Attach – Call Flow

13 Feb 2016
 Network Identities

2015 © Samsung Electronics 2

 Identities Used in LTE - GUTI
 GUTI – Globally Unique Temporary UE Identity - is assigned only by the MME during
initial attach of a UE to the E-UTRAN – masks the true identity of the subscriber
 GUTI provides an unambiguous identification of the UE that does not revel the UE’s
permanent identity. It also allows identification of the MME and Network to which
UE attaches
 GUTI has to main components - GUMMEI Globally Unique Mobility management
Entity Identifier and the M –TMSI that uniquely identifies the UE within the MME
 For paging, the mobile is paged with the S-TMSI which is a shorter version of GUTI
 On the S1 Interface, the IMSI is typically not seen just like the GUTI. Exceptions are
initial attach when no old GUTI is stored on the USIM card or in paging procedure

MCC and
MNC are 3
DIGITS

2015 © Samsung Electronics 3

 Identities Used in LTE - RNTI
 RNTI – Radio Network Temporary Identifier
 RNTI is signaled in the MAC Layer. When MAC uses the PDCCH to indicate radio
resource allocation, the RNTI is mapped on the PDCCH depends on the logical channel
type -
 C- RNTI : Temporary Cell Radio Network Temporary Identifier for Dedicated Control Channel
(DCCH and DTCH). It defines which data sent in DL belongs to a particular subscriber – all RRC
messages are marked with same C RNTI for a subscriber
 P- RNTI : Paging Radio Network Temporary Identifier for Paging Control Channel (PCCH) is
derived from IMSI. It does not refer to a particular UE but to a group of UEs.
 RA- RNTI : Random Access Radio Network Temporary Identifier for Random Access Response
(RAR) on DL-SCH – assigned to particular UE and is contained in the response from eNode B
for PRACH. The UE then uses this RA- RNTI to send RRC Connection Request
 Temporary C-RNTI for Common Control Channel (CCCH) during random access procedure
 SI- RNTI : System Information Radio Network Temporary Identifier for Broadcast Control
Channel (BCCH) – sent on PDCCH - it signals to all UEs where SIBs are found on PDSCH

RNTI Values

2015 © Samsung Electronics 4

 LTE Identities

2015 © Samsung Electronics 5

 Bearers

2015 © Samsung Electronics 6

 LTE Identifiers

2015 © Samsung Electronics 7

 UE Temporary ID’s at different interfaces

2014 © Samsung Electronics 8

 S1AP Interface
 In between eNB and MME, the User can be identified using the S1AP ID’s.
 eNB-UE-S1AP ID is the S1AP ID terminating at the eNB side
 MME-UE-S1AP ID is the S1AP ID terminating at the MME Side.

2014 © Samsung Electronics 9

 GTP Teid’s
 GTP-C Teid’s (S11 MME GTPC Teid and S11/S4 SGW GTPC Teid) are used as the control
plane teid’s at MME and GW respectively.
 GTP-U Teid’s(S1-U eNB GTPU Teid and S1-U SGW GTPU Teid) are used as the user
plane teid’s at eNB and GW respectively.

2014 © Samsung Electronics 10

 Diameter Session ID
 Gx Diameter Session Id can be used to identify the diameter packets related to a
particular subscriber session.
 Gx diameter session Id will be created when the session is created for the subscriber
and will stay till the session is available.

2014 © Samsung Electronics 11

Attach Call Flow

12
 Attach Procedure

T300
starts

T300
stops

2015 © Samsung Electronics 13

 Attach Procedure

2015 © Samsung Electronics 14

 rrcConnection
RACH Request

rrcConnection
Setup

rrcConnection
EPS mobility management
Setup Complete

2015 © Samsung Electronics 15

 RACH Trigger (Two Examples)

2015 © Samsung Electronics 16

 RRC Connection Request (UpLink) (Two Examples)

2015 © Samsung Electronics 17

 RRC Connection Setup (Down Link)

2015 © Samsung Electronics 18

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 19

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 20

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 21

 RRC Connection Setup Complete (Uplink)

2015 © Samsung Electronics 22

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 23

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 24

RJIL Initial Attach Request (APN=jionet)
SAE GW
UE eNB MME HSS PCRF SPR
S-GW P-GW
Power on

RRC Connection Setup

AAAA 1. Attach Request(PDN Connectivity Request)
Steps after
IMSI, Initial Request, APN=jionet
LTE Authentication Attach Request
IC IC NAS Security Setup
Location Update are :
2. Create Session Request 1. Authenticat
IMSI, MSISDN, APN=jionet, PCO, Bearer Context (Bearer ID, Bearer QoS – QCI:9, GBR: 0, MBR: 0) ion
UCU
3. UE IP allocation 4. CCR(Indication of IP-CAN Session establishment)
Initial Request, Subscription-Id(e.g., IMSI), UE-IP, APN, Event-
2. Update
Report, QoS Info(APN-AMBR(UL/DL)), EPS Bearer QoS(QCI, ARP)
Location
5. Profile Request
6. Profile Response
3. Create
User Profile = internet
Session
7. Policy Decision
4. Attach
CCCCCC
8. CCA(Acknowledge of IP-CAN Session Establishment)
9. Policy Enforcement PCC Rule for Default bearer(QCI=9, ARP=1, APN- Accept
5. Modify
AMBR(UL/DL)=50Mbps/100Mbps, Offline, TFT(UL/DL))
10. Create Session Response

Bearer
UE-IP, Default bearer QoS(QCI=9, ARP=1, APN-AMBR(UL)=50Mbps, TFT(UL)=(UE IP, *, SIP, *, UDP)
11. Attach Accept(Activate Default EPS bearer Context Request)

AIA APN=jionet, UE-IP, Default Bearer QoS(QCI=9, ARP=1, UE-AMBR(ULAPN-

AMBR(UL)=50Mbps, TFT(UL)=(UE IP, *, SIP, *, UDP), PCO, GUTI, TAI-list
12. Policy Enforcement
13. Attach Complete(Activate Default Bearer Context Accept) Also SAEGAW sends
14. Modify Bearer Request Bearer ID CCR to OCS before
15. Modify Bearer Response
Create Session
MM Default Bearer(QCI=9) response

Samsung Confidential and Proprietary Information. All Contents Copyright ⓒ 2011 Samsung Electronics Co., Ltd. 25
RJIL PDN Connectivity Request (APN=ims)

PCO : Protocol
Configuration Option is
used to allocate the PCSCF
domain name /IP address
DNS : Domain Name Server
translates hostname into IP
address

PCO option is used by UE

during PDP context
activation to request for
P_CSCF address, DNS
server details etc

Samsung Confidential and Proprietary Information. All Contents Copyright ⓒ 2011 Samsung Electronics Co., Ltd. 26
InitialUEMessage, Attach Request S1AP/NAS message from UE

S1AP message from eNB

eNB S1AP ID which was allocated by eNB for this UE

Message in Hex

NAS-PDU content received from UE.

Attach Request from UE to MME

Authentication Information Request from MME to HSS

AIR message from

MME DRA HSS

Diameter session ID for S6a Interface

IMSI

Authentication Request from MME to HSS

Authentication Information Answer from HSS to MME

Same
session ID

AIA message from

HSS  DRA MME

Authentication Vectors
Authentication Request

Now both UE S1AP

Allocated Ids are created from
MME S1AP ID eNB side and MME
side

Same eNB S1AP ID as

received in Attach Request

EPS Challenge towards UE

Authentication Request from MME to UE

Authentication Response

Same UE S1AP Ids

eNB and MME S1AP ID’s created from eNB
side and MME side
are used

Response calculated by UE

Authentication Response from UE to MME

ME Identity Check Request

Diameter Session
ID for S 13

IMSI

IMEI Check
MME  DRA  EIR
IMEI

ME Identity from MME to EIR

ME Identity Check Answer

IMEI Check Response

EIR -> DRA -> MME
Same Session
ID

White Listed

ME Identity Response from EIR to MME

Update Location Request

ULR message from

MME -> DRA -> HSS
Diameter Session
ID for S6a

IMSI

Update Location Request is sent

when MME does not have the
context information for the UE

Update Location Request from MME to HSS

Cancel Location Request to old MME

CLR to Old MME to delete the UE Context

HSS-> DRA -> Old MME
Update Location Answer to new MME

Same Diameter
Session ID for S6a as
contained in request

ULA message with subscription data

HSS -> DRA -> new MME

APN Information is
sent
APN Profile in Update Location Answer

Jionet

IMS APN
Create Session Request

First GTP-C message for this subscriber, so GW GTP-C Teid is ‘0’

IMSI

S11 MME GTP-C Teid

From MME to Gateway (SAEGW)

Credit Control Request –Gx(CCR - I)

Diameter Gx Session ID

CCR-I
SAEGW(PCEF) -> DRA -> PCRF

Subscription ID contains
IMSI
From PGW to PCRF over Gx
Credit Control Answer – Gx(CCA-I)

Same Session ID
CCA-I
PCRF -> DRA -> SAEGW(PCEF)

Charging Rule Names

Event Triggers for CCR-U towards PCRF

Trigger for ECGI

change can be
added
Credit Control Request – Gy(CCR-I)

Gy Interface
Diameter Session ID for Gy Interface

CCR –I (Gy)
SAEGW -> DRA -> OCS

Session Related Info Sent to OCS

Credit Control Answer – Gy(CCA-I)

CCA-I (Gy)
OCS -> DRA -> SAEGW
Create Session Response

TeID already received by SAEGW

From SAEGW to MME after receipt of CCA

from OCS
SAEGW adds its GTP C TeID

IPv4 and IPv6 Address allocated to UE GTP C both ends

TeID complete

SGW GTP-c Teid

SAEGW adds its GTP U TeID to eNB

SGW GTP-U Teid

S1AP Attach Accept

GW GTP U TeID

S1AP Attach Accept

MME -> eNB

GUTI Value Allocated

To UE
S1AP Initial Context Setup Response

Initial Context Seutp Response

eNB -> MME

eNB GTP-U Teid

S1AP Attach Complete

From UE to MME
Gtpv2 Modify Bearer Request

GTP-C Teid of GW CCA-I (Gy)

OCS -> DRA -> SAEGW
From MME to SAEGW for Default Bearer

S1-U eNB GTP-U Teid

Gtpv2 Modify Bearer Response

GTP-C Teid of MME

From SAEGW to MME for Default Bearer

S1U SGW GTP-U Teid