Attach Sequence for LTE Radio

I have in past posted a complete Attach Sequence on the 3G4G website for LTE Radio Signaling but included the signalling on a few nodes. Recently I came across a signalling example in NTT Docomo technical journal which was less detailed but at a higher level and detailed signalling on these other nodes. It may be worthwhile brushing up the LTE Architecture diagram before diving into this.

With EPC, when a terminal connects to the LTE radio access system it is automatically connected to the PDN and this connected state is maintained continuously. In other words, as the terminal is registered on the network (attached) through the LTE radio access system, a communications path to the PDN (IP connectivity) is established.

The PDN to which a connection is established can be preconfigured on a per-subscriber basis, or the terminal can specify it during the attach procedure. This PDN is called the default PDN. With the always-on connection function, the radio link of the connection only is released after a set amount of time has elapsed without the terminal performing any communication, and the IP connectivity between the terminal and the network is maintained. By doing this, only the radio link needs to be reconfigured when the terminal begins actual communication, allowing the connection-delay time to be reduced. Also, the IP address obtained when the terminal attaches can be used until it detaches, so it is always possible to receive packets using that IP address.

The information flow for the terminal attaching to the network up until the connection to the PDN is established is shown in Figure 2 below.

Steps (1) to (3): When the terminal establishes a radio control link for sending and receiving control signals with the eNodeB, it sends an attach request to the MME. The terminal and MME perform the required security procedures, including authentication, encryption and integrity.

Steps (4) to (5): The MME sends an update location request message to the Home Subscriber Server (HSS), and the HSS records that the terminal is connected under the MME.

Step (6): To begin establishing a transmission path to the default PDN, the MME sends a create session request to the S-GW.

Steps (7) to (8): When the S-GW receives the create session request from the MME, it requests proxy binding update to the P-GW. The P-GW allocates an IP address to the terminal and notifies the S-GW of this information in a proxy binding acknowledgement message. This process establishes a continuous core-network communications path between the P-GW and the S-GW for the allocated IP address.

Step (9): The S-GW prepares a radio access bearer from itself to the eNodeB, and sends a create session response signal to the MME. The create session response signal contains information required to configure the radio access bearer from the eNodeB to the S-GW, including information elements issued by the S-GW and the IP address allocated to the terminal.

Steps (10) to (11) and (13): The MME sends the information in the create session response signal to the eNodeB in an initial context setup request signal. Note that this signaling also contains other notifications such as the attach accept, which is the response to the attach request. When the terminal receives the attach accept in Step (11), it sends an attach complete response to the MME, notifying that processing has completed.

Step (12): The eNodeB establishes the radio data link and sends the attach accept to the terminal. It also configures the radio access bearer from the eNodeB to the S-GW and sends an initial context setup response to the MME. The initial context setup response contains information elements issued by the eNodeB required to establish the radio access bearer from the S-GW to the eNodeB.

Steps (14) to (15): The MME sends the information in the initial context setup response to the S-GW in a modify bearer request signal. The S-GW completes configuration of the previously prepared radio bearer from the S-GW to the eNodeB and sends a modify bearer response to the MME.

Through these steps, a communications path from the terminal to the P-GW is established, enabling communication with the default PDN.

If the terminal performs no communication for a set period of time, the always-on connection function described above releases the radio control link, the LTE radio data link, and the LTE radio access bearer, while maintaining the core network communications path.

After the terminal has established a connection to the default PDN, it is possible to initiate another connection to a different PDN. In this way it is possible to manage PDNs according to service.

For example the IMS PDN, which provides voice services by packet network, could be used as the default PDN, and a different PDN could be used for internet access.

To establish a connection to a PDN other than the default PDN, the procedure is the same as the attach procedure shown in Fig.2, excluding Steps (4) and (5).

TERMS:

Attach: Procedure to register a terminal on the network when, for example, its power is switched on.

Detach: Procedure to remove registration of a terminal from the network when, for example, its power is switched off.

Integrity: Whether the transmitted data is complete and has not been falsified. Here we refer to pre-processing required to ensure integrity of the data.

Bearer: A logical transmission path established, as between the S-GW and eNodeB.

Context setup: Configuration of information required for the communications path and communications management.

Circuit Switched Fallback (CSFB): A Quick Primer

I have explained CSFB with basic signalling here and there is a very interesting Ericsson whitepaper explaining all Voice issues in LTE here.

The following CSFB details have been taken from NTT Docomo Technical Journal:

The basic concept of CS Fallback is shown in Figure 1. Given a mobile terminal camping on LTE, a mobile terminating voice call arrives at the terminal from the existing CS domain via EPC. On receiving a paging message, the mobile terminal recognises that the network is calling the mobile terminal for CS-based voice and therefore switches to 3G. The response confirming the acceptance of a call request is then sent from the mobile terminal to the 3G-CS system, and from that point on, all call control for the voice service is performed on the 3G side.

The CS Fallback consists of a function to notify a mobile terminal of a call request from the CS domain and combined mobility management functions between CS domain and EPC for that

purpose. The network architecture of CS Fallback is shown in Figure 2.

One of the remarkable characteristics of the EPC supporting CS Fallback is that it connects the Mobile Switching Center (MSC) and Visited Location Register (VLR) in the 3G CS domain

with the Mobility Management Entity (MME), which provides EPC mobility management functionality. The interface connecting MSC/VLR and MME is called an SGs reference point. This

interface is based on the concept of the Gs reference point that exchanges signalling with MSC, which connects to the Serving General Packet Radio Service Support Node (SGSN), a 3G

packet switch. The SGs provides nearly all the functions provided by the existing Gs.

The CS Fallback function uses this SGs reference point to transfer the mobile terminating call requests from the CS domain to LTE. It also provides combined mobility management

between the 3G CS domain and the EPC to enable this transfer to take place.

Combined Mobility Management between CS Domain and EPC Network:

A mobile communications network must always know where a mobile terminal is located to deliver mobile terminating service requests to the mobile user on the mobile terminating side. The procedure for determining terminal location is called “mobility management". As a basic function of mobile communications, 3G and LTE each provide a mobility management function.

To complete a call using the CS Fallback function, the CS domain needs to know which LTE location registration area the mobile terminal is currently camping on. To this end, the MME must correlate mobility management control of the CS domain with that of EPC and inform MSC/VLR that the mobile terminal is present in an LTE location registration area.

The 3G core network already incorporates a function for linking mobility management of the CS domain with that of the Packet Switched (PS) domain providing packet-switching functions. As described above, the CS domain and PS domain functions are provided via separate switches. Thus, if combined mobility management can be used, the mobility management procedure for the terminal only needs to be performed once, which has the effect of reducing signal traffic in the network. This concept of combined mobility management is appropriated by the CS Fallback function. Specifically, MSC/VLR uses the same logic for receiving a location registration request from SGSN as that for receiving a location registration request from MME. This achieves a more efficient combined mobility management between the CS domain and EPC while reducing the development impact on MSC.

As described above, a mobile terminal using LTE cannot use 3G at the same time. This implies that the MME, which contains the LTE location registration area (Tracking Area (TA)), is unable to identify which MSC/VLR it should send the mobility management messages to from the TA alone. To solve this problem, the mapping of TAs and 3G Location Areas (LA) within MME has been adopted. The concept behind TA/LA mapping is shown in Figure 3. Here, MME stores a database that manages the correspondence between physically overlapping TAs and LAs. This information is used to determine which MSC/VLR to target for location registration.

The combined TA/LA update procedure for CS fallback is shown in detail in Figure 4. First, the mobile terminal sends to the MME a Tracking Area Update (TAU) request message indicating a combined TAU and the current TA in which the mobile terminal is currently present (Fig. 4 (1)). The MME then performs a location update procedure towards Home Subscriber Server (HSS), which is a database used for managing subscriber profiles (Fig. 4 (2)). Next, the MME uses the TA/LA correspondence database to identify the corresponding LA and the MSC/VLR that is managing that area, and uses the SGs reference point to send a Location Area Update (LAU) request message to the MSC/VLR together with the LA so identified (Fig. 4 (3)). The MSC/VLR that receives the LAU request message stores the correspondence between the ID of the MME originating the request and an ID such as the International Mobile Subscriber Identity (IMSI) that identifies the subscriber (Fig. 4 (4)). This enables the MSC/VLR to know which MME the mobile terminal is currently connected to and that the mobile terminal is camping on LTE. Following this, the MSC/VLR performs a location registration procedure with the HSS (Fig. 4 (5)). Finally, the MSC/VLR informs the MME of temporary user identity (Temporary Mobile Subscriber Identity (TMSI)), which is used at the time of a mobile terminating call in the CS domain, and indicates that location registration has been completed. The MME then informs the mobile terminal of the TMSI and of the LA that the mobile terminal has been registered with thereby completing combined location registration (Fig. 4 (6) (7)).

CS Fallback Call Control Procedures - Mobile Originating Call:

To originate a voice call using the CS Fallback function, a mobile terminal in the LTE location registration area must first switch (fall back) to 3G. The mobile-originating voice call procedure is shown in Figure 5. To originate a call, the mobile terminal begins by sending a CS fallback service request message to the MME (Fig. 5 (1)). Since a packet-communications transmission path (bearer) must always exist in EPC for the purpose of providing an always-on connection, the bearer also has to be handed over to 3G. To accomplish this, the MME issues a handover command to the mobile terminal in LTE and initiates a handover procedure (Fig. 5 (2)). The mobile terminal changes its radio from LTE to 3G during this procedure (Fig. 5 (3)). On completion of handover, the mobile terminal issues an originating request for voice service to the MSC/VLR. A voice-call connection is then established using an existing calloriginating procedure on 3G and the CS Fallback procedure is completed (Fig. 5(4)).

CS Fallback Call Control Procedures - Mobile Terminating Call:

The mobile terminating voice call procedure using CS Fallback is shown in Figure 6. When the MSC/VLR receives a message indicating the occurrence of a mobile terminating call (Fig. 6 (1)), the MSC/VLR identifies the corresponding MME from the call information received (Fig. 6 (2)). Then, the MSC/VLR sends a paging message (Fig. 6 (3)) towards the MME. Next, the MME sends a paging message to the mobile terminal in LTE (Fig. 6 (4)). This paging message includes an indication that the call is a CS service, and on identifying the call as such, the mobile terminal sends a CS fallback service request signal to the MME (Fig. 6 (5)). Following this, a handover procedure to 3G as described above takes place (Fig. 6 (6), (7)). The mobile terminal that is now switched to 3G sends a paging response message to the MSC/VLR at which it is registered (Fig. 6 (8)). Finally, an existing mobile terminating call procedure on 3G is executed and the CS Fallback procedure is completed (Fig. 6 (9)).

Quick primer on Push-to-talk (PTT)

Push to Talk (PTT)

View more documents from Zahid Ghadialy.

MBMS in LTE Release-9

From NTT Docomo Technical Journal:

MBMS is a bearer service for broadcast/multicast transmission of data, to transmit the same information to all interested UEs in an area over a common bearer. Note that MBMS has been supported in UTRA since Release 6.

LTE Release 9 supports basic MBMS functionality not requiring complex control. One of the main features is support for MBMS Single Frequency Network (MBSFN) transmission. With MBSFN transmission eNBs in the MBSFN area transmit the same signal simultaneously using the same time-frequency resource. The UE receives the combined signals as a single, strong signal, improving coverage and signal quality without much additional complexity in the UE. By applying MBSFN transmission, a 3GPP study concluded that to provide 95% coverage with a packet error rate of 1%, a spectral efficiency of 3 bit/s/Hz or greater can be achieved.

The logical architecture for MBMS in LTE is shown in Figure 4. The MBMS gateway (GW) distributes data received from the Broadcast Multicast Service Center (BMSC) to the relevant eNBs by IP multicast. The Multi-Cell Multicast Coordination Entity (MCE) specifies the radio resources to be used by eNBs comprising the MBSFN and ensures that the content is synchronized. To support MBMS, logical channels, namely Multicast Traffic Channel (MTCH) and Multicast Control Channel (MCCH), and a transport channel, namely Multicast Channel (MCH), are defined (Figure 5).

Relation between 3GPP Release-8 and Release-9

Five quick videos from Mobile World Congress 2011 - 3

More on HTC Freestyle and Brew OS here.

More on Live translating service here.

Ps: I know there are 6 videos ;)

Five quick videos from Mobile World Congress 2011 - 2

Facebook onto a SIM using Class 2 SMS

I am sure you have already heard of Gemalto's (worlds largest SIM manufacturer and supplier) Facebook on the SIM announcement. The advantage of this approach is that 100% of the existing phones will be able to support facebook (if the operator supports the application on the SIM). This is a big step0 forward. The press release says:

Gemalto’s software development team has embedded the software application into the SIM. This ensures the Facebook application is compatible with 100% of SIM-compliant mobile phones.

The innovative solution provides mobile subscribers with simple and convenient access to core Facebook features such as friend requests, status updates, wall posts or messages. It also offers unique functions: people can sign up for this service and log in directly from the SIM application. Interactive Facebook messages pop-up on the phone’s screen so people can always share up-to-the-minute posts and events. One can also automatically search their SIM phonebook for other friends and send them requests.

Facebook for SIM is extremely easy to use and is available to everyone. No data contract or application download is needed, because the software is embedded in the SIM and it uses SMS technology. As a result, it works for prepaid as well as for pay-monthly customers. Following an initial limited free trial period, Facebook for SIM then operates on a subscription model via an unlimited pass for a given period of time.

“Facebook for SIM enables operators to leverage two of their main assets: the SMS to communicate with the web application and the SIM for application distribution to the masses,” added Philippe Vallée, Executive Vice President, Gemalto. “Over 200 million people already use Facebook on handsets and those are twice as active as non-mobile users . By providing anytime, anywhere availability to the social network, Gemalto delivers on the growing demand for mobile connectivity all over the world.”

An article on the Register had more details:

The SIM-based client isn't as pretty as its smartphone contemporaries – don't expect picture streams or sliding interfaces – but it was developed with the help of Facebook, and provides text-menu-based interaction with Facebook – including status updates, pokes and friend requests – to any GSM-compatible handset through the magic of the GSM SIM Toolkit and Class 2 SMS messages.

The SIM Toolkit is part of the GSM standard and thus supported on just about every GSM handset, from the dumbest PAYG talker to the latest iGear. It allows the SIM to present menu options to the user, collect responses, and pop up alerts when new data arrives, which is all that's necessary for a basic Facebook client.

Modern handsets also allow the SIM to make TCP/IP data connections, but Gemalto is eschewing that for Class 2 SMS to ensure compatibility with the most basic handsets, and networks.

Class 2 SMS messages are delivered direct to the SIM without the user being involved, so can update friends' status messages and deliver a poke or two. The application running on the SIM then prods the handset into alerting the user.

That user's own updates are sent over SMS too, following a status change or wall posting client pastes that into an SMS, which is sent silently on its way.

How, or if, the network operator charges for all those messages flying about isn't clear. Gemalto won't name operators yet but claims to be talking to one operator who reckons that Facebook is eating half its bandwidth, and another who's already working on SIM distribution strategies.

Not that a new SIM is necessarily required – SIMs are field upgradable, though few operators deploy them with sufficient empty space for an application like this and issuing replacement SIMs is probably easier from a marketing point of view.

You can also find some of these details here.

As I have been working on SMS for the last few weeks, I decided to dig a bit deep into what these Class 2 SMS are.

Classes identify the message's importance as well as the location where it should be stored. There are 4 message classes.

Class 0: Indicates that this message is to be displayed on the MS immediately and a message delivery report is to be sent back to the SC. The message does not have to be saved in the MS or on the SIM card (unless selected to do so by the mobile user).

Class 1: Indicates that this message is to be stored in the MS memory or the SIM card (depending on memory availability).

Class 2: This message class is Phase 2 specific and carries SIM card data. The SIM card data must be successfully transferred prior to sending acknowledgement to the SC. An error message will be sent to the SC if this transmission is not possible.

Class 3: Indicates that this message will be forwarded from the receiving entity to an external device. The delivery acknowledgement will be sent to the SC regardless of whether or not the message was forwarded to the external device.

You can also read this for more details on SMS message contents

Five quick videos from Mobile World Congress 2011

Follow the latest action in Mobile World Congress at Twitter here.

Non-Voice Emergency Services (NOVES)

Its been a while we talked about SMS for Emergency purposes and eCall. A new study item in 3GPP has looked at non-voice alternatives for Emergency purposes.

Picture Source: Dailymail

The following is from the recent 4G Americas report entitled: 4G Mobile Broadband Evolution: 3GPP Release-10 and Beyond:

Non-verbal communications such as text messaging and instant messaging via wireless devices has been very successful and continues to expand. Many of the consumers assume that they can utilize these types of non-verbal communications as mechanisms to communicate with emergency services whenever emergency assistance is required. Such mechanisms currently do not exist. The Emergency Services community has a desire to have multimedia emergency services supported with the same general characteristics as emergency voice calls.

Currently, service requirements for emergency calls (with or without the IP Multimedia Core Network) are limited to voice media. The Non-Voice Emergency Services (NOVES) is intended to be an end-to-end citizen to authority communications. NOVES could support the following examples of non-verbal communications to an emergency services network:

1. Text messages from citizen to emergency services

2. Session-based and session-less instant messaging type sessions with emergency services

3. Multimedia (e.g., pictures, video clips) transfer to emergency services either during or after other communications with emergency services.

4. Real-time video session with emergency services

In addition, to support the general public, this capability would facilitate emergency communications to emergency services by individuals with special needs (e.g., hearing impaired citizens).

The objectives of this study include the following questions for NOVES with media other than or in addition to voice:

1. What are the requirements for NOVES?

2. What are the security, reliability, and priority handling requirements for NOVES?

3. How is the appropriate recipient emergency services system (e.g., PSAP) determined?

4. What are the implications due to roaming?

5. Are there any implications to hand over between access networks?

6. Are there any implications due to the subscriber crossing a PSAP boundary during NOVES communications (e.g., subsequent text messages should go to the same PSAP)?

7. Do multiple communication streams (e.g., voice, text, video emergency services) need to be associated together?

8. What types of “call-back” capabilities are required?

9. What are the load impacts of NOVES in the case of a large scale emergency event or malicious use?

NOVES will be applicable to GPRS (GERAN, UTRAN) and to EPS (GERAN, UTRAN, E-UTRAN and non-3GPP). The content may be transmitted between the subscribers and the emergency services which might bring new security issues. Therefore, the security impacts need to be studied.

You can spend your weekend reading the 3GPP Study Item TR 22.871: Study on Non-Voice Emergency Services (Release 11).

A word of caution, the name NOVES may be changed in future as Emergency agencies in Europe have an objection to the name. See here and here.