EPC Network Signal Flow

Course Objectives

 After the course, you will ：

 Know EPC MM Signaling Flow
 Know EPC SM Signaling Flow
 Know Security management

2
Contents

 EPS Basic Signaling Flow Introduction

 EPS Mobility Management Flow
 EPS Bearer Management Flow
 EPS Security Management

3
 EPS Basic Signaling Flow Introduction

 Mobility Management
 Attach Flow
 TAU Flow
 Service Request Flow
 S1 Release Flow
 GUTI Reallocation Flow
 Detach Flow
 Session Management
 Bearer activation Flow
 Bearer modification with QoS update
 Bearer modification with Qos update from network side
 Bearer modification from network side without Qos update
 Bearer deactivation
 Bearer resource modification requested from UE

© ZTE All rights reserved 4

 EPS Basic Signaling Flow Introduction

 Hand over management

 Intra-E-UTRAN hand over

X2-based hand over

S1-based hand over
 Inter RAT handover

E-UTRAN to UTRAN Iu mode Inter RAT hand over

UTRAN Iu mode to E-UTRAN Inter RAT handover

E-UTRAN to GERAN A/Gb mode Inter RAT hand over

GERAN A/Gb mode to E-UTRAN Inter RAT hand over

Inter RAT hand over cancellation

© ZTE All rights reserved 5

Contents

 EPS Basic Signaling Flow Introduction

 EPS Mobility Management Flow
 EPS Bearer Management Flow
 EPS Security Management

6
 EPC Area Definition and Identity

 Bearer ID(EPS bearer identity)

 Unique identity of one EPS bearer context of a UE, has one to one relationshi
p with NSAPI/RAB ID.
 EPS bearer ID=5~15

 GUTI: Globally Unique Temporary UE Identity

 A globally unique temporary UE identity assigned to every MS attached to E
PS
 GUTI=MCC+MNC+MME Identifier+M-TMSI

 TAI(Tracking Area Identity, TAI)

 Unique in one PLMN, used to identify tracking area ；
 TAI=MCC+MNC+TAC

© ZTE All rights reserved 7

 EPS Mobility Management Status Introduction
EMM state model in UE EMM Deregistered Status
Detach,
Attach Reject,
 MM context is not saved in MME
TAU reject, (unless to avoid AKA service flow
E-UTRAN interface switched off due to Non-3GPP handover, when attached)
All bearers deactivated
 UE is not reachable, MME has
no position or route information
EMM-DEREGISTERED EMM-REGISTERED
of UE

Attach accept
EMM Registered Status
EMM state model in MME
 UE is reachable, MME know the
Detach,
Attach Reject, position of UE ( position is
TAU reject, located to TA List)
All bearers deactivated
 UE has at least one activated
PDN connection( at least one
EMM-DEREGISTERED EMM-REGISTERED
default bearer context ）
Attach accept  UE has security context to save
TAU accept for a UE selecting
E-UTRAN from GERAN/UTRAN security information

© ZTE All rights reserved 8

 EPS Connection Management Status Introductio
n
ECM state model in UE ECM state model in MME

RRC connection S1 connection

released released
ECM-IDLE ECM-CONNECTED ECM-IDLE ECM-CONNECTED

RRC connection S1 connection

established established

ECM-IDLE status ECM-CONNECTED Status

 There is no NAS signal connection between UE  There is signal connection between UE and
and MME ； MME including RRC connection and S1-
 MME keep the TA List position information of MME connection;
UE ；  MME keep the cell ID of UE;
 The context between UE and MME is not  The context between UE and MME is
synchronized synchronized

© ZTE All rights reserved 9

 ECM and EMM Differences

 Focus
 EMM focus on user mobility management
 ECM focus on the signal connection between UE and EPC
 Service Flow
 EMM: Attach, TAU, detach
 ECM: S1 connection release, service request
 ECM and EMM are independent with each other

© ZTE All rights reserved 10

 Mobility Management Flow
Attach Initiated from E-UTRAN Bearer needs to be established
Initiated from UTRAN/GERAN 2/3G attach+2/3G PDP activated context
TA Update TA update （ MME 、 SGW not changed in UE enter unregistered TA
LTE ）
TA update （ MME and/or SGW changed ）
RA update （ From E-UTRAN to UTRAN Iu UE enter UTRAN unregistered RA from EUTRAN
Mode ）
TA update （ UTRAN Iu mode to E-UTRAN ） UE enter EUTRAN unregistered TA from UTRAN
RA update （ E-UTRAN to GERAN ） UE move between EUTRAN and GERAN
TA update （ GERAN A/Gb mode to E-
UTRAN ）
Detach UE initiated UE power off
MME initiated HSS request etc.
HSS initiated Subscriber data change or mobile phone charges
owed
HSS User Purge Interaction between MME and HSS, the same with
data 2/3G
Insert subscriber data
management
page Used to communicate with UE at idle status
Service UE initiated Enter connect status, establish signal connection
request
Network initiated Initiate UE request by paging message
S1 release UE initiated
MME initiated
© ZTE All rights reserved 11
 Mobility Management ---- Attach Flow （ 1 ）

Default
Default bearer
bearer is
is established
established when
when get
get attached,
attached, IP
IP address
address is
is allocated
allocated to
to UE
UE from
from network
network side
side
© ZTE All rights reserved 12
 Mobility Management ---- Attach Flow （ 2 ）

Default
Default bearer
bearer is
is established
established when
when get
get attached,
attached, IP
IP address
address is
is allocated
allocated to
to UE
UE from
from network
network side
side
© ZTE All rights reserved 13
 Mobility Management ---- TAU Flow

© ZTE All rights reserved 14

 Detach Flow initiated by UE

© ZTE All rights reserved 15

 Detach Flow initiated by HSS

UE eNodeB MME Serving GW PDN GW PCRF HSS

1. Cancel Location
2. Detach Request
3. Delete Bearer Request

4. Delete Bearer Request

5. Delete Bearer Response

6. PCEF Initiated IP-CAN
Session Termination
(A)

7. Delete Bearer Response

8. Detach Accept
9. Cancel Location Ack

10. Signalling Connection Release

 HSS uses this procedure for operator-determined purposes to re

quest the removal of a subscriber's MM and EPS bearer at the M
ME.
© ZTE All rights reserved 16
 Detach Flow initiated by MME
UE eNodeB MME Serving GW PDN GW PCRF HSS

1. Detach Request
2. Delete Bearer Request

3. Delete Bearer Request

4. Delete Bearer Response

5. PCEF Initiated IP-CAN
Session Modification
(A)

6. Delete Bearer Response

7. Detach Accept

8. Signalling Connection Release

 The MME initiated detach procedure is either explicit or implicit. The MME may i
mplicitly detach a UE, if it has not had communication with UE for a long period o
f time. The MME does not send the Detach Request (Detach Type) message to th
e UE in case of implicit detach. The MME may explicitly detach the UE by sending
a Detach Request message to the UE. The Detach Type may be set to re-attach in
which case the UE should re-attach at the end of the detach process.
© ZTE All rights reserved 17
 S1 Release

UE eNodeB MME Serving GW

1. S1-AP: S1 UE Context Release Request

2. Update Bearer Request

3. Update Bearer Response

4. S1-AP: S1 UE Context Release Command

5. RRC Connection Release

6. S1-AP: S1 UE Context Release Complete

© ZTE All rights reserved 18

 Service Request initiated by UE

UE eNodeB MME Serving GW PDN GW PCRF HSS

1. NAS: Service Request

2. NAS: Service Request

3. Authentication

4. S1-AP: Initial Context Setup Request

5. Radio Bearer Establishment

6. Uplink Data

7. S1-AP: Initial Context Setup Complete

8. Update Bearer Request

9. Update Bearer Request

10. PCEF Initiated IP-CAN
Session Modification
(A)

11. Update Bearer Response

12. Update Bearer Response

© ZTE All rights reserved 19

 Service Request initiated by network side

© ZTE All rights reserved 20

Contents

 EPS Basic Signaling Flow Introduction

 EPS Mobility Management Flow
 EPS Bearer Management Flow
 EPS Security Management

21
 Bearer Concept Introduction

 Default Bearer ---- like first PDP activation

 a permanent valid bearer, this bearer is established when user get attached
 use the default APN contracted in HSS, PCC rule is the default rule configured on PGW or assigned by
PCRF, user address is assigned by P-GW
 it must be non GBR (Guaranteed Bearer Rate)bearer
 it is usually low bandwidth, low latency, and can be used to visit DHCP server and IMS registration etc.

 Dedicated Bearer －－－ like secondary PDP activation

 established according to the need of user layer or application layer after the establishment of default b
earer, can be initiated from network side or MS
 established on the base of default bearer, it is the bearer to the same PDN with different QoS
 can be GBR or non GBR bearer

 Multi-PDN activation －－－ like secondary PDP activation

 When UE needs to get access to a new PDN, UE will bring the new APN to MME, MME may reselect a n
ew PDN GW. EPS support one PDN GW get accessed to multi-PDN, also multi-PDN GW get accessed to
multi-PDN 。

© ZTE All rights reserved 22

 EPS Bearer
SAE System

UE eNodeB SAE-GW Peer entity

(e.g. UE,
server)

End-to-End Service

SAE Bearer Service external Bearer

Service

SAE Radio SAE Access

Bearer Service Bearer Service

Physical Radio Physical

Bearer Service Bearer Service

© ZTE All rights reserved 23

 EPS bearer with GTP-based S5/S8

Application / Service Layer

UL Service Data Flows DL Service Data Flows

UL TFT DL TFT
UL TFT  RBID DL TFT  S5/S8a-TEID
RBID  S1-TEID S1-TEID  S5/S8a-TEID

UE eNodeB Serving GW PDN GW

Radio Bearer S1 Bearer S5/S8 Bearer

© ZTE All rights reserved 24

 EPS Bearer with PMIP-based S5/S8

Application / Service Layer

Service Data Flows Service Data Flows

DL - PF ? S1 - TE - ID DL - PF ? TNL QoS

UL Packet Filter
DL Packet Filter
RB - ID ? S1 - TE - ID
UL - PF ? RB - ID
DL Packet Filter

UE eNB Serving GW PDN GW

S1 - TE - ID ? TNL QoS

Ra dio Bearer S1 Bearer IP Transport Leg

© ZTE All rights reserved 25

 PCC Logical Architecture (non-roaming scenario)

Application
Function

(AF)

Rx

Subscription Sp Policy and

Profile Charging Rules
Repository Function

(SPR) (PCRF)

Online Charging
Gxx Gx System

(OCS)
Gy
Service Data Flow
Bearer Binding Policy and Based Credit
and Event Charging Control
Reporting Enforcement
Function Function

(BBERF) (PCEF)
Offline
Charging
AN-Gateway PDN-Gateway System

Gz (OFCS)

© ZTE All rights reserved 26

 Bearer QoS Control
 Bearer QoS Control
 QoS control is based on Bearer
 A bearer includes one or more SDF (service data flow)
 for dynamic QoS control use PCC
 Authorized QoS parameter is divided into several levels which is identified by QCI (QoS class identifier) . One QCI
identifies a set of QoS parameters
 Once a bearer is established, QCI can not be changed, a new bearer establishment process needed to be initiate
d if QCI needs to be modified.
 QoS parameter in LTE is divided into UE level, APN level and bearer level. per UE parameter i
ncludes UE-AMBR, per APN parameter includes APN-AMBR, per bearer parameter includes:
QCI, ARP,GBR and MBR.
 per bearer QoS parameter

QCI (QoS Class Identifier ): it is preconfigured on each node. QCI is carried in GTPU header or in wireless part GT
P-U header.

ARP (Allocation and Retention Priority )

GBR (Guaranteed Bit Rate)

MBR (Maximum Bit Rate)
 per APN parameter

APN-AMBR (Aggregate Maximum Bit Rate)

per UE parameter

UE-AMBR

© ZTE All rights reserved 27

 Bearer Flow
Bearer Default bearer activation UE gets attached or request for PDN
activation access
Dedicated bearer activation Qos of newly initiated SDF can’t be
satisfied by currently recommended
bearer
UE request for bearer resource UE request bearer resource for new
assignment SDF, this will initiate bearer
modification or activation from network
side
Bearer PGW initiated bearer modification According to local policy
modification (bearer QoS update)
MME initiated bearer modification Subscriber data changed
(bearer QoS update)
Dedicated bearer modification (non Modify TFT
bearer Qos update)
Bearer PGW initiated bearer deactivation Requested by other network element or
deactivation UE
MME initiated bearer deactivation Subscriber data changed
UE requested bearer resource release UE end SDF
© ZTE All rights reserved 28
 Dedicated Bearer Establishment process (GTP)
SGW PGW
⑥ RRC Conf complete/ Session

②Create Dedicated Bearer Request

③Create Dedicated Bearer Request

Management Resp

①P
⑨Create Dedicated Bearer Resp

CC
⑧Create Dedicated Bearer Resp
⑤ RRC Conf Req

ru
le
Pr
ov
i si
on
④Bearer Setup Req/ Session
MME
Management Req PCRF

⑦Bearer Setup Resp/ Session

Management Resp

 PCRF generate PCC Rule according to service request including QCI,ARP,GBR,MBR etc
 PDN GW establish new bearer for the service, PDN GW generate EPS Bearer QoS according to PCC Rule, PDN GW send dedicated b
earer establishment request to SGW, PDN GW will send default bearer LBI to SGW, PGW assign S5 downstream GTPU tunnel ID;
 SGW assign S1 upstream GTPU tunnel ID and S5 downstream GTPU tunnel ID;
 MME assign Bearer ID to this new EPS Bearer and send Radio Bearer establishment request to EUTRAN, MME send S1 upstream GT
UP tunnel ID to EUTRAN;
 EUTRAN establish Radio Bearer with UE and send EPS Bearer ID to UE;
 EUTRAN send S1 downstream GTPU tunnel ID to MME, MME send to SGW, S1 Bearer is established between EUTRAN and SGW;
 SGW send S5 downstream GTPU tunnel ID to PGW and establish S5 Bearer

© ZTE All rights reserved 29

 Dedicated Bearer Establishment

© ZTE All rights reserved 30

 Dedicated Bearer Establishment initiated from U
E

© ZTE All rights reserved 31

 Bearer Modification initiated from network side

Bearer
Bearer modification
modification can
can be
be initiated
initiated from
from network
network side,
side, including
including QoS
QoS update
update or
or QoS
QoS non
non updated
updated (TFT
(TFT
modification
modification or
or APN-AMBR modification ）
APN-AMBR modification ）

© ZTE All rights reserved 32

 Bearer modification activated by PGW (Qos Upd
ate)
UE eNodeB MME Serving GW PDN GW PCR F

(A) (1. PCC Decision Provision)

2. Update Bearer request

3. Update Bearer Request

4. Bearer Modify Request

5. Radio Bearer Modify Request

6. Radio Bearer Modify Respons e

7. Bearer Modify Response

8. Update Bearer Response

9. Update Bearer response

(10. Provision Ack)

(B)

 Bearer Modification Procedure with Bearer QoS Update, UE in ac

tive mode
© ZTE All rights reserved 33
 Dedicated bearer modification

 Dedicated Bearer Modification Procedure without Bearer QoS U

pdate
© ZTE All rights reserved 34
Contents

 EPS Basic Signaling Flow Introduction

 EPS Mobility Management Flow
 EPS Bearer Management Flow
 EPS Security Management

35
 EPS Network Security Topology

Security layer 1 Security layer 2

eNB S 1-C MME
Xu S1 -U
UE X2 SAE GW
S 1-C
Xu S1 -U Evolved Packet Core
(EPC)
eNB
Security layer 1

E-UTRAN

 EPS Security and UMTS Security in Common

 EPS access authentication: AKA

 EPS Security and UMTS Security in Difference

 EPS security layers

AS （ Access Stratum ） security
– Security between UE and eNB （ E-UTRAN ） , including RRC signaling confidentiality, RRC signalin
g integrity and UP (User Plane) confidentiality

NAS （ Non Access Stratum ） security
– Security between UE and MME, including NAS signaling confidentiality and NAS signaling integrity

Network Domain Security
– Security between layer 1 and layer 2, adopting NDS/IPsec

© ZTE All rights reserved 36

 SAE Key Architecture
K
USIM / AuC

CK, IK
UE / HSS

KASME
UE / ASME

KNASenc KNASint KeNB

UE / MME

KUPenc KRRCint KRRCenc

UE / eNB

© ZTE All rights reserved 37

 Algorithm negotiation flow

UE eNB MME
1: Initiate NAS message 2: forward initiate NAS message
(TMSI, UE capabilities, KSIASME,
…)
3: UMTS AKA

a) Select NAS algorithm

b) Start NAS integrity protection

4: NAS SMC (selected NAS algorithm,

5: NAS SMC UE capabilities, KSIASME, NAS-MAC)

a) Check NAS-MAC
b) Initiate NAS integrity and encryption
6: NAS SMC completed

Initiate NAS encryption

© ZTE All rights reserved 38
Thank you