S-TMSI usage and allocation process

During which procedure the S-TMSI  (SAE-Temporary Mobile Subscriber Identity) is allocated?

Answer could be put as a one-liner, during the Attach procedure.

Going little bit deeper into the details..
At the time of initial attach (so I would say IMSI not GUTI attach, what is the difference? Check here What is GUTI and IMSI attach) procedure, the UE sends Att Req with IMSI to the Network to process the Request. If it's successful the MME will reply with Attach Accept message which contain the GUTI as one of the IE (Information Element).

Based on article IMSI, TMSI and GUTI - how they are created (and 3GPP Specs) we know that GUTI consist from MCC, MNC, MME Group ID, MME Code and M-TMSI.

What is M-TMSI (MME-Temporary Mobile Subscriber Identity)?
M-TMSI represents a TMSI in MME area.


Last statement on allocation topic is left to say that S-TMSI is being created from MME Code and M-TMSI. The S-TMSI represents the TMSI in MME pool area.

During the Attach process MME creates the UE Context and assigns the S-TMSI to it. Later this UE Context holds user subscription information fetched from HSS in Authentication process. The local (in MME) storage of subscription allows faster execution of procedures such as bearer establishment because it removes the need to consult the HSS each time.

Source(s):

own experience,

3GPP Spec

DIAMETER based interfaces in EPC, UMTS and IMS

Recently I've seen question regarding on which interface in LTE or UMTS the DIAMETER protocol is used.

Basically DIAMETER is an Authentication, Authorization & Accounting (AAA)  protocol. That is why any of you will see DIAMETER used for these functions.

                    S6a - Authentication, more in TS 29.272
                    Gy - Prepaid charging, more in TS 23.203, TS 32.299;
                    Gz - Postpaid charging;
                    Gx - QoS/Policy, more in TS 29.211, TS 29.212;
                    Rf - Charging, more in TS 32.299;
                    Ro - Charging, more in TS 32.299;
                    Rx - QoS/Policy, more in TS 29.214;
                    S6d - Authentication;
                    S9 - QoS/Policy;
                    Sh - Subscriber Profile;
                    Cx - Subscriber Profile;
                    e2 - Location.
But also few others specific to IMS

Resource: Basic LTE call flows and tutorials

Found this when surfing the web, maybe any of you will find it useful.
Most of the topics I've covered here, but this looks good for a Radio/Device reference.

Follow the link to get more, resource

Source:
LinkedIn, Internet

Extended Service Request procedure

The Extended Service Request and Service Request are same procedure just used for different purposes.
To make it simple, the below are color-coded. The cases when the Extended Service Request are triggered are marked light blue, the cases in black trigger Service Request procedure.

 Service Request triggers

a)    the UE in EMM-IDLE mode receives a paging request with CN domain indicator set to "PS" from the network;
b)    the UE, in EMM-IDLE mode, has pending user data to be sent;
c)    the UE, in EMM-IDLE mode, has uplink signalling pending;
d)    the UE in EMM-IDLE or EMM-CONNECTED mode is configured to use CS fallback and has a mobile originating CS fallback request from the upper layer;
e)    the UE in EMM-IDLE mode is configured to use CS fallback and receives a paging request with CN domain indicator set to "CS", or the UE in EMM-CONNECTED mode is configured to use CS fallback and receives a CS SERVICE NOTIFICATION message;
f)    the UE in EMM-IDLE or EMM-CONNECTED mode is configured to use 1xCS fallback and has a mobile originating 1xCS fallback request from the upper layer;
g)    the UE in EMM-CONNECTED mode is configured to use 1xCS fallback and accepts cdma2000® signalling messages containing a 1xCS paging request received over E-UTRAN;
h)    the UE, in EMM-IDLE mode, has uplink cdma2000® signalling pending to be transmitted over E-UTRAN;
i)    the UE, in EMM-IDLE or EMM-CONNECTED mode, is configured to use 1xCS fallback, accepts cdma2000® signalling messages containing a 1xCS paging request received over cdma2000®  1xRTT, and the network supports dual Rx CSFB or provide CS fallback registration parameters; or
j)    the UE, in EMM-IDLE or EMM-CONNECTED mode, has uplink cdma2000® signalling pending to be transmitted over cdma2000® 1xRTT, and the network supports dual Rx CSFB or provide CS fallback registration parameters.

LTE EPS Session Management timers - ESM timers

Previously I've shared the EMM timers, today it's a EPS Session Management

LTE EPS mobility management timers - EMM timers

Lately many times I had to reach towards the EPS Mobility Management (EMM) timers, because it took me some time to google them here you go. Hope any one will find them as useful I did. 

In the two tables you can easily find the times name it's default or suggested value, what is triggering it and what happens in case it will finally expire.

Circuit Switched Fallback CSFB - Mobile Terminating call in idle mode

Previously I've covered the topic of CSFB when MT is in active mode. Today the below will cover situation when UE MT is in idle mode.

Fig. 1. CS Call with CSFB with MT UE in IDLE

1. G MSC receives IAM.
2. For the Send Routing Info (SRI) procedure please go to TS 23.018 3GPP.
3. G MSC sends IAM to the MSC on the terminating side.
4. The MME receives a Paging Request with MT side IMSI message from the MSC over a SGs interface. IMSI is used by the MME to find the S TMSI which is used as the paging address on the radio interface. If location information is reliably known by MME (i.e. MME stores the list of TAs), the MME shall page the UE in all the TAs. If the MME does not have a stored TA list for the UE, the MME should use the location information received from the MSC to page the UE.
This procedure takes place before step 3, immediately after MSC receives MAP_PRN from HSS, if pre-paging is deployed.
If the MME receives a Paging Request message for an UE which is considered as detach for EPS services, the MME sends the Paging reject message to the MSC with an appropriate cause value. This rejection triggers the MSC to page the UE over A or Iu-cs interface.
In case of a CS fallback capable UE in NMO II or III, there is a case where, for example, the MME releases the SGs association due to the UE idle mode mobility while the VLR still maintains the SGs association.
5. If the MME did not return an "SMS-only" indication to the UE during Attach or Combined TA/LA Update procedures, the MME sends a Paging message to each eNodeB. The Paging message includes a suitable UE Identity (i.e. S TMSI or IMSI) and a CN Domain Indicator that indicates which domain (CS or PS) initiated the paging message. In this case it shall be set to "CS" by the MME.
If the MME returned the "SMS-only" indication to the UE during Attach or Combined TA/LA Update procedures, the MME shall not send the paging to the eNodeBs and sends Paging Reject towards MSC to stop CS Paging procedure and this CSFB procedure stops.
6. The radio resource part of the paging procedure takes place. The message contains a suitable UE Identity (i.e. S TMSI or IMSI) and a CN Domain indicator.
7a. The UE establishes an RRC connection and sends an Extended Service Request (CS Fallback Indicator) to MME. The UE indicates its S-TMSI in the RRC signalling. The Extended Service Request message is encapsulated in RRC and S1 AP messages. The CS Fallback Indicator indicates to the MME that CS Fallback for this UE is required. The MME sends the SGs Service Request message to the MSC containing an indication that the UE was in idle mode (and hence, for example, that the UE has not received any Calling Line Identification information). Receipt of the SGs Service Request message stops the MSC retransmitting the SGs interface Paging message.
In order to avoid the calling party experiencing a potentially long period of silence, the MSC may use the SGs Service Request message containing the idle mode indication as a trigger to inform the calling party that the call is progressing.
7b.MME sends S1 AP: Initial UE Context Setup to indicate the eNodeB to move the UE to UTRAN/GERAN. The registered PLMN for CS domain is identified by the PLMN ID included in the LAI, which is allocated by the MME.
7c. (not visable above) The eNodeB shall reply with S1-AP: Initial UE Context Setup Response message.

Circuit Switched Fallback CSFB - Mobile Terminating Call in Active mode, no PS HO

Recently CSFB is biggest thing I'm struggling with, because of that I went through many pages of Spec for Circut Switch Fallback and decided this is a very good topic to cover here. 

CS Fallback enables Circuit Switch (CS) based voice and supplementary services to be offered together with LTE access. To allow subscribers to use existing CS based services such as voice voice, supplementary services and location based services from 3G/2G networks. CSFB temporarily moves subscriber from LTE down to 3G/2G during the call setup process. When the call is finished the UE should reselect the LTE network

Procedure described below is for case where there PS HO is not supported.

Fig. 1. CS Paging over SGs in 4G, Call in 3G/2G

Vodafone UK went live with 4G

Recently I was providing (with one colleague Svetlin) the optimization services for EPC for VF-UK, that's why the below touches me also. Today Vodafone went live with proposed developed/deployed and solution optimized by the team and myself.
It's my 3rd LTE launch, but I'm happy as always because of success.

Here are few pictures, as the day like that you just have to start with booze and sweet cupcakes.

It was a good day.

Terminating the SMS over SGs interface

All the best to you on the workaholic day! As I was told by the BBC in the morning.

Recently I've been asked to investigate curious case which on the SMS duplicates. On the end it appeared it's more than just duplicates issue, but because of confidentiality agreements I will not speak about that.

From the begining I would like to add that on the bottom of this article you will find a trace from live MME node. Sometimes to see the real signaling is better than just the call flow. Also I have to add that the trace was collected only on the MME, that's why signaling steps not involving the MME are not present there.

SMS over the SGs

SMS Active Mode

As the Figure 1 caption stays presented call flow is for the idle mode.
According to the specification the if the UE is in active mode, the only difference is that steps 6, 7, 8 are missing, also in the step 9d the MME includes the E-CGI and TAI. 

SMS Idle Mode

At first I would like to start with the call flow, so here it is.

Fig. 1. Mobile terminating the SMS - idle mode

DNS Record Types used in EPC

It's been a while, so I will better start.
Previously, I hope, I've managed to shed some light on the DNS in EPC in general, from high above, form. Today I would like to present a records that are used in the LTE EPC deployments I've been involved into.

DNS A & AAAA records

A records (or ‘Address Records’) return an IPv4 address. This is most commonly used to map hostnames to an IPv4 address. Alternatively it is also used by some applications for subnet masks.

AAAA records return an IPv6 address. This is most commonly used to map hostnames to an IPv6 address of the host.

Example of an A record:

topon.nodes.pgw.be.epc  IN   A       212.183.156.177
topon.nodes.pgw.ms.epc  IN   A       212.183.156.179

where IN = Internet, A = A-record.

Example of an AAAA record:

topon.nodes.pgw.be.epc  IN   AAAA     2600:1800:5::10
topon.nodes.pgw.ms.epc  IN   AAAA     2600:1800:5::20

where IN = Internet, AAAA = AAAA-record.

DNS SRV records

DNS Resource Records (RR) for specifying the location of services (DNS SRV). Clients can ask for a specific service/protocol for a specific domain, and get back the names of any available servers.

Example of an SRV record:

; SRV Records
; _Service._proto.Name    TTL    Class    SRV    Priority    Weight  Port    Target
; SRV records for SGW
; There are multiple A records for each site to account for future nodes as there will be two PGWs at xBE and xMS.
topon.nodes.sgw.be.epc    IN    SRV    1    100    2123  node1.sgw.be.epc.mnc01.mcc234.3gppnetwork.org.
;topon.nodes.sgw.be.epc    IN    SRV    1    100    2123  node2.sgw.be.epc.mnc01.mcc234.3gppnetwork.org.
topon.nodes.sgw.ms.epc    IN    SRV    1    100    2123  node1.sgw.ms.epc.mnc01.mcc234.3gppnetwork.org.
;topon.nodes.sgw.ms.epc    IN    SRV    1    100    2123  node2.sgw.ms.epc.mnc01.mcc234.3gppnetwork.org.

The SRV record is formed of the following fields:

Priority – (=1 in the above example) a client must attempt to contact the target host with the lowest-numbered priority it can reach. Target hosts with the same priority should be tried in an order defined by the weight field.

Weight – (=100 in the above example) specifies a relative weight for entries with the same priority. Larger weights should be given a proportionally higher probability of being selected. A target with a weight of 0 corresponds to a backup.
Port – (=2123 [GTP] in the above example) is the port number assigned to the symbolic service specified in the record.
The system should compute the sum of all weights of those RRs having the lowest, identical precedence. Then choose a random number between 0 and the sum computed.  Select the target associated to this random value.

DNS NAPTR records

Name Authority Pointer (NAPTR) resource records specify lookup services for a wide variety of resources names. When applied to an existing string, NAPTR will produce a new domain label or URI.
With EPC, we will use a variation called S-NAPTR where the regular-expression is empty. Straightforward NAPTR (S-NAPTR) is used to add particular services to a DNS entry. The result of this is that the DNS server can reply back to the query with a service-protocol specific entry. S-NAPTR records are particularly common with mail-reading applications whereby the DNS server can have separate S-NAPTR records for the POP3 and IMAP4 protocols.
When using S-NAPTR, the DNS query does not indicate the ‘service:protocol’ needed. The DNS server will provide all S-NAPTR requested and the DNS client will consider the ones matching only the desired ‘service:protocol’.

Example of a NAPTR record

wap.operator.com.apn.epc.mnc01.mcc234.3gppnetwork.org. IN NAPTR 1 5  "a"  "x-3gpp-pgw:x-gn"   "" topon.nodes.pgw.be.epc.mnc01.mcc234.3gppnetwork.org.

The NAPTR record is formed of the following fields:

Order – (=1 in above example) a client must attempt to contact the target host with the lowest-numbered order it can reach. Target hosts with the same order should be tried in an order defined by the preference field. The DNS client should not consider any NAPTR with higher value for order.

Preference – (=5 in above example) specifies how NAPTR with equal order should be processed. Low numbers are being processed before high numbers.  A client may look at record with higher preference values if it has good reasons to do so such as not understanding the preferred protocol or service.
The important difference between Order and Preference is that once a match is found, the client must not consider records with a different order but they may process records with the same Order but different Preferences.
In other words, Preference is used to give weight to rules that are considered the same from an authority standpoint but not from a simple load-balancing standpoint.

Flags – (=a in above example) controls aspects of rewriting and interpretation in the record. While other flags are allowed with NAPTR, only "S", "A" or "" are allowed with S-NAPTR.

• The "S" Flag means that the next lookup should be for SRV records.
• The "A" Flag means that the next lookup should be either for A, AAAA records.
•  An empty flag " " means that more NAPTR RR lookups are to be performed.

Source:
My own experience

DNS in Evolved Packet Core (EPC)

Lately the DNS topic was addressed here, I'm happy to get back to you with more on this.
Hope you will find more detailed description of usage of DNS in EPC. The below is detailed description of, I think, most important from the DNS topic with examples of dns zone files.

UPDATE: For more info on how the EPC uses the DNS please refer to DNS in LTE label.

Home Network Domain

The Home network Domain will be in the form ‘epc.mnc<mnc-val>.mcc<mcc-val>.3gppnetwork.org’

Both <mnc-val> and <mcc-val> are 3 digits long. If the MNC of the PLM is 2 digits, then a zero shall be added at the beginning.
The Home network domain for some example Operator will be:

epc.mnc456.mcc123.3gppnetworks.org

The Home Network Domain name of an IMSI can be derived by taking the first 5 or 6 digits (depending on whether a 2 or 3 digit mnc is used), use the MNC and MNC values derived to form the domain name, add the label epc at the beginning of the domain name.
For example an IMSI 1234560123456789 has an MSIN 0123456789 and a Home network domain name of epc.mnc456.mcc123.3gppnetworks.org.

Fig. 1. DNS subdomains in EPC

The below example shows how the APN-FQDN is formed:

APN FQDN = internet.apn.epc.mnc015.mcc234.3gppnetwork.org

which consists of:

• APN Network Identifier (APN-NI) - Basically it's the APN name, from UE point of view.

APN-NI = internet

• APN Operator Identifier (APN-OI) - levels equal and below to APN level from DNS configuration point of view
  Or just the rest what is left from APN-FQDN when you remove the APN (-NI) from it.

APN-OI = .apn.epc.mnc015.mcc234.3gppnetwork.

• APN Network Identifier (APN-NI) - Basiclly it's the APN name, from UE point of view.

APN-NI = internet

Whenever configuring the DNS, no matter if this is the one you will used by any Operator in EPC deployment you are doing or just for yourself, dont forget the dots "." they are freaking important.

HSS Selection

This is the last point to cover from the list I was presenting many times by now, and the section DNS in LTE will be finished.
Of course if I will face some interesting or will find somewhere example of DNS file will parse it and put it here, so any of you could reuse it.

Last but not least, the HSS Selection procedure.

The Diameter Proxy/Edge agent performs a NAPTR query (as to RFC 3403) for a HSS server in a particular diameter realm (for example, the HPMN or the roaming hub).
These NAPTR records provide a mapping from a domain to the SRV record for contacting a server with the specific transport protocol in the NAPTR services field.  The services relevant for the task of transport protocol selection are those with NAPTR service fields with values “AAA+D2x”, where x is a letter that corresponds to a transport protocol supported by the domain, i.e. D2S is for SCTP.

Source(s):
From my own experience 

Greetings Polish Engineers

This post has noting in common with LTE, ok, maybe a little bit.

Lately, more or less since when P4 and PTC have won LTE frequencies, I've noticed traffic from Poland. Before February '13.. maybe one pageview in a 2-3months period, and now look like you guys are preparing for the launch or gathering info on this topic.

So... as I speak kinda fluent Polish..
Powodzenia Panowie pracownicy polskich operatorów komórkowych i niech wam LTE lekkim będzie. - All the best Gents, I wish you smooth LTE deployment.

Pick a proper vendor and you'll be fine, ah and yes, you can hire me also. ;-D

SGSN Selection procedure

As I said the last time, all points of the list below will be covered.
Until now I've covered the MME Selection, PGW and SGW Selection - both can be found through links.
So Now I will start with SGSN Selection (5th point on the list below), and later today will try also to publish the idea of HSS Selection.

Anniversary 40 years of mobile calls

I'm a little bit late, but still I think this is bigger or smaller anniversary for all of us and because of that all the best to all of you telecom-interested and/or telecom-engineers mates!

"The first mobile phone call was made 40 years ago today, on 3 April 1973."
more: http://www.bbc.co.uk/news/technology-22013228

Some other LTE resource

Just noticed that someone (Bandwidther thaks for sharing links mate!) put links to this blog on his forum. I went there and it looks like guy(s) are creating community which is worth participate in.
I did not read through, but on the first sight there are many sections including the LTE but also 2G, 3G and even the US version of 3G ;-)

Check it on your own

Bandwidther - Wireless Communication forum

 

What is GUTI and IMSI attach

Just found this as a way that someone joined this blog.
Because I always wanted to start like that..   

Dear wanderer..

If you would ask me to put it simple and shallow way, which I'm trying doing right now, I would say:

Difference between those two is very simple and answer to this question is what really GUTI is and why we are using GUTI in general.

So, GUTI (Globally Unique Temporary UE Identity), is used more or less is to hide "real identity" of the subscriber which is called  IMSI. The less you use IMSI the safer you can feel. Period.

Please keep in mind that it's simple and shallow explanation, and that the GUTI is used in more cases than the one mentioned above.

For more info please refer to LTE Attach article as well to article that cover the IMSI TMSI and GUTI topic.

You could be also interested in Combined Attach information

Source:
from my own experience

PGW and SGW Selection procedures in LTE

Last time it was about MME Selection, and today I will cover the PGW and SGW selection as well.
All other points will cover in details in few next days. Also, I'm aware that good example is worth few thousands words, that's why will provide a iDNS configuration as a separate article with all those NAPTR and so on explained.

Possible selection scenarios

As last time, same list of selection scenarios in which EPS Nodes send the DNS Query message to the Internal DNS (iDNS) for the selection of EPS nodes.

Periodic Tracking Area Update (TAU) - T3412 timer

Today I was asked about the Periodic Tracking Area Update. Question was what is happening when the UE is in one place cell or TA in general.

So here is what the Spec Rel 9. is saying about it.

Periodic TAU

Periodic tracking area updating is used to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by the periodic tracking area update timer (timer T3412). The value of timer T3412 is sent by the network to the UE in the ATTACH ACCEPT message and can be sent in the TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received.

No Periodic TAU case

If the timer T3412 received by the UE in an ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT contains an indication that the timer is deactivated or the timer value is zero, then the timer T3412 is deactivated and the UE shall not perform periodic tracking area updating procedure.

This part is a small change in Spec comparing to Rel 8. I feel this is because Machine to Machine (M2M) communication will take more part in overall. Because what else could be a reason to resign from (Periodic) TAUs?

Timer's behavior

The timer T3412 is reset and started with its initial value, when the UE goes from EMM-CONNECTED to EMM-IDLE mode. The timer T3412 is stopped when the UE enters EMM-CONNECTED mode or EMM-DEREGISTERED state.

How MME is selected - MME Selection procedure

It's beed a while from last time, but here we go. Many times I saw people accesing this site looking for MME seletcion, or how LTE pick MME/SGW/PGW nodes. Hope the below clarifies.


In each LTE network the Internet Domain Name System (DNS) is widely used to handle the Dynamic Peer selection of the PDN-GW, SGW, MME, SGSN and HSS within the network. We could use statistic assingments but, hey! belive me, DNS is much easier if handled properly.

In a few days I will try to cover the details of DNS config for points mentioned below - stay tunned.

EPS Nodes sends the DNS Query message to the Internal DNS (iDNS) for the selection of EPS nodes for the following uses cases.

1. As part of the UE Attach the eNB will query the iDNS Server using the TAI for the address of the MME it should provide to that UE.
2. During UE attach the MME query the iDNS Server to select the PDN-GW (Packet Data Network Gateway, PGW) where a requested (subscribed) PDN connectivity (APN) is located. Selection can be based on the information provided to the MME, when the UE attaches to the network.
3. Following the PGW selection, the MME query the DNS Server to select an available SGW to serve the UE using the TAC, which in most cases is based on network topology and the location of the UE within the network, so that the best SGW is selected.
4. SGSN will query the DNS Server to resolve the Old MME using LAC, and RAC (taken from Old GUTI received from UE) during LTE to 3G/2G Handover.
5. MME will query the DNS Server to resolve the Old SGSN using NRI, LAC, and RAC (taken from P-TMSI received from UE) during 3G/2G to LTE Handover.
6. During attach the MME is configured to support the HSS Peer Service and Interface Associations towards the Diameter proxy/edge agent. These are static configurations in the MME towards the Diameter Proxy and no DNS query is initiated by the MME to select the Diameter Proxy.

Today it will about two of them referring to MME Selection, and the list above will be copied few times more when covering the SGW, PGW, SGSN and HSS selection.