LTE-VoLTE Workshop

AUP - Amdocs LTE team

2019
Agenda
 LTE
 Introduction & Architecture  Field Measurement KPI Classification
 Radio Interface description  Typical Measurement KPI LTE (Accessibility/Drop/Usage/Mobility)
 Logical Channels
 NQI definition & components description
 MIMO description (QDA/QDR/Retention/QDE/Availability)
 LTE Bearer (Radio, Dedicated, Defaults)
 LTE Optimization (meaning/examples)
 Call Setup (PRACH, SRB, RRC, Data Radio Bearer)
 Mobility & connection states
 HandOver procedures (intra/inter X2/S1/IRAT)
 Metric Definitions (RSSI, RSRP, RSRQ, SINR…)

 VoLTE in LTE
 Introduction & Architecture  IMS Architecture
 Definition of CSFB, SVLTE, VoLTE and OTT  VoLTE call setup: Initial attach and default EPS bearer creation
 SRVCC definition
 SIP (Session initiation protocol)
 Volte Architecture
 IMS SIP registration call flow

Information Security Level 2 – Sensitive

2 © 2017 – Proprietary & Confidential Information of Amdocs
LTE and UMTS comparison (1/2)
UMTS LTE
Core Network
CS and PS PS
Domains
Flat Architecture No (includes RNC) Yes

5MHz
10MHz with 2 carrier HSDPA capability (3GPP release 8)
Channel Bandwidth 10MHz with 2 carrier HSUPA capability (3GPP release 9)
1.4, 3, 5, 10, 15, 20MHz
20MHz with 4 carrier HSDPA capability (3GPP release 10)

Multiple Access WCDMA OFDMA/ SC-FDMA

Frequency Re-Use Re-use of 1 Re-use of 1

Yes for DCH and HSUPA

Soft Handover Support No for HSDPA
No

Fast Power Control Yes for DCH and HSUPA

No, slower power control used for uplink
Support No for HSDPA

QPSK for DCH

Uplink Modulation 16QAM for HSUPA
QPSK, 16QAM, 64QAM

QPSK for DCH

Downlink Modulation 16QAM and 64QAM for HSDPA
QPSK, 16QAM, 64QAM, 256QAM

Adaptive Modulation Yes for HSDPA and HSUPA Yes

Information Security Level 2 – Sensitive

3 © 2017 – Proprietary & Confidential Information of Amdocs
LTE and UMTS comparison (2/2)

UMTS LTE

Uplink MIMO No No

Downlink MIMO 2x2 for HSDPA 2x2 and 4x4

Peak Uplink 85Mbps (20MHz channel, 64AQM, Coding Rate 1,

23Mbps (10MHz channel, 16QAM, Coding rate 1)
Throughput normal cyclic prefix, 2PUCCH Resource Blocks per slot)

Peak Downlink 325Mbps (20MHz channel, 64QAM, 4x4 MIMO, Coding

86Mbps (10MHz channel, 64QAM, 2x2 MIMO,
Throughput Coding rate 1, 15 HS-PDSCH codes per carrier)
rate 1, normal cyclic prefix, 1 PDCCH symbol per sub
frame)

No for DCH
Hybrid ARQ Support Yes for HSDPA and HSUPA
Yes

No for DCH
BTS Scheduling Yes for HSDPA and HSUPA
Yes

Neighbor planning Yes No if ANR capability is supported

Scrambling Code
Yes No
Planning
Physical Layer Cell
No Yes
Identity Planning

Information Security Level 2 – Sensitive

4 © 2017 – Proprietary & Confidential Information of Amdocs
Evolution of Network Architecture

CS and PS
TDMA
BSC Core Network

CS and PS
WCDMA
RNC Core Network

Only IP PS
OFDMA network Core Network

Information Security Level 2 – Sensitive

5 © 2017 – Proprietary & Confidential Information of Amdocs
LTE and UMTS functional architecture differences
PDN GateWay Serving GateWay

PGW
GGSN (only user plane functions)
SGW
Mobility Management Entity

SGSN MME
(not user plane
functions)
RNC

Control plane and user plane

split for better scalability
between MME and gateways

RNC functions
moved to eNodeB

Information Security Level 2 – Sensitive

6 © 2017 – Proprietary & Confidential Information of Amdocs
UTRAN Long Term Evolution
Radio Access Network – E-UTRAN Evolved Packet Core (EPC)

S1-MME

S6a

X2 S1-MME
eNB HSS
MME PCRF

S11 S7

eUu
to PDN
S1-U S5/S8 (Pocket Data Network)
Serving PDN
eNB Gateway Gateway

Information Security Level 2 – Sensitive

7 © 2017 – Proprietary & Confidential Information of Amdocs
Evolved Node B (eNB) functions
• Physical layer and Radio Resource Management (bearer control,
mobility control, scheduling)
• Ciphering and integrity protection for the air interface
• MME selection if necessary
• Exchange of crucial cell-specific data to other base stations
(eNBs)
• User Plane data transfer to and from serving gateway S1-MME
• Transmission of messages coming from MME and to MME
(broadcast, paging) MME
• Collection and evaluation of the measurements eNB
X2 S1-U
X2-CP interface – allows signaling between eNodeB
X2-UP interface – allows the transfer of application data between eNodeB
S1-U interface – allows application data transfer through the Serving Gateway
Serving
S1-MME interface – allows signaling with the MME
Gateway

eNB

Information Security Level 2 – Sensitive

8 © 2017 – Proprietary & Confidential Information of Amdocs
Mobility Management Entity (MME) functions
• UE attach and detach procedures control
• Signaling for transport bearers setup and release control HSS
• Authentication and integrity protection control
• Tracking Area (TA) updates control S6a
• Paging control
• Roaming control S1-MME

S11 interface – allows signaling information for mobility MME

and bearer management to be transferred
S11
S6a interface – allows signaling with Home Subscriber
Server (HSS – evolution of HLR) eNB
S1-MME interface – allows signaling with the eNodeB

Serving
Gateway

Information Security Level 2 – Sensitive

9 © 2017 – Proprietary & Confidential Information of Amdocs
E-UTRAN Air Interface
OFDMA / SC-FDMA MIMO

OFDMA

SC-FDMA
TX1 / TX2 RX1 / RX2

Frequency Division Duplexing (FDD) Time Division Duplexing (TDD)

f1
f1 (DL)
DL UL DL UL
f2 (UL)

Information Security Level 2 – Sensitive

10 © 2017 – Proprietary & Confidential Information of Amdocs
OFDM (Orthogonal Frequency Division Multiplexing)
 Available bandwidth (frequency spectrum) is divided into many overlapping
subcarriers (multi-carrier transmission)
 All subcarriers are orthogonal to each other (FFT property)
 Single subcarrier can carry only one modulated and coded symbol
 Subcarrier spacing is determined by the sampling frequency and FFT size
 Constant spacing for all bandwidth configurations in LTE

FFT size and sampling frequency depends on the

bandwidth configurations in order to keep the
constant subcarrier spacing.
Sampling is an integer multiple of 3.84 MHz
(WCDMA symbol sampling)

Information Security Level 2 – Sensitive

11 © 2017 – Proprietary & Confidential Information of Amdocs
 OFDM versus conventional FDM
• OFDM allows a tight packing of small carrier - called the subcarriers - into a given frequency
band.
Power Density

Power Density
Saved
Bandwidth

Frequency (f/fs) Frequency (f/fs)

Information Security Level 2 – Sensitive

12 © 2017 – Proprietary & Confidential Information of Amdocs
Orthogonal Frequency Division Multiple Access (OFDMA)
OFDMA is a multi-user version of OFDM
scheme. OFDMA allows multiple users to
transmit simultaneously on different sub-
carriers per OFDM symbol.
Subcarriers are orthogonal to each
other in the system. OFDMA is used for
downlink direction, for uplink direction
SC-FDMA is used in LTE.
Characteristics of OFDMA system:

LTE Radio Frame duration = 10ms

Sub-frame duration = 1ms
Time Slot duration = 0.5ms
Symbol duration = 0.5ms / 7 or 0.5ms / 6
Symbol count = 7 in normal CP, 6 in extended CP
Subcarrier bandwidth = 15 KHz
Subcarrier count in one PRB = 12

LTE Radio Frame consists of = 10*Subframe =

20*TimeSlot = 140*Symbols
Information Security Level 2 – Sensitive
13 © 2017 – Proprietary & Confidential Information of Amdocs
Single-carrier frequency division multiple access (SC-FDMA)
The SC-FDMA scheme has been selected
as the multiple-access scheme of the LTE
uplink.
SC-FDMA and OFDMA are similar schemes
except for a discrete Fourier transform
which is added to the SC-FDMA
transmission which changes the way how
the data symbols are distributed over
different subcarriers.
The data symbols-subcarrier mapping is
not one-to-one but instead each
subcarrier carries a part from each data
symbol transmitted at that time instant.

The reason for the selection of SC-FDMA comes mainly from its
advantage to provide low a peak-to-average power ratio (PAPR) for
the transmit waveform. This results in less power consumption in the
mobile station compared to an OFDMA transmission
Information Security Level 2 – Sensitive
14 © 2017 – Proprietary & Confidential Information of Amdocs
 LTE Radio Frames - FDD mode
Radio Frame – 10ms

0 1 2 3 16 17 18 19
Frequency (subcarriers)

Subcarrier
0 1 2 3 16 17 18 19 frequency –
180KHz

Cyclic Prefic (CP) is used to avoid the

Sub-frame – 1ms Slot– 0,5ms interference occurred by multipath fading.

0 1 2 3 4 5 6 The number of Symbols per Slot (0.5ms)

could be 6 or 7 depending on the Cyclic
Prefix length

Symbols
Cyclic Prefix

Time (radio frames)

Information Security Level 2 – Sensitive

15 © 2017 – Proprietary & Confidential Information of Amdocs
LTE OFDM symbol: 66.67µs (1/15kHz)
LTE resource grid
• PRB is defined as consisting of 12 consecutive subcarriers for one slot (0,5ms)
• PRB is the smallest element of resource allocation assigned by the eNB scheduler
• NRB DL defines the numer of resources blocks used in the DL

Subcarrier 0 1 2 3 4 5 6 0 1 2 3 4 5 6

1 0 1 2 3 4 5 6 0 1 2 3 4 5 6

0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6

KHz
180
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
0 1 2 3 4 5 6 0 1 2 3 4 5 6
Subcarrier
Resource
12 1 slot 1 slot Element
Information Security Level 2 – Sensitive
1 ms subframe
16 © 2017 – Proprietary & Confidential Information of Amdocs
 Logical, transport and physical channels
Upper Layers

DL UL

Radio link control (RLC)

MCCH

MTCH
CCCH

DTCH
BCCH

PCCH

DCCH

CCCH

DCCH
DTCH
What Logical channels
type of Information

DL-SCH Medium Access Control (MAC)

MCH

UL-SCH
BCH

PCH

How this information

RACH
Transport channels
is transported

PHY

PCFICH

PDCCH
PDSCH

PHICH

PMCH
Where to send
PBCH

PUCCH
PRACH

PUSCH
this information

Information Security Level 2 – Sensitive Air interface

17 © 2017 – Proprietary & Confidential Information of Amdocs
Logical Channels in LTE
Logical Channel
• type of information;
• MAC priority;
• UE identification;

Control Channel Traffic Channel

• signaling info (RRC); • user plane data (IP)

BCCH DCCH DTCH MTCH

• broadcast control ch.;
• system information; • dedicated control ch.; • dedicated traffic • multicast traffic ch.;
• downlink only; • dedicated RRC signaling channel; • MBMS traffic for broadcast
with one UE; • IP user plane data; or multicast MBMS services;
• bi-directional; • bi- or uni-directional; • downlink only;
PCCH
• paging control ch.;
• paging message for
LTE_IDLE UE;
• downlink only;

CCCH
• common control ch.;
• initial access signaling for
RRC_IDLE UE;

MCCH
• multicast control ch.;
• MBMS
Information Securitycontrol
Level 2 – information
Sensitive
18 © 2017 for
– Proprietary
MTCH;& Confidential Information of Amdocs
• downlink only;
Transport Channels in LTE
Transport Channel (TrCH)

• transfer characteristics:
• delay, collision risk;
• supported block sizes and number of blocks;
• support for HARQ;
• support for beam-forming;
• support for DRX/DTX;
• coding (reliability);
Downlink TrCH • static | dynamic resource allocation; Uplink TrCH
• support for QPSK, 16QAM, 64QAM;

BCH RACH
• broadcast channel; • random access channel;
• carries BCCH; • carries no logical channel;
• only for initial L1 access
PCH request;

• paging channel;
UL-SCH
• carries PCCH;
• uplink shared channel;
MCH • carries CCCH, DCCH, DTCH;
• supports HARQ;
• multicast channel;
• carries MTCH, MCCH;

DL-SCH
• downlink shared channel;
• carries DCCH, DTCH, BCCH,
Information Security Level 2 – Sensitive
19 MTCH, MCCH;
© 2017 – Proprietary & Confidential Information of Amdocs
• supports HARQ;
Physical Channels in LTE Physical Channels / Signals
• set of OFDM/SC-FDMA resource elements;
• carry higher layer data (physical channel PhyCH) or
• used internally by L1 (physical channel/signal);

Downlink PhyCH Downlink Signal Uplink Signals Uplink PhyCH

PBCH DL reference signal Demodulation ref. signal PUSCH

• physical broadcast ch.; • pre-defined 2-dimensional • pre-defined sequence • phys. UL shared channel;
• carries BCH (BCCH); orthogonal/pseudo-noise sent along with • carries UL-SCH;
sequence; PUSCH/PUCCH
• used for DL channel • used for uplink channel PUCCH
PDSCH estimation, demodulation; estimation, demodulation;

• phys. DL shared channel; • phys. UL control channel;

• carries PCH and DL-SCH;
DL synch. signal Sounding ref. signal • L1 information
• 1 of 3 pre-defined • pre-defined (long)
PMCH sequences (Zadoff-Chu); sequence sent alone;
• associated with cell-id; • used by NW to optimize
PRACH
• phys. multicast channel; • used for cell detection and channel dependent • phys. random access
• carries MCH; initial time/phase synch.; scheduling; (channel);
• carries RACH (access
request preamble);
PDCCH • [in TS 36.211 referenced
as signal, not as channel]
• phys. DL control channel;
• L1 control information
(scheduling assignments);

PCFICH
• phys. control format
indicator channel
• L1 control information (no.
of ODFM symbols used for
PDCCH);

Information Security Level 2 – Sensitive

20 © 2017 – Proprietary & Confidential Information of Amdocs
Downlink Reference Signal
 DL Reference Signal is spread over the whole bandwidth
 Pilot signal is necessary to perform channel estimation and demodulation (e.g. CPICH in WCDMA)
 Channel estimation in LTE is based on reference signals – CQI, RSRP(Reference Signal Received Power),
RSRQ (Reference Signal Received Quality)
 Reference signals position in time domain is fixed (0 and 4 for Type 1 Frame) whereas in frequency domain it
depends on the Cell ID
 In case more than one antenna is used (e.g. MIMO) the Resource Elements allocated to reference signals
on one antenna are DTX on the other antennas
 Reference signals are modulated to identify the cell to which they belong

Resource Elements allocated to Reference Signals cannot be

used for anything else → overhead
- If 1 Tx antenna*: 4 RSs per PRB
- If 2 Tx antenna*: there are 8 RSs per PRB
- If 4 Tx antenna*: there are 12 RSs per PRB

Information Security Level 2 – Sensitive

21 © 2017 – Proprietary & Confidential Information of Amdocs
 Information Security Level 2 – Sensitive
22 © 2017 – Proprietary & Confidential Information of Amdocs
Planificación de PCI – MOD3(PCI)
 PCI (Physical Cell ID) en el movil es determinado por la decodificación de PSS y SSS (Primary and Secondary Synchronizacion
Signal) y calculado PCI=3*SSS+PSS
 SSS con rangos de 0 a 167 Se puede ver gráficamente que
hay muchos sectores con
 PSS con rangos de 0 a 2
colisión PCI [MOD3(PCI)]
 Entonces el rango de valores para PCI es de 0 a 503
 La regla de modulo 3 para el PCI Planning reduce todos los PCI en 3 grupos [Mod3(PCI)] en 0,1 o 2 respectivamente
 Para evitar colisiones e interferencia que reduzca el DL throughput, en orden de prioridades se debe cumplir
 Evitar asignar mismo PCI a celdas vecinas
 Evitar asignar mismo Mod3 (PCI) a celdas vecinas
 Evitar asignar mismo Mod6 (PCI) a celdas vecinas
 Evitar asignar mismo Mod30 (PCI) a celdas vecinas

 En distribuciones de azimuts no homogéneas,

se suele utilizar una aproximación:
 PSS=0, sector Alpha (sector mas próximo a AZ 0 grados)

 PSS=1, sector Beta

 PSS-2, sector Gamma

Information Security Level 2 – Sensitive

23 © 2017 – Proprietary & Confidential Information of Amdocs
 MIMO
MIMO Overview
Data Transmission Number of Antennas Number of Users

Pre-Coding SISO SU-MIMO

(beamforming) (Single Input Single Output) (Single User MIMO)
single data stream sent over
multiple input antennas

pre-coding
MISO
(Multiple Input Single Output)
X …

Spatial Multiplexing
multiple data stream sent over SIMO
multiple input antennas (Single Input Multiple Output) MU-MIMO
pre-coding

X1
…
… …
…
Xn
MIMO
(Multiple Input Multiple Output)
Diversity Coding
single data stream sent over
multiple input antennas … …
with different coding
e.g. CDMA soft handover
Information Security Level 2 – Sensitive
24 © 2017 – Proprietary & Confidential Information of Amdocs
MIMO Overview

Information Security Level 2 – Sensitive

25 © 2017 – Proprietary & Confidential Information of Amdocs
MIMO– Rank Indicator

Baja utilización de Rank Indicator 2 de 34% en

las celdas ofensoras comparadas con un 53%
de las celdas con buena eficiencia, denotan
malas condiciones de radio reportadas por el
UE.

RANK1 significa que el UE está

viendo una buen SINR solo en
una de sus antenas de
recepción, por lo que le
solicita al eNodeB que baje el
modo de transmisión a una
sola antena o transmita
diversidad. Un RANK2 del UE
significa un buen SINR en
ambos puertos de antena y
eNodeB puede transmitir
MIMO (Spatial Multiplexing).
Information Security Level 2 – Sensitive
26 © 2017 – Proprietary & Confidential Information of Amdocs
Dynamic MIMO Switching

Se sugiere disminuir los umbrales de Dynamic MIMO Switching

(OL y CL) para aumentar la utilización de 2 Code Words Mode o
activar fast adaptive MIMO switch (actFastMimoSwitch).

Information Security Level 2 – Sensitive

27 © 2017 – Proprietary & Confidential Information of Amdocs
 DL PDSCH – Traffic channel
• The Physical Downlink Shared Channel (PDSCH) is the main data-bearing
downlink channel in LTE
• It is used for all user data, as well as for broadcast system information
which is not carried on the PBCH, and for paging messages – there is no
specific physical layer paging channel in the LTE system dlMimoMode PDSCH Transmission Scheme TMs involved in
PDSCH

There are the following mode in case of PDSCH: SingleTX Single stream TM1

2-way TXDiv Transmit Diversity using 2 TM2

•Transmission Mode 1: Transmission from a single eNodeB antenna port transmit antennas
•Transmission Mode 2: Transmit diversity 4-way TXDiv Transmit Diversity using 2 TM2
transmit antennas
•Transmission Mode 3: Open-loop spatial multiplexing
Static Open Open Loop MIMO using 2 TX TM3
•Transmission Mode 4: Closed-loop spatial multiplexing Loop MIMO antennas
•Transmission Mode 5: Multi-user Multiple-Input Multiple-Output (MIMO) (2x2)

•Transmission Mode 6: Closed-loop rank-1 precoding Dynamic Open Open Loop MIMO using 2 TX TM2, TM3
Loop MIMO antennas
•Transmission Mode 7: Transmission using UE-specific reference signals (2x2)
dlMimoMode : Downlink MIMO mode Closed Loop Closed Loop MIMO using 2 TX TM4
SingleTX (0), MIMO (2x2) antennas
2-way TXDiv (10), Closed Loop Closed Loop MIMO using 4 TX TM4, TM2
4-way TXDiv (11), MIMO (4x2) & antennas
Static Open Loop MIMO (2x2) (20), (4x4)
Dynamic Open Loop MIMO (2x2) (30), Single Stream Single stream beamforming TM7, TM2 (TM3*)
Closed Loop MIMO (2x2) (40), Beamforming
Closed Loop MIMO (4x2) (41), & Closed Loop MIMO (4x4) (43)
Information Security Level 2 – Sensitive Dual Stream Dual stream beamforming TM8, TM2 (TM3*)
28 © 2017 – Proprietary & Confidential Information of Amdocs Beamforming
 MCS Index Modulation TBS Index

MCS for PDSCH

I MCS Order Qm I TBS
0 2 0
1 2 1
2 2 2
3 2 3
4 2 4 QPSK
 29 MCS’s defined for PDSCH (MCS0 –
5 2 5
6 2 6
MCS28) (table Table 7.1.7.1-1) 7
8
2
2
7
8

 Four modulation schemes possible:

9 2 9
10 4 9
QPSK, 16QAM, 64QAM, 256QAM 11 4 10
12
13
4
4
11
12
16QAM
 TBS index refers to TBS table in 3GPP 14 4 13
TS36.213 (Table 7.1.7.1-1 is for the UE 15
16
4
4
14
15
which does not support 256 QAM and 17 6 15
18 6 16
Table 7.1.7.1-1A is for the UE which 19 6 17
support 256 QAM) 20
21
6
6
18
19
22 6 20 64QAM
 Note, 256QAM currently supported. 23 6 21
24 6 22
256QAM 25 6 23
26 6 24
27 6 25
28 6 26
29 2
30 4
Information Security Level 2 – Sensitive 31 6 reserved
29 © 2017 – Proprietary & Confidential Information of Amdocs
 MCS Index Modulation TBS Index Redundancy

MCS for PUSCH

Order Version
rvidx
0 2 0 0
1 2 1 0
2 2 2 0
3 2 3 0
 29 MCS’s defined for PDSCH (MCS0 – MCS28) 4 2 4 0
5 2 5 0 QPSK
 Three modulation schemes possible: QPSK, 6
7
2
2
6
7
0
0
16QAM, 64QAM 8 2 8 0
9 2 9 0
 TBS index refers to TBS table in 3GPP TS36.213 10
11
2
4
10
10
0
0
(table 7.1.7.2.1-1) 12 4 11 0
13 4 12 0
14 4 13 0
15 4 14 0
16 4 15 0
16QAM
17 4 16 0
18 4 17 0
19 4 18 0
20 4 19 0
21 6 19 0
22 6 20 0
23 6 21 0
24 6 22 0 64QAM
25 6 23 0
26 6 24 0
27 6 25 0
28 6 26 0
29 1
Information Security Level 2 – Sensitive
30 2
30 © 2017 – Proprietary & Confidential Information of Amdocs 31 reserved 3
 TBS mapping (PDSCH Example)
MCS Index Modulation TBS Index
TBS translation table (incomplete)
Order I TBS N PRB
1 2 3 4 … 99 100 101 … 109 110
0 2 0
1 2 1 0 16 32 56 88 … 2728 2792 2792 … 2984 3112
2 2 2 1 24 56 88 144 … 3624 3624 3752 … 4008 4008
3 2 3 2 32 72 144 176 … 4392 4584 4584 … 4968 4968
4 2 4 3 40 104 176 208 … Example: 4 PRB’s @ TBS index
5736 5736 5992 … 6456 6456
5 2 5 4 56 120 208 256 … 6968 7224 7224 … 7736 7992
6 2 6 5 72 144 224 328 … 18 allocated to UE
8760 8760 8760 … 9528 9528
7 2 7 6 328 176 256 392 … 10296 10296 10680 … 11448 11448
8 2 8
7 104 224 328 472 … 12216 12216 12216 … 13536 13536
9 2 9
8 120 256 392 536 … 14112 14112 14112 … 15264 15264
10 4 9
11 4 10
TBS=1544bits
9 136 296 456 616 … 15840 15840 15840 … 16992 17568
12 4 11 → instantaneous throughput: 1544bits/1ms TTI = 1.544Mbps
10
11
144
176
328
376
504
584
680
776
…
…
17568
19848
17568
19848
17568
20616
…
…
19080
22152
19080
22152
13 4 12
14 4 13 → coding rate:
12 208 440 680 904 … 22920 22920 22920 … 24496 25456
15 4 14 13 224 488 744 1000 … 25456 25456 26416 … 28336 28336
16 4 15 TBS/(N *12sucarriers_per_PRB*14symbols_per_TTI*6bits_per
14
PRB
256 552 840 1128 … 28336 28336 29296 … 31704 31704
17
18
6
6
15
16
_64QAM_symbol) = 1544/(4*12*14*6) = 0.38
15 280 600 904 1224 … 30576 30576 30576 … 34008 34008
16 328 632 968 1288 … 31704 32856 32856 … 35160 35160
19 6 17
17 336 696 1064 1416 … 35160 36696 36696 … 39232 39232
20 6 18
21 6 19 18 376 776 1160 1544 … 39232 39232 40576 … 43816 43816
19 408 840 1288 1736 … 42368 43816 43816 … 46888 46888
Example: MCS20 → 64QAM
22 6 20
23 6 21 20 440 904 1384 1864 … 46888 46888 46888 … 51024 51024
24 6 22 21 488 1000 1480 1992 … 48936 51024 51024 … 55056 55056
25 6 23 22 520 1064 1608 2152 … 52752 55056 55056 … 59256 59256
26 6 24 23 552 1128 1736 2280 … 57336 57336 57336 … 61664 63776
27 6 25 24 584 1192 1800 2408 … 61664 61664 61664 … 66592 66592
28 6 26
25 616 1256 1864 2536 … 63776 63776 63776 … 68808 71112
29 2
Information Security Level 2 – Sensitive
31 30 © 2017 – Proprietary
4 & Confidential Information of Amdocs
26 712 1480 2216 2984 … 73712 75376 75376 … 75376 75376
31 6 reserved
LTE Bearers EPS bearer has several components in it. It means
EPS bearer is a complex of multiple element
bearers as in the following diagram

Information Security Level 2 – Sensitive

32 © 2017 – Proprietary & Confidential Information of Amdocs
Protocol Stack and msg flow

Information Security Level 2 – Sensitive

33 © 2017 – Proprietary & Confidential Information of Amdocs
Dedicated & Default Bearer
• Default Bearer : When LTE UE attaches to the network for the first time, it will be assigned default bearer
which remains as long as UE is attached. Each default bearer comes with an IP address

• Dedicated bearers : It provides dedicated tunnel to one or more specific traffic (i.e. VoIP, video etc).
Dedicated bearer acts as an additional bearer on top of default bearer.

Information Security Level 2 – Sensitive

34 © 2017 – Proprietary & Confidential Information of Amdocs
SIB Information (1/2)
•Access Class Information

SIB 2:
•Uplink Carrier Frequency
•PLMN Identity list •UL Bandwidth

Master •TAC
•Cell Barred Indication
•Uplink carrier Power control
•Preamble Power ramping

information •Intra frequency reselection •MBSFN Configuration Information

•CSG (Closed Subscriber Group)

Block (MIB):
Indication

SIB 1: •CSG Identity

•Qrxlevminoffset
•P-Max
•Frequency band indicator
• Static part of SI •SI periodicity mapping information
•Cell Reselection Information
• Number of antennas •Q-Hyst
•SIB window length (Common SI
•Speed State Reselection Parameters
• System bandwidth scheduling window for all SIB
•System Info Value Tag •Q-Hys Speed SF (Scaling Factor)
• PHICH configuration •Treselection EUTRA

SIB 3:
• Transmitted power •Treselection EUTRA SF
• Scheduling information on •S Intra Search
how the SIBs are scheduled •Cell Reselection Serving Info
together with other data on •S-Non-Intra Search Info
DL-SCH. •Threshold Serving Low Value
•Intra Freq Cell Reselection Info
• Transmitted on BBCH–> PBCH
•P-Max
•Intra Freq Neighbour Cell List

SIB 4:
•Allowed measurement Bandwidth
•Q-OffsetCell
•Intra Freq Black Cell List
•CSG Physical Cell ID Range

The periodicity of MIB is 40ms SIB1 is sent with the periodicity of 80ms
Information Security Level 2 – Sensitive
35 © 2017 – Proprietary & Confidential Information of Amdocs
SIB Information (2/2)

SIB 6:
• Carrier Frequency List UTRA
•INTER-frequency neighboring cells (E-UTRA)
•Inter Frequency Carrier Freq List • UTRA Reselection
Information
SIB 5:
•Inter Frequency Carrier Freq Info
•Inter Frequency Neighbor Cell List

SIB 7:
•Inter Frequency Neighbor Cell Info
•Inter Frequency Black Cell List • Carrier Frequency List GERAN
•Inter Frequency Black Cell Info • GERAN Reselection Information

SIB 8: • CDMA2000 Information

SIB 10: • Earthquake and Tsunami Warning
System primary Notification

SIB 9: • Home eNB Name

(FEMTOCELL)
SIB 11: • Earthquake and Tsunami Warning
System secondary Notification

Information Security Level 2 – Sensitive

36 © 2017 – Proprietary & Confidential Information of Amdocs
Cell Search Procedure (1/2)

Information Security Level 2 – Sensitive

37 © 2017 – Proprietary & Confidential Information of Amdocs
Cell Search Procedure (2/2)

Information Security Level 2 – Sensitive

38 © 2017 – Proprietary & Confidential Information of Amdocs
 Information Security Level 2 – Sensitive
39 © 2017 – Proprietary & Confidential Information of Amdocs
 Information Security Level 2 – Sensitive
40 © 2017 – Proprietary & Confidential Information of Amdocs
 Radio Bearers - Radio Resource Control (RRC)

The major functions of the RRC

protocol include:
• Connection establishment
and release functions
• Broadcast of system
information
• Radio bearer establishment
• Reconfiguration and release
• RRC connection mobility
Radio Bearers procedures.
• Paging notification and
release
• Outer loop power control

Information Security Level 2 – Sensitive

41 © 2017 – Proprietary & Confidential Information of Amdocs
Call Setup Phases PRACH + Msg3
Initial network access process
between UE
and eNB
SRB1 setup
 RRC and E-RAB phases eNB resources are reserved for
PRACH SRB1 S1 conn. RRC SRB2 + signalling
Phase:

setup setup setup security DRB connection between UE and

eNB
NAS security

Success
UE has RRC connection. If
PRACH SRB1 S1 conn RRC SRB2

Success

Success
complete security
dropped, also active
setup Setup +DRB
RAB is dropped.
Success
Complete complete complete
SRB2 RRC security + UE capability enquiry
+DRB
Attempts

Security setup SRB2 + DRB setup

complete failures UE has RAB connection
S1 setup failures
failures
SRB1 setup
Call setup is affected if any of the
failures
followings take place.
PRACH failures • PRACH setup failures
(blocking) • SRB 1 setup failures
• S1 connection failures
• RRC security + UE cap failures
• SRB2 & DRB setup failures

Information Security Level 2 – Sensitive

42 © 2017 – Proprietary & Confidential Information of Amdocs
Mobility

 Concept Comparison
Connected Connected Connected Connected Connected Connected
mode mode mode mode mode mode

Idle Idle Idle Idle Idle Idle

• idle mode mobility • operates on the edge of idle- • connected mode mobility
• no active data/voice connection connected mode mobility • maintaining data/voice
is in place • release procedure with connection when UE moves to
• UE selects a more suitable cell redirection information different cell, frequency layer or
and camp on it • UE is ordered to switch to RAT
• UE performs re-selection actions another frequency layer or RAT • resources are reserved in advance
independently, following the rules • no resources are reserved in on target side
given by the network via advance on target side • service interruption is unnoticeable
Broadcast Channel (BCH) • Radio Access Network (RAN) from end-user perspective
• Absolute Priority (AP) based cell Information Management (RIM) – • seamless Quality of Experience
re-selection mechanism System Information Block (SIB) (QoE)
tunneling

reselection redirection handover

Information Security Level 2 – Sensitive
43 © 2017 – Proprietary & Confidential Information of Amdocs
Interworking Functionalities

SRVCC
CS fallback
Inter-System HO

GSM CS Connected
3G DCH LTE RRC CONNECTED
PS HO

3G FACH GSM PS Transfer

3G URA/CELL PCH
connection
connection establishement/release
connection
establishement/release establishement/release

3G IDLE LTE RRC IDLE GSM/GPRS IDLE

Reselection Reselection

Information Security Level 2 – Sensitive

44 © 2017 – Proprietary & Confidential Information of Amdocs
Mobility and Connection States (1/2)
 2 sets of states for the UE are defined based on the information held in the MME:
 EMM: EPS Mobility Management States
EPS: Evolved Packet System
 ECM: EPS Connection Management States
 EMM:
 EMM- DEREGISTERED
 MME holds no valid location information about the UE (location unknown)
 UE can not be paged

 EMM- REGISTERED
 UE registers with an MME and establishes a default bearer for application data transfer via attach procedure or TAU
procedure after inter-system HO
 UE responds to paging messages

EMM Attach
EMM registered
deregistered Detach

Information Security Level 2 – Sensitive

45 © 2017 – Proprietary & Confidential Information of Amdocs
 Mobility and Connection States (2/2)
 ECM (EPS Connection Management States):
 UE and MME enter ECM-CONNECTED state when the signaling connection is established between UE and
MME
 UE and E-UTRAN enter RRC-CONNECTED state when the signaling connection is established between UE and
the E-UTRAN

RRC connection S1 connection

MME

UE
E-UTRAN MME
RRC connection
establishment
RRC idle RRC connected
RRC connection release

S1 connection establishment
ECM idle ECM connected
S1 connection release
Information Security Level 2 – Sensitive
46 © 2017 – Proprietary & Confidential Information of Amdocs
 LTE Radio Resource Control (RRC) States
RRC Idle state
 No signalling connection between UE and
network exists
 RRC connection may be released due to the following
 UE performs cell reselections
reasons:
 Paging needed when there is data in downlink
 UE is inactive for a long time
direction
 High mobility: UE makes x handovers within m minutes
 RACH procedure used on RRC connection
establishment  Max number of RRC connected UEs reached. Then,
longest inactive UE is released
RRC Connected State
 A signalling connection exists between UE and
network
 UE location is known in MME with an accuracy of
a cell ID
 The mobility of UE is handled by the handover
procedure

Information Security Level 2 – Sensitive

47 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Connection States transitions
Power On
Release due to
Registration (Attach) Inactivity
• Allocate C-RNTI, S_TMSI
• Release RRC connection
• Allocate IP addresses • Release C-RNTI
• Authentication • Configure DRX for paging
• Establish security context

EMM Deregistered EMM Registered EMM Registered

ECM Idle ECM Connected ECM Idle

Deregistration (Detach) New Traffic

Change PLMN
•Establish RRC Connection
• Release C-RNTI, S-TMSI •Allocate C-RNTI
• Release IP addresses

Timeout of Periodic TA
Update
• Release S-TMSI
• Release IP addresses
Information Security Level 2 – Sensitive
48 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Tracking Area
 Tracking Area Identity = MCC (Mobile Country Code), MNC (Mobile Network Code) and TAC
(Tracking Area Code)
o If the UE is in EMM Registered state, an MME knows the exact Tracking Area to which it belongs
o Paging, if needed, will be done within the full Tracking Area
o When a UE is attached to the network, the MME will know the UE’s position on tracking area level
 Tracking areas are allowed to overlap. One cell can belong to multiple tracking areas
 UE is told by the network to be in several tracking areas simultaneously
o Gain: when the UE enters a new cell, it checks which tracking areas the new cell is part of. If this TA is on UE
TA list, then no tracking area update is necessary
HSS

TAI1 eNB 1 2
TAI1-2
TAI1 MME
TAI1-2
TAI1
TAI2
TAI2 eNB
TAI2
TAI2
TAI2
Cell Identity TAI2
TAI2
TAI2
TAI3
TAI3 S-eNB 3
TAI3
TAI3 MME
TAI3
TAI3
Information Security Level 2 – Sensitive TAI3
49 © 2017 – Proprietary & Confidential Information of Amdocs
International Mobile Subscriber Identity (IMSI)
 Used in GSM/UMTS/EPS to uniquely identify a subscriber world-wide.
 The format is:
 MCC: mobile country code
 MNC: mobile network code
 MSIN: mobile subscriber identification number
 MME uses the IMSI to locate the HSS holding the subscribers permanent registration data for
tracking area updates and attaches.

Not more than 15 digits

2 or 3
3 digits digits

MCC MNC MSIN

NMSI
IMSI

Information Security Level 2 – Sensitive

50 © 2017 – Proprietary & Confidential Information of Amdocs
Cell Radio Network Temporary Identifier (C-RNTI)
 C-RNTI is 16 bits long
 Temporary UE identity which is only valid within the serving cell. (To identify an UE uniquely in a
cell)
 Used for radio management procedures

E-UTRA C-RNTI allocated

RRC_CONNECTED

E-UTRA
RRC_IDLE C-RNTI released

Information Security Level 2 – Sensitive

51 © 2017 – Proprietary & Confidential Information of Amdocs
Globally-unique UE Temporary Identifier (GUTI)
 Composition
 GUTI = <GUMMEI><M-TMSI>
 GUMMEI = <MCC><MNC><MME ID>
 MME ID = <MME Group ID><MME Code>
 Length
 MCC and MNC shall have the same field size as in earlier 3GPP systems.
 M-TMSI shall be of 32 bits length.
 MME Group ID shall be of 16 bits length.
 MME Code shall be of 8 bits length.
 M-Temporary Mobile Subscriber Identity
 M-TMSI identifies a user between the UE and the MME.
 The relationship between M-TMSI and IMSI is known only in the UE and in the MME.
 The M-TMSI is unique within MME that allocate it. (Within the MME, the mobile is identified by the M-TMSI)
2 bytes 1 bytes 4 bytes

MCC MNC MME Group ID MME Code M-TMSI

GUTI
Information Security Level 2 – Sensitive
52 © 2017 – Proprietary & Confidential Information of Amdocs
S–Temporary Mobile Subscriber Identity (S-TMSI)

 S-TMSI is shortened form of GUTI that enable more efficient radio signalling procedures (e.g. paging
and Service Request)
 Its main purpose is for user confidentiality.
 S-TMSI = <MME Code><M-TMSI>
 If S1-flex interface option is used, the eNB must select the right MME for a UE. This is done by using
MME Code portion of S-TMSI
 To locally identify a UE in short within a MME group (Unique within a MME Pool)

1 bytes 4 bytes

MME Code M-TMSI

S-TMSI

Information Security Level 2 – Sensitive

53 © 2017 – Proprietary & Confidential Information of Amdocs
 Network Entity Related Identities
 The following identities are used in EPS for identifying a specific network entity:
 Globally Unique MME Identity (GUMMEI): used to identify MME globally.
 GUMMEI = <MCC><MNC><MME Group Id><MME Code> EPS: Evolved Packet System
 E-UTRAN Cell Global Identifier (ECGI): used to identify cells globally.
 ECGI = <MCC><MNC><CI>
 eNB Identifier (eNB ID): used to identify eNBs within a PLMN.
 The eNB ID is contained within the CI of its cells.
 Global eNB ID: used to identify eNBs globally.
 Global eNB ID = <MCC><MNC><eNB ID>
 Tracking Area identity (TAI): used to identify tracking areas.
 TAI = <MCC><MNC><TAC>
 EPS Bearer ID / E-RAB ID:
 The value of the E-RAB ID used at S1 and X2 interfaces to identify an E-RAB allocated to the UE
 The same as the EPS Bearer ID used at the Uu interface to identify the associated EPS Bearer.
 It may also be used at Non-Access Stratum layer.
 Physical-layer Cell Identity (PCI) : used to distinguish between cells/sectors. It similar to Primary Scrambling
Code (PSC) on UTRAN.

Information Security Level 2 – Sensitive

54 © 2017 – Proprietary & Confidential Information of Amdocs
Cell Identifier ECI (is not the same as PCI !!!)
LNCEL: eutraCelId
• The E-UTRAN Cell Global Identifier (ECGI) is used to identify cells globally
• The ECGI is constructed from the MCC, MNC and E-UTRAN Cell Identifier (ECI)
• The ECI is used to identify cells within a PLMN
• It has a length of 28 bits and contains the eNodeB Identifier

• LNCEL: eutraCelId Range: 0…..268435455

• Parameter is compiled by the system from following two
individual parameters on binary string level: 20 bit LNBTSId 8 bit LCRId
• LNBTS: lnBtsId Range: 0…1048575
• LNCEL: lcrId Range: 0….255
eutraCelId

Information Security Level 2 – Sensitive

55 © 2017 – Proprietary & Confidential Information of Amdocs
eNodeB (LNBTS) and Cell Identity - CM

Information Security Level 2 – Sensitive

56 © 2017 – Proprietary & Confidential Information of Amdocs
 X2 Handover Procedure
Before handover Handover preparation Radio handover Late path switching

S-GW + P-GW S-GW + P-GW S-GW + P-GW S-GW + P-GW

MME MME MME MME

Target
Source eNB
eNB X2

= Data in radio = S1 signalling

= Signalling in radio = X2 signalling
= GTP tunnel
= GTP signalling
Information Security Level 2 – Sensitive
 X2 HO as a basic type of a handover within LTE
57 © 2017 – Proprietary & Confidential Information of Amdocs
X2 Handover Preparation
UE Source Target MME GW
1. The source eNB configures the UE
measurement procedures with
MEASUREMENT CONTROL
2. UE is triggered to send MEASUREMENT 1. Measurement control
REPORT to the source eNB. It can be event
2. Measurement report
triggered or periodic
3. Source eNB makes handover decision
3. HO decision
based on UE report + load and service
information 4. HO request
4. The source eNB issues a HANDOVER REQUEST
to the target eNB 5. Admission
control
5. Target eNB performs admission control
6. HO request ack.
6. Target eNB sends the HANDOVER REQUEST
ACKNOWLEDGE to the source eNB

Information Security Level 2 – Sensitive

58 © 2017 – Proprietary & Confidential Information of Amdocs
X2 Handover Execution
7. Source eNB generates the HANDOVER
UE Source Target MME GW
COMMAND towards UE
Source eNB starts forwarding packets to target
eNB
8. Source eNB sends status information to 7. HO command
target eNB Forward
packets to
9. UE performs the final synchronisation to target
target eNB and accesses the cell via 8. Status transfer
RACH procedure
Buffer packets
DL pre-synchronisation is obtained during cell from source
identification and measurements
9. Synchronization
10.Target eNB gives the uplink allocation
and timing advance information 10. UL allocation and timing advance
11.UE sends HANDOVER CONFIRM to target
11. Handover confirm
eNB
Target eNB can begin to send data to UE
Information Security Level 2 – Sensitive
59 © 2017 – Proprietary & Confidential Information of Amdocs
X2 Handover Completion
12.Target eNB sends a PATH SWITCH message to UE Source Target MME GW
MME to inform that the UE has changed cell
13.MME sends a USER PLANE UPDATE REQUEST message
to Serving Gateway 12. Path switch request
14.Serving Gateway switches the downlink data
13. User plane update request
path to the target side
15.Serving Gateway sends a USER PLANE UPDATE 14. Switch
RESPONSE message to MME downlink
path
16.MME confirms the PATH SWITCH message with
the PATH SWITCH ACK message 15. User plane update
17.By sending RELEASE RESOURCE the target eNB response
informs success of handover to source eNB and 16. Path switch request ack.
triggers the release of resources 17. Release resources
18.Upon reception of the RELEASE RESOURCE message,
18. Release
the source eNB can release radio and C-plane resources
related resources associated to the UE context
Information Security Level 2 – Sensitive
60 © 2017 – Proprietary & Confidential Information of Amdocs
 Intra-LTE Inter-eNodeB handover via S1

• Applicable for intra and inter frequency HO and only for

inter-eNB HO
• DL Data forwarding via S1
• Handover in case of
– no X2 interface between eNodeBs, e.g. not operative,
not existing or because blacklisted usage
– eNodeBs connected to different CN elements

• For the UE there is no difference whether the HO is executed via X2 or S1 interface

• HO reasons ‘better cell HO’ (A3) and ‘coverage HO’ (A5) are supported
• MME and/or SGW can be changed during HO (i.e. if source and target eNodeB belong to different
MME/S-GW)

Information Security Level 2 – Sensitive

61 © 2017 – Proprietary & Confidential Information of Amdocs
Inter RAT Handover to WCDMA

Phases:
1. Handover initiation:
 eNB starts a HO to WCDMA following a received measurement report with
event B2 (A2/A1 activates/deactivates measurements)
 Max. 8 cells reported (strongest first) that create the TCL (target cell list)
2. Handover preparation:
 Resource allocation on target side (E-RAB parameters mapped into PDP
context)
3. Handover execution:
 UE moves into WCDMA cell after receiving ‘MobilityfromEUTRACommand’
message
4. Handover completion:
 Release of S1 connection and internal resources after successful HO (no
timers expired)

Information Security Level 2 – Sensitive

62 © 2017 – Proprietary & Confidential Information of Amdocs
Mapping to QoS requirements
 Every bearer must be tied with QoS Class Indicator (QCI) which determines the
QoS parameters
o Applications sharing the same bearer will be affected by the same quality requirements,
thus it is not possible to map very different services (e.g. HTTP with telco) onto the same QCI
o MME creates the default (non-GBR) bearer for every UE attaching a cell
o GBR bearer can be established on UE demand

QCI Guarantee Priority Delay Loss rate Application

1 GBR 2 100ms 1e-2 VoIP

2 GBR 4 150ms 1e-3 Video call

3 GBR 5 300ms 1e-6 Streaming

Real time
4 GBR 3 50ms 1e-3
gaming

5 Non-GBR 1 100ms 1e-6 IMS signaling

Interactive
7 Non-GBR 7 100ms 1e-3
gaming

6 Non-GBR 6 300ms 1e-6

TCP protocols:
8 Non-GBR 8 300ms 1e-6 Browsing, email,
file download
9 Non-GBR 9 300ms 1e-6

Information Security Level 2 – Sensitive

63 © 2017 – Proprietary & Confidential Information of Amdocs
Basic Metric Definitions
• LTE Carrier Received Signal Strength Indicator (RSSI)
o Definition: The total received wideband power observed by the UE from all sources, including co-channel
serving and non-serving cells, adjacent channel interference and thermal noise within the bandwidth of the
whole LTE signal

• LTE Reference Signal Received Power (RSRP)

o Definition: The RSRP is determined for a considered cell as the linear average over the power
contributions (Watts) of the resource elements that carry cell specific Reference Signals within the
considered measurement frequency bandwidth . Reporting range -44…-140 dBm
• LTE Reference Signal Received Quality (RSRQ) Definition: RSRQ = N · RSRP / RSSI
o N is the number of Resource Blocks (RBs) of the LTE carrier
o RSSI measurement bandwidth. Since RSRQ exists in only one or a few resource blocks, and RSSI is measured
over the whole width of the LTE signal . Reporting range of RSRQ from -3…-19.5dB
o What is the portion of pure RS power over the whole E-UTRA power received by the UE

• SINR calculation are:

o S: the power of measured usable signals, such as Reference signals (RS) and physical downlink shared
channels (PDSCHs)
o I: the power of measured interference from other cells in the current system
o N: background noise power
o UEs typically use SINR to calculate the CQI (Channel Quality Indicator) they report to the network
o SINR= S/(I+N) . Reporting range -23dB … +40dB
• Power Headroom (PH)
o In dB, is the difference between current UE PUSCH transmit power and the UE’s maximum capable power
output:
o Power Headroom = UE Max Transmission Power - PUSCH Power . Reporting range -23dB … +40dB
Information Security Level 2 – Sensitive
64 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Received Channel Quality Indication
Required
• LTE modulation is adapted in real-
CQI Modulation Coding rate time to match existing RF condition
SINR
1 QPSK 0.076 -4.46 reported by the UE
2 QPSK 0.11 -3.75 • The table shows CQI index and their
3 QPSK 0.18 -2.55 relation to coding rate and SINR
4 QPSK 308/1024 -1.15

5 QPSK 449/1024 1.75

6 QPSK 602/1024 3.65

7 16QAM 378/1024 5.2

8 16QAM 490/1024 6.1

9 16QAM 616/1024 7.55

10 64QAM 466/1024 10.85

11 64QAM 567/1024 11.55

12 64QAM 666/1024 12.75

13 64QAM 772/1024 14.55

14 64QAM 873/1024 18.15

15 64QAM 948/1024 19.25

Information Security Level 2 – Sensitive

65 © 2017 – Proprietary & Confidential Information of Amdocs
 LTE Measurement Hierarchy
Other ACCESS Technologies
OSS NetAct implementation NETACT/ NSN counters/KPI

within LTE Diagnostics at OSS/PLMN layer

NetAct managed RRM/field counters, SAE GW

phases, and KPIs to detect faults and
OSS level
ensures QoS requirements at all layers

• PLMN level transmission monitoring S1

• Mobility Management Entity (MME)
S1
• S1/X2 S1
S1
• eNB level
• Cell level Probing at
X2
eNBs X2
Probing and drive test is based on
trouble shooting at single eNB/cell area.
Drive test Radio measurements only at cell layer
Information Security Level 2 – Sensitive
66 © 2017 – Proprietary & Confidential Information of Amdocs
Field Measurement KPI Classification
Field Measurement KPI can be classified into the following categories
W-CDMA
BS
 Coverage GPRS GGSN Firewall Internet

Accessibility
Backbone
 PS data
3G SGSN
Retainability
FMT server

 Service Quality CS data
RNC 3G MSC Modem server
 Mobility Field Measurement
KPI PSTN

LTE BS

S-GW Internet
S1 P-GW

Information Security Level 2 – Sensitive Field Measurement

67 © 2017 – Proprietary & Confidential Information of Amdocs KPI
Typical Measurement KPI LTE
Integrity:
Average CQI
Average Latency
Accessibility: RLC PDU Retransmission
RRC Setup Success Rate
E-RAB Setup Success Rate
S1 Setup Success Usage:
eNodeB1
Call Setup Success Rate Cell Availability
eNodeB2
Resource Block Usage
PDCP/RLC Layer
Throughput

X Inter RAT
redirection

UE X2

X
Retainability:
RRC Drop Rate
E-RAB Drop Rate Mobility:
Intra eNodeB HO
Success Rate
Inter eNodeB HO
Success Rate

Information Security Level 2 – Sensitive

68 © 2017 – Proprietary & Confidential Information of Amdocs
Typical Measurement KPI LTE
KPI ID KPI Alias KPI Title
LTE_5569a RACH Stp Completion SR E-UTRAN RACH Setup Completion Success Rate
LTE_1056e Compl RACH stp SR Complete RACH Setup Success Rate
LTE_5239a Cell Avail excl BLU E-UTRAN Cell Availability, excluding blocked by user state (BLU)
LTE_5218f Total E-UTRAN RRC conn stp SR Total E-UTRAN RRC Connection Setup Success Ratio
LTE_5060j E-UTRAN Init E-RAB acc E-UTRAN Initial E-RAB Accessibility
LTE_5017a E-UTRAN E-RAB stp SR E-UTRAN E-RAB Setup Success Ratio
LTE_5117d RB SR E-UTRAN Radio Bearer Success Ratio
LTE_5212a PDCP SDU Volume, DL E-UTRAN PDCP SDU Volume DL
LTE_5213a PDCP SDU Volume, UL E-UTRAN PDCP SDU Volume UL
LTE_753c RRC stp att RRC Setup Attempts
LTE_5119f E-RAB DR, User Perspective E-UTRAN E-RAB Drop Ratio, User Perspective
LTE_5025g E-RAB DR RAN E-UTRAN E-RAB Drop Ratio, RAN View
LTE_5444b Avg RSSI for PUSCH E-UTRAN Average RSSI for PUSCH
LTE_5544b Avg SINR for PUSCH E-UTRAN Average SINR for PUSCH
LTE_5441b Avg RSSI for PUCCH E-UTRAN Average RSSI for PUCCH
LTE_5541b Avg SINR for PUCCH E-UTRAN Average SINR for PUCCH
LTE_5427a Average CQI E-UTRAN Average CQI
LTE_5292d Avg PDCP cell thp DL E-UTRAN average PDCP Layer Active Cell Throughput DL
LTE_5289d Avg PDCP cell thp UL E-UTRAN average PDCP Layer Active Cell Throughput UL
LTE_5273b Avg PRB usage per TTI UL E-UTRAN Average PRB usage per TTI UL
LTE_5276b E-UTRAN Avg PRB usage per TTI DL Average PRB usage per TTI DL
LTE_5058c E-UTRAN tot HO SR inter eNB X2 E-UTRAN Total HO Success Ratio, inter eNB X2 based
LTE_5043b Intra eNB HO SR total E-UTRAN Total HO Success Ratio, intra eNB
LTE_5126a Inter X2 based HO prep E-UTRAN HO Preparation, inter eNB X2 based
LTE_5123b E-UTRAN HO Preparations, intra eNB E-UTRAN HO Preparations, intra eNB
LTE_5035a Intra eNB HO SR E-UTRAN HO Success Ratio, intra eNB
LTE_5204b E-RAB Stp SR, QCI1 E-UTRAN E-RAB Setup Success Ratio, QCI1
LTE_5572d E-RAB QCI1 DR, RAN view E-UTRAN E-RAB QCI1 Drop Ratio, RAN View
LTE_5209d E-RAB QCI1 normal rel, User E-UTRAN E-RAB QCI1 Normal Release Ratio User Perspective
LTE_5195a Inter RAT HO SR E-UTRAN Inter RAT HO Success Ratio
LTE_5198b Inter RAT Total HO SR E-UTRAN Inter RAT Total HO Success Ratio
LTE_5196a Inter RAT HO Attempts E-UTRAN Inter RAT HO Attempts
LTE_5541a Avg SINR for PUCCH Average SINR for PUCCH
LTE_1339a Avg UE distance Average UE distance to base station
LTE_1340a Expect cell size Expected cell size
Information Security Level 2 –RAT
Sensitive
69
LTE_5191c Inter HO Preparation SR E-UTRAN Inter RAT HO Preparation Success Ratio
© 2017 – Proprietary & RB
LTE_5004c Confidential
DR Information of Amdocs E-UTRAN Radio Bearer Drop Ratio
LTE_5191b Inter RAT HO Preparation SR E-UTRAN Inter RAT HO Preparation Success Ratio
LTE Network Quality Index (LTE NQI)
AMX Monitoring

LTE NQI = QDA * QDR * PS_RETENTION_LTE * Weighted Availability * QDE_DL * QDE_UL

POOR ACCEPTABLE GOOD

<70 % >=70 % & <85 % >=85 %

http://10.92.49.75:8092/Radar/Network

Information Security Level 2 – Sensitive

70 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Network Quality Index (LTE NQI)
QDA

QDA – Quality Distribution Accessibility

QDA (%) = 100 * Good_Attempts / (Good_Attempts + Bad_Attempts)

IF Accessibility < 99%

THEN
Consider QDA_Attempts as Bad_Attempts
ELSE
Consider QDA_Attempts as Good_Attempt

QDA_Attempts = 𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆_𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶_𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸_𝐴𝐴𝐴𝐴𝐴𝐴 + S1_SIGN_CONN_ESTAB_ATT_UE + EPS_BEARER_SETUP_ATTEMPT

𝑆𝑆𝑆𝑆𝑆𝑆𝑆𝑆_𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶_𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸_𝐴𝐴𝐴𝐴𝐴𝐴 = SIGN_CONN_ESTAB_ATT_MO_S + SIGN_CONN_ESTAB_ATT_MT + SIGN_CONN_ESTAB_ATT_MO_D +
SIGN_CONN_ESTAB_ATT_DEL_TOL + SIGN_CONN_ESTAB_ATT_HIPRIO + SIGN_CONN_ESTAB_ATT_EMG
Information Security Level 2 – Sensitive
71 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Network Quality Index (LTE NQI)
QDR

QDR – Quality Distribution Retainability

QDR (%) = 100 * Good_Attempts / (Good_Attempts + Bad_Attempts)

IF Retainability < 99%

THEN
Consider QDR_Attempts as Bad_Attempts
ELSE
Consider QDR_Attempts as Good_Attempt
Retainability (%) = 100 ∗

ERAB_REL_HO_PART + ERAB_REL_ENB
− ERAB_REL_ENB_RNL_INA − ERAB_REL_ENB_RNL_RED − ERAB_REL_TEMP_QCI1
⎛ ⎞
+EPC_EPS_BEARER_REL_REQ_RNL + EPC_EPS_BEARER_REL_REQ_OTH + ERAB_REL_EPC_PATH_SWITCH
[1 − ⎜ ⎟
⎜ QDR_Attempts ⎟

⎝ ⎠
QDR_Attempts
ERAB_REL_ENB + ERAB_REL_HO_PART + EPC_EPS_BEARER_REL_REQ_NORM + EPC_EPS_BEARER_REL_REQ_DETACH +
=
EPC_EPS_BEARER_REL_REQ_RNL + EPC_EPS_BEARER_REL_REQ_OTH + ERAB_REL_EPC_PATH_SWITCH − ERAB_REL_TEMP_QCI1

Information Security Level 2 – Sensitive

72 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Network Quality Index (LTE NQI)
Retention in LTE

Retention in LTE
PS Retention in LTE (%) = 100 * (1 – PS_Data_Calls_IRAT_Ratio)

This factor is the ratio of LTE connections “lost” to 3G and 2G via IRAT from 4G.
IRAT redirections due to CSFB do not penalize the metric since these voice calls are supposed to be moved to 3G.

Releases num = (ERAB_REL_ENB_RNL_RED − CSFB_REDIR_CR_ATT) + (ISYS_HO_SUCC − CSFB_PSHO_UTRAN_ATT )

+ (ISYS_HO_UTRAN_SRVCC_SUCC + ISYS_HO_GERAN_SRVCC_SUCC)]
Releases den = (ERAB_REL_ENB + ERAB_REL_HO_PART + EPC_EPS_BEARER_REL_REQ_NORM
+ EPC_EPS_BEARER_REL_REQ_DETACH + EPC_EPS_BEARER_REL_REQ_RNL
+ EPC_EPS_BEARER_REL_REQ_OTH + ERAB_REL_EPC_PATH_SWITCH − ERAB_REL_TEMP_QCI1
− CSFB_REDIR_CR_ATT − CSFB_PSHO_UTRAN_ATT)

Information Security Level 2 – Sensitive

73 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Network Quality Index (LTE NQI)
Weighted Availability

Weighted Availability

Weighted_Availability (%) = Weight * Availability (%)

The highlights of the weighted availability:

• Measure outside maintenance window only

• Consider only automatic outages, not manually locked cells
• Weight factor is based on average RRC Connected Users (not volume)

Information Security Level 2 – Sensitive

74 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Network Quality Index (LTE NQI)
QDE

QDE – Quantity Distribution Efficiency

QDE_DL and QDE_UL, are defined as the weighted ratio of measurement samples (cell hours) above a minimum
acceptable threshold:

• Efficiency DL threshold = 1bps/Hz

• Efficiency UL threshold = 0.35bps/Hz

If all DL efficiency samples are at least 1bps/Hz and all UL samples are at least 0.35bps/Hz, both
QDE_DL and QDE_UL are 100%.

Information Security Level 2 – Sensitive

75 © 2017 – Proprietary & Confidential Information of Amdocs
 LTE Optimization

Cases Examples

Information Security Level 2 – Sensitive

76 © 2017 – Proprietary & Confidential Information of Amdocs
LTE Optimization
Coverage Optimization
•Identify Over shooter and Under Propagating sectors.
•Reduce Coverage overlap and create dominate
Coverage Capacity server.
•Low downlink or uplink MCS usage analysis
Optimization Optimization
Capacity Optimization
•Identify High PRB Utilization Cluster
•Identify High users cells/clusters
•Identify High PRACH Utilization Cluster

Carrier Balance Analysis

Carrier Top •Maximize Layer Efficiency

LTE Offenders •Balance Traffic and Load between carriers
Balance Optimization •Best Possible Customer Experience
Analysis Analysis
Interference Analysis
•Identify External and Internal Interference
•Massive cluster level RF shaping
•Improve Performance and RSRQ

Mobility Optimization
• Identify Ping Pong HO area
Interference Mobility • Perform Parameter tuning to improve HOSR and
Analysis Optimization redirection
• Perform Parameter tuning to improve CSFB

Top Offenders Analysis

• Identify and Optimize Daily top 20 offender sectors

Information Security Level 2 – Sensitive

77 © 2017 – Proprietary & Confidential Information of Amdocs
 Periodic Review: detected & solved
LTE – GSM Mobility configuration all over the network.

• 2G → LTE functionalities
• LTE System Information (BSS 21353) (RG20)
• Idle mode mobility to LTE
• Inter-System NCCR for LTE (RG301737) (RG30) Not recommended due to not well
performing Packet Cell Change Order
• GPRS Packet transfer mode mobility to LTE RRC-Idle (PCCO) message, as NCCR to 3G experience.

• Fast Return to LTE (RG301854) (RG30)

• Redirection, direct camping on LTE cell immediately after the CS call ends.
GSM Network 3G Network 4G Network BSC does not know whether it is CSFB call or not,
CSFB is seen as normal call setup from BSC point
Re-selection/ ISHO Re-selection / PS of view. (Currently not enabled LTE CSFB to GSM)
HO/ Smart LTE For normal call setup, after call ends will be
layering redirected to LTE with the feature enabled.
LTE capable UE

Current situation
GSM Network 4G Network Directly
•
• Faster
Recommended &
Re-selection
• without transit into 3G network implemented.
LTE capable UE
Recommended

Information Security Level 2 – Sensitive

78 © 2017 – Proprietary & Confidential Information of Amdocs
LTE – Interference method detection (1/3)
Summary Periodic Review: detected & reported for
hunting all over the network.

 LTE interference detection method definition & create a delivery Avg RSSI for PUSCH > -95 dBm
report for interference hunting Avg SINR for PUSCH < 5 dB

 Very important issue for LTE because is affecting/impacting

eNBs:
 Degradation for NQI (QDA/QDR/QDE), all attempts are bad.
 Initial Accessibility Interference Good Cell

RRC access (radio fails)

All attempts are BAD, then affect QDA


 Drop Rate (radio fails) Better QDA, just few hours below 99%

 Throughput (cell/user)
 Intra eNB HandOver
 Inter eNB HandOver through X2 interface

Information Security Level 2 – Sensitive

79 © 2017 – Proprietary & Confidential Information of Amdocs
LTE – Interference method detection (2/3)
Example of detected areas
Periodic Review: detected & reported
for hunting all over the network.

 Interference method definition

 Detection of cells.
 These cells are in Area with Low UL
Throughput
Avg RSSI for PUSCH > -95 dBm
Avg SINR for PUSCH < 5 dB

Information Security Level 2 – Sensitive

80 © 2017 – Proprietary & Confidential Information of Amdocs
LTE – Interference method detection (2/3)
Example of feature activation • Feature LTE786 activated to improve end
user performance
• Not recovered NQI but Amdocs solution
provide service to end user.
Flexible UL BW LTE786
• User LTE increased
Flexible UL BW LTE786
• Apply for every cell interfered.

Still having bad QDA

Flexible UL BW LTE786
Flexible UL BW LTE786
Interference

LNCEL:
blankedPucch:0 -> 40.
redBwRpaEnUl: True.
prachFreqOff:25.
81
Information Security Level 2 – Sensitive
© 2017 – Proprietary & Confidential Information of Amdocs
MPUCCH:
nCqiRb: 44
Summary - Pushing traffic to LTE (2)
Measurement Based LTE Layering – RSRP

 Motivation: As LTE network has better performance for data services, then pushing the
user faster from 3G to LTE will improve the end user performance into Claro user.
 Then moving the threshold values to more relax signal level during the Measurement
Based LTE Layering will allow to push users to LTE network.

Increasing around ~40% of redirection from 3G to LTE

& returning to 3G increased around ~10% of
redirection from LTE to 3G
Note: average for the three areas tested (RMEN5, RTUC4, RTORC)

Measurement Based Layering

RSRP <19.5dB

Operator
MO Parameter Amdocs proposal
Value
HOPL AdjLMinRSRPLevel -114dBm -116dBm

Information Security Level 2 – Sensitive

82 © 2017 – Proprietary & Confidential Information of Amdocs
Retention into LTE (2) Trial Feb 2018
RSRP redirection stronger

 Motivation: as the Retention into LTE was one key problem into LTE, then to retain more traffic into LTE it was
found that making the values of RSRP (Coverage) lower for redirection to 3G. ONLY apply for CORE cells.
 Improving PSRET LTE, not impacting QDR
 80% reduction of redirection RSRP to 3G
 Improved HSDPA/HSUPA Accessibility
 Improved ~20% BAD HS QDA ATT reduction
 Reduction of HSPA users/improved throughput
eNodeB
device
Operator mobile
MO Parameter Amdocs proposal user
Value
LNCEL Threshold4 -120dBm -125dBm

Information Security Level 2 – Sensitive

83 © 2017 – Proprietary & Confidential Information of Amdocs
Retention into LTE (2) Trial Feb 2018
RSRP redirection stronger
eNodeB
device
 3G improved mobile
user

Information Security Level 2 – Sensitive

84 © 2017 – Proprietary & Confidential Information of Amdocs
Idle Mode Mobility Load Balancing
Prevent RRC attempts overload in 3G F3 carrier

 Motivation: prevent RRC attempts overload in F3 carrier due to CSFB.

 LTE487 Idle mode mobility load balancing (IMMLB) statistically distributes UEs sent with
RRC connection release message towards different frequency layers
 By enabling IMMLB, RRC attempts in 3G carriers are better balanced.

RRC Attempts example

Operator Amdocs
MO Parameter
Value proposal
REDRT redirFreqUtra UARFCN UARFCN
REDRT csFallBPrio 0 1
REDRT redirectPrio 0 1
LNBTS actIdleLB 0 1

Information Security Level 2 – Sensitive

85 © 2017 – Proprietary & Confidential Information of Amdocs
 VoIP in LTE

Information Security Level 2 – Sensitive

86 © 2017 – Proprietary & Confidential Information of Amdocs
Introduction CS: Circuit Switched
VoLTE: Voice over LTE

 What is VoLTE?
• LTE networks are packet- switched. They do not include the traditional 2G/3G
voice services (CS).

• VoLTE (Voice over LTE) is the solution to provide the Voice (VoIP) and SMS
service capability on LTE networks. Requirements:
- Real time traffic
- Quality of Service
- Interoperability to existing CS voice network

IP Multimedia Subsystem (IMS) enables integrated voice, data and multi-

media services interworking between different access networks.
- IMS is based on SIP call control for creating, modifying, and terminating
sessions
Information Security Level 2 – Sensitive
87 © 2017 – Proprietary & Confidential Information of Amdocs
Commercial LTE Voice Solutions

Simultaneous voice and LTE

Information Security Level 2 – Sensitive
88 © 2017 – Proprietary & Confidential Information of Amdocs
SVLTE Definition
•

In the simultaneous voice and LTE (SVLTE) solution, dual-mode mobile phones work on the
LTE network and the CS network simultaneously. The LTE network provides data services,
while
• the CS network provides voice services.
Advantage: SVLTE is a solution for mobile phones without requirements for the network.
Disadvantage:
• The cost and power consumption of dual-mode mobile phones are high.

MSC server
MME

CS EPC

Voice service Data service

2G/3G LTE

Information Security Level 2 – Sensitive

89 © 2017 – Proprietary & Confidential Information of Amdocs
OTT Definition
• Over-the-top (OTT) is a solution that uses APPs, such as the Skype, to provide
voice services for LTE subscribers.

• Advantage:
□ Only the OTT server needs to be deployed to the live network and slight change is
required. The OTT can enhance user experience by offering rich multimedia services.

• Disadvantages:
□ The OTT solution is not carrier-class-based and has low reliability.

□ The OTT solution cannot provide E2E QoS guarantee.

□ The OTT solution is hard to provide common services, such as emergency calls and
interception, and services that are used only by regulatory bodies.

□ Roaming and interconnection are hard to be implemented due to lack of standards.

Information Security Level 2 – Sensitive

90 © 2017 – Proprietary & Confidential Information of Amdocs
Comparison Among CSFB, SVLTE, VoLTE and OTT
Deployment
Solution Feature Advantage Disadvantage Suggestion

The IMS and LTE

networks provide voice Rich
VoLTE services. The handover The IMS network Large-scale LTE
multimedia
between the LTE
services. needs to be coverage
network and 2G/3G
network is supported. HD voice/video. deployed.
E2E QoS
Voice calls are
Voice services are Slight change not reliable. -
OTT implemented by APPs is required on Roaming and
of OTT carriers. live networks.
interworking are
hard to be
implemented.
UEs attach to the LTE Slight change
The call delay is long. Initial phase of the
network. When a UE is required on
CSFB User experience is LTE network
initiates or receives a live networks.
(transition
call, the UE falls back to New NEs do not need affected.
solution)
the CS network. to be deployed.
Terminals attach to both Costs of mobile
The live network does Initial phase of the
the CS and LTE phones are high.
LTE network
SVLTE networks. The CS not need to be Advantages of the
(transition solution)
network provides voice LTE network cannot
Information Security Level 2 – Sensitive adjusted.
91 services.
© 2017 – Proprietary & Confidential Information of Amdocs be used.
Voice support in LTE

CSFB
(CS Fallback)
Voice in LTE

(Voice over LTE)

SRVCC
(Single Radio Voice Call Continuity)

Information Security Level 2 – Sensitive

92 © 2017 – Proprietary & Confidential Information of Amdocs
CS Fallback
 Circuit Switched Fall Back (CSFB) is a technology whereby voice and SMS services are delivered to LTE devices
through the use of UMTS/GSM or another circuit-switched network.
 CS Fallback is performed during the call setup as:
o Inter-RAT redirection from LTE to UTRAN
o Inter-RAT handover from LTE to UTRAN
o Inter-RAT cell change order from LTE to GERAN (NACC)
o The EPC needs to support CS inter-working because the MME indicates the eNB to perform HO/NACC
 Benefits
o Existing 2G/3G infrastructure can be reused in initial LTE deployments
o CSFB feature can be further utilized in roaming scenarios

Switching is based on priorities of layers configured by an

operator:
• GSM layer = set of BCCH frequencies,
• UMTS layer = carrier frequency.
Information Security Level 2 – Sensitive
93 © 2017 – Proprietary & Confidential Information of Amdocs
CSFB Mobile Terminating Call via redirect to UMTS
UE eNB RNC MME SGW MSC

SGs Paging Request

Paging (Idle) // CS Service Notification (Active) Service Request (Active)

Extended Service Request NAS : MT CS Fallback

Service Request (Idle) S1AP : CS Fallback Indicator

Initial Context Setup Request (Idle)

Initial Context Setup Response (Idle)

UE Context Modification Request (Active) S1AP : CS Fallback Indicator
UE Context Modification Response (Active)

RRC Connection Release RRC : Redirect Information

UE Context Release Request

Release Access Bearer Request

UE Context Release Command
Release Access Bearer Response
UE Context Release Complete

4G -> 3G
RRC Connection Setup
Location updating or Paging Response

Information Security Level 2 – Sensitive

94 © 2017 – Proprietary & Confidential Information of Amdocs
Layer 3 Message CSFB (MT Call) LTE–UMTS

Information Security Level 2 – Sensitive

95 © 2017 – Proprietary & Confidential Information of Amdocs
Introduction to SRVCC (Single Radio Voice Call Continuity)
3GPP Mobility Management events
High serving cell RSRP
Event Triggers
A1 Serving becomes better than threshold A2 measurements
active
A2 Serving becomes worse than threshold

Start of 3G
A3 Neighbour becomes offset better than
measurements
serving A2 event
A4 Neighbour becomes better than threshold

B2 measurements active
A5 Serving becomes worse than threshold1 and
for the provided
neighbour becomes better than threshold2
measurement objects
B1 Inter RAT neighbour becomes better than
threshold Start of handover
B2 Serving becomes worse than threshold1 and B2 event
inter RAT neighbour becomes better than Low serving cell RSRP
threshold2
* Measurement gaps scheduled if needed – depending on the UE capability, so acc. to IE interRAT-NeedForGaps stored in UE-
EUTRA Capability
Information Security Level 2 – Sensitive
96 © 2017 – Proprietary & Confidential Information of Amdocs
Single Radio Voice Call Continuity
 SRVCC provides voice service continuity when changing from an LTE cell to a
WCDMA/GSM cell
o The eNB will trigger required inter-RAT measurements only if the UE has an EPS bearer with
QCI=1 (i.e. GBR for Conversational Voice) and both the MME and the UE are SRVCC
capable
o Non-voice bearers handling
 SRVCC to GERAN: PSHO is not supported, non-voice bearers will not be handed over
 SRVCC to UTRAN: all non-voice bearers will be handed over to PS domain

Information Security Level 2 – Sensitive

97 © 2017 – Proprietary & Confidential Information of Amdocs
Volte Architecture
• The Voice over LTE, VoLTE scheme for providing voice over an LTE system utilizes IP Multimedia Subsystem (IMS) enabling
it to become part of a rich media solution.
• It uses SIP protocol ( Session initiation protocol)

CSCF (Call Session Control Function)

• P-CSCF (Proxy Call Session Control Function): is the first contact point for users within the IMS.
o All SIP signaling traffic from the UE are sent to the P-CSCF
o Similarly, all terminating SIP signaling from the network is sent from the P-CSCF to the UE
• I-CSCF (Interrogating Call Session Control Function): is a contact point within an communication service provider’s
network for all connections destined to a subscriber of that network communication service provider
o I-CSCF should obtain the name of the next hop (either S-CSCF or AS) from the HSS.
o I-CSCF should assign an S-CSCF based on received capabilities from the HSS.
o The assignment of the S-CSCF will take place when a user is registering with the network or a user receives a SIP request
while they are unregistered from the network but has services related to an unregistered state (e.g. voice mail)
o I-CSCF should rout incoming requests further to an assigned S-CSCF or the AS (in the case of public service identity).
• S-CSCF (Serving Call Session Control Function): is the focal point of the IMS as it is responsible for handling registration
processes, making routing decisions and maintaining session states and storing the service profile(s). When a user sends
a registration request it will be routed to the S-CSCF, which downloads authentication data from the HSS. Based on the
authentication data it generates a challenge to the UE.

Information Security Level 2 – Sensitive

98 © 2017 – Proprietary & Confidential Information of Amdocs
IMS Architecture
CSCF - Call Session Control Function
P-CSCF - Proxy Call Session Control Function
I-CSCF - Interrogating Call Session Control Function
S-CSCF - Serving Call Session Control Function

AS - Application Server
HSS - Home Subscriber Server
SLF - Subscriber Location Function
MRB - Media Resource Broker

BGCF - Breakout Gateway Control Function

MGCF - Media Gateway Control Function
MGW - IP Multimedia Subsystem Media Gateway
IBCF - Interconnection Border Control Function
TrGW - Transition Gateway
MRFC - Multimedia Resource Function Controller
MRFP - Multimedia Resource Function Processor

Information Security Level 2 – Sensitive

99 © 2017 – Proprietary & Confidential Information of Amdocs
VoLTE call setup: Initial attach and default EPS bearer creation

 When the UE is turned on, it establishes a PDN connection with a default APN.
Usually the operator provides two APNs, i.e., “Internet” APN and the “IMS” APN. The default APN is an “Internet” APN that is used
for internet data traffic and its default EPS bearer has a QCI value of ‘9’.
After the PDN connection is established with the internet APN, the UE attempts additional PDN connection with the IMS well
known APN, i.e., “IMS APN”. The IMS APN is preconfigured in the UE and its default EPS bearer has a QCI value of ‘5’ being used
for SIP signaling.
Once the PDN connection with the IMS APN is completed and the default EPS bearer is successfully created, the UE is able to
communicate with the IMS Core for VoLTE call service.
 Once the UE attaches to the LTE network and the default EPS bearer is created successfully with the IMS APN, the UE registers
to the IP Multimedia Subsystem (IMS) network before accessing the VoLTE service.
The IMS registration procedure includes the IMS authentication, e.g., IMS-AKA, and security negotiation between UE and IMS
network.
After successful IMS registration, the IMS network becomes aware of UE context such as subscription profile, registration status,
etc. After the initial IMS registration, the UE shall refresh the IMS registration status by periodically sending re-Registration.

Information Security Level 2 – Sensitive

100 © 2017 – Proprietary & Confidential Information of Amdocs
 SIP (Session initiation protocol)
In IMS subsystem, the critical protocols are the Session Initiation
Protocol (SIP), SigComp, Real-time Transport Protocol (RTP), RTP
Control Protocol (RTCP) and IP Security (IPSec) and Diameter.
In a VoLTE call SIP protocol is used to create, modify and terminate
sessions, essentially negotiating a session between two users. SIP does
not perform transport layer (delivering data) those are done by
RTP/RTCP.

SIP Message Codes and Its Meaning

SIP Response Code are divided in following categories:

•1XX Codes (Informational/Provisional): These code are for request received and
SIP Method Description
being processed e.g. 100 Trying, 180 Ringing
•2xx Codes (Successful Action) : The action was successfully received,
INVITE INVITE indicates that a client is being invited to participate in a call session
understood, and accepted e.g. 200 OK, 202 Accepted
ACK ACK Confirms that the client has received a final response to an INVITE request
•3XX Codes (Redirection): Further action needs to be taken (typically by the
BYE Terminates a call; It can be sent by either the caller or the called party
sender) to complete the request e.g. 301 Moved Permanently, 302 Moved
CANCEL Cancels any pending request
Temporarily
OPTIONS It Queries the capabilities of servers
•4XX Codes (Client Failure): The request contains bad syntax or cannot be fulfilled
PRACK Provisional acknowledgement
at the server e.g. 401 Unauthorized, 403 Forbidden
SUBSCRIBE Subscribes to event notification
•5XX (Codes Server Failure): The server failed to fulfill an apparently valid request
NOTIFY Notifies the subscriber of a new Event
e.g. 500 Server Internal Error, 504 Server Time-out
PUBLISH Publishes an event to the Server
•6XX (Global Failure): The request cannot be fulfilled at any server e.g. 600 Busy
INFO Sends mid-session information that does not modify the session state
Everywhere, 604 Does Not Exist Anywhere
REFER Asks recipient to issue a SIP request (call transfer)
MESSAGE Transports
Information instant
Security messages
Level using SIP
2 – Sensitive
101 © 2017 – Proprietary & Confidential Information of Amdocs
UPDATE Modifies the state of a session without changing the state of the dialog
SIP (Session initiation protocol)
The detailed list of all Response code is given in below tables.
1XX Codes 2XX Codes
SIP Message Code Description SIP Message Code Description
100 Trying 200 OK
180 Ringing 202 Accepted
181 Call Is Being Forwarded 204 No Notification
182 Queued
183 Session Progress 3XX Codes
199 Early Dialog Terminated SIP Message Code Description
300 Multiple Choices
4XX Codes 301 Moved Permanently
SIP Message Code Description Description 302 Moved Temporarily
400 Bad Request 429 Provide Referrer Identity 305 Use Proxy
401 Unauthorized 430 Flow Failed 380 Alternative Service
402 Payment Required 433 Anonymity Disallowed
403 Forbidden 436 Bad Identity-Info 5XX Codes
404 Not Found 437 Unsupported Certificate SIP Message Code Description
405 Method Not Allowed 438 Invalid Identity Header 500 Server Internal Error
406 Not Acceptable 439 First Hop Lacks Outbound Support 501 Not Implemented
407 Proxy Authentication Required 440 Max-Breadth Exceeded 502 Bad Gateway
408 Request Timeout 469 Bad Info Package 503 Service Unavailable
410 Gone 470 Consent Needed 504 Server Time-out
412 Conditional Request Failed 480 Temporarily Unavailable 505 Version Not Supported
413 Request Entity Too Large 481 Call/Transaction Does Not Exist
414 Request-URI Too Long 482 Loop Detected 6XX Codes
415 Unsupported Media Type 483 Too Many Hops SIP Message Code Description
416 Unsupported URI Scheme 484 Address Incomplete 600 Busy Everywhere
417 Unknown Resource-Priority 485 Ambiguous 603 Decline
420 Bad Extension 486 Busy Here 604 Does Not Exist Anywhere
421 Extension Required 487 Request Terminated 606 Not Acceptable
422 Session Interval Too Small 488 Not Acceptable Here
423 Interval Too Brief 489 Bad Event
Information Security Level 2 – Sensitive
102 424
© 2017 – Proprietary & Confidential Information of Amdocs 491
Bad Location Information Request Pending
428 Use Identity Header 493 Undecipherable
IMS SIP registration call flow
1) The IMS client attempts to register by sending a REGISTER request
to the P-CSCF.
2) The P-CSCF forwards the REGISTER request to the I-CSCF.
3) The I-CSCF polls the HSS for data used to decide which S-CSCF
should manage the REGISTER request. The I-CSCF then makes
that decision.
4) The I-CSCF forwards the REGISTER request to the appropriate S-
CSCF.
5) The S-CSCF typically sends the P-CSCF a 401 (UNAUTHORIZED)
response as well as a challenge string in the form of a “number
used once” or “nonce”.
6) The P-CSCF forwards the 401 – UNAUTHORIZED response to the UE.
7) Both the UE and the network have stored some Shared Secret
Data (SSD), the UE in its ISIM or USIM and the network on the HSS.
The UE uses an algorithm per RFC 33101 (e.g. AKAv2-MD5) to
hash the SSD and the nonce.” The UE sends a REGISTER request to
the P-CSCF. This time the request includes the result of the hashed
nonce and SSD.
8) The P-CSCF forwards the new REGISTER request to the I-CSCF.
9) The I-CSCF forwards the new REGISTER request to the S-CSCF.
10) The S-CSCF polls the HSS (via the I-CSCF) for the SSD, hashes it
against the nonce and determines whether the UE should be
allowed to register. Assuming the hashed values match, the S-
CSCF sends 200 – OK response to the P-CSCF. At this point an
IPSec security association is established by the P-CSCF.
11) The P-CSCF forwards the 200 – OK response to the UE.

Information Security Level 2 – Sensitive

103 © 2017 – Proprietary & Confidential Information of Amdocs
Volte Analysis example
Layer 3 Analysis E2E- Tektronix Analysis

Information Security Level 2 – Sensitive

104 © 2017 – Proprietary & Confidential Information of Amdocs
Thank you