Core Network

Neda Montazeri
Evolution to 5G
1G 2G 3G 4G 5G

“1980” “1991” “1998” “2008” “2019”

• Speed: 2.4 Kbps • Speed: 64 Kbps • Speed: 2 Mbps • Speed: • Speed: up to 10 Gbps
• Standard: AMPS, • Standard: GSM, • Standard: UMTS/ 1 Gbps when stationary • …
TACS GPRS, EDGE HSPA 100 Mbps when traveling
• Standard: LTE
 2G and 3G
Network Architecture
Circuit Switching (CS)

- Mostly used in the voice call.

- Whenever a call is being made, a dedicated logical
link needs to be established. Packet Switching (PS)
- Network resource is allocated and reserved for the
subscriber for entire duration of the call.
- Mostly used in the packet data connection. (internet browsing)
- Whenever an MS sends or receive data, data is organized into
packet and each packet has source/destination ID.
2G and 3G Core Nodes
 is the user traffic that contain the conversation between 2 or more user peers.
User
Plane Carried over the core network as a bearer
Example: Voice call or browsing data traffic through GPRS

is signaling communication used to control the bearer traffic.

Control
Plane Involving of sending and receiving message between 2 nodes.
Example: Communication between SGSN and HLR.
 User Plane
Control Plane Circuit Core Domain

Nc
MSS/VLR MSS/VLR

Mc Mc

A Nb
MGW MGW
PSTN/
BSC Other
Abis
PLMN
BTS C/F/E

GERAN
Iu-CS SMSC
HLR EIR

MS Charging Center
Gb
RNC
IuB

NodeB Gr/Gf/Gd/Gs Gc
Iu-PS
UTRAN
Gn Gi Packet
SGSN GGSN Data
Network
Packet Core Domain
A simplified 2G/3G PS call flow (1/3)
A simplified 2G/3G PS call flow (2/3)
A simplified 2G/3G PS call flow (3/3)
 4G
Network Architecture
4G Core Nodes
 S1-MME
S6a

S11
LTE X2
-Uu
S1-U

Gx Rx
Gxc
S1-MME
Operator’s
IP Service
S1-U S5 SGi

Control Plane
User Plane
A simplified 4G PS call flow (1/2)
A simplified 4G PS call flow (2/2)
Attach Procedure
in LTE
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN
RRC Connection
Request
RRC Connection
Response Setup

RRC Connection

1. Attach Request GUTI=GUMMEI+M-TMSI

(IMSI or old GUTI, LAST TAI)
RRC Connection
Setup Complete 2. Attach Request GUMMEI=MCC+MNC+MMEI
(IMSI or old GUTI, LAST TAI) MMEI=MMEGi+MMEC
S1 Initial UE
Message
S1 Signaling
Connection

ECM Connection

ECM- ECM-
Connected Connected

EMM- EMM-
Registered Registered
Attach Request:

1- The UE sends the Attach Request message to the eNodeB. The message contains
IMSI or old GUTI(Globally Unique Temporary ID), last visited TAI (if available), UE
Core Network Capability, Attach Type, and ESM message container (Request Type,
PDN Type, Protocol Configuration Options, and Ciphered Options Transfer Flag).

2- The eNodeB finds the MME based on the RRC(Radio Resource Control) parameter
carrying the old GUMMEI and Selected Network. If the MME does not connect to
the eNodeB or the old GUMMEI is unavailable, the eNodeB selects an MME by using
the MME selection function. The eNodeB forwards the Attach Request message to
the new MME.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN

3. Identification Request/Response
(Old GUTI)/(IMSI)
Type of identity:

4. Identity Request/Response 0 0 1: IMSI

(Type of Identity: IMSI)/(Mobile identity: IMSI) 0 1 0: IMEI
0 1 1: IMEISV
1 0 0: TMSI/P-TMSI/M-TMSI
1 0 1: TMGI and optional MBMS
5a. Authentication/Security Session Identity
(RAND,AUTN)/(RES) 0(IMSI,SNI,Type)/(RAND,AUTN,XRES,K
0 0: No Identity (note 1) ASME)
All other values are reserved.

5b. Identity Request/Response

(Type of Identity: IMEI)/(Mobile identity: IMEI)

5b. ME Identity Check

(ME Identity,IMSI)/(Ack or Not Ack)
 Note: Authentication Procedure
1. MME initiate authentication data request message to
HSS, this message shall include the IMSI, the Serving
Network identity i.e. MCC+MNC, and the Network Type
UE MME HSS (i.e. E-UTRAN).

1. Authentication Data Req 2. Upon the receipt of the authentication data request from the MME,
the HSS sends an authentication response back to the MME that
(IMSI,SNI,Type) contains the requested information. If multiple EPS authentication
vectors had been requested then they are ordered based on their
sequence numbers. The MME shall be aware of the order of the EPS
2. Authentication Data Res authentication vectors and shall use that the EPS authentication
(RAND,AUTN,XRES,KASME) vectors in order.

3. The MME sends to the USIM the RAND and an authentication token
3. User Authentication Req AUTN for network authentication.
(RAND,AUTN)
4. At receipt of this message, the USN shall verify the authentication
vector by checking whether AUTN can be accepted. The MME checks
4. User Authentication Res that the RES equals XRES. If so the
authentication is successful. If not, depending on type of identity used
(RES) by the UE in the initial NAS message, the MME may initiate further
identity requests or send an authentication reject message towards
the UE
Authentication & Identification
3- Optional: If the UE identifies itself by using the GUTI and attaches to a different MME after detach, the new
MME obtains the old MME/SGSN address by using the GUTI and sends the Identification Request message to
the old MME/SGSN to request for the subscriber IMSI. The message contains old GUTI and complete Attach
Request message. The old SGSN/MME sends the Identification Response message to the new MME.

4- Optional: If UE information does not exists on the old SGSN/MME or new MME, the new MME sends a
Identity Request message to the UE to request for the IMSI.

5- Optional: The authentication policy determines whether authentication is required.

5a. If integrity of the Attach Request message in 1 is not protected or the integrity check fails, an
authentication procedure is required.
5b. The MME obtains the IMEI from the UE by using the Identity Request message. The IMEI must be
encrypted for transmission. The MME can send the ME Identity Check Request message to the EIR. The
message contains ME Identity and IMSI. The EIR returns the result by using the ME Identity Check Ack
message. Based on the returned result, the MME determines whether to continue the attach procedure or
reject the attach request initiated by the UE.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN

6. Ciphered Options Request/Response

(Security mode)/(Ciphered Options)

7. Delete Session Request

(LBI)

7. PCRF Initiated IP-CAN

Session Termination

7. Delete Session Response

(Cause value)
Ciphering
6- Optional: This message is sent by the network to the UE to establish NAS signaling security. If the UE configures the Ciphered
Options Transfer Flag in the Attach Request message, the MME can send the Ciphered Options Request message to the UE to request
for Ciphered Options such as PCO(Protocol Configuration Options) and APN. When the UE subscribes to services of multiple PDNs, if
the PCO contains subscriber identification (such as subscriber name and password in the PAP/CHAP parameter), the UE must return
the APN in the Ciphered Options Response message.

7- Optional: If active bearer contexts of the UE exist on the new MME (for example, the UE reattaches to the same MME when the
detach is not completed), the new MME sends the Delete Session Request message to the related GW to delete the bearer contexts.
The message contains LBI(linked EPS bearer identity). The GW replies with the Delete Session Response message. The message
contains Cause. If the PCRF is deployed, the P-GW initiates the IP-CAN(IP-connectivity access network) session termination procedure
to notify the PCRF that resources have been released.

NOTE(1):
When a subscriber accesses the network, the policy and charging enforcement function (PCEF) sends an IP-CAN session establishment request to the
UPCC. The UPCC approves the request and activates the predefined rules on the PCEF.
When the status of the subscriber changes to Frozen, the UPCC sends an IP-CAN session termination request to the PCEF.
Each IP-connectivity access network (IP-CAN) session lasts 30 minutes.

NOTE(2):
The LBI is the ID of the default bearer of the UE.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN
8. Update Location Request
(MME Identity, IMSI, ME Identity)

9. Cancel Location
(IMSI and Cancellation Type)

9. Cancel Location Ack

(Ack or Not Ack)

10. Delete Session Request

(LBI)
10. PCRF Initiated IP-CAN
Session Termination
10. Delete Session Response
(Cause)

11. Update Location Ack

(IMSI and Subscription Data)
Update Location
8- Optional: After the detach, if the UE attaches to a different MME on which no valid subscription context of the UE exists or
the IMEI is changed (for example, the subscriber changes the mobile phone), the MME sends the Update Location Request
message to the HSS. The message contains MME Identity, IMSI, ME Identity, and MME Capabilities.

9- Optional: The HSS sends the Cancel Location Request message to the old MME. The message contains IMSI and
Cancellation Type. The old MME returns the Cancel Location Answer message to the HSS (including the IMSI) and deletes the
MME context and bearer context.

10- Optional: If active bearer contexts of the UE exist on the old MME/SGSN, the old MME/SGSN sends the Delete Session
Request message to the related GW to delete the bearer contexts. The message contains LBI. The GW replies with the Delete
Session Response message. The message contains Cause. If the PCRF is deployed, the P-GW initiates the IP-CAN session
termination procedure to notify the PCRF that resources have been released.

11- Optional: The HSS sends the Update Location Answer message to the new MME. The message contains IMSI and
Subscription Data. The subscription data contains one or multiple PDN subscription contexts. Each PDN subscription context
contains an EPS subscribed QoS profile and the subscribed APN-AMBR. If the UE accesses the network by using an
unsubscribed APN or the HSS rejects the Update Location request, the new MME rejects the attach request of the UE.

NOTE:
The Insert Subscriber Data procedure is deleted in the MME mobility management. The MME constructs contexts for the UE by using
the subscription data in the Update Location Ack message.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN
12. Create Session Request
(IMSI,MSISDN,IMEI,PDN GW Address,APN,RAT(Radio Access Technology) Type)

13. Create Session Request

(IMSI,MSISDN,IMEI,PDN GW Address,
APN,RAT(Radio Access Technology) Type)
Create Session Request

12- The MME activates the default bearer by using the APN carried in the Attach Request message or
the default APN for subscription. The MME selects a P-GW based on the APN configuration, selects the
S-GW based on the network topology, and allocates an EPS bearer ID for the default bearer. Then the
MME sends the Create Session Request message to create the default bearer. The message contains
IMSI, MSISDN, MME TEID for control plane, PDN GW address, PDN Address, APN, radio access
technology (RAT) type, and Default EPS Bearer QoS.

13- The S-GW creates a new EPS bearer in the EPS bearer list and sends the Create Session Request
message to the P-GW based on PDN GW address carried in 12. The message contains IMSI, MSISDN,
APN, Serving GW Address for the user plane, Serving GW TEID of the user plane, Serving GW TEID of the
control plane, RAT type, and Default EPS Bearer QoS. The S-GW then caches all downlink data packets
sent from the P-GW and forwards the data packets after obtaining the eNodeB TEID from the Modify
Bearer Request message in 23.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN

14a. CCR-I
(Credit Control Request-Initial)
(IMSI,MSISDN)

14b. Policy Decision

14c. CCA-I
(Credit Control Answer-Initial)
(PCC rules and event triggers )
Credit Control
14- Optional: If dynamic PCC(Policy and Charging Control) is enabled, the P-GW initiates the IP-CAN session establishment
procedure to obtain the default PCC rules for the UE. If dynamic PCC is disabled, the P-GW uses the locally configured
policies.

14a. The P-GW sends the CCR-I message to the PCRF to instruct the PCRF to create the IP-CAN session.
14b. The PCRF performs authorization and policy decision-making.
14c. The PCRF returns the CCA-I message to the P-GW, carrying the selected IP-CAN bearer establishment mode.

NOTE:
The PCRF may provide the default charging mode and the following information:
- PCC Rules: executable policies related to the IP-CAN sessions
- Event Triggers: events that the P-GW must report to the PCRF
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN

15. Create Session Response

(PDN GW Address for the user plane,PDN GW TEID of the user plane,PDN GW TEID of
the control plane,PDN Type,PDN Address,EPS Bearer Identity)

First Downlink Data (If Not Handover)

16. Create Session Response

(PDN GW Address for the user plane,PDN GW TEID of the user plane,PDN
GW TEID of the control plane,PDN Type,PDN Address,EPS BearerIdentity)
Create Session Response
15- The P-GW creates a new EPS bearer in the EPS bearer context list and
generates a new charging ID. The P-GW can forward the user-plane PDU
between the S-GW and PDN, and starts charging. The P-GW returns the Create
Session Response message to the S-GW. The message contains PDN GW
Address for the user plane, PDN GW TEID of the user plane, PDN GW TEID of
the control plane, PDN Type, PDN Address, EPS Bearer Identity, and EPS Bearer
QoS.

16- The S-GW returns the Create Session Response message to the new MME.
The message contains the PDN Type, PDN Address, Serving GW address for
User Plane, Serving GW TEID for User Plane, Serving GW TEID for control
plane, EPS Bearer Identity, EPS Bearer QoS, and PDN GW addresses and TEIDs.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN
17. Attach Accept
(New GUTI)
S1 Initial Context
Setup Request
18. Attach Accept (E-RAB)
(EPS Radio Bearer ID)
RRC Connection
Reconfiguration

19. RRC Connection Reconfiguration Complete

(Complete Msg)

20. S1 Initial Context Setup Response

(eNodeB TEID, Address used for S1-U downlink transmission)

21. Direct Transfer

(Attach Complete Msg)

22. Attach Complete

(EPS Bearer Identity,NAS sequence number)

EMM- EMM-
Registered Registered
 Attach Accept/Complete
17- The new MME sends the Attach Accept message to the eNodeB to request the establishment of radio
resources. The Attach Accept message is contained in the SI-MME control message Initial Context Setup Request. If
a new GUTI is allocated for the new MME, the new GUTI is sent by using the Attach Accept message.

18- The eNodeB sends the RRC Connection Reconfiguration to the UE to allocate the air interface resources. The
RRC Connection Reconfiguration message carries the EPS radio bearer ID and carries the Attach Accept message for
the UE.

19- The UE sends the RRC Connection Reconfiguration Complete message to the eNodeB.

20- The eNodeB sends the Initial Context Setup Response message to the new MME, carrying the eNodeB TEID and
the address used for S1-U downlink transmission.

21- The UE sends the Direct Transfer message to the eNodeB, carrying the Attach Complete message.

22- The eNodeB forwards the Attach Complete message to the new MME. The message contains EPS Bearer
Identity, NAS sequence number, and NAS-MAC.
 Old
eNode New
UE MME/ EIR S-GW P-GW PCRF HSS
B MME
SGSN

First Uplink Data

23. Modify Bearer Request

(EPS Bearer Identity,eNodeB address,eNodeB TEID, and Handover Indication)

23a. Modify Bearer Request

(EPS Bearer Identity,eNodeB address,
eNodeB TEID, and Handover Indication)

23b. Modify Bearer Response

(EPS Bearer Identity)

24. Modify Bearer Response

(EPS Bearer Identity)

First Downlink Data

25. Notify Request

26. Notify Response
Modify Bearer
After sending the Attach Complete message and obtaining a PDN address, the UE sends uplink data packets
to the eNodeB connected to the S-GW and P-GW.
23- The new MME sends the Modify Bearer Request message to the S-GW. The message contains EPS Bearer
Identity, eNodeB address, eNodeB TEID, and Handover Indication.
23a. If the message carries Handover Indication, the S-GW sends the Modify Bearer Request message to the
P-GW. The message contains Handover Indication and instructs the P-GW to send the data packets from the
non-3GPP network to the 3GPP IP access system through tunnels and forward the data packets of the
created default or dedicated bearers to the S-GW.
23b. The P-GW returns the Modify Bearer Response message to the S-GW.
24- The S-GW returns the Modify Bearer Response message to the new MME. The message contains EPS
Bearer Identity.
After receiving the eNodeB TEID, the S-GW sends the cached downlink data packets.
25- Optional: After receiving the Modify Bearer Response message, the MME needs to send the Notify
Request message to the HSS, carrying the APN, P-GW Identity, and PLMN information of the P-GW if the
following conditions are met: The request type is not handover, the UE can be handed over to non-3GPP
access in the subscription data, and the MME does not select the P-GW in the PDN subscription context
specified by the HSS.
26- Optional: The HSS stores the flag pairs of the APN and P-GW and sends the Notify Response message to
the MME.
MTN Core Topology
R6,R7,R9
Thanks
Neda Montazeri