S-TMSI usage and allocation process

During which procedure the S-TMSI  (SAE-Temporary Mobile Subscriber Identity) is allocated?

Answer could be put as a one-liner, during the Attach procedure.

Going little bit deeper into the details..
At the time of initial attach (so I would say IMSI not GUTI attach, what is the difference? Check here What is GUTI and IMSI attach) procedure, the UE sends Att Req with IMSI to the Network to process the Request. If it's successful the MME will reply with Attach Accept message which contain the GUTI as one of the IE (Information Element).

Based on article IMSI, TMSI and GUTI - how they are created (and 3GPP Specs) we know that GUTI consist from MCC, MNC, MME Group ID, MME Code and M-TMSI.

What is M-TMSI (MME-Temporary Mobile Subscriber Identity)?
M-TMSI represents a TMSI in MME area.


Last statement on allocation topic is left to say that S-TMSI is being created from MME Code and M-TMSI. The S-TMSI represents the TMSI in MME pool area.

During the Attach process MME creates the UE Context and assigns the S-TMSI to it. Later this UE Context holds user subscription information fetched from HSS in Authentication process. The local (in MME) storage of subscription allows faster execution of procedures such as bearer establishment because it removes the need to consult the HSS each time.

Source(s):

own experience,

3GPP Spec

Terminating the SMS over SGs interface

All the best to you on the workaholic day! As I was told by the BBC in the morning.

Recently I've been asked to investigate curious case which on the SMS duplicates. On the end it appeared it's more than just duplicates issue, but because of confidentiality agreements I will not speak about that.

From the begining I would like to add that on the bottom of this article you will find a trace from live MME node. Sometimes to see the real signaling is better than just the call flow. Also I have to add that the trace was collected only on the MME, that's why signaling steps not involving the MME are not present there.

SMS over the SGs

SMS Active Mode

As the Figure 1 caption stays presented call flow is for the idle mode.
According to the specification the if the UE is in active mode, the only difference is that steps 6, 7, 8 are missing, also in the step 9d the MME includes the E-CGI and TAI. 

SMS Idle Mode

At first I would like to start with the call flow, so here it is.

Fig. 1. Mobile terminating the SMS - idle mode

HSS Selection

This is the last point to cover from the list I was presenting many times by now, and the section DNS in LTE will be finished.
Of course if I will face some interesting or will find somewhere example of DNS file will parse it and put it here, so any of you could reuse it.

Last but not least, the HSS Selection procedure.

The Diameter Proxy/Edge agent performs a NAPTR query (as to RFC 3403) for a HSS server in a particular diameter realm (for example, the HPMN or the roaming hub).
These NAPTR records provide a mapping from a domain to the SRV record for contacting a server with the specific transport protocol in the NAPTR services field.  The services relevant for the task of transport protocol selection are those with NAPTR service fields with values “AAA+D2x”, where x is a letter that corresponds to a transport protocol supported by the domain, i.e. D2S is for SCTP.

Source(s):
From my own experience 

PGW and SGW Selection procedures in LTE

Last time it was about MME Selection, and today I will cover the PGW and SGW selection as well.
All other points will cover in details in few next days. Also, I'm aware that good example is worth few thousands words, that's why will provide a iDNS configuration as a separate article with all those NAPTR and so on explained.

Possible selection scenarios

As last time, same list of selection scenarios in which EPS Nodes send the DNS Query message to the Internal DNS (iDNS) for the selection of EPS nodes.

Periodic Tracking Area Update (TAU) - T3412 timer

Today I was asked about the Periodic Tracking Area Update. Question was what is happening when the UE is in one place cell or TA in general.

So here is what the Spec Rel 9. is saying about it.

Periodic TAU

Periodic tracking area updating is used to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by the periodic tracking area update timer (timer T3412). The value of timer T3412 is sent by the network to the UE in the ATTACH ACCEPT message and can be sent in the TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received.

No Periodic TAU case

If the timer T3412 received by the UE in an ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT contains an indication that the timer is deactivated or the timer value is zero, then the timer T3412 is deactivated and the UE shall not perform periodic tracking area updating procedure.

This part is a small change in Spec comparing to Rel 8. I feel this is because Machine to Machine (M2M) communication will take more part in overall. Because what else could be a reason to resign from (Periodic) TAUs?

Timer's behavior

The timer T3412 is reset and started with its initial value, when the UE goes from EMM-CONNECTED to EMM-IDLE mode. The timer T3412 is stopped when the UE enters EMM-CONNECTED mode or EMM-DEREGISTERED state.

How MME is selected - MME Selection procedure

It's beed a while from last time, but here we go. Many times I saw people accesing this site looking for MME seletcion, or how LTE pick MME/SGW/PGW nodes. Hope the below clarifies.


In each LTE network the Internet Domain Name System (DNS) is widely used to handle the Dynamic Peer selection of the PDN-GW, SGW, MME, SGSN and HSS within the network. We could use statistic assingments but, hey! belive me, DNS is much easier if handled properly.

In a few days I will try to cover the details of DNS config for points mentioned below - stay tunned.

EPS Nodes sends the DNS Query message to the Internal DNS (iDNS) for the selection of EPS nodes for the following uses cases.

1. As part of the UE Attach the eNB will query the iDNS Server using the TAI for the address of the MME it should provide to that UE.
2. During UE attach the MME query the iDNS Server to select the PDN-GW (Packet Data Network Gateway, PGW) where a requested (subscribed) PDN connectivity (APN) is located. Selection can be based on the information provided to the MME, when the UE attaches to the network.
3. Following the PGW selection, the MME query the DNS Server to select an available SGW to serve the UE using the TAC, which in most cases is based on network topology and the location of the UE within the network, so that the best SGW is selected.
4. SGSN will query the DNS Server to resolve the Old MME using LAC, and RAC (taken from Old GUTI received from UE) during LTE to 3G/2G Handover.
5. MME will query the DNS Server to resolve the Old SGSN using NRI, LAC, and RAC (taken from P-TMSI received from UE) during 3G/2G to LTE Handover.
6. During attach the MME is configured to support the HSS Peer Service and Interface Associations towards the Diameter proxy/edge agent. These are static configurations in the MME towards the Diameter Proxy and no DNS query is initiated by the MME to select the Diameter Proxy.

Today it will about two of them referring to MME Selection, and the list above will be copied few times more when covering the SGW, PGW, SGSN and HSS selection.

X2-based handover without SGW relocation

Last article was about IMSI, TMSI and GUTI, and how they are created, it was also mentioned there that GUTI is used in handover (HO) procedure. I thought that today is a good time to say few words about handover.
There are two general types of handovers in LTE.

• X2 based, and
• S1 based

In this article I'm going to describe only X2 based HO and to be perfectly honest with you I have to admit, that I will publish information about X2 based handover with case where no SGW is changed.

For others types please look for different article (After publishing articles describing other HOs I will update this line with direct links. [Update-16-03-2012] First one is X2-based handover with SGW relocation).

All of this information you can find by yourself just by reading 3GPP TS 23.401.

As always it's good to start with general picture, so here it is.

Fig. 1. UE is moving from old to new RAN coverage provided by eNodeB,

As you can see, green arrow is demonstrating UE movement between two eNodeBs controlled by the same MME. Such procedure as you should know is called a handover. In this procedure every bearer set between UE and PGW will be moved to new eNodeB(if target eNodeB is able to handle them).
Please see below general description of X2-based handover according to specyfication.

Interfaces and their protocol stacks

After familiarising with main network elements, time has come to better know interfaces between those elements.
Interfaces are allowing MME, SGW and PGW cooperating with other network elements( e.g. HSS or PCRF).
Each one of them is built in standardised way described by 3GPP.org. Each interface described here is taken from 23.401 3GPP.org documentation.
Please keep in mind, that the documentation is (sometimes) bigger than we need it to be, so not every aspect of interfaces is described here.

Lets start with big picture of situation in which user is not roaming.

Fig.1. Non-roaming architecture by 3GPP

Functions of main LTE packet core elements - MME, SGW, PGW

Now when I have to start writing, I'm looking deep into back of my skull, to figure out with what I have my first LTE-like problem. And you know what? I don't remember.
So maybe the best way of starting anything is to start (writing) from the beginning.
Let's have a closer look at three main packet core elements of LTE network.

MME - Mobility Management Entity
MME is the key control node for LTE access network. It is responsible for tracking and paging procedure including retransmissions, and also for idle mode of User Equipment (UE). MME is also involved in bearer activation and its deactivation procedures, to its task also belongs choosing the SGW for a UE in process of initial attach and when the intra-handover take place which involves Core Network (CN) node relocation.
MME is responsible for authenticating user towards the HSS, if user is roaming MME terminates S6a interface towards user's home HSS. All Non Access Stratum (NAS) signaling terminates at the MME point, which is also responsible for generation and allocation of temporary UE identities (GUTI). Among its duties is also authorization UE to Public Land Mobile Network (PLMN) and enforcing UE roaming restrictions if there are any. MME is also termination point of ciphering and integrity protection for NAS signaling. Lawful Interception (LI) of signaling could be also supported by MME entity. It also provides the control plane function for mobility between LTE and 2G/3G networks by the S3 interface( from SGSN to MME).