EPC Cours Notes

7/23/2019 EPC Cours Notes

1/128

LTE Evolved Packet Core NetworkFlexicourse

Course Code: LT3604F Duration: 1 day

LTE courses include

LTE/SAE Engineering Overview

LTE Air Interface

LTE Radio Access Network

Cell Planning for LTE Networks

LTE Evolved Packet Core Network

4G Air Interface Awareness

Understanding Next Generation LTE

...delivering knowledge,

maximizing performance...

www.wraycastle.comWray Castle leading the way in LTE training


2/128


3/128

LTE Evolved Packet Core Network Flexicourse

Wray Castle Limited

LTE EVOLVED PACKETCORE NETWORK

Flexicourse

First published 2009Last updated August 2009WRAY CASTLE LIMITED

BRIDGE MILLS

STRAMONGATE KENDALLA9 4UB UK

Yours to have and to hold but not to copy

The manual you are reading is protected by copyright law. This means that Wray Castle Limited could take you

and your employer to court and claim heavy legal damages.

Apart from fair dealing for the purposes of research or private study, as permitted under the Copyright, Designs

and Patents Act 1988, this manual may only be reproduced or transmitted in any form or by any means with the

prior permission in writing of Wray Castle Limited.


4/128


ii Wray Castle Limited LT3604F/v1


5/128

EPS and IMS Overview

LT3604F/v1 Wray Castle Limited iii

LTE EVOLVED PACKET CORE NETWORKFlexicourse

Contents

Section 1 EPS and IMS Overview

Section 2 Evolved Packet Core

Section 3 Major Protocols

Section 4 EPC Operations

Glossary


6/128


iv Wray Castle Limited LT3604F/v1


7/128


LT3604F/v1 Wray Castle Limited v

Section 1



8/128


vi Wray Castle Limited LT3604F/v1


9/128


LT3604F/v1 Wray Castle Limited vii

Contents

The Evolution of UMTS ........................................................................................................................ 1.1

Release 8 and Beyond ......................................................................................................................... 1.2

EPS and IMS Architecture ................................................................................................................... 1.3

PDN Connectivity Services .................................................................................................................. 1.4

E-UTRAN ............................................................................................................................................. 1.5

EPC ...................................................................................................................................................... 1.6

IMS Functions ...................................................................................................................................... 1.7

Additional Options ................................................................................................................................ 1.8

PS Interworking .................................................................................................................................... 1.9

CS Interworking .................................................................................................................................. 1.10

Non-3GPP Access Interworking ........................................................................................................ 1.11

EPS Services ..................................................................................................................................... 1.12

Glossary ............................................................................................................................................. 1.13


10/128


viii Wray Castle Limited LT3604F/v1


11/128


LT3604F/v1 Wray Castle Limited ix

Objectives

At the end of this section you will be able to:

discuss the evolution of 3GPP networks and show where the EPS lies within it

outline the relationship between the EPS and the IMS

demonstrate an understanding of the abbreviations LTE, SAE, E-UTRAN, EPC, EPS and IMSand explain their applicability to the evolved network

describe the basic architecture of a combined EPS and IMS network

outline the functions of the EPS

list the main elements and interfaces found within the E-UTRAN

outline the basic set of network elements that comprise an EPC

describe the functions of the IMS

list the main elements found within an IMS

demonstrate an understanding of the interworking options available to the EPS

list services an EPS can support


12/128


x Wray Castle Limited LT3604F/v1


13/128


LT3604F/v1 Wray Castle Limited 1.1

1990 1992

GSM

1994 1996 1998 2000 2002 2004 2006 2008 2010 2012

GPRS

EDGE

UMTS R99

HSPA

HSPA+

2G

2.5G

2.75G

3G

3.5G

3.75G

LTE/EPS

3.9G/4G

Phase 1

Phase 2

Phase 2+

R96

R97

R98

R99

R5

R6

R7

R4

R8

The Evolution of UMTS

3GPPs (3rd

Generation Partnership Project) design for UMTS networks began with the publication ofthe Release 99 (also known as Release 3) specifications in the late 1990s.

R99 UMTS core networks followed the basic structural architecture of the GSM/GPRS system thathad preceded them and were functionally split into CS (Circuit Switched) and PS (Packet Switched)core networks. 3GPP made it clear that support for the legacy technologies employed by the CS corenetwork would become more limited over time and stated that their intention was to evolve UMTS(Universal Mobile Telecommunications System) networks towards an all IP basis.

Release 4 specifications introduced the concept of the MGW (Media Gateway), which allowed CSservices to migrate away from the time-division bearer technologies that had traditionally been usedto carry voice and other real-time services towards newer, more flexible technologies such as ATM(Asynchronous Transfer Mode) and IP (Internet Protocol).

The ability to provide support for real-time services carried via the PS core network was introduced inRelease 5, with the IMS (IP Multimedia Subsystem). The IMS allows, among other functions, servicessuch as voice and video calling, which were previously provided via the CS core network, to beoffered via an IP-based core instead.

Release 6 and Release 7 specifications introduced support for alternative access methods to 3GPPcore network environments, allowing operators to interface with Wi-Fi and other types of accesssystem.


14/128


1.2 Wray Castle Limited LT3604F/v1

2010 2012 2014 2016 2018 2020 2022 2024 2026 2028 2030 2032

LTE/EPS

3.9G/4G

R8

EGRPS Evolution

HSPA Evolution

LTE Advanced

IMT Advanced

Beyond R8

Release 8 and Beyond

The next generation of UMTS services begins with Release 8.

3GPP R8 (Release 8) specifications outline the architecture and protocols required to support what3GPP initially called 3.9G, but which they and the rest of the industry now call 4G, services.

3GPPs vision of 4G is generally known as the LTE (Long Term Evolution) of the radio accessnetwork and the SAE (System Architecture Evolution) of the core, although it is officially known as theEPS (Evolved Packet System).

EPS radio access is provided via the E-UTRAN (Evolved Universal Terrestrial Radio Access Network) the LTE part of the system and the EPC (Evolved Packet Core) provides the long promised all IPcore network environment.

Development for systems beyond R8 is also underway, with evolutions planned for all current

generations of 3GPP-based mobile networks.

2G GSM/EDGE networks will continue to evolve with E-GPRS2 (Enhanced GPRS 2)and EDGE(Enhanced Data rates for Global Evolution) Evolution, which allow systems to offer 1 Mbit/s or more tomobile data users. 3G UMTS networks have options to increase the data rates available to HSPA(High Speed Packet Access) users using HSPA+ and HSPA Evolution. 4G LTE systems can beaugmented by LTE Advanced enhancements.


15/128



IMS

UTRAN/

GERAN

E-UTRAN

WLAN or

WiMAX

2G/3G SGSNHSS

EIRPCRF

IP Services

PDN GWS-GW

MME

S2

S1-U

S5 SGi

Rx+S7/GxS13

S12S4

S3 S6a

UMTS/

GPRS

E-UTRA

Interworking

to MME

S11S1-MME

EPS and IMS Architecture

The R8 Evolved Packet System supersedes the access and core elements of earlier iterations ofUMTS, replacing the R3R7 UTRAN radio access network with the E-UTRAN (LTE) and thedifferentiated CS and PS cores with a single EPC (SAE).

To allow the evolved network to continue to support real-time services and connection types thatrequire more management, 3GPP recommends that the EPS connects to an IMS.

Not all connections established via the EPS will require handling within the IMS basic Internetconnections, e-mail transmission and other non-real-time services will continue to be routed directlyto their destinations via the SGi interface.

There is some discussion within the mobile industry as to whether an IMS is actually required to offerreal-time or CS services over LTE. Many take the view that traditional CS services mainly consistingof voice and SMS (Short Message Service) can be provided by reusing the GAN (Generic Access

Networks) approach employed to carry CS services over Wi-Fi and other types of IP access system.

The VoLGA (Voice over LTE Generic Access) consortium has proposed just such an approach, which

would allow network operators to reuse their existing CS infrastructure.

Further Reading: 3GPP TS 23.401:4.2 (figure after colon relates to the section in the document)


16/128



PDN-GW

PDN

Connectivity

Service

EPS

Bearer

Evolved Packet

System

PDN Connectivity Services

Packet Data

Network

PDN Connectivity Services

The EPS is designed to provide IP connectivity between a UE and a PDN (Packet Data Network).

The connection provided to a UE is referred to as a PCS (PDN Connectivity Service).

This consists of an EPS bearer that connects the UE to an Access Point in a PDN-GW (PDNGateway) and traverses both the E-UTRAN and the EPC. The PDN-GW routes traffic between theEPS bearer and the external PDN.

The EPS bearer, in turn, carries one or more SDF (Service Data Flow) between the UE (UserEquipment) and external data services.

If a UE requires additional connectivity that is only available via a different PDN-GW Access Point,

then additional PDN Connectivity Services may be established in parallel.

Further Reading: 3GPP TS 23.401:4.7.1


17/128



UE

S1

E-UTRAN

X2

Uu

eNB

Evolved Packet Core

(EPC)

S1

E-UTRAN

The E-UTRAN provides radio access for the EPS.

During development this part of the system was known as LTE (for the Long Term Evolution of the 3Gradio path) and although the terminology used has since been standardized as the E-UTRAN, it islikely that the term LTE will remain in common use.

The E-UTRAN consists of the eNB (Evolved Node B) and some IP-based interfaces, but no controllernode.

The evolved access network therefore has a flatter structure than those that preceded it where thefunctions formerly attributed to the 2G GERAN (GPRS/EDGE Radio Access Network) BSC (BaseStation Controller) or 3G UTRAN RNC (Radio Network Controller) have been subsumed into the basestation itself.

The main interfaces of the E-UTRAN are:

Uu the air interface between eNB and UE

S1-U user traffic between eNB and EPC

S1-MME control traffic between eNB and EPC

X2 handover traffic between neighbouring eNBs

Traffic is carried over the E-UTRAN in an E-RAB (Evolved Radio Access Bearer), which runs between

a UE and the EPC.

Further Reading: 3GPP TS 36.300 and 36.2xx family


18/128



Internet

EPC

Mobility

Management

Entity (MME)

ServingGateway

(S-GW)

PDN Gateway(PDN-GW)

Policy and Charging

Resource Function

(PCRF)

Home Subscriber Server

(HSS)

IP Network

EPC (Evolved Packet Core)

EPC (Evolved Packet Core)

The EPC is designed to perform a set of interconnection functions similar to those performed byprevious incarnations of the 3GPP core network, including session, subscriber and mobilitymanagement.

As with the E-UTRAN, the EPC has been designed to offer a flatter architecture and is thereforepopulated with fewer devices than were found in legacy core networks.

The four basic nodes of the EPC are:

MME (Mobility Management Entity) S-GW (Serving Gateway) PDN-GW (Packet Data Network Gateway) PCRF (Policy and Charging Resource Function)

The EPC network elements are interconnected via a set of S interfaces, which are all IP-based, andwhich mostly reuse existing packet core network protocols such as GTP (GPRS Tunnelling Protocol).

Further Reading: 3GPP TS 23.401


19/128



MGCF BGCF BGCF

SGW

MRFP

MRFC

Key:

I-CSCF InterworkingCSCF

IM-MGW IP Multimedia MGW

MGCF Media GatewayControl Function

MRFC Media Resource

Control Function

MRFP Multimedia ResourceFunction Processor

P-CSCF Proxy Call State

Control Function

S-CSCF Serving CSCF

SGW Serving Gateway

IPMultimedia

Networks

Other

IMS

Networks

CS Domain

PDN

Gateway

(PDN-GW)

EPS IMS

HSS

I-CSCF

P-CSCF S-CSCF

IM-MGW

Mb

Mb

SGi Mn

Mj

MgMr

Mi

Mw

Mm

CxMwMw

Mk

Mp

IMS Functions

The IMS allows IP-based access networks to take advantage of the call and session control facilitiesprovided by a range of IP-based protocols such as the SIP (Session Initiation Protocol) and the RTP(Real Time Protocol).

A simplified explanation of the IMSs function could state that it is designed to allow real-time trafficservices (voice and video telephony, multiplayer gaming, etc.) to be offered by an IP-based networkwith the same quality of service as would have been provided by a circuit-switched system (althoughthe remit of the IMS is wider than this narrow explanation would allow).

The main functions of the IMS are the establishment and control of data sessions between users, andthe associated subscriber, mobility and security management of those users while they areconnected. IMS functions and architecture are performed primarily by a 3GPP-specific SIP serverknown as a CSCF (Call Session Control Function). There are several different types of CSCF.Subscriber management is handled by the HSS (Home Subscriber Server), which is also common to

the EPS.

Additionally, a variety of traffic and signalling gateways are employed to allow interworking between

IP-connected IMS users and users connected to legacy network types.



20/128



UEBroadband

InternetHeNB

(Home eNB)

EPC

2G/3G CS

Core Network

MSC or

MSC-Server/

MGWGANC

HeNB

GatewayeNB

A or Iu-CSinterface

Additional Options

Additional Options

The EPC has been designed to be flexible enough to handle a variety of connection and servicescenarios. For example, access to CS and other real-time services for LTE users is possible withoutan IMS. Proposals have been put forward by bodies such as the VoLGA Forum to allow CS servicesto be handled by existing 2G and 3G core network such as the MSC (Mobile-services SwitchingCentre) or MSC-Server/MGW (Media Gateway).

In this scenario a GANC (Generic Access Network Controller) would be positioned between the EPCand the legacy core networks. The GANC presents itself to the legacy core as an equivalent device toa BSC (Base Station Controller) or RNC and to the EPC as just another packet data networkdestination.

Voice and SMS (Short Message Service) traffic is permitted to travel across the legacy networksusing its standard format, which is simply encapsulated into IP packets for the journey across theEPC and E-UTRAN. GAN-capable UEs (User Equipments) employ the same upper layer protocol

stacks as would be found in 2G or 3G user devices. Overall, the benefit of GAN-based CS services isthat operators can continue to derive value from previous investments in CS technologies.

The EPC has also been provided with a standardized method of integrating home base stations intoan operators mix of access options.

An HeNB (Home eNode B) device connects to a residential or business users broadband Internetservice and generates a small-scale LTE cell at the users premises. Traffic is carried to the EPC viaan HeNB GW (Home eNB Gateway), which distributes C-plane and U-plane traffic to the required

EPC elements.

Further Reading: 3GPP TS 23.401, 36.300, www.volga-forum.com


21/128



IMS

UTRAN/GERAN

E-UTRAN

WLAN or

WiMAX

2G/3G SGSNHSS

PCRF

IP Services

PDN GWS-GW

MME

S2

S1-U S5 SGi

Rx+S7/GxS12

S4

S3 S6a

UMTS/

GPRS

LTE

Interworking

to MME

S1-MME S11

PS Interworking

The EPS forms part of the ongoing evolution of GSM and UMTS networks and therefore has beendesigned to offer full backwards compatibility with legacy networks and has also been provided withthe ability to interwork with non-3GPP network types.

The EPC S3 and S4 interfaces enable a legacy SGSN (Serving GPRS Support Node) to interworkwith the EPS MME and S-GW nodes.

This in turn allows UEs (User Equipment) served by 2G GERAN or 3G UTRAN access networks toestablish connections via the EPC (in this scenario, access is provided via the 2G/3G SGSN, with theEPC PDN-GW taking on the connection anchor role of the GGSN (Gateway GPRS Support Node).

The interworking capabilities provided by these interfaces also allows handover of PS connectionsbetween 2G and 3G access networks and the E-UTRAN.

The S12 interface has been designed to allows UMTS UTRAN elements (specifically the RNC) tointerface directly with an EPC S-GW without the need for an intermediate SGSN.

Further Reading: 3GPP TS 23.401:4.2


22/128



GERAN/UTRAN

E-UTRAN

S-GW PDN-GW

MME

MSC

Server

MGW

UE

IMS

Traffic

Connection

CS Interworking

CS interworking is supported via the IMS, but only for the handover of CS calls from the E-UTRAN toGERAN/UTRAN cells; it is not possible to hand calls back from GERAN/UTRAN to E-UTRAN.

The support of CS handover is incorporated into the SRVCC (Single Radio Voice Call Continuity)functions specified in 3GPP TS 23.216 and the IMS Service Continuity features of TS 23.237.

When a UE with active CS-type services determines that the only handover candidates are GERANor UTRAN cells, it initiates the SRVCC process.

The MME differentiates between the UEs current CS and PS sessions; CS sessions are subject toSRVCC, whilst PS sessions are handed over to an SGSN.

The MME co-ordinates the handover with a CS domain MSC-Server using a set of PS to CShandover messages. Once the target cell and BSS/RNS have been prepared for the handover and

CS resources have been reserved, the session traffic is re-routed by the IMS away from the EPCPDN-GW and towards a CS domain MGW.

The MGW forwards the traffic to the selected BSS (Base Station System)/RNS (Radio NetworkSubsystem) and on to the UE.

SRVCC and Service Continuity only apply to calls anchored in an IMS, networks that opt to use theGAN approach to CS traffic will follow a different set of procedures.

A more limited CS service is also supplied by the CS Fallback feature.

Further Reading: 3GPP TS 23.401, 23.216 (SRVCC), 23.237 (IMS Service Continuity), 23.272 (CSFallback)


23/128



PCRF

HSS

HPLMN

Networks

PDN-GW

3GPP AAA

Server

UE

S-GW

IP Services

IMS

Non-3GPP Non-trusted,Non-3GPP IP

access

Trusted

IP accessNon-3GPP

3GPP

Access SGi

Gx

SWn

SWm

SWx

SWa

S6b

Rx

STa

S2cS2c

Gxa

Gxb

Gxc

S5

S6a

S2c

Non-3GPP Access Interworking

The 3GPP R6 and R7 series of specifications included several solutions aimed at allowing access to3GPP core network environments from non-3GPP radio access networks. These facilities have beenevolved to accommodate access to the EPS from non-3GPP systems also.

There are specific provisions to allow access from Wi-Fi (802.11-based systems), WiMAX (WorldwideInteroperability for Microwave Access) (802.16-based systems) and 3GPP2 systems such ascdmaOne

TMand CDMA2000

TM, although access from other types of system is not necessarily

precluded.

3GPP makes the distinction between trusted and non-trusted access networks and provides arange of different interworking options for each scenario.

The diagram shows options supporting UEs that can access an EPC directly (via the E-UTRAN) and

also via trusted and non-trusted, non-3GPP access systems.



24/128



Internet

Access

Intranet

Access

SMS,

MMS, IM

EmailVoice and

Video

Telephony

Online

Gaming

Location-based

Services

Roaming

EPS Services

The EPS is designed to handle all of the traffic types handled by legacy networks. It also provideshigh-bit-rate data bearers (in theory, up to and beyond 100 Mbit/s) and real-time IP-basedconnections.

Some of the services that the EPS can supply are shown in the diagram.


25/128



Glossary

3GPP (3rd

Generation Partnership Project) ............................................................................................ 1

ATM (Asynchronous Transfer Mode) ...................................................................................................... 1

BSC (Base Station Controller) ................................................................................................................ 8BSS (Base Station System) .................................................................................................................. 10

CS (Circuit Switched) .............................................................................................................................. 1CSCF (Call Session Control Function). .................................................................................................. 7

EDGE (Enhanced Data rates for Global Evolution) ................................................................................ 2E-GPRS2 (Enhanced GPRS 2) .............................................................................................................. 2eNB (Evolved Node B) ............................................................................................................................ 5EPC (Evolved Packet Core) .................................................................................................................... 2EPS (Evolved Packet System) ................................................................................................................ 2E-RAB (Evolved Radio Access Bearer) .................................................................................................. 5E-UTRAN (Evolved Universal Terrestrial Radio Access Network) ......................................................... 2

GAN (Generic Access Networks) ............................................................................................................ 3GANC (Generic Access Network Controller) .......................................................................................... 8GERAN (GPRS/EDGE Radio Access Network) ..................................................................................... 5GGSN (Gateway GPRS Support Node) ................................................................................................. 9GTP (GPRS Tunnelling Protocol) ........................................................................................................... 6

HeNB (Home eNode B) ........................................................................................................................... 8HeNB GW (Home eNB Gateway) ........................................................................................................... 8

HSPA (High Speed Packet Access) ....................................................................................................... 2HSS (Home Subscriber Server) .............................................................................................................. 7

IMS (IP Multimedia Subsystem) .............................................................................................................. 1IP (Internet Protocol) ............................................................................................................................... 1

LTE (Long Term Evolution) ..................................................................................................................... 2

MME (Mobility Management Entity) ........................................................................................................ 6MSC (Mobile-services Switching Centre) ............................................................................................... 8MSC-Server/MGW (Media Gateway). ..................................................................................................... 8

PCRF (Policy and Charging Resource Function) ................................................................................... 6PCS (PDN Connectivity Service) ............................................................................................................ 4PDN (Packet Data Network). .................................................................................................................. 4PDN-GW (Packet Data Network Gateway) ............................................................................................. 6

PS (Packet Switched) ............................................................................................................................. 1


26/128



R8 (Release 8) ........................................................................................................................................ 2RNC (Radio Network Controller) ............................................................................................................. 5RNS (Radio Network Subsystem) ......................................................................................................... 10RTP (Real Time Protocol). ...................................................................................................................... 7

SAE (System Architecture Evolution) ..................................................................................................... 2

SDF (Service Data Flow) ........................................................................................................................ 4SGSN (Serving GPRS Support Node) .................................................................................................... 9S-GW (Serving Gateway) ........................................................................................................................ 6SIP (Session Initiation Protocol) ............................................................................................................. 7SMS (Short Message Service) ................................................................................................................ 3SRVCC (Single Radio Voice Call Continuity) ....................................................................................... 10

UE (User Equipment) .............................................................................................................................. 8UMTS (Universal Mobile Telecommunications System) ......................................................................... 1

VoLGA (Voice over LTE Generic Access) .............................................................................................. 3

WiMAX (Worldwide Interoperability for Microwave Access) ................................................................. 11


27/128


Wray Castle Limited

Section 2

Evolved Packet Core


28/128


ii Wray Castle Limited LT3604F/v1


29/128

Evolved Packet Core

LT3604F/v1 Wray Castle Limited iii

Contents

EPS Network Functions ....................................................................................................................... 2.1

Network Logical Structure .................................................................................................................... 2.2

MME(Mobility Management Entity) ..................................................................................................... 2.3

S-GW (Serving Gateway) ..................................................................................................................... 2.4

PDN-GW (Packet Data Network Gateway) .......................................................................................... 2.5

PCRF (Policy and Charging Rules Function) ....................................................................................... 2.6

Combined Functionality ........................................................................................................................ 2.7

Resilience Through Pooling ................................................................................................................. 2.8

Interface Naming Convention .............................................................................................................. 2.9

S1 to E-UTRAN Interface ................................................................................................................... 2.10

S1-U Interface .................................................................................................................................... 2.11

S1 Interfaces for Home eNBs ............................................................................................................ 2.12

GTPv1-U Traffic Interfaces ................................................................................................................ 2.13

GTPv2-C C-plane Interfaces .............................................................................................................. 2.14

Diameter-based Interfaces ................................................................................................................. 2.15

PCRF Diameter Interfaces ................................................................................................................. 2.16

Interface to CS Networks ................................................................................................................... 2.17

EPS Area Identities ............................................................................................................................ 2.18

Node Identifiers .................................................................................................................................. 2.19

Subscriber Identities ........................................................................................................................... 2.20

Connection Identifiers ........................................................................................................................ 2.21

Transport Identities ........................................................................................................................... 2..22


30/128


iv Wray Castle Limited LT3604F/v1

Default and Dedicated EPS Bearers .................................................................................................. 2.23

EPS Quality of Service ....................................................................................................................... 2.24

QoS Levels ......................................................................................................................................... 2.25

Providing CS Services via LTE/EPS .................................................................................................. 2.26

CS Fallback ........................................................................................................................................ 2.27

VCC (Voice Call Continuity) ............................................................................................................... 2.28

CS Service Provision via a GANC ..................................................................................................... 2.29

EPC Security Functions ..................................................................................................................... 2.30

AKA (Authentication and Key Agreement) ......................................................................................... 2.31

User Confidentiality ............................................................................................................................ 2.32

Glossary ............................................................................................................................................. 2.33


31/128

Evolved Packet Core

LT3604F/v1 Wray Castle Limited v

Objectives

At the end of this section you will be able to:

outline the functions performed by EPC elements

discuss options for interworking the EPC with legacy packet core networks

describe the main points of interest related to EPC topics such as pooling

list the set of S interfaces described for the EPC and outline their basic functions andprotocols

discuss options for User Plane connectivity between a UE and a PDN-GW

outline how combinations of redundant S interfaces can provide for EPC resilience

list the basic set of identifiers used to describe EPC areas

outline the set of node identifiers that have been defined for the EPC

discuss the impact of the evolved device/subscriber identifiers employed by the EPC

outline the fundamental properties of an EPS Bearer and describe the structure of an EPSBearer ID

describe the relationship that exists between an EPS Bearer and an E-RAB (E-UTRAN RadioAccess Bearer)

outline the role of the APN (Access Point Name) in the handling of a PCS (PDN ConnectivityService)

describe the interaction between the EPC and the GTP

outline the interaction between the EPC, GTP and IP

discuss the concept of the PCS and its relevance within the EPC

outline the functions of the default EPS Bearer

describe the differences between the default and dedicated bearer types and outline theirrelationship with the Service Data Flow

describe the EPC connection hierarchy and list the set of parameter types that define them

outline the QoS concepts employed by the EPC and define the roles of the QCI and the ARP

outline the methods that are available for providing CS services to EPS attached UEs,including Generic Access Network functions, CS Fallback and Voice Call Continuity

outline the security functions employed by the EPC


32/128


vi Wray Castle Limited LT3604F/v1


33/128

Evolved Packet Core


Network

Management

Network

Access

Anchoring

Mobility

Management

IP Functions

IMS

UTRAN/

GERAN

E-UTRAN

WLAN or

WiMAX

2G/3G SGSNHSS

PCRF

IP Services

PDN GWS-GW

MME

S2

S1-U

S5 SGi

Rx+S7/Gx

S12S4

S3 S6a

UMTS/

GPRS

E-UTRA

Interworkingto MME

S11S1-MME

EPS Network Functions

Network Access functions include providing information to assist terminals with network selection andperforming admission control, authentication and authorization, charging and policy control.

EPC gateway nodes are essentially IP routers with an extended capability set, and as such areprimarily dedicated to performing IP packet routing functions for user traffic, signalling and networkmanagement data flows. The EPC (via the PDN-GW) is also responsible for allocating valid IPaddresses to each new EPS Bearer.

Regarding mobility management, the EPC has responsibility for idle mode mobility management ofattached UEs and for managing the relocation of user traffic connections when a UE roams from onenetwork area to another or to another network.

The EPC is responsible for selecting the PDN-GW node that will anchor each user traffic connection(or EPS Bearer); this is achieved by selecting the appropriate PDN-GW access point for the type of

service being requested by a UE.

Basic network management functions performed by the EPC include load balancing and rebalancingbetween MMEs. The objective of these balancing functions is to prevent an MME or pool of MMEs

from becoming overloaded.



34/128



Non-Access

Stratum (NAS)

Access Stratum

(AS)

Non-Access

Stratum (NAS)

Access Stratum

(AS)

Uu S1User Equipment eNode B Evolved Packet Core

Network Logical Structure

As with UMTS R99, the services provided to UEs by the EPS are divided into those handled by theAS (Access Stratum) and those provided by the NAS (Non-Access Stratum).

The AS comprises all of the functions performed by the E-UTRAN.

The NAS consists of the Bearers and bearer control signalling functions that support them.

The S1AP (S1 Application Protocol) includes provision for the direct transfer of NAS signallingbetween UE and MME via the eNB.

Compared to the core network architecture of previous generations of mobile system such as GSM orR99 UMTS, the EPC has been provided with a much flatter network design, which limits the number

of node types deployed.



35/128

Evolved Packet Core


Mobility

Management Entity

(MME)

NAS signalling and signalling security

Inter CN node signalling for mobility between 3GPP

access networks

UE reachability in idle mode

Tracking Area list management

PDN GW and serving GW selection

MME selection for handovers with MME change

SGSN selection

Roaming connection towards home HSS

Authentication

Bearer management and establishment

MME (Mobility Management Entity)

The MME (Mobility Management Entity) assumes many of the functions that would previously havebeen performed by the VLR (Visitor Location Register) or SGSN and which in the evolved network aretermed EMM (EPS Mobility Management) functions.

The MMEs main responsibility is to terminate the Control Plane NAS signalling flows from individualUEs and to manage the authentication and security functions for each attached UE. Unlike the legacyVLR, however, the MME is also responsible for bearer establishment. It receives Service Requestsfrom UEs and issues appropriate instructions to the S-GW (Serving Gateway) that will handle eachuser plane connection.

The EMM functions also include responsibility tracking UEs that are in idle mode and the MMEensures UE Reachability by receiving TAU (Tracking Area Update) messages, maintaining thetracking area lists and performing paging of individual UEs when required.

To assist with service resilience, MMEs can be grouped into pools. eNBs (Evolved Node Bs) areable to contact any MME within the pool(s) with which they are associated when passing on UEAttach requests. The MME then has flexibility as to the S-GW chosen to establish the user planeconnection for each UE.

The MME is also in charge of roaming and handover functions to 2G/3G SGSNs.



36/128



Serving Gateway

(S-GW)

Local mobility anchor point for inter-eNB handover

Mobility anchoring for inter-3GPP mobility

Idle mode downlink packet buffering

Lawful interception

Packet routing and forwarding

Transport level DiffServ packet marking

Charging

S-GW (Serving Gateway)

The S-GW handles user plane connectivity between UEs and the EPC and acts as the EPC mobilityanchor for UEs roaming within part of a PLMN. This entails performing IP packet routing and bufferingfunctions and also managing QoS by inserting DSCP (DiffServ Code Point) data into IP packetheaders.

The S-GW also provides mobility anchoring for connections that roam onto legacy 3GPP GERAN(2G) and UTRAN (3G) access networks. As all EPS user traffic must pass through an S-GW it is alogical node within which, in concert with the PDN-GW, to base the EPS Lawful Interception interfaceand also the charging functions.

The standard S5 and S8 interfaces that link the S-GW and PDN-GW are based on the 3GPP GTP;many non-3GPP systems obtain similar IP mobility functionality by employing the MIPv4 (Mobile IPv4)or PMIPv6 (Proxy Mobile IPv6) protocols developed by the IETF (Internet Engineering Task Force).Adapted versions of the S5 and S8 interfaces are available that support the PMIP protocol for IP

mobility. In such cases, the S-GW will also act as the FA (Foreign Agent) to anchor mobile IP tunnels.

To provide some legacy perspective, taken together the MME and S-GW provide the EPC withfunctionality similar to that previously provided by the SGSN, with the MME handling the signallingand session control aspects and the S-GW dealing with the user traffic.

Early in its development, the S-GW was also known as the UPE (User Plane Entity), although this

terminology has now been dropped.

Further Reading: 3GPP TS 23.401:4.4.3.2


37/128

Evolved Packet Core


PDN Gateway

(PDN-GW)

Per-user-based packet filtering

Lawful interception

UE IP address allocation

DiffServ packet marking

SDF level charging

SDF gating control and data rate enforcement

Contains APN (Access Point Name)

DHCPv4 (server and client) and DHCPv6(client, relay and server) functions

PDN-GW (Packet Data Network Gateway)

PDN-GW (Packet Data Network Gateway)

If the functionality of the MME/S-GW can be thought of as analogous to that of the legacy SGSN, thenthe PDN-GW can be thought of as similar in function to the legacy GGSN. The PDN-GW (Packet DataNetwork Gateway) (also known in some versions of the specifications as the P-GW) routes trafficbetween EPS Bearers and the SGi interface, which leads to external data networks such as the IMSand the Internet.

As all inbound and outbound EPS traffic must pass through a PDN-GW it is the logical node in whichthe networks packet filtering and classification functions are based. These include the deep packetinspection techniques that are used to classify packets into particular SDFs (Service Data Flows)before routing them over an EPS Bearer or the SGi interface, which in turn allows the PDN-GW to actas the networks PCEF (Policy and Charging Enforcement Function) Under direction from the PCRF(Policy and Charging Rules Function) the PDN-GW will apply per SDF charging, service level andrate enforcement and QoS-related traffic shaping functions that control the gating of user trafficflows.

Each PDN-GW contains a number of logical access points (each identified by an APN (Access PointName)) which act as the GTP tunnel endpoints and mobility anchors of the EPS Bearers that extendservice out to mobile UEs. As in the legacy GGSN, the APNs are responsible for the allocation of IPaddresses to UEs during the establishment of each EPS Bearer and for routing traffic between the

Bearers and particular external networks.

Further Reading: 3GPP TS 23.401:4.4.3.3


38/128



Policy and

Charging Rules

Function (PCRF)

Decides whether and when to create additional

EPS nearers

Provides PCC data such as service data flow

detection, gating, QoS, ARP and flow-based

charging information to traffic handling entities

Terminates the S7/Gx and Rx interfaces for

home network service and the S9 interface

point for roaming with local breakout

PCRF (Policy and Charging Rules Function)

The PCRF (Policy and Charging Rules Function) is responsible for propagating the networksconnection policies and charging rules to the PDN-GW via the S7/Gx interface and to traffic gatewayelements within the IMS via the Rx interface. It is the element that decides if new connections are tobe allowed and, if so, whether they will be carried by an existing EPS Bearer or whether a new one isrequired.

The PCRF is responsible for providing service data flow detection, gating, QoS and flow-basedcharging information to traffic handling entities within the network. This includes rules that allow thePDN-GW to provide the correct level of service to user data flows once the type of traffic being carriedhas been determined. For example, if the PDN-GW determines that the SDF to a user is carrying real-time traffic it may gate up to the data rate and QoS level indicated by the PCRF and the userssubscription profile.

The PCRFs charging rules allow the operator to apply the appropriate rating to CDRs (Call Data

Records) generated for each SDF so that, for instance, real-time connections can be differentiatedfrom an Internet browsing session.

In the case of EPS roaming, when users use their terminals abroad, 3GPP has developed anextended PCRF architecture, based on the S9 interface, that defines Home Policy and ChargingRules Function (H-PCRF) and Visited Policy and Charging Rules Function (V-PCRF) logical functions.



39/128

Evolved Packet Core


MobilityManagement Entity

(MME)

Functions could

be combined within

same device

S11

S5

Serving Gateway

(S-GW)

PDN Gateway

(PDN-GW)

Combined Functionality

3GPP has deliberately designed the EPC network elements and interfaces to give vendors thegreatest possible flexibility when developing their solutions.

Although the MMW, S-GW, PDN-GW and PCRF all have a set of rigidly defined functions and openinterfaces, the specifications make it explicit that equipment vendors are free to deploy these logicalfunctions to physical devices in whatever way suits them best.

For example, the MME and SGW functions can both be located in one device, such as an upgrade toan existing 3G SGSN platform. The S11 interface would then be internal to that combined device.

In the same way it is conceivable that a vendor may decide to combine the functions of the S-GW and

PDN-GW into one combined EPS gateway, rendering the S5 an internal interface.



40/128



PDN-GW

Co-ordinated MME Pool

and S-GW Service Area

E-UTRAN Tracking Areas served by Pools and Areas

Resilience Through Pooling

In common with ongoing developments within many existing 3G core networks, the EPC is designedto take advantage of the concept of pooling, specifically of MME and S-GW nodes.

The S1-flex facility that allows each eNB in the E-UTRAN to be associated with multiple MMEs in theEPC allows those MMEs to be grouped into pools. Each pool will be responsible for the eNBs in oneor more complete tracking areas.

This means that when an eNB selects the MME that will handle the Attach process for a UE, thatMME can continue to serve that UE as long as it remains within the tracking areas associated with theMMEs pool. This reduces the requirement for MME relocation and consequently reduces thenetworks signalling load. Pooling also provides a measure of resilience for network services to theextent that, if one MME falls over, eNBs have a number of alternative devices to select. As withcurrent implementations of the pooling concept, however, MME pooling does not protect theconnections to UEs being served by a failed MME when the MME fails all ongoing services

supported by it fail too.

In the same way as an MME pool area comprises a set of cells within which a UE does not need tochange the serving MME, an S-GW service area is a set of cells within which a UE does not need tochange S-GW.

MME pools may overlap, and each MME pool area is identified by an MMEGI (MME Group Identifier).

S-GW Areas are also permitted to overlap.



41/128

Evolved Packet Core


S8

EPSRoaming

S9

Roaming

PCRF

EIR

IMS

UTRAN/

GERAN

E-UTRAN

WLAN or

WiMAX

2G/3G SGSNHSS

EIRPCRF

IP Services

PDN GWS-GW

MME

S2

S1-U

S5 SGi

Rx+S7/GxS13

S12S4

S3 S6a

UMTS/

GPRS

E-UTRA

Interworkingto MME

S11S1-MME

Interface Naming Convention

There are numerous interfaces defined for the EPC, most of which share the reference letter S.

They are functionally separated into those that carry control (C-plane) and those that carry user(U-plane) traffic. Support of most S interfaces in the EPC is mandatory, although some are optional.

An overview of the interfaces is given in the diagram.



42/128



SCTP

IP

L2

L1

S1-AP

GTPv1-U

SCTP

IP

L2

L1

User PDU

S-GW

S1-MME

S1-U

MME

E-NB

S1 to E-UTRAN Interface

The S1 interface can be seen as the evolved equivalent of the 3G Iu interfaces and interconnects theE-UTRAN with the EPC. Individual S1 interfaces run logically between each eNB and the set ofMMEs and S-GWs to which it is associated.

Messages and other control plane traffic and S1-U flows carry user plane and call control traffic.

Message structures for the S1-MME interface, which operates between the eNB and the MME, aredefined by the S1AP (S1 Application Protocol). S1AP performs duties that combine those performedby the legacy RANAP (Radio Access Network Application Part) and GTP-C (GPRS TunnellingProtocol on the C plane) protocols with additional elements to support traffic flows in an all-IPenvironment.

Data flow over the S1-MME is protected from loss and network failure by the use of SCTP (StreamControl Transmission Protocol) at the transport layer (layer 4). SCTP was specifically designed by the

IETF to handle the flow of signalling and control traffic over an IP network. Retransmission of failed ormissing data packets, and therefore guaranteed delivery of signalling data, is one of the facilities

provided by SCTP.

Further Reading: 3GPP TS 23.401:5.1, 36.413 (S1AP)


43/128

Evolved Packet Core


SCTP

IP

L2

L1

S1-AP

GTPv1-U

SCTP

IP

L2

L1

User PDU

S-GW

S1-MME

S1-U

MME

E-NB

S1-U Interface

The S1-U interface employs GTP-U (GPRS Tunnelling Protocol on the User plane) to create andmanage tunnels carrying user-plane data contexts between the eNB and the S-GW.

3GPP has developed a new version of GTP (GTPv2) for use within the EPS. GTPv2 only changes theC-plane aspects of GTP, however, and is referred to as GTPv2-C.

U-plane traffic continues to be carried by GTPv1. Current versions of the relevant 3GPP specificationsrefer to this version of GTP and GTPv1-U.

The S1-U user plane carries all traffic destined to travel over the air interface to the UE, whichincludes all user data plus application control data such as SIP and RTP messages. It also handlesthe delivery of NAS signalling messages carried between the UE and the MME using the DTAP(Direct Transfer Application Part) facility.

The S1-U interface employs UDP (User Datagram Protocol) at layer 4 and therefore has no dataretransmission capabilities available at the transport layer.

Although the S1-Flex functionality allows each eNB to connect to multiple MMEs and S-GWs, anindividual UE will, unless a relocation is taking place, only ever be served by one MME and one S-GWat any one time. All signalling and traffic connections for a UE will therefore be concentrated through

one pair of devices.

Further Reading: 3GPP TS 23.401:5.1, 29.274 (GTPv2-C), 23.281 (GTPv1-U)


44/128



SCTP

IP

L2

L1

S1-AP

GTPv1-U

SCTPIP

L2

L1

User PDU

BroadbandS1-MME

S1-U

MME

S-GW

Home eNB

(HeNB)

Home eNB Gateway

(HeNB GW)

S1 Interfaces for Home eNBs

The HeNB (Home eNode B) concept provides a standardized method for creating and connectingLTE femtocells. Similar methods have been developed for the 3G HNB (Home Node B).

A femtocell provides limited-area radio coverage to residential or business premises; connections arepassed back to the operators core network via a broadband Internet connection. Indeed, femtocelldevices are often incorporated into broadband routers along with the broadband modem and Wi-Fiaccess point.

The HeNB provides the same set of services as a full eNB and is logically connected to the EPC viathe same S1-MME and S1-U interfaces.

Operators may optionally deploy an HeNB GW (Home eNB Gateway) to concentrate S1-MME traffictowards the MMEs, although the HeNBs will work even without a Gateway.

The HeNB presents itself to the HeNB GW as an eNB; the Gateway presents itself to the HeNB as anMME. The HeNB GW presents itself to the MME as an eNB.

An X2 interface between neighbouring HeNBs is not supported, although mobility between HeNB

cells and other cells via the MME/S-GW is possible.

Further Reading: 3GPP TS 36.300:4.6, TR 25.820


45/128

Evolved Packet Core


UDP

IP

L2

L1

GTPv1-U

S-GW

SGSN

RNC

S12

S4

PDN-GW

Roaming

EPS

S5

S8

SGSN

S16

GTPv1-U Traffic Interfaces

Most EPC interfaces are based on a combination of GTPv1-U and GTPv2-C.

The S4 interface carries U-plane traffic between an S-GW and an SGSN for EPC-attached UEs thathave roamed onto GERAN (GPRS EDGE Radio Access Network)/UTRAN access. SGSNs thatsupport the S4 can also be upgraded to use the S16 interface, which allows the evolved combinationof GTPv1-U and GTPv2-C to be used between SGSNs.

The S5 interface interconnects an S-GW to PDN-GWa within the same PLMN (Public Land MobileNetwork). The S8 Interface provides roaming connectivity between a visited S-GW and a home PDN-GW. The S5 interface is based on the 2G/3G Gn interface, whilst the S8 is analogous to the Gpinterface.

The S12 interface is used to provide a U-plane only direct tunnel between an S-GW and a 3G RNC,which allows the user plane to bypass the SGSN and thus avoids any traffic bottlenecks that may

occur.

Further Reading: 3GPP TS 23.401:5.1, 23.281 (GTPv1-U), 23.060 (GPRS)


46/128



UDP

IP

L2

L1

GTPv2-CMME

S-GW

SGSN

S3

PDN-GW

Roaming EPS

S5

S8

S10

SGSN

S16

S11

MME

GTPv2-C C-plane Interfaces

The S3 interface provides control plane connectivity between an MME and an SGSN and is used tocarry handover and other control signalling between EPS and GERAN/UTRAN PS environments. TheS16 interface carries control messaging between evolved SGSNs.

The S16 interface carries control messaging between evolved SGSNs. If an S16 interface exists itcan be used to handle the relocation of bearers between SGSNs without requiring the operation to becontrolled by an S-GW.

In addition to carrying user traffic, the S5 and S8 interfaces also carry GTPv2-C based controlmessaging. Networks based on non-3GPP protocols may elect to use variants of the S5 and S8interfaces based on IETF mobile IP protocols instead.

The S10 interface carries inter-MME signalling traffic and is employed during functions such as MMErelocation. This may occur, for example, when a Connected Mode UE roams out of one MME pool

area into another, or when MME load balancing or rebalancing is taking place. The S10 is analogousto the Gn interface and is based on GTPv2-C running over UDP/IP.

Further Reading: 3GPP TS 23.401:5.1, 29.274 (GTPv2-C), 23.060 (GPRS)


47/128

Evolved Packet Core


Diameter

TCP/SCTP

IP

L2

L1

MME

SGSN

EIR

S6a

HSS

S6d

S13

Diameter-based Interfaces

The Diameter protocol was designed by the IETF as a more standardized successor to the venerableRADIUS (Remote Access Dial-In User Service) protocol, which provides a method of transportingAAA (Authentication, Authorization and Accounting) data over an IP network. Various proprietaryadaptations of RADIUS have been developed, which were largely non-interoperable, making it a defacto closed standard.

The S6a interface connects the MME to the HSS and allows the secure transfer of subscriber andother data between those nodes. The Diameter Base Protocol and the applications that enablecommunication between the MME and HSS run over an IP link and can be protected at the transportlayer by either TCP (Transmission Control Protocol) or SCTP.

The S13 interface optionally interconnects the MME and the Equipment Identity Register (EIR) and istherefore analogous to the GPRS Gf interface. Unlike the Gf, however, the S13 interface is based onthe Diameter protocol.

The S6d interface allows 2G/3G SGSNs that also support the S4 interface to the S-GW to connectdirectly to the EPS HSS (Home Subscriber Server) for mobility management and subscriber dataaccess purposes.


48/128



Diameter

TCP/SCTP

IP

L2

L1

S7/Gx

S9

Rx

IMS

Visited PCRF

Home PCRF

PDN-GW

PCRF Diameter Interfaces

The S7 interface connects the PDN-GW to the PCRF. It carries policy lookups sent by the PDN-GW inresponse to connection requests and the replies generated by the PCRF that determine how or ifthose requests will be fulfilled.

The S7 interface is based on the existing Gx interface and 3GPP specifications and diagrams use thereference names interchangeably.

The Rx interface connects the PCRF to the IMS and carries a similar range of message types as theGx.

The S9 interface carries policy and charging rules data between home and visited PCRFs to allowhome network policies to be applied to roaming UE connections.

Visited PCRFs may have the facility to request PCC (Policy and Charging Control) details from a

users home network but they are under no obligation to enforce them if they contradict local policies.

Further Reading: 3GPP TS 23.401:4.7.4; 23.203


49/128

Evolved Packet Core


SGsAP

SCTP

IP

L2

L1

MME

MSC/VLR or

MSC Server

SGs/SV

Interface to CS Networks

Interface to CS Networks

The EPC was designed as an all IP environment and as such carries all traffic, even voice, in IPstreams but interfaces have been developed that allow for backwards compatibility with and handoverof CS traffic to legacy networks, if required.

The SGs interface is based on the GERAN/UTRAN Gs interface and carries mobility managementand handover signalling between an MME and a legacy MSC or MSC Server. It was created to servethe interfacing requirements of the CS Fallback service, which allows EPC-Attached UEs to drop backto 2G/3G networks to handle CS calls.

The SGsAP (SGs Application Part) message format employed on the interface is an adaptation of theBSSAP+ (Base Station System Application Part +) protocol employed on the legacy Gs interface, andprovides much the same set of services.

Other interfaces have been developed to support other forms of EPC-CS Core interaction; the SGs

interface, for example, carries MME-MSC/MSC-S signalling to support the SRVCC, which allows IMS-anchored real time sessions to be seamlessly handed over between EPS Bearers andGERAN/UTRAN CS Bearers.

Further Reading: 3GPP TS 23.216 (SRVCC), 23.272 (CS Fallback)


50/128



PLMN = MCC+MNC

MME Group ID (MMEGI)

Tracking Area ID (TAI)

Evolved Cell ID (ECGI) = eNB

ID + Cell ID

EPS Area Identities

The EPS continues to use the PLMN identifier employed by legacy 3GPP systems, which consists ofthe MCC (Mobile Country Code) and the MNC (Mobile Network Code).

The MMEGI (MME Group Identifier) is a 16-bit identifier assigned to an individual MME Pool. TheMMEGI only has to be unique within a PLMN.

The TAI (Tracking Area Identifier) is analogous to the LA (Location Area) or RA (Routing Area)identifiers employed by the GERAN/UTRAN in that it is used to identify a group of cells in the accessnetwork. In the E-UTRAN the TA (Tracking Area) is the granularity with which each UEs location istracked. It is also the area within which a UE will be paged. The TAI consists of the networks MCCand MNC followed by a TAC (Tracking Area Code).

As in legacy systems it is necessary to be able to identify uniquely each cell in the network for callestablishment, paging, handover and billing purposes. 3GPP has devised an updated Cell ID known

as an ECGI (E-UTRAN Cell Global Identifier).

The ECGI incorporates a unique eNB Identifier, which allows the S1 and X2 interface protocols todiscover and identify the target nodes for functions such as EPS Bearer handover.

Further Reading: 3GPP TS 29.803, 23.401:5.2, 36.300:8.2


51/128

Evolved Packet Core


Gateway Names/IP addresses

Access Point Name (APN)

MCC MNC MMEI

24 bits

MMEGI MMEC

16 bits 8 bits

GUMMEI

MMEI

ECGIMCC MNC eNB ID Cell ID

20 bits 8 bits

Node Identifiers

Node Identifiers

The MME is primarily a signalling node and each MME has to be accessible to and exchange controldata with MMEs and other devices within its own network and in other networks elsewhere in theworld. For this reason, each MME is assigned a unique and globally significant identifier known as aGUMMEI (Globally Unique MME Identity).

The GUMMEI consists of the networks MCC and MNC followed by a MMEI (MME Identifier), which inturn consists of the MMEGI and the MMEC (MME Code). The MMEGI identifies the Pool to which theMME belongs and the MMEC is its index within that pool.

The addressing of S-GW and PDN-GW nodes follows the model for addressing legacy PS corenetwork nodes ultimately, each node will be identified by an IP address, which may or may not bebacked up with a DNS-resolvable device name. The termination and anchor point for an EPS Beareris an access point in a PDN-GW, which is analogous to a PDP Context terminating on GGSN APN in2G/3G networks. Each PDN-GW AP is assigned an IP address associated with a DNS-resolvable

name the APN (Access Point Name).

The EPS ECGI is globally unique and allows individual cells to be separately identified. The ECGI is a28-bit identifier which consists of the PLMN ID (MCC + MNC), a 20-bit eNB ID (which will be uniquewithin a PLMN) and an 8-bit Cell ID (which will be unique within one eNB). This gives each PLMNscope to identify up to 1 million eNBs and for each eNB to control up to 256 cells.

Further Reading: 3GPP TS 23.401:5.2, 36.300


52/128



MCC MNC MMEI

24 bits

GUTIM-TMSI

32 bits

M-TMSI

32 bits

M-TMSI

M-TMSI

32 bits

MMEC

8 bits

S-TMSI

Subscriber Identities

The main means of identifying EPS subscribers remains the IMSI (International Mobile SubscriberIdentity), which is permanently assigned to a subscriber account.

Temporary and anonymous identification of subscribers is provided by the GUTI (Globally UniqueTemporary Identity), which is assigned by the serving MME when a UE has successfully attached andis reassigned if the UE moves to the control of a new MME.

The GUTI is analogous to the legacy TMSI (Temporary Mobile Subscriber Identity), but with theadditional feature that its structure uniquely identifies not only the subscriber within the MME but alsothe MME that assigned it.

The GUTI is constructed from the GUMMEI, which identifies the MME, and the M-TMSI (MMETemporary Mobile Subscriber Identity). The M-TMSI is used to provide anonymous identification of asubscriber within an MME once that subscriber has been authenticated and attached. As with legacy

TMSI use, the MME may elect to reissue the M-TMSI at periodic intervals and it will be reissued inany case if the UE passes to the control of a different MME.

The M-TMSI allows a subscriber to be uniquely identified within an individual MME, whereas theS-TMSI (SAE TMSI) allows subscribers to be identified within an MME group or pool.

To achieve this, the S-TMSI simply adds the one-octet MMEC (MME Code) to the M-TMSI. TheMMEC is the MMEs index within its pool.

Further Reading: 3GPP TS 23.203, 23.401:5.2


53/128

Evolved Packet Core


S-GW

MME

Radio Bearer EPS Bearer

PDN-GWUE

Connection Identifiers

The EPS Bearer ID is assigned by the MME upon bearer establishment.

It uniquely identifies an EPS Bearer for one UE accessing via the E-UTRAN.

The EPS Bearer ID is a one-octet string, which in theory means that each UE can have up to 256EPS Bearers associated with it per MME. However, the relevant specifications currently indicate thatthe most significant 4 bits of the ID should be set to 0, which limits the number of EPS Bearers per UEto 16.

The EPS Bearer travels between the UE and the PDN-GW; during handovers it may also extend overthe X2 interface between source and target eNBs.

When travelling over the S1 and X2 interfaces, there is a one-to-one mapping between the EPSBearer and the E-RAB (E-UTRAN Radio Access Bearer) and between the identities assigned to each

of those entities.



54/128



UE S1-AP ID

S1-MME S1-AP Context

MME S1-AP ID

Tunnel

Endpoint IDs

(TE-ID)

S1-U GTP Tunnel

X2-C (UE X2-AP IDs)

X2-U (GTP TE-IDs)

UE

MME

S-GW

Transport Identities

To allow the S1 and X2 protocols to identify the UEs that form the endpoint of each transport tunnel,

terminals are assigned identities that are unique within the eNBs or MMEs that support thoseendpoints.

The UE S1-AP ID and MME S1-AP ID are unique within the eNB and MME respectively that arehandling the E-RAB/EPS Bearer to an Attached UE. The IDs are simple numerical identifiers (24-bitsin the eNB and 32-bits in the MME) and are not associated with a specific instance of the S1 interfacein each device. An eNB can therefore support a maximum of 2

24(16.7 million) UE S1 connections and

an MME 232

(4.3 billion).

The UE X2-AP ID performs the same basic function as the S1-related identities, but for the X2interface. The X2 is optional and is only used to pass handover-related traffic between source andtarget eNBs, so the X2-AP ID will only be created as required when a handover is initiated. The ID is12 bits long and provides a maximum of 4096 UE X2 handover identities per eNB.

The 4-byte GTP TEID (Tunnel Endpoint ID) is used in the EPS the same way as it is in legacynetworks. Each device that supports a GTP tunnel refers to it in terms of the TEID assigned to thetunnel plus the IP address and UDP port number of the interface that handles it. TEIDs are assignedby the receiving side of each connection and are exchanged using S1-AP during tunnelestablishment.

Further Reading: 3GPP TS 23.401:5.2; 36.413:9.2.3; 29.274 (GTPv2-C); 36.41x (S1); 36.42x (X2)


55/128

Evolved Packet Core


Initial or Default

EPS Bearer

S-GW PDN-GW

UE

eNB

Subsequent or

Dedicated EPS

Bearer

Internet

IMS

Default and Dedicated Bearers

Both Bearers routed

via same APN

Both Bearers share

same IP address

Default and Dedicated EPS Bearers

Each UE will establish an initial or default EPS Bearer as part of the attach process. This will providethe required always on IP connectivity to the UE and may be to a default APN, if one is stored in theusers subscriber profile, or to an APN selected by the network.

In networks that interconnect to an IMS, the default bearer allows the UE to perform SIP registrationand thereafter to provide a path for session initiation messaging. In these circumstances, the data rateand QoS assigned initially to the default bearer is commensurate with the expected low level of SIP-based traffic flow, but these parameters can be modified to accommodate the requirements ofapplication traffic flows when a connection is established.

If a UE has a requirement to establish an application connection whose QoS or data rate demandsare incompatible with those currently assigned to the default bearer (but which can still be routedthrough the current APN), the PDN-GW or PCRF may initiate the establishment of an additional EPS

Bearer to carry the new traffic flow. Any additional bearers assigned to a UE in addition to the defaultbearer are termed dedicated bearers and will be identified by different EPS Bearer/E-RAB and radiobearer IDs.

A UE may have more than one PDN Connectivity Service running if it has connections establishedthrough more than one APN/PDN-GW. In that case, there will be one Default Bearer and an optionalnumber of Dedicated Bearers created for each PCS. The 4-bit EPS Bearer ID limits the total numberof bearers established for one UE to sixteen (numbered 0 to 15).



56/128



EPS

EPS QoS Characteristics PCEF (Policy andCharging Enforcement

Function) in PDN-GW

QCI (QoS Class Identifier)

ARP (Allocation and Retention Priority)

GBR (Guaranteed Bit Rate)

MBR (Maximum Bit Rate)

EPS Quality of Service

QoS in the EPS is defined by a combination of four parameters:

QCI (QoS Class Identifier)

ARP (Allocation and Retention Priority)

GBR (Guaranteed Bit Rate)

MBR (Maximum Bit Rate)

EPS QoS is applied between the UE and the PDN-GW.

Further Reading: 3GPP TS 23


57/128

Evolved Packet Core


UE

EPS bearer with

GBR QoS

UE-AMBR for all

non-GBR EPS

Bearers from UE

APN-AMBR for non-GBR

EPS bearers to PDN-GW 2

PDN-GW 2

PDN-GW 1S-GW

APN-AMBR for non-GBR

EPS bearers to PDN-GW 2

QoS Levels

QoS in the EPC is currently defined by three levels: GBR (Guaranteed Bit Rate), MBR (Maximum BitRate) and AMBR (Aggregate Maximum Bit Rate).

GBR connections are assigned a guaranteed data rate and are therefore useful for carrying certaintypes of real-time and delay-sensitive traffic. MBR connections are non-guaranteed, variable-bit-rateservices with a defined maximum data rate. If a connections data rate goes beyond the set maximumthe network may decide to begin discarding the excess traffic.

GBR and MBR parameters are applied on a per bearer basis, whereas AMBR is applied to a groupof bearers; specifically, a group of non-GBR bearers that terminate on the same UE. AMBR allows theEPS to set a maximum aggregate bit rate for the whole group of bearers that can then be sharedbetween them.

The APN-AMBR parameter sets the shared bit rate available to a group of non-GBR bearers that

terminate on the same APN and can therefore be seen to be applied on a per PCS basis; theUE-AMBR parameter aggregates all non-GBR bearers associated with one UE.

Dedicated bearers can be established as GBR or non-GBR (i.e. MBR) as required. Default bearers,due to the probable need to adjust their bandwidth after the initial Attach has taken place, must benon-GBR.



58/128



MGW

EPS

GERAN/UTRAN

UE using

E-UTRAN

access

GERAN/UTRANAccess

PDN-GW

E-UTRAN

Access S-GW

MME

IMSMSC-S

SGSN

A/Iu

Gb/Iu

Mc

Sv

S3S4

S1 S5

S11 SGi

CS traffic

PS traffic

Providing CS Services via LTE/EPS

The EPC was designed to handle non-real-time IP-based PS applications such as Internet accessand messaging by providing an EPS Bearer between a UE and an external network or AF.

3GPPs intention was that real-time and more traditional services, especially those that were handledby CS networks voice, fax, SMS, dial-up data, supplementary services, emergency calls, etc would be handled in conjunction with an IMS.

It was always accepted that some network operators may wish to continue to make use of their legacyCS core networks, either in place of an IMS or alongside one, and 3GPP and a number of industrybodies have proposed methods of achieving this.


59/128

Evolved Packet Core


EPS Attached UE

Paged via E-UTRAN

Falls back toGERAN/UTRAN for

connection

Returns to E-UTRAN

when Idle

IMS not

required

MGW

EPS

GERAN/UTRAN

GERAN/UTRANAccess

PDN-GW

E-UTRAN

Access S-GW

MME

MSC-S

SGSN

A/IuGb/Iu

Mc

Sv

S3S4

S1 S5

S11 SGi

CS traffic

CS signalling

CS Fallback

Arguably, the simplest solution to the problem of providing CS services without necessarily deployingan IMS is to use 3GPPs CS Fallback service.

CS Fallback allows an EPS UE to perform combined Attach/Location Update functions with the EPSand the legacy CS core.

Mobile-Terminated CS transactions, such as inbound calls or SMS, are directed to the legacy CS coreas usual. The MSC or MSC Server that receives the inbound transaction alerts the UEs serving MMEvia the SGs interface and the MME pages the UE. When it responds, the UE is directed to drop downto a CS capable cell in the GERAN/UTRAN to receive the inbound service. Mobile-Originated CSservices are handled in the same way, with the UE requesting the service via the EPS but beingdirected to GERAN/UTRAN access resources to complete the transaction. Once the CS transaction isover, the UE will return to idle mode and will camp onto an E-UTRAN cell.

Any EPS Bearers carrying PS traffic will be handed over to the GERAN/UTRAN via an SGSN, ifpossible, when the CS Fallback is initiated.

CS Fallback can operate in conjunction with IMS-based services or could be used as an interimmeasure by an operator that is not yet ready to deploy one.

Further Reading: 3GPP TS 23.272 (CS Fallback)


60/128



UE HO to

GERAN/UTRAN

access

CS call employs

SRVCC

PS uses standard

HO techniques

MGW

EPS

GERAN/UTRAN

GERAN/UTRANAccess

PDN-GW

E-UTRAN

Access S-GW

MME

MSC-S

SGSN

A/IuGb/Iu

Mc

Sv

S3S4

S1 S5

S11 SGi

CS traffic

PS traffic

IMS

VCC (Voice Call Continuity)

VCC (Voice Call Continuity) is designed to make use of the combined resources of the IMS andlegacy CS core network by allowing IMS-anchored real-time or CS calls to be handed over from theE-UTRAN and the GERAN/UTRAN.

The specific variant of this concept outlined in the diagram is SRVCC (Single Radio VCC), whichsupports UEs that only contain one radio and can therefore only connect to one air interface methodat a time; in this scenario, the UE is capable of connecting to E-UTRAN, UTRAN or GERAN cells butonly one at a time.

Call- and handover-related signalling is passed between the MME and MSCMSC Server via the Svinterface. Handover or hand back of calls from UTRAN/GERAN to E-UTRAN is not supported; once acall drops down to 2G/3G it stays there.

Any active PS sessions will be split from the CS sessions and handed over to a 2G/3G SGSN at the

same time as the CS sessions are transferred.

The SRVCC specification also provides options for handing over IMS-anchored real-time sessionsfrom UTRAN (HSPA) and 3GPP2 1xRTT CDMA2000 access networks to GERAN/UTRAN resources.

Further Reading: 3GPP TS 23.216 (SRVCC)


61/128

Evolved Packet Core


MGW

EPS

GERAN/UTRAN

EPS Attached UE

CS traffic forwarded

to EPS via GANC

PDN-GWS-GW

MME

CS traffic

MSC-S

A/Iu

SGs/Sv

S1 S5

S11

SGi

IMS not

requiredGANC

A/Iu

EPS-GERAN/UTRAN CS

HO negotiated via SGs

or Sv interfaces

GERAN/UTRAN

Access

E-UTRANAccess

CS Service Provision via a GANC

One further proposal for offering CS services via the EPS, put forward by the VoLGA (Voice over LTEGeneric Access) Forum, is to reuse the framework developed to provide connectivity to 3GPPservices via a GAN (Generic Access Network). A GAN can be essentially any kind of network that cansupport the flow of IP traffic, although the GAN specifications produced by organizations like 3GPPare mainly aimed at Wi-Fi based systems.

This option involves causing the least disruption to the CS core and the EPS by installing a GANC(Generic Access Network Controller) between the two network environments. Handover and controlsignalling between the EPS and CS core would travel over the SGs or Sv interfaces, which weredeveloped to support CS Fallback and SRVCC services respectively.

The scheme does involve some administrative extensions to EPS operation, which would allow asuitably equipped UE to register for VoLGA services and for CS handovers between the EPS and2G/3G networks.

Further Reading: 3GPP TS 43.318, 44.318 (GAN); www.volga-forum.com


62/128



Mutual authentication

Authorization

User confidentiality

Ciphering

Integrity protection

EPC Security Functions

The EPC is responsible for maintaining user subscription and security data and for using that data toensure that unauthorized users cannot gain access to network services. UEs must also be given themeans to ensure that the network they are connecting to is valid and authentic.

The EPC must also ensure that users identities remain confidential. The same applies to the trafficthat users send over the network.

Finally, the integrity of the flow of signalling and control traffic around and across the network must beprotected to ensure that it is not intercepted and altered by unauthorized persons.



63/128

Evolved Packet Core


MME

UE/USIM

HSS

eNB

Quintuplet

XRESRAND

AUTN

CK

IK

AKA (Authentication and Key Agreement)

EPS employs the same AKA (Authentication and Key Agreement) mechanism as is used by 3GUMTS networks.

The EPS AKA mechanism aims to ensure that the network can authenticate users and vice versa,and that once authenticated, users and network can agree on a set of encryption mechanisms toemploy to protect user and control traffic. EPS AKA operates between the UE and the MME and isfacilitated by subscription data stored in the USIM (Universal Subscriber Identity Module) and theHSS.

As in 3G UMTS, when a user is required to authenticate, the HSS will generate a quintet of AVs(Authentication Vectors): a random 128-bit number (RAND), an XRES (Expected Response), a CK(Cipher Key), an IK (Integrity Key) and an AUTN (Authentication Token) which are passed to theserving MME.

RAND is used as a challenge and is transmitted to the UE. The USIM processes RAND through itscopy of the shared secret K authentication key and generates a response, which is transmitted backto the MME. If the USIM response matches XRES then the USIM is deemed to be genuine and theUE is allowed to access network services.

The CK is passed to the serving eNB to allow user plane encryption to and from the UE to take place,while the IK is employed between the UE and the MME to protect the integrity of signalling messages.

Finally, the AUTN is passed to the UE to allow it to authenticate the network.

Further Reading: 3GPP TS 33.102; 33.401; 23.401


64/128



MME

UE/USIM

EPC and E-UTRAN

IMSI

M-TMSI

User Confidentiality

As with legacy 3GPP systems, the EPS uses the IMSI to absolutely and uniquely identify each user.The user confidentiality mechanism provides subscriber anonymity by ensuring that the IMSI istransmitted across the network as little as possible.

A UE accessing a network for the first time or after a long period of inactivity has no option but totransmit its users IMSI to the network to allow identification and authentication to take place. Oncethe user has been authenticated, however, the MME generates an alias that may then be used inplace of the IMSI to identify the subscriber.

Generically in 3GPP networks this alias is known as a TMSI (Temporary Mobile Subscriber Identity).The specific variety employed in the EPS is the M-TMSI. The correspondence between M-TMSI and ausers true IMSI is known only to the MME and users UE. An M-TMSI will be unique within the MMEthat issued it. When combined with an MMEC (MME Code) to make an S-TMSI it becomes

Documents

EPC Cours Notes