Evolved Packet Core
E- UTRAN region TA
Tracking Area Tracking Area
eNBs and the cells they manage are organized into contiguous geographical units known as the TA (Tracking Area).
A TA may be as small as one cell or as large as a region of an E-UTRAN or an entire E-UTRAN, but some networks configure them to cover the set of cells generated by a single eNB. This configuration might be more likely in E-UTRANs that employ distributed cell coverage, where a central eNB manages a distributed set of remote radio heads that cover a large area. Functionally, a TA represents an area within which an idle mode UE can roam without performing a location update and within which that UE will be paged in the event of a mobile terminated transaction. Individual TAs are bound into larger, UE-specific meta units known as Tracking Area Lists to provide an enhanced level of flexibility to the tracking and paging processes.
The TAI (Tracking Area Identity) – which consists of MCC (Mobile Country Code), MNC (Mobile Network Code) and TAC (Tracking Area Code) - of the TA to which a cell belongs is advertised on each cell’s BCCH. To this extent, the TA as used in LTE is analogous to the LA (Location Area) and RA (Routing Area) as used in CS and PS mobility respectively in legacy GSM and UMTS Networks.
An individual cell may belong to one Tracking Area (per PLMN) only, although conceivably an eNB may be associated with more than one TA, if its set of supported cells extends across a TA boundary. In multi-operator E-UTRAN deployments a single eNB may be associated with up to six PLMNs. In these cases SIB 1 of the cell’s BCCH (Broadcast Control Channel) is able to broadcast a separate PLMN Identity IE (Information Element) carrying the MCC/MNC details of those networks, however, SIB 1 only has space to carry one TAC. This means that all six possible PLMNs associated with that E-UTRAN must have aligned and coordinated TA configurations. Each PLMN will continue to have its own set of TAIs as these are constructed using the network’s MCC/MNC followed by the cell’s TAC.
Further Reading: 23.401:4.3.5.3, 36.300:10.1.7 (TAs and RAN sharing)
LT3604/v4.0 © Wray Castle Limited 2.9
UE M-TMSI last reported TA = TA 1
TAI List for TAC1 (in PLMN 1) TAI 1, TAI 2, TAI 7 MME
TAI = PLMN ID (MCC/MNC) + TAC
This example shows ‘regional’ TAs, consisting of cells belonging to multiple eNBs, other configuration options include defining TAs based on the set of cells managed by a single eNB
Tracking Area Management Tracking Area Management
The LTE TA concept incorporates an additional element, however, that is not supported in legacy systems, that of the TAI List (also known simply as TA Lists).
TAI/TA Lists are configured by an operator in their MMEs and consist of a set of adjacent TAs that, between them, form a larger contiguous area than that covered by just a single TA. Typically, the MME will be provided with datafill that shows the set of associated Tracking Areas for each individual TA and from that will compile TAI Lists based on each UE’s current location. All TAs in a TA List must be associated with the MME, TA Lists cannot span multiple MMEs. The TA List can therefore be viewed as creating a meta area that concatenates a number of TAs into a larger virtual unit. UEs are able to roam within the set of TAs without being required to perform a TAU when they move between TAs. TA Lists are assigned on a UE-by-UE basis and different UEs in the same cell may be assigned different TA Lists if the MME decides it is advantageous.
The current location of UEs in ECM-Idle mode is tracked by the MME down to the TA level. When an idle mode UE reselects to a new cell it must check the TAI of the new cell and perform a TAU if the new cell belongs to a TA that is not in the UE’s current TA List. When necessary, an MME will page for an idle mode UE in all cells belonging to the current TA List. When a UE performs a TAU, the MME will calculate a new TA List based on the TAI contained in the TAU and will pass that information back to the UE in the TAU Accept message.
One of the reasons for employing the Tracking Area List is that it allows operators to resize paging areas without needing to reconfigure any base stations. In GSM/UMTS the size of a Location Area is always a balance between the paging load on cell paging channels generated in large LAs and the level of LA Update signalling generated by small LAs. If high paging or LA Update loads are experienced it may be an indication that the network’s LAs are incorrectly sized, resulting in the operator being required to reconfigure base stations into different LAs. This would typically require careful planning and a period of downtime for each base station as it was reconfigured.
If the LTE paging or TAU load is too high operators can rebalance the sizes of paging areas by editing the TA List associated with each TA; removing TAs from a list could reduce the size of the TA List area and lower the paging load or adding TAs to a list could make the TA List area larger and therefore lower the TAU load. All of this is achieved by reconfiguring the MME and avoids the need to take any sites down to reconfigure the base stations.
Further Reading: 3GPP TS23.401:4.3.5.3
2.10
LTE Evolved Packet Core Network
MME Group 1
S-GW Service Area = TA1, TA2 S-GW Service Area = TA3, TA4 Resilience Through Pooling
Resilience Through Pooling
In common with ongoing developments within many existing 3G core networks, the EPC is designed to take advantage of the concept of ‘pooling’, specifically of MME and S-GW nodes.
The ‘S1-flex’ facility that allows each eNB in the E-UTRAN to be associated with multiple MMEs in the EPC allows those MMEs to be grouped into ‘pools’. Each pool will be associated with an MME Pool Area, which consists of all of the eNBs in one or more complete tracking areas. MME pools (or MME Groups) are assigned unique MME Group IDs within their network and each MME in a Group is assigned an MMEC (MME Code), which is its index number within that group. MMEs that are members of multiple groups will be assigned separate MMEIs (MME Identities) by each Group.
This means that when an eNB selects the MME that will handle the Attach process for a UE, that MME can continue to serve that UE as long as it remains within the tracking areas associated with the MME’s pool. This reduces the requirement for MME relocation and consequently reduces the network’s signalling load. Pooling also provides a measure of resilience for network services to the extent that, if one MME falls over, eNBs have a number of alternative devices to select. As with current
implementations of the pooling concept, however, MME pooling does not protect the connections to UEs being served by a failed MME – when the MME fails all ongoing services supported by it fail too.
In the same way as an MME pool area comprises a set of cells within which a UE does not need to change the serving MME, an S-GW service area is a set of cells within which a UE does not need to change S-GW. Technically, a Serving Gateway Service Area consists of the set of TAs associated with an S-GW.
The S-GW selection function in the MME is invoked when a UE Attaches or when an S-GW Change is triggered and attempts to limit the possibility of further S-GW changes by ensuring that the S-GW that is selected to serve a UE is associated with a Service Area that covers all of the Tracking Areas in the UE’s current TA List.
MME pools may overlap, and each MME pool area is identified by an MMEGI (MME Group Identifier).
S-GW Services Areas are typically provided with DNS-resolvable names but there is no official ‘S-GW Service Area Identifier’. S-GW Service Areas are also permitted to overlap.
Further Reading: 3GPP TS 23.401:3.1
LT3604/v4.0 © Wray Castle Limited 2.11 pool of MMEs for all PLMNs
Network Sharing Network Sharing
The costs associated with building (CAPEX) and operating (OPEX) cellular networks have driven many operators to explore the potential methods of sharing systems with other operators.
The first stage of network sharing is often site and infrastructure sharing. In these deals, two or more operators pool their RAN resources and ensure that, where possible base stations belonging to each of them are deployed on the same sites, thus allowing them to share the costs of site acquisition/rental, power and transmission.
The next level of sharing is to implement RAN sharing, in which individual base stations are shared by operators. In 2G and 3G networks base station sharing was often implemented on the basis of ‘shared base station, separate frequencies’ with each base station generating a different set of cells per operator.
LTE allows not only base station sharing but frequency sharing as well, with each eNB able to broadcast the PLMN codes of up to six operators.
RAN sharing can, in turn, be associated with two different kinds of core network sharing, known as MOCN (Multi-Operator Core Networks) and GWCN (Gateway Core Networks).
In MOCN configurations, the shared eNBs are connected to fully separate EPCs. UEs would perform PLMN Selection on Attach and the S1-flex function performed by the eNB would select an MME in the chosen PLMN to forward Attach Requests on to. MOCN configurations are also possible in 3G networks, with the RNC and Iu-flex functions replacing those of the eNB.
In GWCN configurations, the shared eNBs are connected to a set of shared MMEs, which in turn connect to a set of separate core networks. UEs would again perform PLMN selection but the eNB would perform S1-flex functions towards a single, combined set of MMEs. The MMEs would then perform separate S-GW/PDN-GW selection per PLMN and would support S6a interfaces to a different set of HSS nodes per PLMN. GWCN configurations are also possible for both 2G and 3G networks, where a shared set of MSC Servers/SGSNs replace the MMEs.
The final level of sharing is full network integration, in which both the RAN and the EPC are shared by multiple operators. Each operator could then exist as a separate ‘brand’ of the same PLMN or could each operate as a separate MVNO (Mobile Virtual Network Operator) attached to the same PLMN.
Further Reading: 3GPP TS23.251 (Network Sharing)
2.12
LTE Evolved Packet Core Network
PLMN – MCC+MNC
MME Group ID (MMEGI)
Tracking Area ID (TAI)
E-UTRAN Cell ID (ECGI) = eNB ID + Cell ID
EPS Area
EPS Area IdentitiesIdentities
The EPS continues to use the PLMN identifier employed by legacy 3GPP systems, which consists of the MCC and the MNC. The assignment of MCC and MNC numbers is ultimately the responsibility of the ITU (International Telecommunication Union).
The MMEGI is a 16-bit identifier assigned to an individual MME Pool. The MMEGI only has to be unique within a PLMN and is assigned by individual operators.
The TAI is analogous to the LA or RA identifiers employed by the GERAN/UTRAN in that it is used to identify a group of cells in the access network. In the E-UTRAN the TA is the granularity with which each UE’s location is tracked. It is also the area within which a UE will be paged. The TAI consists of the network’s MCC and MNC followed by a TAC.
As in legacy systems it is necessary to be able to identify uniquely each cell in the network for call establishment, paging, handover and billing purposes. 3GPP has devised an updated Cell ID known as an ECGI (E-UTRAN Cell Global Identifier).
The ECGI incorporates a unique eNB Identifier, which allows the S1 and X2 interface protocols to discover and identify the target nodes for functions such as EPS Bearer handover.
Further Reading: 3GPP TS 29.803, 23.401:5.2, 36.300:8.2 MNC Assignments 2011 - www.itu.int/dms_pub/itu-t/opb/
sp/T-SP-E.212B-2011-PDF-E.pdf
LT3604/v4.0 © Wray Castle Limited 2.13
Evolved Packet Core
Gateway names/IP addresses Access Point Name (APN)
GUMMEI
MCC MNC MMEI
24 bits
MMEI MMEGI MMEC
8 bits 16 bits
MCC MNC eNB ID Cell ID eCGI
20 bits 8 bits
Node Identifiers Node Identifiers
The MME is primarily a signalling node and each MME has to be accessible to and exchange control data with MMEs and other devices within its own network and in other networks elsewhere in the world.
For this reason, each MME is assigned a unique and globally significant identifier known as a GUMMEI (Globally Unique MME Identity).
The GUMMEI consists of the network’s MCC and MNC followed by an MMEI (MME Identifier), which in turn consists of the MMEGI and the MMEC. The MMEGI identifies the pool to which the MME belongs and the MMEC is its index within that pool.
The addressing of S-GW and PDN-GW nodes follows the model for addressing legacy PS core network nodes – ultimately, each node will be identified by an IP address, which may or may not be backed up with a DNS-resolvable device name. Examples of this naming convention could include ‘sgw6.operator.
com’ or ‘hss01.region.operator.com’.
The termination and anchor point for an EPS Bearer is an access point in a PDN-GW, which is analogous to a PDP Context terminating on GGSN APN in 2G/3G networks. Each PDN-GW AP is assigned an IP address associated with a DNS-resolvable name – the APN. Example APNs could include
‘internet’, ‘mms’ or ‘ims’.
The EPS ECGI is globally unique and allows individual cells to be separately identified. The ECGI is a 28-bit identifier which consists of the PLMN ID (MCC + MNC), a 20-bit eNB ID (which will be unique within a PLMN) and an 8-bit Cell ID (which will be unique within one eNB). This gives each PLMN scope to identify up to 1 million eNBs and for each eNB to control up to 256 cells.
Further Reading: 3GPP TS 23.401:5.2, 36.300
2.14
LTE Evolved Packet Core Network
M
MCCC C MMNNC C MMMMEEII
24 bits
GUTI
M-TMSI M-TMSI
32 bits
M-TMSI M-TMSI
32 bits
M-TMSI
M-TMSI M-TMSI
32 bits MMEC
MMEC
8 bits
S-TMSI
M
MCCC C MMNNC C MMSSIINN
64 bits
IMSI
NAS Identities NAS Identities
The main means of identifying EPS subscribers remains the IMSI, which is permanently assigned to a subscriber account.
Temporary and anonymous identification of subscribers is provided by the GUTI (Globally Unique Temporary Identity), which is assigned by the serving MME when a UE has successfully attached and is reassigned if the UE moves to the control of a new MME.
The GUTI is analogous to the legacy TMSI, but with the additional feature that its structure uniquely identifies not only the subscriber within the MME but also the MME that assigned it.
The GUTI is constructed from the GUMMEI, which identifies the MME, and the M-TMSI (MME Temporary Mobile Subscriber Identity). The M-TMSI is used to provide anonymous identification of a subscriber within an MME once that subscriber has been authenticated and attached. As with legacy TMSI (Temporary Mobile Subscriber Identity) use, the MME may elect to reissue the M-TMSI at periodic intervals and it will be reissued in any case if the UE passes to the control of a different MME.
The M-TMSI allows a subscriber to be uniquely identified within an individual MME, whereas the S-TMSI allows subscribers to be identified within an MME group or pool.
To achieve this, the S-TMSI simply adds the one-octet MMEC to the M-TMSI.
Further Reading: 3GPP TS 36.300 (E-UTRAN) and 24.301 (NAS)
LT3604/v4.0 © Wray Castle Limited 2.15
There are numerous interfaces defined for the EPC, most of which share the reference letter ‘S’.
They are functionally separated into those that carry control (C-plane) and those that carry user (U-plane) traffic. Support of most S interfaces in the EPC is mandatory, although some are optional.
An overview of the interfaces is given in the diagram.
Further Reading: 3GPP TS 23.401:4.2
2.16
LTE Evolved Packet Core Network
MME
S-GW
IP Data link layer
S1–AP S1–AP
SCTP
Physical layer S1-MME
Physical layer UDP
IP Data link layer
User plane User planePDUsPDUs
GTPv1-U S1-U
S1AP (S1 Application Protocol) S1AP (S1 Application Protocol)
S1AP is designed to provide a control plane connection on the S1-MME interface between an eNB and an associated MME.
The S1-flex concept means that each base station may be associated with multiple MMEs, which in turn means that each eNB could host multiple instances of the S1AP.
S1AP is responsible for E-RAB (E-UTRAN Radio Access Bearer) management, i.e. setting up, modifying and releasing bearers under instruction from an MME. It also performs initial context transfer to establish an S1UE context in the eNB on initial attach including collating details of the UE’s capabilities and the creation of a default bearer. It undertakes UE context management; transferring UE context data between eNBs and MMEs in the event of handovers or relocations.
S1AP is also responsible for the creation of additional E-RABs (for carrying further Default or Dedicated EPS Bearers) and for mobility functions for UEs in ECM-Connected state. It also performs paging and the Direct Transfer of NAS signalling between the UE and the MME.
S1AP takes the place of GTP-C on the S1 interface, carrying bearer-specific control information between the MME and the eNB, including details such as TEIDs and UE S1 identities.
S1AP is also responsible for carrying the messaging that enables the E-RAB ‘path switch’ function to take place after an inter-eNB handover. Additionally, it provides support for MME relocation and S-GW change functions.
S1AP is an evolution of the RANAP (Radio Access Network Application Part) protocol employed in 3G networks.
Further Reading: 3GPP TS 36.41x series, 36.413 (S1AP)
LT3604/v4.0 © Wray Castle Limited 2.17
Evolved Packet Core
Home or Visited Network S-GW
SGSN
S4
PDN-GW
IP Services
S5 RNC
S12
S8
Home Network
PDN-GW
S1-U eNB
L1 UDP
IP L2 GTPv1-U
GTPv1-U Traffic Interfaces GTPv1-U Traffic Interfaces
Most EPC interfaces are based on a combination of GTPv1-U and GTPv2-C.
The S4 interface carries U-plane traffic between an S-GW and an SGSN for EPC-attached UEs that have roamed onto GERAN/UTRAN access. SGSNs that support the S4 can also be upgraded to use the S16 interface, which allows the evolved combination of GTPv1-U and GTPv2-C to be used between SGSNs.
The S5 interface interconnects an S-GW to a PDN-GW within the same PLMN. The S8 Interface provides roaming connectivity between a visited S-GW and a home PDN-GW. The S5 interface is based on the 2G/3G Gn interface, whilst the S8 is analogous to the Gp interface.
The S12 interface is used to provide a U-plane only ‘direct tunnel’ between an S-GW and a 3G RNC, which allows the user plane to bypass the SGSN and thus avoids any traffic bottlenecks that may occur.
The S1 and X2 E-UTRAN user plane interfaces are also based on GTPv1-U.
Further Reading: 3GPP TS 23.401:5.1, 23.281 (GTPv1-U), 23.060 (GPRS)
2.18
LTE Evolved Packet Core Network
Home or Visited Network
SGSN
MME S3
S10
MME MSC
Sv
S-GW SGSN
S11 S16
PDN-GW S5
S8
Home Network
PDN-GW
IP Services
L1 UDP
IP L2 GTPv2-C
GTPv2-C C-plane Interfaces GTPv2-C C-plane Interfaces
The S3 interface provides control plane connectivity between an MME and an SGSN and is used to carry handover and other control signalling between EPS and GERAN/UTRAN PS environments. The S16
The S3 interface provides control plane connectivity between an MME and an SGSN and is used to carry handover and other control signalling between EPS and GERAN/UTRAN PS environments. The S16