LTE Attach Procedure
The LTE Attach procedure include Dowling Synchronization (Reading of SIB,
MIB and Cell Selection Procedure), Uplink Synchronisation (RACH Procedure).
Both of them I have already covered separately in my previous post.
Today I am going to continue from Attach Request sent by UE to eNB in RRC
Connection Request. In LTE the Attach procedure completes after establishment
of “Default EPS Bearer” between UE and P-GW.
The Complete procedure I will describe part by part for better understanding. The
procedure of “Default EPS Bearer” Establishment includes “S5 Bearer”
Establishment between S-GW and P-GW, “DRB Bearer Establishment” between
UE and eNB and lastly “S1 Bearer” Establishment between eNb and S-GW.
1.Establishment of S5 Bearer:
Once eNb receives the Attach Request Message from UE. It forwards the message
to MME in “Initial UE Message” in which it includes the “Attach Request and
PDN Connectivity Request (for Data)”.
Created by Avijit Shaw
After this MME understands that this UE want to Attach with the Network so
establish the first Bearer for the UE, MME need to follow below given
procedures,
1.1 UE Authentication.
1.2 NAS Security Procedure.
1.3 Location Update.
1.4 Session Creation.
1.1 UE Authentication: After receiving the Initial UE Message, the MME sends
“Authentication Request” to HSS in which it includes the IE’s User Name,
PLMN etc.
Now, HSS generates an Authentication Vector or AV i.e. RAND, AUTH, XRES,
and KASME for the UE, and sends it to the MME in “Authentication Information
Message”.
After receiving the AVs from the HSS the MME keeps the XRES value with itself
and sends the remains data to the UE in the “Authentication Request Message”.
From the Received AVs the UE generates the “RES” value and sends it to the
MME in the “Authentication Response Message”.
Now MME verifies whether the XRES is equal to RES or not. If not then
Authentication failure will occur and the Attach will get rejected if matches then
MME initiates the second procedure i.e. 1.2 NAS Security.
Created by Avijit Shaw
1.2 NAS Security Procedure: NAS Security happens basically for securing the
NAS Layer between UE and MME for Secure Communication. For this MME
Sends “Security Mode Command Message” to eNb which then eNb forwards
to UE. In this message MME includs the “KSIASMI, UE Security Capability,
IMEISV Req”.
In Response the UE sends “Security Mode Command Response Message” to
eNb, which eNb further forwards to MME. In this message UE includes the IMEI
of the device.
Here NAS Security is completed now MME will initiate the 3rd Procedure which
is “Location Update”.
1.3 Location Update: After successfully completion of the Authentication and
Security Procedure now MME informs the HSS that the UE is ready to
Register for which it sends a “Location Update” message to HSS in which it
includes all the IE’s related to the UE such as “User Name, IMEI, RAT Type,
PLMN and etc”.
In Response the HSS updates the Location of the UE and sends “IMSI, APN,
IMEI, MSISDN, PCO, TAI and etc” to the MME in “Update Location Answer”
message.
Now MME is ready for the last but not least “Session Creation Procedure”.
Created by Avijit Shaw
1.4 Session Creation: In this procedure the MME sends a “Create Session
Request Message” to S-GW, which is basically a request for initiating the
establishment of “S5 Bearer between S-GW and P-GW.
The S-GW forwards this request to P-GW and P-GW sends a “Credit Control
Request (CCR)” to PCRF. Where the P-GW request the OCRF to share the
“Policy Rules” for this particular UE.
In response the PCRF sends the “PCC Rule” for the UE to the P-GW in “Credit
Control Answer (CCA)”. After this the P-GW installs the Policy Decision for the
UE and sends “Create Session Response Message” to the S-GW parallelly it
establishes the “S5 Bearer” between S-GW and itself i.e P-GW.
Here, the establishment of S5 Bearer completes. Now the Second part os DRB
Bearer Establishment between UE and eNb. The Procedure the DRB Bearer
Establishment starts when MME sends “Initial Context Setup Request” message
to eNb in which MME includes “Attach Accept Message” for the UE.
After Receiving this Message from MME the eNb then initiate the “DRB Bearer
Establishment Procedure”.
Created by Avijit Shaw
2.Establishment of DRB (Data Radio Bearer):
Once eNb has received the “Initial Context Setup Request”. It sends “Security
Mode Command Request Message” to the UE to secure the AS Layer between
UE and eNb.
In Response the UE sends Security Mode Command Response Message by which
it indicates the eNb that the security algorithms sent by you have been Completed.
Now the AS layer is “Ciphering and Integrity Protected”.
After that eNb sends “RRC Connection Reconfiguration” to UE in which it
includes “Attach Accept and Activate Default EPS Bearer Context Request
embedded”. Hence DRB Bearer gets established successfully between UE and
eNb.
After establishing the DRB Bearer UE sends “RRC Connection Reconfiguration
Complete” Message to eNb.
After which the eNb sends an “Initial Context Setup Response Message” to
MME. Parallelly UE also sends an “Attach Complete” Message to the eNb in
which it embedded the “Activate Default EPS Bearer Context Accept Message”,
which eNb forwards to the MME in the “Attach Complete” Message.
Now, after receiving the “Attach Complete” message from the eNb, MME
understands that Attach is done and now “Path Modification” is required. So, it
sends a “Modification Bearer Request” to the S-GW by which it indicates the S-
GW that you can directly communicate with eNb for any further communication.
This is basically for the establishment of S1 Bearer between S-GW and eNb.
Created by Avijit Shaw
Hence, In response the S-GW modifies the Path with help of P-GW and the last
but not leasr “S1 Bearer” gets establish between eNb and S-GW.
Here, the Attach Process gets complete. But one last thing is still pending and that
is, the “PDN Connectivity Request” for IMS Signalling.
Yes, In LTE, UE need to send a PDN Connectivity Request to the Network 2
times. The PDN Connectivity Request is for “Data i.e. QCI – 9” and the second
PDN Connectivity Request is for “IMS i.e. QCI – 1” This second PDN
Connectivity Request is also very important because in this message UE requests
the Network to share the address of P-CSCF, which will be needed to the UE for
IMS Registration which is again another part of LTE Attach. Which we will
discuss in upcoming posts.
PDN Connectivity Request: QCI 9:
After a successful Attach, the UE sends “PDN Connectivity Request” to the eNb
in which it mentions the APN as “IMS”. Which eNb forwards to the MME. Now
to establish the separate bearer for the IMS SIP Signalling, the MME sends
“Create Session Request” to S-GW and S-GW forwards it to the P-GW. Here P-
GW sends a “Credit Control Request (CCR) to PCRF in response of which the
PCRF sends “Credit Control Answer to the P-GW. This is basically an
acknowledgement from the PCRF to create a separate Bearer based on the shared
Policy Rules.
The P-GW immediately sends a “Create Session Response” message to S-GW
which S-GW forwards to the MME.
Now MME Sends “E-RAB Setup Request” to eNb including “Activate Default
EPS Bearer Context Request” including the address of P-CSCF.
Created by Avijit Shaw
The eNb then sends a Response to the MME in the “E-RAB Setup Response”
message, by which it indicates the MME that it has successfully received and
shared the address of P-CSCF with the UE.
However, now eNb sends “RRC Connection Reconfiguration Message” to the
UE including the “Activate Default EPS Bearer Context Request”.
In response of that the UE sends “RRC Re-Configuration Complete” message to
the eNb, in which it includes in “Activate Default EPS Bearer Context Request
Accept Message”. Which eNb forwards to the MME in “Activate Default EPS
Bearer Context Request Accept Message.
Here a Default “S1 GTP-U Bearer” gets established for IMS SIP Messages.
Created by Avijit Shaw
After this UE initiates the IMS registration.
[Note: In this Call Flow, UE Capabilities information sharing between UE and
eNb is missing]
The above given details are as of my own experience and reading skill. If
anyone finds any mistake or incorrect data. I warmly welcome them to
correct me.
Attach PDF Link: LTE Attach Call Flow
Log View of LTE Attach Call Flow
Created by Avijit Shaw
