4G Part 2

Evolved Packet Core

Vahid Shah-Mansouri
School of ECE, University of Tehran
References
 M. Sauter, “From GSM to LTE”, John Wiled and Sons, 2011.
Chapter 1.
 S. Sesia, I. Toufik, and M. Baker, “LTE: The UMTS Long Term
Evolution,” 2nd Edition, John Wiley & Sons Ltd, 2011.

2 Cellular Networks
EPC Structure and Function
 EPC has several functions:
 Network attachment/registration, bearer set ups, paging, IP addressing, handover.
 Three main elements with network functions: SGW, MME, PGW
 Some servers: HSS, PCRF
 Several interfaces: S1, S11, S5/S8, S10, S6a, Gx, SGi
 IMS is something besides EPC but strongly related.

3
 All-IP Operation
Control Plane
User Plane

4 Cellular Networks
Serving Gateway (SGW)
 It is the main border between the RAN and the core.
 On the RAN side, it terminates the S1 GTP tunnels,
 On the core network side, it terminates the S5 GTP tunnels to
the gateway.
 The SGW is a data plane element within the LTE SAE.
 Routing and forwarding data packets between eNBs and PDN
gateway based on tunnels.
 Acts as mobility anchor for the user plane during inter-
eNB handovers.

5 Cellular Networks
Mobility Management Entity (MME)
 MME is the main player of the control plane of the LTE SAE.
 As the MMEs are not involved in air interface matters, the
signaling it exchanges with the radio network is referred to as
Non-access Stratum (NAS) signaling.
 MME handles a number of functions:
 Registration:
 with the help of HSS, MME performs UE authentication.
 Bearer management:
 This includes the establishment, maintenance and release of the bearers and
it is handled by the NAS protocol.
 S-GW tunnel creation, maintenance, and release are handled by MME.
 Handover support:
 In case no X2 interface is available, the MME helps to forward the
handover messages between the two eNBs involved.
 Functions related to inter-working with other networks:
 This includes handing over of voice calls to legacy networks.

6 Cellular Networks
Packet Data Network (PDN) Gateway (PGW)
 The P-GW is responsible for
 Connecting the UE to the external
world.
 The PDN-GW terminates the S5 user
plane interface and GTP tunnel.
 Allocate IP address for the UE.
 Requested by MME after authentication.
 Performs QoS enforcement.
 Flow-based charging according to rules
from the PCRF.
 It also serves as the mobility anchor for
 inter-working with non-3GPP technologies.
 Roaming to other operators.
7 Cellular Networks
Home Subscriber Server (HSS)
 The HSS contains users’ SAE subscription data such as
the services, the EPS-subscribed QoS profile and any
access restrictions for roaming.
 HSS is unique in the network.
 LTE shares its subscriber database with GSM and UMTS.
 HLR and HSS are usually combined physically.
 In addition, the HSS holds dynamic information such as
the identity of the MME to which the user is currently
attached or registered.
 The HSS may also integrate the Authentication Centre
(AuC) server which generates the vectors for
authentication and security keys.

8 Cellular Networks
Home Subscriber Server (HSS)
 The most important parameters that the HSS holds are
 The user’s International Mobile Subscriber Identity (IMSI),
 Authentication information
 Circuit-switched service properties
 Packet-switched service properties
 The ID of the MME

9 Cellular Networks
Policy Control and Charging Rules Function
(PCRF)
 It is a server responsible
for
 controlling the flow-based
charging functionalities in
the Policy Control
Enforcement Function
(PCEF) which resides in the
P-GW.
 PCRF feeds PCEF with
policy charging (PCC)
rules.
 PCEF uses PCCs to make
decision for charging,
filtering, shaping, and QoS
control.

10 Cellular Networks
Policy Control and Charging Rules Function
(PCRF)
 Policy Control Enforcement
Function (PCEF) using PCC
 Detects a packet belonging
to a service data flow.
 Identifies the service that a
service data flow
contributes to.
 Provides applicable
charging parameters for a
service data flow.
 Provides policy control for
a service data flow.

11 Cellular Networks
Policy Control and Charging Rules Function
(PCRF)
 Policy charging control (PCC)
rule
 a rule name;
 service identifier;
 service data flow filter(s);
 gate status;
 QoS parameters;
 charging key (i.e. rating group);
 The PCEF shall select a PCC
rule for each received
packet by evaluating
received packets against
service data flow
12 Cellular Networks
Policy Control and Charging Rules Function
(PCRF)
 PCEP can have pre-
configured rules and can
operate independent of
PCRF.
 PCRF makes it dynamic.
 Connection of OCS, OFCS,
PCEF, and PCRF are based
on Diameter protocol.

13 Cellular Networks
Diameter
• Provides Authentication of users, Authorization and
Accounting of user.
• Carried over TCP or SCTP (or TLS over TCP/SCTP)
• Used as the signaling of the 4G Core network.

Client REQ Agent Request

Server
NAS: Network Access Answer Answer
Server
Relay e.g.
Proxy -Policy server
Mobile IPv4 FA
Redirect Agent
Server Msg
S-CSCF
e.g. stop service now - HSS
Diameter
Features
- Delivery of attribute value pairs: AVPs
- Capability negotiation User Authentication
- Error Notification
- Extensibility Service specific authentication info ->
- Sessions and Accounting grant service or not

 AVP Resource usage information

The Diameter protocol consists of - accounting and capacity planning is
a header followed by one or more supported
Attribute-Value-Pairs (AVPs).
AVP = header encapsulating Relay, proxy and redirect of requests
protocol-specific data (e.g.
routing information) + AAA thru a server hierarchy
information.

15 Cellular Networks
SAE QoS Provisioning
 SAE bearer is the connection between the UE and the core
network edge node (PDN-GW).
 Each bearer carries end-to-end services and is associated with
a QoS.

User Plane Bearer Service

SAE QoS Provisioning
 Service Data Flow (SDF) = IP flow
 SDFs are mapped to bearers by IP routing elements
(gateways)

17 Cellular Networks
SAE QoS Provisioning
 Each bearer (SDF) is recognized by following parameters:
 QoS Class Identifier (QCI)
 A scalar that is used as a reference to node specific parameters that
control packet forwarding treatment (e.g., scheduling weights, admission
thresholds, queue management thresholds, link layer protocol
configuration, etc.), and that have been pre-configured by the operator
owning the access node.
 Allocation and Retention Priority (ARP)
 The primary purpose or ARP is to decide if a bearer
establishment/modification request can be accepted or rejected in case
or resource limitation
 Guaranteed Bit Rate (GBR)
 Maximum Bit Rate (MBR)
 Aggregate Maximum Bit Rate (AMBR) (for non-GBR bearers)

18 Cellular Networks
SAE QoS Provisioning

19 Cellular Networks
 E-UTRAN Network Interfaces: S1 Interface
 The S1 interface connects the eNodeB to the EPC.
 It is split into two interfaces for control plane and user
plane.
 The protocol structure over S1 is based on a full IP
transport stack with no dependency on legacy SS7.

3GPP TS 36.413 , “S1 Application Protocol

(S1AP)”, version 14.4.0 Release 14.
20 Cellular Networks
S1-MME Interface (Control Plane)
 Connects UE to MME.
 Control Plane
 IP plus SCTP construct the transport
protocol.
 S1-Application Protocol (S1-AP) is the
main application protocol of the user
plane.
 NAS protocol is passed through this
interface.

21 Cellular Networks
S1-MME Interface (Control Plane)
 S1-AP functions:
 Bearer-level procedures
 On the scope of the S1 interface, a bearer
corresponds to the S1 segment of a session
plus the radio interface path.
 S1-AP is responsible for all procedures related
to bearer setup, modification and release
resources on Uu and S1 for one or several E-
RABs.
 Procedures: E-RAB Setup, E-RAB Modify, E-RAB
release

22 Cellular Networks
S1-MME Interface (Control Plane)
 S1-AP Tasks (continued)
 Handover procedures
 Encompasses all the S1 functions related to user
mobility between eNodeB or with 2G or 3G 3GPP
technologies.
 Procedures: Handover Preparation, Handover
Resource Allocation, Handover Notification, Path
Switch Request, Handover Cancellation,
eNB/MME status transfer.
 NAS signalling transport
 this corresponds to the transport of UE–MME
signalling over the S1 interface.

23 Cellular Networks
S1-MME Interface (Control Plane)
 S1-AP Tasks (continued)
 Paging procedure
 Through the paging procedure, the MME requests the eNodeB to page
UE in a given set of cells.
 Managements procedure
 Functions: reset, error indications, S1 set up, eNB configuration data, and
update, overload start, overload stop,
 Trace Function:
 In order to trace the activity of a UE in connected mode, MME can
command eNB to log all the events or part of them.
 Trace can be activated for the interface rather than UE as well.

24 Cellular Networks
S1-U Interface (User Plane)
 A simple protocol.
 The S1-U (or S1 User plane interface) role
is to transport user data packet between
the eNodeB and the Serving GW.
 Compared to S1-MME which uses a
variant of TCP, S1-U uses UDP.
 It is based on GPRS Tunneling Protocol and
UDP or IP.

25 Cellular Networks
S1-Flexibility
 In UMTS network, each RNC is connected to only one SGSN.
 EPC allows eNBs to be connected to multiple MME/SGWs at the
same time.
 A pool area is an area which a UE may move into without a need to
change its serving Core Network node.

26 Cellular Networks
 S1-Flexibility
 The S1 flexibility
 allows the network to become more robust to core node failure
 allows reduction of the number of inter-core network node handover
procedures (in Connected mode) or Tracking Area updates (in Idle mode).
 allows core network load balancing

27 Cellular Networks
Stream Control Transport Protocol (SCTP)
 STCP is a reliable connection-oriented transport
protocol which is very similar to the well known and
widely used TCP.
 STCP implements congestion and flow control, detection
of data corruption, loss or duplication of data and
supports a selective retransmission mechanism.
 When comparing TCP and SCTP from a functional
perspective, SCTP provides three key features which TCP
does not support:
 The multi-streaming,
 The multi-homing,
 SCTP framing.

28 Cellular Networks
Stream Control Transport Protocol (SCTP)
 Multi-Streaming:
 Allows setting up several independent streams between two peers
connected by one SCTP connection.
 In such a case, when a transmission error occurs on one of the
stream, it does not affect data transmission on the other streams.
 Multi-homing:
 This allows an SCTP endpoint to be reached through multiple IP
addresses.
 SCTP framing:
 SCTP works at the message level whereas TCP is an octet stream
protocol.
 TCP transport bytes and may assemble or fragment packets but
SCTP transports whatever it has received from upper layer.

29 Cellular Networks
 Non Access Stratum Protocol
 The non-access stratum (NAS) described in the present document forms the
highest stratum of the control plane between UE and MME.
 The NAS is used to convey non-radio signalling between the User Equipment
(UE) and the Mobility Management Entity (MME) for an LTE/E-UTRAN access.
 NAS has two main functionalities
 The support of registration and session management procedures to establish and
maintain IP connectivity between the UE and a packet data network gateway (PDN
GW).
 The support of mobility of the user equipment (UE);

30 Cellular Networks
 Non Access Stratum Protocol
 The MME creates a UE context when a UE is turned on and
attaches to the network.
 UE context holds user subscription information downloaded
from the HSS plus dynamic information.
 The NAS uses UE context and convey non-radio signalling
between the UE and the MME.
 NAS procedures:
 attach, detach, PLMN selection, paging, authentication, tracking area
updating, bearer establishment, modification, release, security
management

31 Cellular Networks
Circuit Switch Fall Back (CSFB)
 Circuit Switched FallBack (CSFB) is a technology whereby
voice and SMS services are delivered to LTE devices through
the use of GSM or another circuit-switched network.
 The SGs interface is used to deliver non EPC paging messages
that inform the mobile device of an incoming call.
 It is delivered via S1AP paging.
 The call itself, however, is not
delivered over the LTE
interface and the mobile device
has to fall back to a GSM or
UMTS network where a
circuit-switched connection is
then established for the call.
32 Cellular Networks
The E-UTRAN Network Interface: X2 Interface

 The X2 interface is established

between one eNB and some of its
neighbours.
 A full mesh is not mandated in an
E-UTRAN network.
 Two types of information typically
need to be exchanged over X2 :
 Interference/overload related
information
 handover related information.

33 Cellular Networks
The E-UTRAN Network Interface: X2 Interface

 The control plane and user plane

protocol stacks over the X2
interface are the same as over the
S1 interface.
 Big part of SON capability.

34 Cellular Networks
X2-AP Procedures
 The X2 interface X2-AP procedures are divided into two
modules :
1. X2AP Basic Mobility Procedures :The X2AP Basic Mobility Procedures
module contains procedures used to handle the UE mobility within E-
UTRAN.
2. X2AP Global Procedures: The Global Procedures module contains
procedures that are not related to a specific UE. The procedures in this
module are in contrast to the above module involving two peer eNBs.
 Basic mobility procedures
 Handover Preparation, SN Status Transfer, UE Context Release, Handover
Cancel
 Global Procedures
 Load Indication, Error Indication, X2 Setup, Reset, eNB Configuration
Update, Resource Status Reporting Initiation, Resource Status Reporting,
Mobility Settings Change, Radio Link Failure Indication, Handover Report,
Cell Activation.
35 Cellular Networks
X2-AP Functions
 The X2AP protocol provides the following functions:
 Setting up the X2
 This function is used to exchange necessary data for the eNB for setup the
X2 interface and implicitly perform an X2 Reset.
 Resetting the X2:
 This function is used to reset the X2 interface.
 Mobility Management
 allows the eNB to move the responsibility of a certain UE to another eNB.
Forwarding of user plane data, Status Transfer and UE Context Release
function are parts of the mobility management.
 Load Management.
 This function is used by eNBs to indicate resource status, overload and
traffic load to each other.
 Reporting of General Error Situations
 This function allows reporting of general error situations, for which
function specific error messages have not been defined.

36 Cellular Networks
X2-AP Functions
 eNB Configuration Update.
 This function allows updating of application level data needed for two
eNBs to interoperate correctly over the X2 interface.
 Mobility Parameters Management.
 This function allows the eNB to coordinate adaptation of mobility
parameter settings with a peer eNB.
 Mobility Robustness Optimisation
 This function allows reporting of information related to mobility failure
events.
 Energy Saving.
 This function allows decreasing energy consumption by enabling
indication of cell activation/deactivation over the X2 interface.

37 Cellular Networks
Self Organizing Network (SON) Operation
 A Self-Organizing Network is an automation technology designed to
make the planning, configuration, management, optimization and
healing of mobile radio access networks simpler and faster.
 There are three main areas over which the self-organising networks
operate.
 Self configuration: The aim is for base stations to become essentially
"Plug and Play" items. They should need as little manual intervention in
the configuration process as possible.
 Self optimisation: Once the system has been set up, it will be necessary
to optimise the operational characteristics to best meet the needs of the
overall network.
 Mobility robustness optimisation
 Mobility load balancing and traffic steering
 Energy saving
 Coverage and capacity optimisation
 RACH optimisation

38 Cellular Networks
Self Organizing Network (SON) Operation
 Self-healing: Any system will develop faults from time to time.
This can cause major inconvenience to users, however it is
often possible for the overall network to change its
characteristics to temporarily mask the effects of the fault.
 Self recovery of software
 Self-healing of board faults
 Cell outage detection
 Cell outage recovery
 Cell outage compensation
 Return from cell outage compensation

39 Cellular Networks
X2 Set up Procedure
 The initialization of the X2 interface starts with the identification
of a suitable neighbour followed by the setting up of the neighbor
relation table (NRT).
 The identification of a suitable neighbour may be done by
configuration, or alternatively by a self-optimizing process known
as the Automatic Neighbour Relation Function (ANRF).
 Once the transport network layer (TNL) has been set up, the
initiating eNodeB must trigger the X2 setup procedure.
 This procedure enables an automatic exchange of application
level configuration data relevant to the X2 interface (X2 SETUP
REQUESTS) which includes cell’s physical identity, the frequency
band, the tracking area identity and/or the associated PLMNs.

40 Cellular Networks
Automatic Neighbour Relation Function
(ANRF)
 ANRF is an example of a SON function.
 Each eNodeB can automatically populate a Neighbour Relation
Table (NRT) for each cell it controls using ANRF.
 When an eNodeB receives from a UE a Physical Cell Identity
(PCI) of a neighbour cell as part of a normal measurement
report, and the eNodeB does not recognize the PCI, the
eNodeB can instruct the UE to execute a new dedicated
reporting procedure which uses the newly discovered PCI as a
parameter.
 Through this procedure, the UE reads and reports to the
requesting eNodeB some system information of the detected
neighbouring cell, including the ECGI, the Tracking Area Code
(TAC) and all available PLMN IDs.

41 Cellular Networks
LTE Handover Function
 On the basis of the measurement and reporting configuration
that the mobile device has received from the eNode-B, it
starts measuring the signal strength of neighboring cells.
 Once a configured reporting criterion has been met, it reports
the current values for the signal strength of the active cells and
neighboring cells to the eNode-B.
 On the basis of this input, the eNode-B can take a decision if a
handover of the connection to a neighboring cell with a better
signal is necessary.
 In LTE, there are two types of handovers.
 X2 Hanover: Performed by X2-AP and is the most efficient one
where the source eNode-B and the target eNode-B directly
communicate over X2 interface.
 S1 handover: the MME assists in the process in this case via S1-AP
procedures.
42 Cellular Networks
 Handover Using S1-AP
 When there is no X2 interface between the two eNodeBs, or if
the source eNodeB has been configured to initiate handover
towards a particular target eNodeB via the S1 interface, then an
S1-handover will be triggered.
 Compared to UMTS, the main difference is the introduction of
the ‘STATUS TRANSFER’.
 Status transfer contains PDCP Sequence Numbers (SN) and
Hyper Frame Numbers (HFN).

43 Cellular Networks
Handover Using S1-AP

44 Cellular Networks
 Handover Using X2-AP
 The handover is directly
performed between two
eNodeBs. This makes the
preparation phase quick.
 The MME is only informed at
the end of the handover.
 The release of resources at the
source side is directly triggered
from the target eNodeB.

45 Cellular Networks
 Handover Over X2
 HO over X2 can be categorized
according to its resilience to
packet loss:
 Seamless
 Lossless
 In the HO Request message, the
source eNB requests for a GTP
tunnel.
 In the response message, the tunnel
end-point is declared.
 Seamless:
 Packets arriving after HO REQUEST
ACK are forwarded over X2 to the
target eNB.
 Lossless:
 Unacknowledged/buffered packets +
packets arriving after HO REQUEST
ACK are forwarded over X2 to the
target eNB.
46 Cellular Networks
 Handover Over X2
 Selective retransmission:
 If target eNB is informed by the UE,
it may not transmit some downlink
packets received from source eNB.
 Source eNB is also able to inform
target eNB about unacked packets
which have been acked after HO
REQUEST ACK.
 Multiple preparation
 This feature enables the source eNB
to trigger the handover preparation
procedure towards multiple
candidate target eNBs.
 It is transparent from UE.

47 Cellular Networks
Status Transfer
 Status Transfer Message includes (the following fields are
present for each RAB)
 The uplink PDCP sequence number
 Uplink Hyper Frame Number
 The downlink PDCP sequence number
 Downlink Hyper Frame Number

48 Cellular Networks
GPRS Tunneling Protocol (GTP)
 What is Tunneling?
 a two-way communication path between two end-points.
 Encapsulation of a traffic packet in a new packet with new src/dest
addresses.
 Tunneling transparently transfers packets between the mobile station
and external data networks.

49 Cellular Networks
GPRS Tunneling Protocol
 Why a new addressing protocol over IP?
 IP does not support mobility (i.e., keeping the host address while
moving to other points of attachment.)
 If we use UE IP address for packet forwarding, the packet
may never arrive the UE after UE changes its location.
 Tunnels are solution to cope with mobility of the UEs in the
network.

50 Cellular Networks
Example of GPRS Tunneling in 2G/3G

51 Cellular Networks
GPRS Tunneling Protocol (GTP) in 4G
 EPS tunnels are
 One between eNB and SGW
 the other between SGW and PGW.
 In case of handover, there is a temporary tunnel on the X2
interface.
 MME to MME for Inter-MME HO.

52 Cellular Networks
GPRS Tunneling Protocol (GTP)
 Using the GTP protocol, the user plane packet is inserted in a
new packet and serves as its payload.
 A new header is created for the new packet.
 The new header information is used for routing purposes.
 User is sending a packet to the google. Source ip address is the UE
address and destination is google’s.
 Packet reaches eNB. It encapsulate the packet in a new packet. The
source address is the eNB. Destination address is SGW.
 GTP Header is added as well.

53 Cellular Networks
GPRS Tunneling Protocol (GTP)
 GTP Header Format:
 Payload/protocol Type – which indicates if the packet is pure user data
or a GTP control message
 Tunnel Endpoint Identifier: uniquely identifies the receiving protocol
entity at the destination.
 Extension header flag (E): states whether there is an extension header.
 Sequence number flag (S): states whether there is a Sequence Number.
 N-PDU number flag (PN): states whether there is a N-PDU number.
 N-PDU: different meaning in different connections.

54 Cellular Networks
GTP Message Type
Message Type
0 Reserved
1 Echo request
2 Echo response
3 Version not supported
4-31 Reserved
32 Create Session Request
33 Create Session Response
34 Modify Bearer Request
35 Modify Bearer Response
36 Delete Session Request
37 Delete Session Response

55 Cellular Networks