eNodeB MME

S1AP View of LTE Attach & EPS Bearer Setup

This sequence diagram looks at the UE signaling from the S1AP vantage point. The following signaling is covered:

(1) UE Attach, authentication and security signaling

(2) Setup of two EPS Bearers (RAB id 5 and 6)

(3) Release of UE context due to inactivity

(4) Reestablishment of the UE context with a Service Request.

Click on any message title in this flow to see the complete message details.

EventHelix.com Inc, 2014.

Generated with EventStudio (http://www.eventhelix.com/eventstudio/) and VisualEther (http://www.eventhelix.com/visualether/)

Note: You can click on any message title in this flow to see complete field level details.

LTE Attach and Default EPS Bearer Establishment on a PDN

Register the UE with the Core Network and initiate the data service by setting up the default EPS Bearer.

allocate The eNodeB allocates 1 as the

ENB-UE-S1AP-ID: 1 ENB-UE-S1AP-ID for the new
session.
Initial UE Message {ATTACH REQUEST, PDN CONNECTIVITY REQUEST} Initial UE Message contains an
1 Attach Request and PDN
Connectivity Request. The message
ENB-UE-S1AP-ID: 1, contains UE specific information
.000 .... = NAS key set identifier: (0),
MME Group ID: 32769, like the PLMN and Tracking Area.
MME Code: 1, The message also contains
M-TMSI: 0x00000001, information about the requested
NAS EPS session management messages: PDN connectivity request (0xd0), services. UE also sends ESM
Protocol or Container ID: Internet Protocol Control Protocol (0x8021),
Code: Configuration Request (1), information transfer flag in the PDN
Protocol or Container ID: DNS Server IPv4 Address Request (0x000d), CONNECTIVITY REQUEST message
Protocol or Container ID: IP address allocation via NAS signaling (0x000a), to signal that the APN will be sent
Protocol or Container ID: IPv4 Link MTU Request (0x0010), after the encryption has been
Location Area Code (LAC): 0x0001 (1),
tAC: 0001, established.
RRC-Establishment-Cause: mo-Signalling (3)

allocate The MME allocates 211 as the

MME-UE-S1AP-ID: 211 MME-UE-S1AP-ID for the session.

Authenticate and Setup Encryption

The UE and the Network mutually authenticate each other. This is followed by setting up encryption.
Downlink NAS Transport {AUTHENTICATION REQUEST} The MME sends an Authentication
1 211 Request to the UE. The message
contains the RAND and AUTN
MME-UE-S1AP-ID: 211, numbers. Key selection identifier
ENB-UE-S1AP-ID: 1,
.... .000 = NAS key set identifier: (0) ASME, (KSI-ASME) is also included in the
RAND value: e80526e22caab2fc9a4dda558c612e6a, message. This message is sent in
SQN xor AK: 9113c6e1085c, the clear.
AMF: 9001,
MAC: df93421ca180ebe5
 eNodeB MME
Uplink NAS Transport {AUTHENTICATION RESPONSE} The UE sends the RES value back
1 211 to the MME.
MME-UE-S1AP-ID: 211,
ENB-UE-S1AP-ID: 1,
RES: 3158e212e3432930,
tAC: 0001

Downlink NAS Transport {SECURITY MODE COMMAND} MME initiates the NAS security
1 211 procedure. The encryption and
integrity protection algorithms are
MME-UE-S1AP-ID: 211, included in the message. Key
ENB-UE-S1AP-ID: 1,
.000 .... = Type of ciphering algorithm: EPS encryption algorithm EEA0 (null ciphering algorithm) (0), selection identifier (KSI-ASME) is
.... .001 = Type of integrity protection algorithm: EPS integrity algorithm 128-EIA1 (1), also included in the message.
.... .000 = NAS key set identifier: (0) ASME,
.... .001 = IMEISV request: IMEISV requested (1)

Uplink NAS Transport {SECURITY MODE COMPLETE} UE responds back to the MME. This
1 211 message is sent with NAS ciphering
and integrity protection.
MME-UE-S1AP-ID: 211,
ENB-UE-S1AP-ID: 1,
BCD Digits: 3544270632334702,
tAC: 0001

ESM Information Request Procedure

Obtain additional UE parameters that could not be exchanged before an encrypted path was setup.
Downlink NAS Transport {ESM INFORMATION REQUEST} The ESM information request
1 211 procedure is used by the network
to retrieve protocol configuration
MME-UE-S1AP-ID: 211, options like APN etc. from the UE
ENB-UE-S1AP-ID: 1
during the attach procedure. This
procedure is used as the UE has
indicated (in the PDN
CONNECTIVITY REQUEST) that it
has ESM information that needs to
be sent with security.
Uplink NAS Transport {ESM INFORMATION RESPONSE} The UE shall send an ESM
1 211 INFORMATION RESPONSE
message to the network. The UE
MME-UE-S1AP-ID: 211, shall include all the protocol
ENB-UE-S1AP-ID: 1,
APN: nxtgenphone, configuration options that need to
tAC: 0001 be transferred security protected.
 eNodeB MME

Default EPS Bearer Establishment

Setup the data service and assign an IP address to the UE. Also setup QoS parameters.
Initial Context Setup Request {ATTACH ACCEPT, ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST} The MME responds with a combo
1 211 message containing the Attach
Accept and the Default Bearer
MME-UE-S1AP-ID: 211, establishment request. The bearer
ENB-UE-S1AP-ID: 1,
e-RAB-ID: 5, request specifies the QoS, APN and
transportLayerAddress: 7f000164 [bit length 32, 0111 1111 0000 0000 0000 0001 0110 0100 decimal value PDN information.
2130706788],
transportLayerAddress(IPv4): 127.0.1.100 (127.0.1.100),
gTP-TEID: 7e10b568,
.... .010 = Attach result: Combined EPS/IMSI attach (2),
NAS EPS session management messages: Activate default EPS bearer context request (0xc1),
Quality of Service Class Identifier (QCI): QCI 9 (9),
APN: nxtgenphone,
PDN IPv4: 192.168.3.129 (192.168.3.129),
Protocol or Container ID: Internet Protocol Control Protocol (0x8021),
Code: Configuration Nak (3),
MME Group ID: 32769,
MME Code: 1,
M-TMSI: 0x00000001,
Location Area Code (LAC): 0x0001 (1),
SecurityKey: 061787a33046218e9a58bb029aeff40d6e2ea1a1fe4f09af... [bit length 256]

UE Capability Info Indication UE sends a detailed capability

1 211 information message. This
message specifies the hardware
MME-UE-S1AP-ID: 211, and software features of the UE.
ENB-UE-S1AP-ID: 1,
accessStratumRelease: rel10 (2),
ue-Category: 4,
...1 .... profile0x0001: True

Initial Context Setup Response [E-RAB Setup List Res] The eNodeB responds back to the
1 211 Initial Context Setup Request with
details about the RAB
MME-UE-S1AP-ID: 211, establishment (eRAB id 5).
ENB-UE-S1AP-ID: 1,
e-RAB-ID: 5,
transportLayerAddress: 7f000101 [bit length 32, 0111 1111 0000 0000 0000 0001 0000 0001 decimal value
2130706689],
transportLayerAddress(IPv4): 127.0.1.1 (127.0.1.1),
gTP-TEID: 6f84e480

Uplink NAS Transport {ATTACH COMPLETE, ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT} The eNodeB then transports the
1 211 attach acceptance and the default
EPS Bearer acceptance.
MME-UE-S1AP-ID: 211,
ENB-UE-S1AP-ID: 1,
NAS EPS session management messages: Activate default EPS bearer context accept (0xc2),
tAC: 0001

Connecting to a Second PDN and Activating the Default EPS Bearer for the PDN

The UE connects to a second Packet Data Network and establishes the Default Bearer for the second
PDN.
Uplink NAS Transport {PDN CONNECTIVITY REQUEST} The UE wishes to connected to a
1 211 second PDN. The APN for the
second PDN is included in the NAS
MME-UE-S1AP-ID: 211, message received from the UE.
ENB-UE-S1AP-ID: 1,
APN: ims,
tAC: 0001
 eNodeB MME
E-RAB Setup Request {ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST} The MME accepts the second PDN
1 211 connectivity requests and initiates
establishment of the Default EPS
MME-UE-S1AP-ID: 211, Bearer for the second PDN.
ENB-UE-S1AP-ID: 1,
APN: ims

E-RAB Setup Response The eNodeB responds with details

1 211 about the RAB establishment for
the new RAB (eRAB id 6)
MME-UE-S1AP-ID: 211,
ENB-UE-S1AP-ID: 1,
e-RAB-ID: 6,
transportLayerAddress: 7f000101 [bit length 32, 0111 1111 0000 0000 0000 0001 0000 0001 decimal value
2130706689],
transportLayerAddress(IPv4): 127.0.1.1 (127.0.1.1),
gTP-TEID: 6f84e481

Uplink NAS Transport {ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT} UE responds back with the
1 211 establishment of the Default EPS
Bearer for the second PDN.
MME-UE-S1AP-ID: 211,
ENB-UE-S1AP-ID: 1,
tAC: 0001

Data Transfer

Releasing the UE Context After Inactivity

The eNodeB initiates the release of the UE context if the data service has been inactive for some time.
UE Context Release Request The data transfer has been
1 211 completed. The eNodeB detects
inactivity and requests the release
MME-UE-S1AP-ID: 211, of the UE context.
ENB-UE-S1AP-ID: 1

UE Context Release The MME initiates the UE context

1 211 release.
mME-UE-S1AP-ID: 211,
eNB-UE-S1AP-ID: 1

UE Context Release The UE context has been released.

1 211 Note that the default bearers are
still present. Only the radio
MME-UE-S1AP-ID: 211, resources have been released.
ENB-UE-S1AP-ID: 1

free
ENB-UE-S1AP-ID: 1

free
MME-UE-S1AP-ID: 211

Resuming Service with a Service Request

When the user starts sending data, the service is resumed again. There is no need to repeat the security
procedures and setup the radio bearers. The abbreviated procedure reduces latency and hence improves
user experience.

UE wishes to resume data

transfer
 eNodeB MME

allocate The eNodeB allocates 2 as the

ENB-UE-S1AP-ID: 2 ENB-UE-S1AP-ID for the new
session.
Initial UE Message {SERVICE REQUEST} The Initial UE Message contains the
2 Service Request message. The
Service Request procedure
ENB-UE-S1AP-ID: 2, resumes the existing bearers and
NAS-PDU: c7055ac8,
Message authentication code (short): 0x5ac8, encryption is setup without
pLMNidentity: 134001, requiring additional security
m-TMSI: 00000001 handshakes.

allocate The MME allocates 212 as the

MME-UE-S1AP-ID: 212 MME-UE-S1AP-ID for the session.

Initial Context Setup Response[E-RAB Setup List, UE Security and Radio Capabilities, Security Key] The Initial Context Setup Response
2 212 resumes the existing bearers. The
UE security is also setup with the
MME-UE-S1AP-ID: 212, single handshake.
ENB-UE-S1AP-ID: 2,
e-RAB-ID: 5,
transportLayerAddress: 7f000164 [bit length 32, 0111 1111 0000 0000 0000 0001 0110 0100 decimal value
2130706788],
transportLayerAddress(IPv4): 127.0.1.100 (127.0.1.100),
gTP-TEID: 7e10b56a,
e-RAB-ID: 6,
transportLayerAddress: 7f000164 [bit length 32, 0111 1111 0000 0000 0000 0001 0110 0100 decimal value
2130706788],
transportLayerAddress(IPv4): 127.0.1.100 (127.0.1.100),
gTP-TEID: 7e10b56b,
SecurityKey: 6904516fd4ec481fc0aaafaabf379cc328d009e7f824c53b... [bit length 256],
accessStratumRelease: rel10 (2),
ue-Category: 4,
...1 .... profile0x0001: True

Initial Context Setup [E-RAB Setup List Res] The eNodeB notifies the MME that
2 212 the eRABs have been setup
successfully.
MME-UE-S1AP-ID: 212,
ENB-UE-S1AP-ID: 2,
e-RAB-ID: 5,
transportLayerAddress: 7f000101 [bit length 32, 0111 1111 0000 0000 0000 0001 0000 0001 decimal value
2130706689],
transportLayerAddress(IPv4): 127.0.1.1 (127.0.1.1),
gTP-TEID: 6f84e482,
e-RAB-ID: 6,
transportLayerAddress: 7f000101 [bit length 32, 0111 1111 0000 0000 0000 0001 0000 0001 decimal value
2130706689],
transportLayerAddress(IPv4): 127.0.1.1 (127.0.1.1),
gTP-TEID: 6f84e483

Data Transfer

Releasing the UE Context After Inactivity

Inactivity on the data path results in the UE context getting released.

UE Context Release Request
2 212
MME-UE-S1AP-ID: 212,
ENB-UE-S1AP-ID: 2
 eNodeB MME
UE Context Release
2 212
mME-UE-S1AP-ID: 212,
eNB-UE-S1AP-ID: 2

UE Context Release
2 212
MME-UE-S1AP-ID: 212,
ENB-UE-S1AP-ID: 2

free
ENB-UE-S1AP-ID: 2

free
MME-UE-S1AP-ID: 212

Generated with EventStudio (http://www.eventhelix.com/eventstudio/) and VisualEther (http://www.eventhelix.com/visualether/).

EXPLORE MORE
LTE http://www.eventhelix.com/lte/

IMS http://www.eventhelix.com/ims/

LTE Attach Messaging http://www.eventhelix.com/lte/attach/LTE-Attach-Messaging.pdf

LTE Security http://www.eventhelix.com/lte/security/