Attach – Call Flow

13 Feb 2016
 Network Identities

2015 © Samsung Electronics 2

 Identities Used in LTE - GUTI
 GUTI – Globally Unique Temporary UE Identity - is assigned only by the MME during
initial attach of a UE to the E-UTRAN – masks the true identity of the subscriber
 GUTI provides an unambiguous identification of the UE that does not revel the UE’s
permanent identity. It also allows identification of the MME and Network to which
UE attaches
 GUTI has to main components - GUMMEI Globally Unique Mobility management
Entity Identifier and the M –TMSI that uniquely identifies the UE within the MME
 For paging, the mobile is paged with the S-TMSI which is a shorter version of GUTI
 On the S1 Interface, the IMSI is typically not seen just like the GUTI. Exceptions are
initial attach when no old GUTI is stored on the USIM card or in paging procedure

MCC and
MNC are 3
DIGITS

2015 © Samsung Electronics 3

 Identities Used in LTE - RNTI
 RNTI – Radio Network Temporary Identifier
 RNTI is signaled in the MAC Layer. When MAC uses the PDCCH to indicate radio
resource allocation, the RNTI is mapped on the PDCCH depends on the logical channel
type -
 C- RNTI : Temporary Cell Radio Network Temporary Identifier for Dedicated Control Channel
(DCCH and DTCH). It defines which data sent in DL belongs to a particular subscriber – all RRC
messages are marked with same C RNTI for a subscriber
 P- RNTI : Paging Radio Network Temporary Identifier for Paging Control Channel (PCCH) is
derived from IMSI. It does not refer to a particular UE but to a group of UEs.
 RA- RNTI : Random Access Radio Network Temporary Identifier for Random Access Response
(RAR) on DL-SCH – assigned to particular UE and is contained in the response from eNode B
for PRACH. The UE then uses this RA- RNTI to send RRC Connection Request
 Temporary C-RNTI for Common Control Channel (CCCH) during random access procedure
 SI- RNTI : System Information Radio Network Temporary Identifier for Broadcast Control
Channel (BCCH) – sent on PDCCH - it signals to all UEs where SIBs are found on PDSCH

RNTI Values

2015 © Samsung Electronics 4

 LTE Identities

2015 © Samsung Electronics 5

 Bearers

2015 © Samsung Electronics 6

 LTE Identifiers

2015 © Samsung Electronics 7

 UE Temporary ID’s at different interfaces

2014 © Samsung Electronics 8

 S1AP Interface
 In between eNB and MME, the User can be identified using the S1AP ID’s.
 eNB-UE-S1AP ID is the S1AP ID terminating at the eNB side
 MME-UE-S1AP ID is the S1AP ID terminating at the MME Side.

2014 © Samsung Electronics 9

 GTP Teid’s
 GTP-C Teid’s (S11 MME GTPC Teid and S11/S4 SGW GTPC Teid) are used as the control
plane teid’s at MME and GW respectively.
 GTP-U Teid’s(S1-U eNB GTPU Teid and S1-U SGW GTPU Teid) are used as the user
plane teid’s at eNB and GW respectively.

2014 © Samsung Electronics 10

 Diameter Session ID
 Gx Diameter Session Id can be used to identify the diameter packets related to a
particular subscriber session.
 Gx diameter session Id will be created when the session is created for the subscriber
and will stay till the session is available.

2014 © Samsung Electronics 11

Attach Call Flow

12
 Attach Procedure

2014 © Samsung Electronics 13

 T300 starts in UE (200ms)
Attach Procedure

Timer starts in eNB :

RRC_CONNECTION_SETUP (1000 ms)

Timer stops in eNB :

RRC_CONNECTION_SETUP

T300 stops in UE

Timer Starts at UE :
S1_INITIAL_CONTEXT_SETUP = Timer Stops at UE :
10000 ms S1_INITIAL_CONTEXT_SETUP

2015 © Samsung Electronics 14

 Attach Procedure

RRC Connection Reconfiguration message including EPS Radio Bearer Identity and Attach
Accept message; UE sends Uplink Information Transfer message to the eNodeB which
includes the Attach Complete message
2015 © Samsung Electronics 15
 Attach Procedure Timer starts in eNB :
RRC_UE_CAPABILITY_ENQUIRY[ms] = 2000

Timer starts in eNB :

RRC_SECURITY_MODE_COMMAND = 2000
ms
Timer stops in eNB :
RRC_SECURITY_MODE_COMMAND

Timer starts in eNB :

RRC_CONNECTION_RECONFIG = 1500 ms

Timer stops in eNB :

RRC_CONNECTION_RECONFIG = 1500 ms

RRC Connection Reconfiguration message including EPS Radio Bearer Identity and Attach
Accept message; UE sends Uplink Information Transfer message to the eNodeB which
includes the Attach Complete message
2015 © Samsung Electronics 16
 rrcConnection
RACH Request

rrcConnection
Setup

rrcConnection
EPS mobility management
Setup Complete

2015 © Samsung Electronics 17

 RACH Trigger (Two Examples)

2015 © Samsung Electronics 18

 RRC Connection Request (UpLink) (Two Examples)

2015 © Samsung Electronics 19

 RRC Connection Setup (Down Link)

2015 © Samsung Electronics 20

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 21

 Attach Request
• The UE initiates the Attach procedure by sending the Attach Request message to the eNodeB
with following identities.
• IMSI or GUTI
• TAI (if available)
• UE Capabilities - indicates supported NAS and AS security algorithms by UE
• Attach Type - indicates EPS or combined EPS/IMSI
• ESM Message Container
• RRC Parameters
• The ESM Message Container contains the following identities.
• Request Type
• PDN Type - indicates requested IP version (IPv4, IPv6 or IPv4v6)
• Protocol Configuration Options (PCO) - included by UE and sent transparently to MME to
indicate Address allocation preference of UE (eg. after establishing default bearer using DHCP)
• Ciphered Options Transfer flag - must be set if PCO or APN or both are to be sent by UE
• KSIASME (if valid EPS security parameters available)
• NAS Sequence number (if valid EPS security parameters available)
• NAS-MAC (if valid EPS security parameters available)
• additional GUTI
• P-TMSI
• The RRC parameters indicate the Selected Network and old GUMMEI.
2015 © Samsung Electronics 22
 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 23

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 24

 RRC Connection Setup Complete (Uplink)

2015 © Samsung Electronics 25

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 26

 RRC Connection Setup Complete (Uplink)

Attach Request

2015 © Samsung Electronics 27

 AMBR
• UE-AMBR and APN-AMBR

• APN-AMBR
The APN-AMBR defines the total bit rate that is allowed for all non-GBR bearers associated with a
specific APN. The APN-AMBR limits the total non-GBR traffic for an APN, independent of the
number of PDN connections and non-GBR bearers that are opened for that APN. For example, if an
operator provides an APN for Internet, the operator may then limit the total bandwidth for that
APN.

UE-AMBR

• The UE-AMBR is defined per subscriber and defines the total bit rate allowed to be consumed for
all non-GBR bearers of a UE. The subscription profile contains the UE-AMBR. The eNodeB enforces
the UE-AMBR.

• There are different AMBR values for uplink and downlink directions - UL APN-AMBR, DL APN-
AMBR, and UL UE-AMBR, DL UE-AMBR.

2015 © Samsung Electronics 28

RJIL Initial Attach Request (APN=jionet)
SAE GW
UE eNB MME HSS PCRF SPR OCS
S-GW P-GW
Power on

RRC Connection Setup

1. Attach Request(PDN Connectivity Request)
ASIUCAUM
IMSI, Initial Request, APN=jionet
LTE Authentication
NAS Security Setup
Location Update

2. Create Session Request

IMSI, MSISDN, APN=jionet, PCO, Bearer Context (Bearer ID, Bearer QoS – QCI:9, GBR: 0, MBR: 0)

3. UE IP allocation 4. CCR(Indication of IP-CAN Session establishment)

Initial Request, Subscription-Id(e.g., IMSI), UE-IP, APN, Event-
Report, QoS Info(APN-AMBR(UL/DL)), EPS Bearer QoS(QCI, ARP)
5. Profile Request
6. Profile Response
User Profile = internet
7. Policy Decision
8. CCA(Acknowledge of IP-CAN Session Establishment)
PCC Rule for Default bearer(QCI=9, ARP=1, APN-
9. Policy Enforcement 9.1 CCR (Indication of Session, APN=JioNet)
AMBR(UL/DL)=50Mbps/100Mbps, Offline, TFT(UL/DL))
10. Create Session Response
UE-IP, Default bearer QoS(QCI=9, ARP=1, APN-AMBR(UL)=50Mbps, TFT(UL)=(UE IP, *, SIP, *, UDP)
9.2 CCA (Ack of session, APN=JioNet)
11. Attach Accept(Activate Default EPS bearer Context Request)
APN=jionet, UE-IP, Default Bearer QoS(QCI=9, ARP=1, UE-AMBR(ULAPN-
AMBR(UL)=50Mbps, TFT(UL)=(UE IP, *, SIP, *, UDP), PCO, GUTI, TAI-list Steps after Attach Request are :
12. Policy Enforcement 1. Authentication
13. Attach Complete(Activate Default Bearer Context Accept) 2. Security Mode
3. Identity Check
14. Modify Bearer Request Bearer ID
4. Update Location
15. Modify Bearer Response 5. Create Session
Default Bearer(QCI=9) 6. Attach Accept
7. UE capability
8. Modify Bearer
Samsung Confidential and Proprietary Information. All Contents Copyright ⓒ 2011 Samsung Electronics Co., Ltd. 29
RJIL PDN Connectivity Request (APN=ims)
PCRF OCS

PCO option is used

Steps after
by UE during PDP Modify
context activation Bearer are :
to request for 1. PDN
Request
P_CSCF address, 2. Create
DNS server details Session
etc 3. Activate
Bearer
4. Modify
Bearer

4.1 CCR & CCA to/from PCRF, APN=ims)

4.2 CCR & CCA to/from OCS, APN=ims)

Not
configured
PCO : Protocol
Configuration Option is
used to allocate the PCSCF
domain name /IP address
Modify Bearer Request DNS : Domain Name
Server translates PCAM
Modify Bearer Response hostname into IP address

Samsung Confidential and Proprietary Information. All Contents Copyright ⓒ 2011 Samsung Electronics Co., Ltd. 30
 VoLTE - UE Attachment and IMS Registration message

Auth Challenge

Steps after Modify

Bearer are :
UAR : User Authorization Request, UAA : User Authorization Answer 1. REGISTER
2. Authorization
MAR : Multimedia Authorization Request, MAA : Multimedia Authorization 3. 401
Answer Unauthorized
4. REGISTER
UDR : Update Data Request, UDA : Update Data Answer 5. Authorization
6. 200 OK
SAR : Server Authorization Request, SAA : Server Authorization Answer
2015 © Samsung Electronics RA4RA2 31
 SRB
 "Signalling Radio Bearers" (SRBs) are defined as Radio Bearers (RB) that are used only
for the transmission of RRC and NAS messages. More specifically, the following three
SRBs are defined:
 SRB0 is for RRC messages using the CCCH logical channel;

 SRB1 is for RRC messages (which may include a piggybacked NAS message) as well as for
NAS messages prior to the establishment of SRB2, all using DCCH logical channel;

 SRB2 is for RRC messages which include logged measurement information as well as for
NAS messages, all using DCCH logical channel. SRB2 has a lower-priority than SRB1 and is
always configured by E-UTRAN after security activation.

 Once security is activated, all RRC messages on SRB1 and SRB2, including those
containing NAS or non-3GPP messages, are integrity protected and ciphered by PDCP.
NAS independently applies integrity protection and ciphering to the NAS messages

2015 © Samsung Electronics 32

 SRB
LTE SRB Type Direction RRC message RLC Mode
RRC Connection Setup
RRC Connection Reject
Downlink
RRC Connection Re-establishment
LTE SRB0 (CCCH) RRC Connection Re-establishment reject Transparent

RRC Connection Request

Uplink
RRC Connection Re-esblishment Request
RRC Connection Reconfiguration
RRC Connection Release
Security Mode Command
UE Capability Enquiry
Downlink DL information transfer(if no SRB-2)
Mobility from EUTRA Command
Handover from EUTRA preparation request
CS Fallback parameter response CDMA2000
Counter Check

LTE SRB1(DCCH) RRC Connection Setup Complete

Security Mode Complete
Acknowledged
Security Mode Failure
RRC Connection Reconfiguration Complete
RRC Connection Re-establishment Complete
Uplink Measurement report
UE Capability information
UL Information Transfer(if no SRB2)
UL handover preparation transfer
CS fallback parameters request CDMA2000
Counter Check response

Downlink DL Information Transfer

LTE SRB2 (DCCH)
Uplink UL Information Transfer
2015 © Samsung Electronics 33
 Control Channel Mapping
LoCH
Message RB Lo CH LCID
No
MIB - BCCH 0 -

SIB 1 - BCCH 1 -

SIB 2 - BCCH 1 -

RRC : PRACH Preamble - - - -

RRC : RACH Response - - - -

RRC : RRC Connection Request SRB0 UL CCCH 0 0

RRC : RRC Connection Setup SRB0 DL CCCH 0 0

RRC : RRC Connection Setup Complete + NAS : Attach Request + ESM : PDN Connectivity Request SRB1 UL DCCH 0 1
RRC : DL Information Transfer + NAS : Authentication Request SRB1 DL DCCH 0 1

RRC : UL Information Transfer + NAS : Authentication Response SRB1 UL DCCH 0 1

RRC : DL Information Transfer + NAS : Security Mode Command SRB1 DL DCCH 0 1

RRC : UL Information Transfer + NAS : Security Mode Complete SRB1 UL DCCH 0 1

RRC : Security Mode Command SRB1 DL DCCH 0 1

RRC : Security Mode Complete SRB1 UL DCCH 0 1

RRC : RRC Connection Reconfiguration SRB1 DL DCCH 0 1

RRC : RRC Connection Reconfiguration Complete SRB1 UL DCCH 0 1

RRC : UL InformationTransfer + NAS : Attach Complete + NAS : Activate Default EPS Bearer SRB2 UL DCCH 1 2

RRC : UL Information Transfer + ESM : PDN Connectivity Request SRB2 UL DCCH 1 2

DRB (user) Data Radio Bearer

SRB Signalling Radio Bearer

2015 © Samsung Electronics 34

 Diameter
 Diameter is an authentication, authorization, and accounting protocol for computer
networks. It evolved from and replaces the much less capable RADIUS protocol that
preceded it.
 The main features provided by Diameter but lacking in RADIUS are:
 Support for SCTP
 Capability negotiation
 Application layer acknowledgements, Diameter defines failover methods and state machines
(RFC 3539)
 Extensibility; new commands can be defined
 Aligned on 32-bit boundaries
 A Diameter Application is not a software application but is a protocol based on the
Diameter base protocol defined in RFC 6733 (Obsoletes: RFC 3588).
 Each application is defined by an application identifier and can add new command codes
and/or new mandatory AVPs (Attribute-Value Pair). Adding a new optional AVP does not
require a new application.

2015 © Samsung Electronics 35

LTE Attach Messages

UE Capabilities for E-UTRAN

From eNB to MME

IMS PS Voice preferred and

CS voice as secondary
 Message Details in brief (UE messages shown in Red Font)

Attach Request – UE to MME over 102 VLAN (RRC Connection Set Up); contains
S1AP ID allocated from eNB, Contains PDN connectivity request for Jionet APN, with
IMS Voice as preferred and CS Voice as secondary
1. Authentication – MME to DRA to HSS using Diameter ID for S6a, contains IMSI,
HSS replies using same Diameter Session ID with Authentication Vectors , MME
sends Authentication Request (EPS Challenge Request) to UE using same S1AP
ID received from eNB during Attach Request and allocates the MME end S1AP
ID. Now both S1AP ID allocated (eNB side and MME side). UE then sends
Authentication Response computed by it using the same S1AP IDs.
2. Security Mode – MME to UE over S1AP interface; MME sends Security Mode
Command to UE using the same S1AP ID, UE replies with Security Mode
Response which also includes IMEI.
3. Identity Check – MME to DRA to EIR over S13 interface; MME sends IMSI &
IMEI to EIR for Identity Check through Diameter. New Diameter ID created. EIR
replies stating IMEI as “white listed”
4. Update Location – MME to HSS over S6a; In case MME does not have context
information of UE, Update Location is sent to HSS which then sends Cancel
Location Message to old MME. HSS sends Update Location Answer to new MME
using same Diameter Session ID as contained in the request – this reply contains
APN details (Jionet and IMS) and three PDN types IPv4, IPv6 and IPv4/IPv6
 Message Details in brief (UE messages shown in Red Font)

5. Create Session: MME to SAEGW over S11 interface; This is first GTP C message
for the subscriber. GPTC TeID from MME side added. SAEGW sends CCR-I
request over Gx interface to PCRF. CCA-I is received from PCRF containing the
charging rules & the triggers for CCR-U towards PCRF. SAEGW sends CCR-I
towards OCS over Gy interface with details of session related information. OCS
replies with CCA-I. After receiving reply from both PCRF and OCS, SAEGW sends
Create Session Response to MME and adds the GTPC TeID for the S11 interface
(now both ends TeID created for GTPC over S11) and IPv4 and IPv6 Address
allocated to UE for Jionet APN, indicates the AMBR values, adds the GTPU
TeID for eNB for S1-U interface

6. Attach Accept: MME to UE using the same S1AP ID created earlier. Contains
GTPU TeID for S1-U interface received from SAEGW, contains GUTI & S-TMSI.
7. UE capability: eNB to MME using already existing S1AP ID; sends UE capability
for UTRAN and GERAN; eNB sends Initial Context Set Up Response to UE
(Activate Default EPS Bearer Context Request) which includes the GTPU TeID
for S1-U interface towards SAEGW; UE sends Attach Complete Message
towards MME
8. Modify Bearer: MME sends Modify Bearer Request towards SAEGW which
contains the GTPU TeID received from eNB (Now both ends TeID of GTPU are
with SAEGW); SAEGW acknowledges by sending Modify Bearer Response to
MME
IMS Attach Messages

IMS Registration Messages

InitialUEMessage, Attach Request (1/2) S1AP/NAS message from UE

S1AP message from eNB

eNB S1AP ID which was allocated by eNB for this UE

Message in Hex

NAS-PDU content received from UE.

Attach Request from UE to MME

VLAN 102
Attach Request – Voice Preference (2/2)

From UE to MME
IMS PS Voice preferred and
CS voice as secondary

VLAN 102
Authentication Information Request from MME to HSS

AIR message from

MME DRA HSS

Diameter session ID for S6a Interface

IMSI

Authentication Request from MME to HSS

Authentication Information Answer from HSS to MME

Same
session ID

AIA message from

HSS  DRA MME

Authentication Vectors
Authentication Request

Now both UE S1AP

MME sends Ids are created from
the Allocated eNB side and MME
MME S1AP side
ID
Same eNB S1AP ID as
received in Attach Request

EPS Challenge towards UE

Authentication Request from MME to UE

Authentication Response

Same UE S1AP Ids

eNB and MME S1AP ID’s created from eNB
side and MME side
are used

Response calculated by UE

Authentication Response from UE to MME

Security Mode Command

From MME to UE

Security Capability related

Security Mode Complete

From UE to MME

Contains IMEI
ME Identity Check Request

Diameter Session
ID for S 13

IMSI

IMEI Check
MME  DRA  EIR
IMEI

ME Identity from MME to EIR

ME Identity Check Answer

IMEI Check Response

EIR -> DRA -> MME
Same Session
ID

White Listed

ME Identity Response from EIR to MME

Update Location Request

ULR message from

MME -> DRA -> HSS
Diameter Session
ID for S6a

IMSI

Update Location Request is sent

when MME does not have the
context information for the UE

Update Location Request from MME to HSS

Cancel Location Request to old MME

CLR to Old MME to delete the UE Context

HSS-> DRA -> Old MME
Update Location Answer to new MME

Same Diameter
Session ID for S6a as
contained in request

ULA message with subscription data

HSS -> DRA -> new MME

APN Information is
sent
APN Profile in Update Location Answer

Jionet

Three PDN types IpV4,

IpV6 and IPv4v6

IMS APN
Create Session Request

First GTP-C message for this subscriber, so GW GTP-C Teid is ‘0’

IMSI
Can contain - Three PDN
types IpV4, IpV6 and
IPv4v6

S11 MME GTP-C Teid

From MME to Gateway (SAEGW)

Credit Control Request –Gx(CCR - I)

Diameter Gx Session ID

CCR-I
SAEGW(PCEF) -> DRA -> PCRF

Subscription ID contains
IMSI
From PGW to PCRF over Gx
Credit Control Answer – Gx(CCA-I)

Same Session ID
CCA-I
PCRF -> DRA -> SAEGW(PCEF)

Charging Rule Names

Event Triggers for CCR-U towards PCRF

Trigger for ECGI

change can be
added
Credit Control Request – Gy(CCR-I)

Gy Interface
Diameter Session ID for Gy Interface

CCR –I (Gy)
SAEGW -> DRA -> OCS

Session Related Info Sent to OCS

Credit Control Answer – Gy(CCA-I)

CCA-I (Gy)
OCS -> DRA -> SAEGW
Create Session Response

TeID already received by SAEGW

Aggregate MBR values for

Jionet APN

SAEGW adds its GTP C TeID

IPv4 and IPv6 Address allocated to UE GTP C both ends

TeID complete

SGW GTP-c Teid

SAEGW adds its GTP U TeID to eNB

SGW GTP-U Teid

From SAEGW to MME after receipt of CCA from OCS

S1AP Attach Accept

GW GTP U TeID

S1AP Attach Accept

MME -> eNB

GUTI Value Allocated

To UE
S-TMSI
Allocated =
MME Code + M-
TMSI
UE Capability Info Indication

UE Capabilities for E-UTRAN

From eNB to MME

UE Capabilities for geran-cs

UE Capabilities for geran-ps

S1AP Initial Context Setup Response

Initial Context Seutp Response

eNB -> MME

eNB GTP-U Teid

S1AP Attach Complete

From UE to MME
Gtpv2 Modify Bearer Request

GTP-C Teid of GW CCA-I (Gy)

OCS -> DRA -> SAEGW
From MME to SAEGW for Default Bearer

S1-U eNB GTP-U Teid

Gtpv2 Modify Bearer Response

GTP-C Teid of MME

From SAEGW to MME for Default Bearer

S1U SGW GTP-U Teid

IMS Attach
 Message Details in brief (UE messages shown in Red Font)

1. PDN Connectivity Request for IMS APN – UE to MME; uses the same S1 AP
ID already created ; indicates PDN connectivity type as IPv4 or IPv6 or
IPV4/IPv6; requests details of P CSCF and DNS Server;
2. Create Session: MME to SAEGW using the GTPC TeID already defined; This
contains the GTPC TeID from MME; SAEGW sends CCR U message to PCRF
over Gx interface; New Diameter Session ID created for IMS APN; This message
contains details of IMSI & MSISDN and the IPv4 & IPv6 address allotted to IMS
APN; PCRF replies with CCA I which contains charging rule and event triggers
to sent CCR U; SAEGW then sends Create Session Response to MME with
GTPC TeID of SGW & PGW for QCI 5 and the Primary & Secondary IPv4 &
IPv6 address of P-CSCF and the IP Address of DNS and the IPv4 & IPv6
address allocated to IMS APN and the SAEGW TeIDs for S1-U traffic
3. Attach Accept: MME to ENB ; MME sends S1 ERAB Set Up Request to eNB
and Activate Default Bearer Context Request to UE; Message also contains
the the IP address for IMS APN for UE and AMBR values for IMS APN. The eNB
sends ERAB Set Up Response containing the GTPU TeIDs for S1 U for QCI 5;
Now both ends of GTPU TeID defined for QCI 5; UE sends Activate Default
Bearer Context Accept.
4. Modify Bearer: MME to SAEGW; MME sends Modify Bearer Request which
contains details of the eNB GTP TeID for S1 U for QCI 5; SAEGW sends Modify
Bearer Accept. Now QCI 5 bearer is established and data can start flowing.
IMS Attach Messages

IMS Registration Messages

S1AP PDN Connectivity Request [1/2]

Same
MME- UE-S1AP-ID
UE to MME

Same
ENB- UE-S1AP-ID

S1AP PDN Connectivity Request for IMS APN

S1AP PDN Connectivity Request [2/2]

S1AP PDN Connectivity Request for IMS APN

UE to MME
Three PDN types IpV4,
IpV6 and IPv4v6
APN: IMS
Requesting Details of DNS
and P-CSCF Address
Create Session Request for IMS APN

GW GTP-C Teid
MME to SAEGW
allocated before

APN: IMS
IMSI: same
GTP-C Teid of MME

GTPv2 Create Session Request

CCR-I for IMS Session on Gx Interface

CCR-I for IMS Apn on Gx Interface Diameter Gx Session ID

SAEGW(PCEF)  DRA  PCRF for IMS APN
This is new Diameter Session ID
allocated for IMS. This is not the same
ID which has been used for Jionet

Subscription ID contains IMSI

and MSISDN
IPv4 and V6 Address
allocated to IMS APN

SAEGW to PCRF
CCA-I for IMS Session on Gx Interface

Same IMS Diameter Session ID of Gx Interface

used in Request message(CCR-I)

Charging
Rule Name

Event Triggers about

when to send CCR-U

CCA-I for IMS Apn in Gx Interface

PCRF  DRA  PCEF(SAEGW)
Create Session Response for IMS APN [1/3]

MME GTP-C Teid

allocated before

GTP-C Teid of SGW and

Bearer ID for IMS
PGW
EBI - 6

EBI 5 is allocated to Jionet and EBI 6 for IMS

based on availability
SAEGW to MME GTPv2 Create Session Response
Create Session Response for IMS APN [2/3]

SAEGW to MME
The UE would be allocated IPv4 or IPv6 or IPv4v6 based on initial request,
configuration in HSS and PGW. Final decision on allocation by PGW . For usage
Ipv6 would be preferred if available on both UE and Network side

DNS IP which UE has

to Use
Primary and Secondary IPV4 P-
CSCF Address (since only IPv4 If available, IPv6 P-CSCF
configured) address can also be given
by SAEGW

IPv4 and IPv6 Address

allocated for IMS APN

GTPv2 Create Session Response

UE is allocated two sets of IP Addresses – one for Jionet APN and second for IMS APN
Create Session Response for IMS APN [3/3]

SAEGW to MME

S1-U SGW and S5/S8 PGW GTP-

U Teid’s for User Plane Packet's

QOS for EBI-6 bearer

QCI -5

GTPv2 Create Session Response

S1AP E-RAB Setup, Activate default EPS… [1/3]

One message contains

S1AP E-RAB Setup Request &
NAS Activate default EPS bearer Context Request

S1AP E-RAB Setup Request which

contains
EBI-6
QOS details

MME to eNode B
S1AP E-RAB Setup Request
S1AP E-RAB Setup, Activate default EPS… [2/2]

NAS PDU
towards UE

EBI-6

QCI -5

Only last 64 bits of IPv6

Address and IPv4 Address

MME to UE
Aggregate MBR values for
IMS APN
NAS Activate default EPS bearer Context Request
S1AP E-RAB Setup Response

S1AP Message from eNB

eNode B to MME

GTP-U Fteid details of eNB

EBI-6

S1AP E-RAB Setup Response

S1AP/NAS Activate default EPS bearer context accept

NAS Message from UE

UE to MME

Accept message from UE

Activate Default EPS bearer context accept

Gtpv2 Modify Bearer Request for Ebi-6

Modify Bearer Request

MME to SAEGW

GTP-U Fteid of eNB

Gtpv2 Modify Bearer Response for Ebi-6

Request Accepted
Modify Bearer Response

Now the GTP-U teid’s of eNB and

GW are known at both sides.

SAEGW to MME User data transfer can flow now.

GTP-U Fteid of SGW

TCP SYN
TCP 3-Way Handshake
A three-way-handshake is a method used in a TCP/IP network to create a Reliable Connection
between a client and server. It is a three-step method that requires both client and server to
exchange SYN and ACK (acknowledgment) packets before actual data communication begins.
A three-way-handshake is also known as a TCP handshake.
TCP SYN

When Client wants to initiate a connection with Server, Client sends a segment with
SYN(Synchronize Sequence Number). This segment will inform the Server that Client would like
to start a communication with Server and informs that with what sequence number it will
start its segments with.
Note: Sequence Numbers are mainly used to keep data in order.
TCP SYN –ACK
Now Server will respond to Client with "Acknowledgment" (ACK) and SYN bits set.
Here Servers ACK segment does two things; they are as below

1. It acknowledges Client’s SYN segment.

2. It informs Client that what sequence number it will start its data with.
TCP ACK
Now finally Client Acknowledges Server’s initial sequence Number and in its ACK signal.
And then Client will start the actual data transfer.
Note: Initial Sequence Numbers are randomly selected while initiating connections between
two machines.
 IMS REGISTRATION using
QCI 5 Bearer already created

CCR: Credit Control Request , CCA: Credit Control Answer

UAR : User Authorization Request, UAA : User Authorization Answer
MAR : Multimedia Authorization Request, MAA : Multimedia Authorization Answer
UDR : Update Data Request, UDA : Update Data Answer
SAR : Server Authorization Request, SAA : Server Authorization Answer

A different subscriber taken as example

 Message Details in brief (UE messages shown in Red Font)
1. REGISTER: UE to P CSCF; contains the IP Address allocated for IMS APN to UE and IP
address of P CSCF received via PCO Options and the SIP Call ID used for Registration;
P CSCF sends REGISTER Message to ICSCF : contains the Public User Identity which
generally starts with sip: or tel:
2. Authorization: ICSCF sends UAR message to HSS; HSS replies with UAA to I CSCF; I-
CSCF forwards the SIP Register message to the S-CSCF address received from HSS; S
CSCF then sends MAR to HSS requesting Authentication Vectors for Multimedia
session from HSS. HSS replies with MAA;
3. 401 Unauthorized: From S CSCF to P CSCF to SAEGW to UE; Contains SIP
Authorization parameters received from HSS and uses the same Call ID as received in
the REGISTER Message;
4. REGISTER: UE sends second REGISTER to SAEGW to P CSCF to S CSCF using same
Call ID; This contains the Authentication Response based on the keys received in 401
Unauthorized
5. Authorization: S-CSCF Sends the REGISTER Message to I CSCF; I-CSCF (SCFX in NSN)
sends UAA to HSS and again asks HSS about which S CSCF (S-CFX) to use; HSS replies
with UAA to I CSCF; I-CSCF forwards the SIP Register message to the S-CSCF address
received from HSS; S CSCF sends SAR to HSS and Updates HSS that the user is
authenticated and asks to provide the subscription Information; S-CSCF request HSS
to map the subscriber to the mentioned S-CSCF server name; HSS replies with SAA
which contains charging information and identities present in HSS for the subscriber;
6. 200 OK: S- CSCF to P CSSF to SAEGW to UE; uses the same Call ID; After this
message is received we can see the two Horizontal BARS symbols for IMS in UE
IMS Attach Messages

IMS Registration Messages

SIP REGISTER (Unprotected) A different subscriber taken as example

IPv6 Address allocated to P-CSCF Address received i

IMS APN PCO options

Expiry Value for SIP Transaction

Private Identity of the user

Used in Authentication Request

SIP Call ID used for Registration

process
SIP “Via” header contains Transport,
Last SIP hop and transaction ID

UE to P CSCF SIP Register(Unprotected)

SIP REGISTER (Unprotected) from P-CSCF to I-CSCF

One more “Via” header

added about p-cscf route
Content of the Message will not
be modified, rather new
headers like Via and IMS related
will be added.

From: contains the Public User Identity

Generally starts with sip: or tel:

REGISTER message

SIP Register(Unprotected)
User Authorization Request (I-CSCF to HSS)

New Diameter Session ID allocated by

I-CSCF

User Name Contains IMSI

User Authorization Request

SCFX  DRA  HSS
User Authorization Answer (HSS to I-CSCF)

User Authorization Response I-CSCF forwards the SIP

HSS  DRA  SCFX Register message to the S-CSCF
address received from HSS

S-CSCF address

Result as
Diameter Subsequent Registration
Multimedia Auth Request (S-CSCF to HSS)

Requesting Authentication Vectors for Multimedia

session from HSS.
New diameter Session ID allocated by S-CSCF

Requested Authentication Vectors : 5

Multimedia Auth Answer (HSS to S-CSCF)

Same diameter session ID used for MAR

Received
SIP Auth Items : 1
SIP 401 Unauthorized (S-CSCF  P-CSCF  SAEGW UE)

Same SIP Call ID used in

REGISTER message

“Via” header used for routing

purposes

SIP Auth parameters

Received from HSS
SIP Register (2nd ) (UE -> SAEGW -> PCFX -> SCFX)

Authentication Response based on the

keys received in 401 Unauthorized

Same SIP
Call ID
User Authorization Request ( 2nd time)

New Diameter Session ID again

I-CSCF(SCFX in NSN) again asks

HSS about which S-CFX to use
User Authorization Answer(HSS  I-CSCF)

I-CSCF forwards the SIP

Register message to the S-CSCF
address received from HSS

S-CSCF Server name

Server Assignment Request (S-CSCF  DRA  HSS)

S-CSCF Updates HSS that user is authenticated and

asks to provide the subscription Information

S-CSCF Server name

Server Assignment Answer (HSS  DRA  S-CSCF)

S-CSCF request HSS to map the

subscriber to the mentioned
S-CSCF server name
Identities present in HSS for this
subscriber

Charging Information
200 Ok for SIP Register (S-CSCF  P-CSCF  SAEGW  UE)

After this message is received

we can see the two Horizontal
BARS symbols for IMS in UE
SIP Call ID
Used for registration process

Public Identity
for the user for next transactions
Modify bearer request *is initiated by MME/S4-SGSN and/or from S-GW to P-GW*
Here you are not adding or deleting any resources/bearers.
This message is used when there is no change on allocated bearers, Only the cause is
user is moving from one place to another. Basically Radio Part is changing. This
information MME should inform to all Core Network Elements (S-GW) and it helps
them to attain the resources and handovers case too. It will just modify the bearers.
After getting the response of Modify Bearer Request it indicates that User Plane is
ready to carry the user data as Control plane is done and now data can flow in between
E-UTRAN and S-GW.
Update Bearer Request: *is initiated by P-GW to S-GW and/or from S-GW to MME/S4-
SGSN*
I want to explain here with example. Suppose you are playing a online game in your
Mobile. It requires a promised speed to avoid the delay and you are subscribed for that
too. Now suddenly you got to know that you have to send a mail to your boss but you
don't want to close your game. For this purpose you need more resources.
Here Update Procedure will come.
You already have dedicated bearers with you. Your packet forwarding is happening
through P-GW but you need more resources. In this case P-GW will initiate the
message Update Bearer Request.
DRIVE TEST LOGS
 Attach Procedure

2015 © Samsung Electronics 106

 T300 starts in UE (200ms)
Attach Procedure

Timer starts in eNB :

RRC_CONNECTION_SETUP (1000 ms)

Timer stops in eNB :

RRC_CONNECTION_SETUP

T300 stops in UE

Timer Starts at UE :
S1_INITIAL_CONTEXT_SETUP = Timer Stops at UE :
10000 ms S1_INITIAL_CONTEXT_SETUP

2015 © Samsung Electronics 107

 Attach Procedure

RRC Connection Reconfiguration message including EPS Radio Bearer Identity and Attach
Accept message; UE sends Uplink Information Transfer message to the eNodeB which
includes the Attach Complete message
2015 © Samsung Electronics 108
 Attach Procedure Timer starts in eNB :
RRC_UE_CAPABILITY_ENQUIRY[ms] = 2000

Timer starts in eNB :

RRC_SECURITY_MODE_COMMAND = 2000
ms
Timer stops in eNB :
RRC_SECURITY_MODE_COMMAND

Timer starts in eNB :

RRC_CONNECTION_RECONFIG = 1500 ms

Timer stops in eNB :

RRC_CONNECTION_RECONFIG = 1500 ms

RRC Connection Reconfiguration message including EPS Radio Bearer Identity and Attach
Accept message; UE sends Uplink Information Transfer message to the eNodeB which
includes the Attach Complete message
2015 © Samsung Electronics 109
EPC ATTACH ASIUCAUM

PDN connectivity
Request for Jionet APN

Attach Request (RACH third Message)

EPC ATTACH ASIUCAUM
Authentication Request

Authentication Response

UE Capability Information

Attach Accept and Default EPS

Security Bearer Request QCI 9
Attach Accept & Activate Default Bearer
IMS ATTACH Attach
Complete /
Default EPS
Bearer QCI 9
accept

PDN
Connectivity
Request to IMS

Default Bearer
Accept QCI 5

PCAM
 TCP SYNC
IMS REGISTRATION RA4RA2

REGISTER

401
Unauthorized

REGISTER

200 OK

SUBSCRIBE

200 OK

NOTIFY
200 OK

SIP MESSAGES WOULD START AFTER TCP SYN

 INVITE
100 TRYING
183 Session in
Progress

PRACK
200 OK