in C as a user space utility, and implements a basic GTPv2 packet exchange format with

-          Create Session Request/Response,

-          Modify Session Request/Response packets and

-          Echo Request/Response packets

Using the simulator, once can simulate a MME or a SGW, and can send GTPv2 packets like “Create Session Request” with various IEs and watch how the PGW responds.

Configuration

Lte/config/lteconfig:

The simulator is configured with PGW or MME address in the lteconfig file, which is parsed by lex/yacc when the simulator is running to use the various parameters that the user has configured. The various items that are configurable are

-          Debug: If Debug string is found, the simulator prints out detailed debugs on the console

-          PGW IP address

-          Numbe of PDP sessions to emulate

-          MySQL Database name for results

Results

Result are written to the msql database that the simulator connects to. The name of the database is

picked up from the lteconfig file. The results are multiple lines of the following format.

-          Tmestamp, Packet type sent/recvd, status

GTPv2 Create Session Details              

Create Session Request

The Create Session Request message shall be sent on the S11 interface by the MME to the SGW, and on the S5/S8 interface by the SGW to the PGWas part of the procedures [3]:

-          E-UTRAN Initial Attach

-          UE requested PDN connectivity

The simulator is configured as a SGW to send the GTPv2 “Create Session Request” to the PGW and is connected to the PGW via Ethernet. 

The packet looks like the following:

 

From the “Create Session Request” packet above, it is seen that there are multiple mandatory IEs that need to be included in the initial packet when the UE is attached for the first time. The explanation of the IEs is given below.

IMSI is the identity of the mobile subscriber, and consists of Mobile Country Code (MCC), Mobile Network Code (MNC) and Mobile Subscriber Identification Number (MSIN).

Note: On S5/S8 interface, one of the following 2 protocols are used.

1)      GPRS Tunnelling Protocol, User Plane (GTP-U): GTP-U is used when S5/S8 is GTP based. GTP-U forms the GTP-U tunnel that is used to send End user IP packets belonging to one EPS bearer. It is used in S1-U interface, and is used in S5/S8 if the CP uses GTP-C.

2)      Generic Routing Encapsulation (GRE): GRE is used in the S5/S8 interface in conjunction with PMIP. GRE forms an IP in IP tunnel for transporting all data belonging to one UE’sconnection to a particular PDN. GRE is directly on top of IP, and UDP is not used.

References

[1] 3GPP TS 23.401 V10.1.0 (2010-09) 3GPP, General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network, (E-UTRAN) access (Release 10)

[2] IPv6 in 3GPP Evolved Packet System, http://tools.ietf.org/html/draft-korhonen-v6ops-3gpp-eps-00

[3] 3GPP TS 29.274 V8.5.0 (2010-03), Evolved General Packet Radio Service (GPRS), Tunnelling Protocol for Control plane, (GTPv2-C); Stage 3, (Release 8)