1. Chapter 3
LTE Network

2. Outline 3.1 LTE Network Architecture 3.2 Protocol Stack
3.1.1 Overall Architecture
3.1.2 Basic functions of all entities
3.1.3 LTE interfaces
3.2 Protocol Stack
3.2.1 User plane protocol stack
3.2.2 Control plane protocol stack
3.3 Traffic flow on LTE/EPC
3.4 LTE identifiers
3.4.1 UE and ME Identifier
3.4.2 NE and Location Identifier
3.4.3 EPS Session/Bearer Identifier

3. Introduction
The LTE network called EPS (Evolved Packet System) is an end-to-end (E2E) all IP network
EPS = LTE + EPC
LTE: Technology related to a radio access network (E-UTRAN)
EPC: Technology related to a core network

4. 3.1.1 Overall Architecture

5. 3.1.2 Basic functions of all entities
LTE Entities

6. 3.1.2 Basic functions of all entities
EPC Entities

7. 3.1.2 Basic functions of all entities

8. 3.1.3 LTE Interfaces

9. 3.1.3 LTE Interfaces

10. 3.2 Protocol Stacks 3.2.1 User plane protocol stack
3.2.2 Control plane protocol stack

11. 3.2.1 User plane protocol stack

12. 3.2.1 User plane protocol stack
LTE-Uu Interface
PDCP protocol: Support transport of IP packets over the radio link. It performs header compression, Access Stratum (AS) security, packet-reordering/retransmission during handover
RLC protocol: segmentation/concatenation of PDCP PDUs during the construction of RLC PDU.
MAC protocol: MAC layer is connected to the RLC layer through logical channels, and to the PHY layer through transport channels. supports multiplexing and de-multiplexing between logical channels and transport channels. Higher layers use different logical channels for different QoS metrics.
S1-U/S5/X2 interface
GTP-U: GTP-U protocol is used to forward user IP packets over S1-U, S5 and X2 interfaces.

13. 3.2.2 Control plane protocol stack

14. 3.2.2 Control plane protocol stack

15. 3.2.2 Control plane protocol stack
LTE-Uu Interface
NAS: mobility management and bearer management functions
RRC:
Supports the transfer of the NAS signaling.
Broadcasting of system information.
Setup, reconfiguration, reestablishment and release of the RRC connection
Setup, modification and release of the radio bearer
X2 interface
X2AP: supports UE mobility and SON functions within the E-UTRAN
User data forwarding
Transfer of SN status and UE context release

16. 3.2.2 Control plane protocol stack
S1-MME interface
S1AP: support functions:
S1 interface management, E-RAB management
NAS signaling transport, UE context management
delivers the initial UE context to the eNB to setup E-RAB
S11/S5/S10 interfaces
GTP-C: supports exchange of control information for creation, modification and termination for GTP tunnels
S6a interface
Diameter: supports delivery of PCC rules from the PCRF to the PCEF (P-GW)

17. 3.2.2 Control plane protocol stack
Gx interface
Diameter: supports delivery of PCC rules from the PCRF to the PCEF (P-GW)
Gy interface
Diameter: supports exchange of real-time credit control information between the P-GW and OCS.
Gz interface
GTP’: supports CDR transfer from the P-GW to the OFCS.

18. 3.3 Traffic flow on the LTE network
IP packets are forwarded through the GTP tunnel over S1-U and S5 interfaces.
These GTP tunnels are established per EPS bearer when a user is attached to the LTE network
More than one EPS bearer is established on each of the S1-U and S5 interfaces  in order to identify these bearers, a Tunnel Endpoint Identifier (TEID) is assigned to the end points (UL and DL) of each GTP tunnel
When identifying a GTP tunnel, a TEID, IP address and UDP port number are used
The receiving end side of the GTP tunnel locally assigns the TEID value the transmitting side has to use
The TEID values are exchanged between tunnel endpoints using control plane protocols

19. 3.3 Traffic flow on the LTE network

20. 3.3 Traffic flow on the LTE network
Traffic flow in uplink direction: from UE to the Internet
A UE transfers user IP packets to an eNB over LTE-Uu interface
The eNB encapsulates the user IP packets with the S1 GTP tunnel header and forwards to the S-GW
After receiving the outer IP packets, the S-GW strips off the S1 GTP tunnel header, encapsulates the user IP packets (the inner IP packets) with the S5 GTP tunnel header and forwards to the P-GW
After receiving the outer IP packets, the P-GW gets the user IP packets by stripping off the S5 GTP tunnel header and transfers them to the Internet through IP routing

21. 3.3 Traffic flow on the LTE network
Traffic flow in downlink direction: from the Internet to UE
A P-GW receives IP packets destined for a UE over the Internet
The P-GW encapsulates the user IP packets with the S5 GTP tunnel header and forwards to the S-GW
After receiving the outer IP packets, the S-GW strips off the S5 GTP tunnel header, encapsulates the user IP packets (the inner IP packets) with the S1 GTP tunnel header and forwards to the eNB
After receiving the outer IP packets, the eNB gets the user IP packets by stripping off the S1 GTP tunnel header and transfers them to the UE through the Data Radio Bearer (DRB) over the radio link

22. 3.4 LTE Identifiers 3.4.1 UE and ME Identifier
Classification of LTE IDs
User Equipment IDs
Mobile Equipment IDs
3.4.2 NE and Location Identifier
Classification
Network Equipment IDs
Location IDs
3.4.3 EPS Session/Bearer Identifier
EPS Session and Bearer Overview
EPS Session/Bearer Identifier

23. 3.4.1.1 Classification of LTE IDs
Feature of these LTE IDs:
Creation time
Created when equipment installation
Created by operator before or during service operation
Created on-demand as a user accesses the network or uses services
Type
Temporary
Permanent
Range
Each LTE ID is uniquely identified across the world, operator networks, entities or channels

24. 3.4.1.1 Classification of LTE IDs

25. 3.4.1.1 Classification of LTE IDs

26. 3.4.1.1 Classification of LTE IDs

27. 3.4.1.2 User Equipment IDs PLMN ID (Public Land Mobile Network)
indicating the network that a user has subscribed to

28. User Equipment IDs
IMSI (International Mobile Subscriber Identity)
Permanent ID allocated to a mobile subscriber
Identifying a mobile subscriber globally

29. 3.4.1.2 User Equipment IDs GUTI (Globally Unique Temporary Identifier)
Security problems if IMSI is frequently exposed over the radio link
Allocated to a UE by an MME when the UE attaches to the Network, and used instead of the IMSI to identify the UE
GUTI allocation

30. 3.4.1.2 User Equipment IDs GUTI Format
MME Identifier = MME group ID + MME code
GUMMEI : Globally Unique MME Identifier
M-TMSI : MME Temporary Mobile Subscriber Identity
Allocated by MME

31. 3.4.1.2 User Equipment IDs IP Address
allocated by an LTE network to a UE in order for the UE to connect to a PDN (i.e. an IP network)
Each UE has a different IP address per PDN
IP address allocation
Static: an operator allocates a permanent IP address to a UE at the time of subscription
Dynamic: a P-GW has an IP pool and dynamically assigns an available IP address from the pool every time a UE performs initial attach to an LTE network

32. User Equipment IDs

33. User Equipment IDs

34. User Equipment IDs
C-RNTI (Cell Radio Network Temporary Identifier)
Allocated to a UE by an eNB through a random access procedure in a cell controlled by the eNB and is effective only within the [serving] cell
C-RNTI allocation

35. User Equipment IDs
Paired UE S1AP IDs : needed to distinguish UEs over the S1-MME interface
S1AP layer handles the control messages between an eNB and an MME over an S1-MME interface
The eNB uses the same S1 link for all the S1AP control messages
In order to tell which S1AP message is for which UE, an eNB allocates an ID (eNB UE S1AP ID) to each UE when it sends the first S1AP message for a UE to an MME
Similarly, MME UE S1AP ID is allocated by MME for each UE

36. User Equipment IDs
UE S1AP ID allocation and S1AP layer

37. 3.4.1.2 User Equipment IDs Paired UE X2AP IDs
X2AP layer handles the control messages (X2AP messages) between two neighbor eNBs over an X2 interface
UE X2AP ID allocation and X2AP layer

38. Mobile Equipment IDs
A UE consists of an ME and a UMTS Subscriber identity Module (USIM)
ME can further be divided into Terminal Equipment (TE) and a Mobile Terminal (MT)

39. 3.4.1.3 Mobile Equipment IDs IMEI and IMEISV
IDs permanently owned by an ME
An IMEI is given when an ME is being manufactured, and contains information about the manufacturer, model, and serial number of the ME
IMEI is composed of a Type Allocation Code (TAC), a Serial Number (SNR) and a Check Digit (CD)
IMEI/SV is composed of a TAC, an SNR and a Software Version Number (SVN)
A TAC is made up of a Reporting Body Identifier (RBID) that indicates a reporting body
An ME Type ID that represents the manufacturer’s name and the model identifier
Serial numbers are assigned by the manufacturer

40. Mobile Equipment IDs

41. 3.4.2 NE and Location Identifier
Classification
Network Equipment IDs
Location IDs

42. 3.4.2 NE and Location Identifier
Classification
Network Equipment IDs
Location IDs

43. Classification

44. Classification

45. 3.4.2.2 Network Equipment IDs GUMMEI, MMEI, MMEGI and MMEC
IDs to Identify MME
MMEI (MME Identifier) is used when identifying an MME in the network of an operator
GUMMEI (Globally Unique MME Identifier), combination of a PLMN ID and an MMEI, is used when identifying an MME outside of the network of the operator
MMEGI that represents an MME group
MMEC that represents a particular MME in the MME group

46. Network Equipment IDs
IDs to identify MME and format

47. 3.4.2.2 Network Equipment IDs eNB ID and Global eNB ID
IDs to identify eNB
An eNB ID is used for identifying an eNB within an operator’s network only
Global eNB ID, combination of a PLMN ID and an eNB ID, is used for identifying one outside the network

48. 3.4.2.2 Network Equipment IDs P-GW ID : ID to identify P-GW
P-GW ID allocation
Fixed allocation: network operator provisions a P-GW ID as a subscribed profile in the HSS
Dynamic allocation: MME selects a P-GW according to the P-GW selection policy set by the operator
Either IP address or FQDN (Fully Qualified Domain name) forms

49. Location IDs
TAC and TAI : TAC (Tracking Area Code) and TAI (Tracking Area Identifier)
IDs to identify the location of a UE
The TAC is used to identify a TA in the network of an operator, whereas the TAI, combination of a PLMN ID and a TAC, is used to uniquely identify a TA globally

50. Location IDs
The MME allocates a TAI list to the UE at its initial attach, and keeps track of its location. The UE informs the MME of its new location and requests for TA update whenever it leaves its registered TA
If the current TA renewal period is expired, the UE has to inform the MME of its current TA, even while staying in TAs listed in the list
If the UE is in active state, the MME knows in which cell the UE is  forward data
If the UE is in idle state  the MME perform Paging procedure to find the UE
UE knows the TA change by listening to the broadcast information from the cell

51. 3.4.3 EPS Session/Bearer Identifier
EPS Session and Bearer Overview
EPS Session/Bearer Identifier

52. 3.4.3.1 EPS Session and Bearer Overview

53. 3.4.3.1 EPS Session and Bearer Overview
represented by an IP address of the UE and a PDN ID (Access Point Name (APN))
has more than one EPS bearer to deliver user traffic and applies the service quality (QoS) policy
always has a default bearer
EPS Bearer
A UE can have multiple EPS bearers concurrently
Different EPS bearers are identified by their EPS bearer ID, which is allocated by an MME
EPS Bearer = Data Radio Bearer + S1 Bearer + S5 Bearer

54. 3.4.3.1 EPS Session and Bearer Overview
Types of EPS Bearers
Each PDN must have one default EPS bearer, but may have none to many dedicated EPS bearers
Multiple dedicated bearers can be created if required by the user or the network
When there is no user traffic, these dedicated EPS bearers can be removed, whereas the default one is never removed

55. 3.4.3.2 EPS Session/Bearer Identifier
PDN ID (APN) (Packet Data Network ID or Access point name)
APN = Network ID + Operator ID

56. 3.4.3.2 EPS Session/Bearer Identifier
EPS Bearer IDs
A UE can have up to 11 EPS bearers and their ID values
Bearer IDs allocators

57. 3.4.3.2 EPS Session/Bearer Identifier
EPS Bearer IDs

58. 3.4.3.2 EPS Session/Bearer Identifier
E-RAB ID :
assigned by an eNB, generally with the same value as the EPS bearer ID
during the setup procedure of the EPS bearer, the MME requests the eNB for e-RAB setup, the eNB creates DRB with the UE and S1 bearer with the S-GW
DRB ID
assigned by an eNB upon establishment of the EPS bearer, and is mapped with EPS bearer IDs on 1:1 basis
the eNB creates DRB for communication with the UE by assigning a DRB ID and selecting logical channel configuration parameters based on the required QoS
TEID
While EPS bearers are being set up, for S5 bearer, the S-GW allocates DL S5 TEID and the P-GW allocates UL S5 TEID. For S1 bearer, the S-GW assigns UL S1 TEID and the eNB assigns DL S1 TEID

59. 3.4.3.2 EPS Session/Bearer Identifier
Summary

60. References Technical documents from www.netmanias.com
“LTE Network Architecture: Basic”
“LTE Identification I: UE and ME Identifier”
“LTE Identification II: NE and Location Identifiers”
“ LTE Identification III: EPS Session/Bearer Identifier ”