Core Network: Architecture and Signaling Procedures

The UE sends an Attach Request message to the eNodeB, carrying this NAS message inside the RRC connection establishment procedure. The message carries the IMSI or the old GUTI, the old GUTI type, and the last visited TAI, which helps the MME allocate a TAI list, as well as the UE Core Network Capability, an ESM message container with a PDN Connectivity Request, the Key Set Identifier for the Access Security Management Entity (KSI_ASME), the NAS sequence number, and the NAS Message Authentication Code (NAS-MAC).

On receiving the Attach Request, the eNodeB derives the target MME address from the old Globally Unique MME Identifier (GUMMEI), or, if no association exists, selects a new MME, and forwards the NAS message to the New MME over the S1-MME interface, inside an S1AP Initial UE Message. This message carries the NAS Protocol Data Unit (NAS-PDU) with the Attach Request, the Selected Network, the TAI, and the E-UTRAN Cell Global Identifier (ECGI), as well as the S-Temporary Mobile Subscriber Identity (S-TMSI), the GUMMEI, and the RRC establishment cause.

If the UE identified itself with an old GUTI and the MME changed since the last detach, the New MME derives the address of the previous serving node from the old GUTI and sends a GTP version 2 (GTPv2) Identification Request message to the Old MME/SGSN, to retrieve the IMSI and the Mobility Management (MM) context from that node. This message carries the old GUTI and the complete Attach Request message.

The Old MME/SGSN verifies the Attach Request message, using the NAS-MAC or the Packet Temporary Mobile Subscriber Identity (P-TMSI) signature, and responds with a GTPv2 Identification Response message that, if the integrity check succeeds, carries the IMSI, the MM Context, and the Cause.

If the IMSI is unknown to both the new and the old serving nodes, the New MME sends a NAS Identity Request message to the UE, carrying the identity type IMSI, to ask the UE for its permanent identity.

The UE responds with a NAS Identity Response message that carries its IMSI, letting the New MME proceed with authentication and with subscription retrieval from the HSS.

The New MME and the UE then perform the Authentication and Security Procedures, carrying the RAND, the AUTN, the Authentication Response (RES), the selected NAS algorithms, the Key Set Identifier for E-UTRAN (eKSI), the UE Security Capability, and the NAS-MAC. These procedures activate integrity protection and NAS ciphering, establish a secure NAS connection, and confirm the legitimacy of the UE and the network.

The New MME can check the Mobile Equipment (ME) identity with the Equipment Identity Register (EIR) by sending a Diameter ME-Identity-Check-Request (ECR) message over the S13 interface, carrying the ME Identity, that is the International Mobile Equipment Identity and Software Version Number (IMEISV), and the IMSI, to confirm that the equipment is not stolen or unauthorized.

The EIR responds with a Diameter ME-Identity-Check-Answer (ECA) message that carries a Result-Code, stating the status of the ME, for example whitelisted or blacklisted, and the New MME decides whether to continue or reject the Attach procedure based on this result.

If the New MME holds active bearer contexts for this UE from a previous session that was not properly detached, it releases the stale user-plane resources by sending a GTPv2 Delete Session Request message to the S-GW (Serving Gateway), carrying the Linked EPS Bearer Identity (LBI).

The S-GW forwards the GTPv2 Delete Session Request message, carrying the LBI, to the P-GW (PDN Gateway) to complete the session release, and, if the network deploys a PCRF, the P-GW also starts an IP Connectivity Access Network (IP-CAN) Session Termination procedure.

The P-GW acknowledges the deletion by returning a GTPv2 Delete Session Response message that carries a Cause to the S-GW.

The S-GW returns the GTPv2 Delete Session Response message, carrying a Cause, to the New MME, confirming that the old session contexts are removed.

To register itself as the serving node and retrieve the subscription data, the New MME sends a Diameter Update-Location-Request (ULR) message to the HSS over the S6a interface. The message carries the MME Identity, the IMSI, the IMEISV, the MME Capabilities, and the ULR-Flags, including the Initial-Attach-Indicator, through which the New MME indicates an initial attach.

If a registration exists for an old MME or SGSN, the HSS instructs that node to remove its MM and bearer contexts for the UE by sending a Diameter Cancel-Location-Request (CLR) message to the Old MME/SGSN, carrying the IMSI and the Cancellation Type.

The Old MME/SGSN removes the contexts and returns a Diameter Cancel-Location-Answer (CLA) message, carrying the IMSI, to the HSS.

The HSS acknowledges the location update by sending a Diameter Update-Location-Answer (ULA) message to the New MME, carrying the IMSI, the ULA-Flags, and the Subscription Data, including the PDN subscription contexts, the QoS profile, and the APN Aggregate Maximum Bit Rate (APN-AMBR), covering the authorized APNs.

The New MME selects an S-GW and sends it a GTPv2 Create Session Request message to establish the default EPS bearer, carrying the IMSI, the Mobile Station International Subscriber Directory Number (MSISDN), the MME TEID for the control plane, the PDN GW address, the APN, the RAT type, the Default EPS Bearer QoS, and the EPS Bearer Identity.

The S-GW creates an entry in its EPS bearer table and forwards the GTPv2 Create Session Request message to the P-GW that the MME indicated, carrying the IMSI, the APN, its own Serving GW Address and TEID for the user plane, the SGW TEID for the control plane, the RAT type, the Default EPS Bearer QoS, and the EPS Bearer Identity.

If the network deploys dynamic Policy and Charging Control (PCC), the P-GW, acting as the Policy and Charging Enforcement Function (PCEF), retrieves the PCC rules for the new IP-CAN session by sending a Diameter Credit-Control-Request (CCR) message to the PCRF over the Gx interface. The message carries the CC-Request-Type INITIAL_REQUEST, the Subscription-Id, that is the IMSI, the Called-Station-Id, that is the APN, the IP-CAN-Type, the RAT-Type, the Default-EPS-Bearer-QoS, and the APN-AMBR.

The PCRF determines the policy and returns a Diameter Credit-Control-Answer (CCA) message to the P-GW, carrying the PCC rules, the authorized QoS information, and the Event-Trigger, for the P-GW to enforce.

The P-GW creates an EPS bearer context and returns a GTPv2 Create Session Response message to the S-GW, carrying its own Address and TEID for the user plane, its TEID for the control plane, the PDN Type, the allocated PDN Address, that is the UE IP address, the EPS Bearer Identity, the QoS, and the Charging Id.

The S-GW returns the GTPv2 Create Session Response message to the New MME, carrying the PDN Type, the PDN Address, the Serving GW address and TEID for the user plane, the SGW TEID for the control plane, the EPS Bearer Identity, the EPS Bearer QoS, and the P-GW TEID for uplink traffic.

To establish the UE context in the Radio Access Network (RAN) and request the setup of the radio bearers and the S1-U bearers, the New MME sends an S1AP Initial Context Setup Request message to the eNodeB, carrying the MME UE S1AP ID, the UE Aggregate Maximum Bitrate, the E-RAB To Be Setup List, with the EPS Bearer QoS, the SGW TEID, and the SGW Address, and the NAS-PDU with the Attach Accept message.

The eNodeB sets up the radio bearer by sending an RRC Connection Reconfiguration message to the UE, carrying the EPS Radio Bearer Identity and the NAS-PDU with the Attach Accept, and the UE stores its assigned IP address and QoS parameters.

The UE completes the radio reconfiguration and returns an RRC Connection Reconfiguration Complete message, carrying the RRC Transaction Identifier, to the eNodeB, confirming that the radio bearers are set up.

The eNodeB sends an S1AP Initial Context Setup Response message to the New MME, carrying the eNB UE S1AP ID, the MME UE S1AP ID, and the E-RAB Setup List, with the eNodeB Address and the eNodeB TEID for downlink traffic.

The UE sends an RRC Direct Transfer message to the eNodeB that carries the NAS Attach Complete message, with the EPS Bearer Identity, the NAS sequence number, and the NAS-MAC, indicating that the UE processed the network’s attach acceptance.

The eNodeB forwards the Attach Complete message to the New MME inside an S1AP Uplink NAS Transport message, carrying the MME UE S1AP ID, the eNB UE S1AP ID, and the NAS-PDU.

When the New MME receives both the Initial Context Setup Response and the Attach Complete message, it informs the S-GW of the eNodeB’s downlink tunnel information, so that data can flow, by sending a GTPv2 Modify Bearer Request message to the S-GW, carrying the EPS Bearer Identity, the eNodeB address, the eNodeB TEID, the RAT type, and the Handover Indication.

The S-GW acknowledges with a GTPv2 Modify Bearer Response message, carrying the EPS Bearer Identity and the Cause, to the New MME, and can now deliver any downlink data that it buffered to the UE.

For non-emergency services, the New MME notifies the HSS of the established PDN connection, so that the HSS can store the P-GW identity and the APN, by sending a Diameter Notify-Request (NOR) message to the HSS, carrying the IMSI, the Terminal Information, the PDN GW Address, and the APN.

The HSS stores the information and returns a Diameter Notify-Answer (NOA) message, carrying a Result-Code, to the New MME, completing the Attach procedure.