1

2
There are several domains in EPS each one a grouping of logical nodes that interwork
to provide a specific set of functions in the network.

A network implementing 3GPP specification is illustrated above.

On the left of the diagram are four clouds that represent different RAN domains that
can connect to the EPC, including the second and third generation of mobile access
networks specified by 3GPP, more commonly known as GSM and WCDMA
respectively.

LTE is of course the latest mobile broadband radio access as defined by 3GPP.

Finally there is the domain called non-3GPP access networks. This denotes any packet
data access network that is not defined by 3GPP standardisation processes, e.g.
eHRPD, WLAN, fixed network accesses or some combination of these.

This also means that 3GPP does not specify the details about these access
technologies – these specifications are instead handled by other standardisation
bodies such as 3GPP2, IEEE, or Broadband Forum.

Interworking with these access technologies is discussed later in the course.

3
The diagram above illustrates the complete architecture developed for EPS, together
with the Packet Core domain defined prior to EPC.

It also shows how the connection to this ‘old’ 3GPP packet core is designed (in fact
this specific connection comes in two flavours itself, a fact that adds to the complexity
of the diagram, but more about that later).

The diagram illustrates the complete architecture, including support for

interconnection of just about any packet data network one can think of.

It is unlikely that any single network operator would make use of all these logical
nodes and interfaces; this means that deployment options and interconnect options
are somewhat simplified.

4
The EPC is a new, high-performance, high-capacity all-IP core network for LTE.

EPC addresses LTE requirements to provide advanced real-time and media-rich

services with enhanced Quality of Experience (QoE).

EPC improves network performance by the separation of control and data planes and
through a flattened IP architecture, which reduces the hierarchy between mobile data
elements (for example, data connections from eNodeB only traverse through EPC
gateways).

The diagram shows the EPC as a core part of the all-IP environment of LTE.

The EPC is realized through four new elements:

• Serving Gateway (SG-W)
• Packet Data Network (PDN) Gateway (PGW)
• Mobility Management Entity (MME)
• Policy and Charging Rules Function (PCRF)
While SGW, PGW and MME are introduced in 3GPP Release 8, PCRF was introduced in
3GPP Release 7. Until now, the architectures using PCRF have not been widely
adopted.
The PCRF’s interoperation with the EPC gateways and the MME is mandatory in
Release 8 and essential for the operation of the LTE.

5
Serving Gateway
The SGW is a data plane element whose primary function is to manage user-plane
mobility and act as a demarcation point between the RAN and core networks.

SGW maintains data paths between eNodeBs and the PDN Gateway (PGW).

From a functional perspective, the SGW is the termination point of the packet data
network interface towards E-UTRAN.

When terminals move across areas served by eNodeB elements in E-UTRAN, the SGW
serves as a local mobility anchor.

This means that packets are routed through this point for intra E-UTRAN mobility and
mobility with other 3GPP technologies, such as 2G/GSM and 3G/UMTS.

6
Like the SGW, the Packet Data Network Gateway (PDN GW) is the termination point of
the packet data interface towards the Packet Data Network(s).
As an anchor point for sessions towards the external Packet Data Networks, the PDN
GW supports:
• Policy enforcement features (applies operator-defined rules for resource
allocation and usage)
• Packet filtering (for example, deep packet inspection for application type
detection)
• Charging support (for example, per-URL charging)

In LTE, data plane traffic is carried over virtual connections called service data flows
(SDFs). SDFs, in turn, are carried over bearers — virtual containers with unique QoS
characteristics. The diagram above illustrates the scenario where one or more SDFs
are aggregated and carried over one bearer.

One bearer, a data-path between a UE and a PDN, has three segments:

• Radio bearer between UE and eNodeB
• Data bearer between eNodeB and SGW (S1 bearer)
• Data bearer between SGW and PGW (S5 bearer)
The lower diagram illustrates three segments that constitute an end-to-end bearer.
The primary role of a PGW is QoS enforcement for each of these SDFs, while SGW
focuses on dynamic management of bearers.

7
The Mobility Management Entity (MME) is a nodal element within the LTE EPC.
It performs the signalling and control functions to manage the User Equipment (UE)
access to network connections, the assignment of network resources, and the
management of the mobility states to support tracking, paging, roaming and
handovers.
MME controls all control plane functions related to subscriber and
session management.
MME manages thousands of eNodeB elements, which is one of the key differences
from requirements previously seen in 2G/3G (on RNC/SGSN platforms).
The MME is the key element for gateway selection within the EPC (Serving and PDN).
It also performs signalling and selection of legacy gateways for handovers for other
2G/3G networks. The MME also performs the bearer management control functions
to establish the bearer paths that the UE/ATs use.

The MME supports the following functions:

• Security procedures: End-user authentication as well as initiation and
negotiation of ciphering and integrity protection algorithms.
• Terminal-to-network session handling: All the signalling procedures used to
set up packet data context and negotiate associated parameters like QoS.
• Idle terminal location management: The tracking area update process used
to enable the network to join terminals for incoming sessions.

8
The introduction of the EPC and all-IP network architecture in the mobile network has
profound implications on:
• Mobile services, as all voice, data and video communications are built on the
IP protocol
• Interworking of the new mobile architecture with previous mobile
generations (2G/3G)
• Scalability required by each of the core elements to address dramatic
increases in number of direct connections to user terminals, orders of
magnitude of bandwidth increase, and dynamic terminal mobility
• Reliability and availability delivered by each element to ensure service
continuity
To address a radically different set of network and service requirements, the EPC
must represent a departure from existing mobile networking paradigms.

Three new logical nodes and associated interfaces are added; the PCRF, OCS and
OFCS.
OCFS is short for Offline Charging System and OCS is short for Online Charging System,
both logical entities interface the PDN GW (through the Gz interface and Gy interface
respectively) and support various features related to charging of end-users based om
a number of different parameters such as time, volume, event, etc.

9
The major improvement provided in Release 7 of 3GPP in terms of policy and
charging is the definition of a new converged architecture to allow the optimization of
interactions between the Policy and Rules functions.
The R7 evolution involves a new network node, Policy and Charging Rules Function
(PCRF), which is a concatenation of Policy Decision Function (PDF) and Charging Rules
Function (CRF).
Release 8 further enhances PCRF functionality by widening the scope of the Policy
and Charging Control (PCC) framework to facilitate non-3GPP access to the network
(for example, WiFi or fixed IP broadband access).
In the generic policy and charging control 3GPP model, the Policy and Charging
Enforcement Function (PCEF) is the generic name for the functional entity that
supports service data flow detection, policy enforcement and flow-based charging.
The Application Function (AF) here represents the network element that supports
applications that require dynamic policy and/or charging control.
In the IMS model, the AF is implemented by the Proxy Call Session Control Function
(P-CSCF).
The diagram above shows how PCRF interfaces with other EPC elements.

10
This is however a point at which 3GPP has made the solution a bit more complex than
what you could think was needed. 3GPP has in fact defined two different solutions for
how to interconnect LTE and WCDMA/HSPA or GSM/GPRS..

An important piece of understanding here is to note that when a terminal attaches to

LTE it is served by the MME, whereas when the terminal attaches over WCDMA/HSPA
or GSM/GPRS networks it is instead served by a SGSN.

The SGSN has become part of the packet core architecture since the first GSM/GPRS
specifications back in 1997. an SGSN connects to a GGSN which acts as the point of
interconnect to external IP networks for all packet data sessions. In fact it is the SGSN
that selects the GGSN to use for a specific terminal.

When a user is moving between two networks that happen to be served by two
different SGSNs, these SGSNs interact over an interface (Gn) to support IP session
continuity, that is, that the IP address and all other data associated with the IP session
itself, is maintained through keeping the GGSN unchanged when changing from one
access network to another.

11
If we disregard physical packet equipment which may or may not have smooth
migration paths to the EPC architecture, the logical SGSN node has a key role to play
also for LTE, but that is however not the case for the logical GGSN node.
The legacy packet core architecture and control signalling procedures form the base
for the first solution for interworking between LTE and GSM/GPRS or WCDMA/HSPA.
It was actually the second one defined but it is the most straightforward.

This solution includes the SGSN attaching to GSM and WCDMA radio networks as
today, but then includes the MME and the PDN GW acting as an SGSN and a GGSN
respectively. The MME and PDN GW are in fact replicating the signalling needed for
movements between GSM/GPRS and WCDMA/HSPA to also apply for mobility with
LTE.

This includes both the MME and the PDN GW interfacing the SGSN over the standard
packet core Gn interface. It may even be a Gn interface with an older date, that is
specified and in operation prior to EPC being designed. This latter case is referred to
as pre-Rel-8-SGSN.

In order to get this solution to work, key functions are needed:

• The SGSN must be able to distinguish between a terminal that attaches over
GSM/GPRS or WCDMA/HSPA but is not capable of moving to LTE
• From a terminal that in fact can connect to LTE but is currently attaching to
GSM/GPRS or WCDMA/HSPA due to lack of LTE coverage

12
The simplest case is when terminal B attaches to an LTE radio network. It is then
served by the MME which will select a PDN GW and Serving GW.

When either of the terminals attach over GSM or WCDMA radio it is served by the
SGSN. For terminal B this may happen when there is no LTE coverage, while terminal
A does not have LTE support so the LTE coverage situation is then irrelevant.

The SGSN may use different ways of choosing either a GGSN or a PDN GW as an IP
session anchor point for the terminal, but the most obvious way is to utilise the APN,
which is part of the configuration data related to a user subscription and is pointing at
the preferred external network.

Since only terminals which include LTE radio access support may ever move and
attach to an LTE RAN, the simplest solution is to make sure that only these
subscriptions are configured with an APN that is associated with the PDN GE. This
helps the SGSN in tasking a correct decision and ensuring the terminal B is using the
PDN GW and not the GGSN as the IP anchor point.

The other important part of the solution is to provide a single (or at least consistent)
set of user and subscription data. Traditionally the SGSN ahs interfaced a logical node
called HLR which is the main database in GSM/GPRS or WCDMA/HSPA. This interface
is called Gr. The MME instead interfaces the HSS. When moving between
GSM/WCDMA and LTE, there must not be inconsistent information in the network
about, for example, to what network (A, B or C) a specific terminal is currently
attached.

This means that the HLR and HSS need either to share a single set of data, ot to
ensure consistency through other means such as close interaction between the two
network functions.

3GPP does not specify any detailed solution to this problem. In fact, 3GPP
specifications avoid the problem through defining HLR as a subset of HSS in later
versions of the standards. As for the actual solution of ensuring this data consistency,
it varies between different vendors of network infrastructure equipment.

13
The second solution for interconnecting between GSM/GPRS or WCDMA/HSPA also
includes the SGSN.

In this solution the SGSN implements four new interfaces. Three of these interfaces
(called S3, S4 and S16) rely on an updated version of GTP protocol, the protocol that
is has been used since the old days of GPRS in the late 1990s and which forms a core
part of the 3GPP packet core architecture.

All three are used instead of the different variants of the Gn interface present in the
legacy packet core architecture. The fourth new interface is S6d which mimics the
MME S6a interface towards the HSS for retrieving subscriber data from the HSS. Just
as with the S6a, the IETF Diameter protocol is used over S6d, eliminating the need for
the SGSN to support SS7/MAP signalling towards the HLR.

S3 is a signalling only interface. It is used between the SGSN and the MME to support
inter-system mobility. S16 is the SGSN-SGSN interface, while S4 is connecting the
SGSN to the PDN GW. Note that here is a difference compared to the other solution
where the SGSN interfaces the PDN GE and treats this like a GGSN.

Connecting the SGSN with the Serving GW creates a common anchor point for LTE,
GSM/GPRS and WCDMA/HSPA in the Serving GW.

14
Since the Serving GW for all roamers is located in the visited network, this means that
all user traffic related to one roaming user will pass through this point in the network,
regardless of which radio network that is being used.

This is new and a difference to how roaming is handled in the old solution where the
SGSN itself implements the roaming interface for GSM or WCDMA and the Serving
GW only for LTE. With all roaming traffic instead passing through a single point in the
network, it allows for the visited network operator to control and monitor the traffic
in a consistent way, potentially based on policy.

15
One potential drawback is that user traffic need to pass through one additional node
on its way to the PDN GW, but there is a solution to that, at least for WCDMA/HSPA.

This is to utilise a direct connection between the Radio Network Controller (RNC) and
the Serving GW. This interface is called S12, is optional, and if used, it means that the
SGSN will only handle the control signalling for WCDMA.

The primary driver for this is that the network does not have to be scaled in terms of
SGSN user capacity as well, important due to the expected large increase of data sent
over wireless networks.

16
CDMA 2000-1x (3G-1x) and 1x-EV-DO (EV-DO) technologies — also known as High
Rate Packet Data (HRPD) in 3GPP2 Standards — provide a mature, smooth and stable
evolution path to LTE.
The key advantages of this path include investment protection and flexibility that
allows service providers to remain competitive throughout the evolution process.
But to fully benefit from these technologies, wireless operators need a migration
strategy that addresses their own unique needs concerning time to market, choice of
migration path, the importance of a technology ecosystem, VoIP and seamless
interworking, as well as spectrum efficiency and CAPEX.
A network-assisted solution based on eHRPD offers key advantages over a multi-radio
handset solution.
First, it can improve handoff performance while eliminating the need for two
simultaneous transmitters in the handset — which reduces handset cost and
complexity and maximizes battery life.

17
The diagram above shows the architecture for interworking between the 3GPP
Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and the 3GPP2 evolved
High Rate Packet Data (eHRPD) network.

This architecture supports the interworking interfaces defined in TS23.402 [20],

including the following interfaces:

• S101; the signalling interface between the EPC Mobility Management Entity
(MME) and the evolved HRPD Access Network (eAN/ePCF). Note that the
eAN/ePCF functions are defined in A.S0022-0 [3]

• S103; the bearer interface between the Evolved Packet Core (EPC) Serving
Gateway (S-GW) and the HSGW (ref TS29.276 [31]).

18
The diagram above shows the E-UTRAN – eHRPD interworking architecture for home-
routed traffic. In this case the anchor point (i.e., the P-GW) is located in the home
network.

19
The diagram above shows the E-UTRAN – eHRPD interworking architecture for local
breakout traffic. In this case the anchor point (i.e., P-GW) is located in the visited
network.

20
By interconnecting the LTE system with the EV-DO system through a network
signalling tunnel, LTE/EV-DO handsets can pre-register and setup their sessions in EV-
DO while still connected to LTE.

As a result, when they move into the EV-DO network to complete a handoff, users will
not perceive a break in service.

Because of the inter-network signalling link, handsets can accomplish this handover
with virtually no loss in service, despite using only one transmitter.

Upgrading EV-DO networks to support eHRPD requires software upgrades of the EV-
DO RNC and base stations as well as an upgrade of the PDSN to support HRPD serving
gateway (HSGW) functions.

21
To support eHRPD, existing EV-DO networks must also implement the following
changes:

• The IP mobility anchor must move from the Home Agent (HA) to the LTE
PDN Gateway (PDN GW).

• The mobility management model must change from client-mobile IP to

proxy mobile IP (PMIP).

• The Foreign Agent in the PDSN will not be used. Instead, the HSGW
implements PMIP and the handset uses simple IP for packet data session
assignment.

• Switch from PAP/CHAP authentication to EAP-AKA. This is a more secure

method which is common to the EPS-AKA authentication method used for LTE
access which conforms to 3GPP standards.

22
23
24
S1-MME: Reference point for the control plane protocol between E-UTRAN and MME

S1-U: Reference point between E-UTRAN and Serving GW for the per bearer user
plane tunnelling and inter eNodeB path switching during handover

S3: It enables user and bearer information exchange for inter 3GPP access network
mobility in idle and/or active state

S4: It provides related control and mobility support between GPRS Core and the 3GPP
Anchor function of Serving GW. In addition, if Direct Tunnel is not established, it
provides the user plane tunnelling

S5: It provides user plane tunnelling and tunnel management between Serving GW
and PDN GW. It is used for Serving GW relocation due to UE mobility and if the
Serving GW needs to connect to a non-collocated PDN GW for the required PDN
connectivity

S6a: It enables transfer of subscription and authentication data for

authenticating/authorizing user access to the evolved system (AAA interface)
between MME and HSS

25
Gx: It provides transfer of (QoS) policy and charging rules from PCRF to Policy and
Charging Enforcement Function (PCEF) in the PDN GW

S8: Inter-PLMN reference point providing user and control plane between the Serving
GW in the VPLMN and the PDN GW in the HPLMN. S8 is the inter PLMN variant of S5

S9: It provides transfer of (QoS) policy and charging control information between the
Home PCRF and the Visited PCRF in order to support local breakout function

S10: Reference point between MMEs for MME relocation and MME to MME
information transfer

26
S11: Reference point between MME and Serving GW

S12: Reference point between UTRAN and Serving GW for user plane tunnelling when
Direct Tunnel is established. It is based on the Iu-u/Gn-u reference point using the
GTP-U protocol as defined between SGSN and UTRAN or respectively between SGSN
and GGSN. Usage of S12 is an operator configuration option

S13: It enables UE identity check procedure between MME and EIR

SGi: It is the reference point between the PDN GW and the packet data network.
Packet data network may be an operator external public or private packet data
network or an intra operator packet data network, e.g. for provision of IMS services.
This reference point corresponds to Gi for 3GPP accesses

Rx: The Rx reference point resides between the AF and the PCRF in the TS 23.203 [6].

27
28
The EPC architecture has been designed to allow interconnection with just about any
access technology. This creates a common way of treating access to a PDN GW
regardless of the access technology used, meaning that, for example, terminal’s IP
address assignment, access to general IP services as well as network features like user
subscription management, security, charging, policy control and VPN connections can
be made independent of the access technology – be it wireless or fixed.

The architecture allows for connection to both 3GPP technologies and non-3GPP
technologies such as, CDMA, WLAN or a fixed access technology.

The key functionality desired is support for mobility in the PDN GW, Mobile IP was
designed in the 1990s by the IETF to provide IP host mobility which is the ability for a
portable device to connect to a visited IP network and establish a connection to the
home IP network through tunnelling of IP packets.

To all corresponding hosts, this device would appear as still being in the home IP
network. Mobile IP technology has since been used to provide mobility for packet
data services in mobile networks based on CDMA technology.

Due to the diversity of the requirements when specifying the SAE framework, this
part has come out with quire o few options.

29
First of all either ‘Client-based’ or ‘network-based’ mobile IP can be used. Client-
based means that the Mobile IP client resides in the terminal and that IP tunnels are
established between the terminal and the PDN GW across the access network that
acts on behalf of the terminal and provides mobility support.

The major advantage with Client-based approach is that it may work over any access
network, as long as there is adequate support in the terminal itself.

This function may be used totally transparent to the functionality in the access
network.

The advantage with Network-based approach is the opposite – it simplifies the

terminal client application, but instead requires that there is specific Mobile IP
support in the network itself. eHRPD is one access network where the latter approach
has been chosen.

One of the key concerns with Client-based mobility was how secure, trusted and
efficient such mobility would be. These concerns partly drove the development of the
Network-based mobility track in 3GPP and IETF.

30
There are two ways to distinguish between the available options:
1. Is it a connection to ‘trusted’ or an ‘non-trusted’ network?
2. Are ‘Network-based’ or ‘Client-based’ mobility mechanisms used?

Network-based and Client-based concepts were already described, so what is then a

‘trusted’ and ‘non-trusted’ network? Simply put this is really an indicator on if the
3GPP operator trust the security of the non-3GPP access network. A typical ‘trusted’
network may be an eHRPD, while a ‘non-trusted’ network may be, for example, usage
of WLAN in a public café and connecting to the PDN GW over the public Internet.

The corresponding interfaces S2a, Sta and Gxa are similar to already discussed. Sta
and Gxa apply to any trusted non-3GPP access network and are used for user data
and policy control respectively. S2a is used for data connectivity when Network-based
mobility schemes are used in combination with trusted networks.

The corresponding interfaces for non-trusted networks are S2b, Swa (not STb) and
Gxb. There is however a major difference here. Since the operator may not trust the
non-3GPP access network that is used by the device when attaching, the S2b and Gxb
interfaces do not interface with the access network itself, but instead a new logical
node called the evolved Packet Data Gateway (ePDG).

This is an evolution of the PDG that is specified in earlier versions of the 3GPP
standards to allow interconnection (but not inter-access mobility) of WLAN access to
a 3GPP network.

Typically the ePDG belongs to the mobile operator. Encrypted tunnels are established
between the user devices and the ePDG, to ensure that each device can
communicate with the network in a secure way. This creates a logical association
between the device and the ePDG, referred to as the Swu interface, which carries
both signalling needed for management of the tunnel itself as well as carrying data.

The ePDG then connects to the PDN GW and data as well as signalling is transferred
using S2b interface between these two nodes.

The interface between the non-trusted network and the ePDG is called SWn. It carries
all signalling and data between the two networks – the non-trusted access and the
operator network to which the ePDG belongs. Swu traffic and signalling is hence
always routed over the SWn interface..

One final interface to understand is this non-3GPP access solution SWm. This is a
signalling-interface only and connects the ePDG to the AAA server. It is used to
transport AAA-related parameters between the AAA server and the ePDG, in order to
support setup and authentication of the IPSec tunnels between the ePDG and the
terminal

31
The two main solutions for using voice are to either use IMS mechanisms and realise
voice using MultiMedia Telephony (MMTel) framework, that is using voice-over-IP, or
to stick with the old ‘circuit-switched’ way of providing voice services. The second
option is in 3GPP specifications realised through that users temporarily leave LTE to
perform the voice calls over 2G/3G and then return when the voice call is finished.
This ma not be the most elegant of solutions but can be seen primarily asa gap-filler
in case IMS infrastructure is not in place.

When a user engaged in an IMS/MMTel voice call moves around, it is not unlikely that
that the user device may encounter that the LTE radio coverage is being lost. After all
this is a mobile system, and this of course may happen frequently depending on how
users move around.

For this purpose, 3GPP specified mechanisms to hand over an ongoing voice call in
IMS/MMTel. What happens then depends on whether the target system can support
IMS/MMTel or not. If this is the case this will be solved through packet handover
procedures and the IMS/MMTel session will continue after handover.
If this is not the case the IMS/MMTel session will be handed over to a circuit switched
call in GSM, WCDMA or 1xRTT.

To achieve a smooth handover, this procedure involves pre-registration of the

terminal in the target system CS domain and an efficient handover signalling

32
If no IMS is present in the network at all or LTE users have to temporarily leave LTE
during voice calls as described over leaf, the MME interacts with the CS domain to
achieve this temporary suspension of the LTE services.

The case of a packet handover to GSM/WCDMA is supported using handover

signalling over the S3 (or Gn) interface between the MME and the SGSN. The
corresponding interface in CDMA is called the S101 and connects the MME to the
RNC used for eHRPD.

In order to further optimise the packet handover performance, packet forwarding

may be used. This means that any packets destined for the user device that may have
happened to have been sent ‘downwards’ from the PDN GW may be forwarded to the
corresponding node in the target system. This is not absolutely required, but may
improve the user experience of a handover, since in theory no data need be lost
during handover.

The case of packet forwarding between LTE and GSM/WCDMA is supported over
S4/Gn between SGSN and Serving GW, whereas the case of LTE-eHRPD packet
forwarding is supported over the S103 interface between the Serving GW and the
eHRPD.

In the case of IMS/MMTel is not supported by the target network, there are also
functions for handing over an IMS-based MMTel session to circuit switched voice call
in GSM, WCDMA or CDMA 1xRTT. This handover is realised through procedures
executed over the Sv interface between the MME and the MSC Server or the S102
interface between the MME and the 1xRTT MSC. This procedure is known as ‘Single-
Radio Voice Call Continuity’.

Finally support for always falling back to circuit-switched calls even when in LTE
coverage is supported through signalling over the SGs interface between the MME
and a GSM/WCDMA MSC Server or over the S102 interface connecting the MME to
an 1xRTT MSC. This procedure is known as ‘Circuit-Switched Fallback’.

33
Basically LTE is a Packet only technology. It is well designed for data traffic. Then what
about Voice call ?

This is normally done via CS call in existing technology (WCDMA, GSM, C2K etc.).

There can be a couple of options to achieve voice call in LTE.

• One of the option is just to use packet based voice call (e.g., VoIP or IMS).
• Another option is to use multiple technology.

For example, if UE wants to have packet communication, the network redirect it to

the normal LTE core network and if UE wants to do voice call the network redirect the
call to one of the existing technology like WCDMA, GSM or C2K.

This technology that enables to redirect connection to other technology (e.g.,

WCDMA, GSM, C2K) is called 'CS Fallback'.

It may sound very simple and useful... but it is not that simple as you think.

First, the UE should support multiple technologies and the network side would be
even more complicated.

One of the simplest representation on the network side would be as follows.

34
As you may guess, there should be some link point between LTE network and 2G/3G
network to make this CS fallback happen.

In this case, the connection point is between MSC and MME and the interface
connecting these two entities are called 'SG' interface.

Now LTE and 2G/3G network is connected. Now let's look into the interplay of the
two networks to make the voice call possible.

35
Now LTE and 2G/3G network is connected. Now let's look into the interplay of the
two networks to make the voice call possible.

This interplay can be explained by adding just three lines as shown above:
• Voice call traffic path
• Registration to CS network path
• Paging path

Is this everything to make CS Fallback happen?

There is some difference in terms of signalling protocol between LTE and 2G/3G.

To make these two different protocol work together would not be that simple.

To make this happen, LTE network should have a certain level of understanding
(compatibility) with 2G/3G protocol and 2G/3G network should have a certain level of
understanding LTE protocol.

It is not the scope of this short section to describe the whole details of 'CS Fallback'
protocol side.

36
The IMS (IP Multimedia Subsystem) is a generic platform offering IP-based
multimedia services.

IMS provides functions and common procedures for session control, bearer control,
policy and charging.

IMS is made up of several functional entities that include, Call Session Control
Functions (CSCF), Media Gateway (MGW) nodes and functions, like the Media
Gateway Control Function (MGCF).

These entities allow the platform to interconnect any access network – 2G/3G/UMTS
or EPC, to a set of common multimedia services and the PSTN and IP networks, both
public and private.

It also allows session control to be carried out in the users home network, even when
the user is roaming in another network.

37
As a final part of the overview, let us look as three distinct features in the architecture
that may seem as somewhat outside the core of the architecture.

The first is called ETWS. This is short for Earthquake and Tsunami Warning System and
is considered an important safety feature for countries endangered by natural
catastrophes. Simply it means that a warning is received by the Cell Broadcast Centre
(CBC) from, say, a government agency monitoring seismic activity and predicting
earthquakes. The CBC interfaces the MMEs in the network over the SBc interface.
Since all terminals in the network must be reachable for this warning the MMEs must
convey the warning to all terminals that happen to be in idle mode and whose
location is only known with the accuracy of a Tracking Area which may or may not
contain lots of base stations and radio cells.

Another feature is the support for the Equipment Identity Register (EIR) which is
optionally used by the MME when a user attaches. The EIR is a database that contains
information regarding whether the device used to attach to the network happens to
be stolen or not. If that is the case the MME can reject the attach attempt. The MME
interfaces the EIR with the S13 interface.

And finally the ANDSF (Access Network Discovery and Selection Function), put simply
it is a device in the network that can control how users and their devices prioritise
between different access technologies if several non-3GPP access network are
available.

38
39
40
41
42
It must be said that LTE as a radio access technology is flanked by a couple of
significant improvements in the core network known as the EPS.

Simplifying tings a little, it is not wrong to state that EPS is an all-IP transport network
for mobile operators.

IP will also become the physical transport layer on the wired interfaces of the E-
UTRAN.

This all-IP architecture Is also one of the facts behind the bullet point on simplified
network architecture.

However to assume that to be familiar with TCP/IP is enough to understand and

measure LTE would be a fatal error.

While the network architecture and even basic signalling procedures (except
handovers) become simpler, the understanding and tracking of radio parameters
require more knowledge and deeper investigation than they did before.

43
Conditions on the radio interface will change rapidly and with a time granularity of
1ms the radio resources assigned to a particular connection can be adjusted
accordingly.

For instance, the radio quality that is impacted by the distance between the User
Equipment (UE) and base station can determine the modulation scheme and hence
the maximum bandwidth of a particular connection.

Simultaneously the cell load and neighbour cell interference – mostly depending on
the number of active subscribers in that cell – will trigger fast handover procedures
due to changing best serving cell in city centre areas, while in rural areas macro cells
will ensure the bet possible coverage.

The typical footprint of a LTE cell is expected by 3GPP experts to be in the range from
approximately 700m up to 100km.

Surely due to the wave propagation laws such macro cells cannot cover all services
over the entire footprint.

Therefore the service coverage within a single cell will vary, for example from the
inner to the outer areas and the maximum possible bit rates will decline. Service
optimisation will be another challenge.

44
To understand LTE it is necessary to look back at its predecessors and follow the path
of evolution for packet switched services in mobile networks.

The first stage of the General Packet Radio Service (GPRS), that is often referred to as
the 2.5G network, was deployed in live networks after the year 2000.

It was basically a system offered a model of how radio resources Iin this case, GSM
time slots) that had not been used by Circuit Switched (CS) voice calls could be used
for data transmission and hence profitability of the network could be enhanced.

At the beginning there was no pre-emption for PS (Packet Switched) services, which
meant that the packet data needed to wait to be transmitted until CS calls had been
finished.

In contrast, to the GSM CS calls that had a dedicated Traffic Channel (DTCH) assigned
on the radio interface, the PS data had no access to dedicated radio resources and PS
signalling and the payload was transmitted in unidirectional Temporary Block Flows
(TBFs) as shown above.

45
These TBFs were short and the size of data blocks was small due to the fact that the
blocks must fit the transported data into the frame structure of a 52-multiframe,
which is the GSM radio transmission format on the physical layer.

Larger Logical Link Control (LLC) frames that contain already segmented IP Packets
needed to be segmented into smaller Radio Link Control (RLC) blocks.

The following tasks are handled by the RLC protocol in 2.5G:

 Segmentation and reassembly of LLC packets – segmentation results in RLC
blocks
 Provision of reliable links on the air interface – control information is added
to each RLC block to allow Backward Error Correction (BEC)
 Performing sub-multiplexing to support more than on MS (Mobile Station)
by one physical channel

The Medium Access Control (MAC) protocol is responsible for:

 Point-to-point transfer of signalling and user data within a cell
 Channel combining to provide up to eight physical channels to one MS
 Mapping RLC blocks onto physical channels (time slots)

46
Toward the core network in 2.5G GPRS the Gb interface is used to transport the IP
payload as well as GPRS Mobility Management/Session Management (GMM/SM)
signalling messages and short messages (Short Message Service, SMS) between the
SGSN and the PCU (Packet Control Unit) as shown above.

The LLC protocol is used for peer-to-peer communication between the SGSN and the
MS and provides acknowledged and unacknowledged transport services.

Due to different transmission conditions on Physical layers (E1/T1 on the Gb and Abis
interfaces, 52-multiframe on the air interface), the size of the IP packets needs to be
adapted.

The maximum size of the LLC payload field is 1540 octets (bytes) while IP packets can
have up to 65,535 octets (bytes).

So the IP frame is segmented on SGSN before transmission via LLC and reassembled
on the receiver side.

All in all, the multiple segmentation/reassembly of IP payload frames generates a fair

overhead of transport header information that limits the chargeable data throughput.

In addition the availability of radio resources for PS data has not been guaranteed.

47
The most significant enhancements of EGPRS compared to GSM/GPRS are shown
above and overleaf.

On the one hand a new modulation technique, 8 phase shift keying (8PSK), was
introduced to allow transmission of 8 bits per symbol across the air interface and
thus, an increase in the maximum possible bit rate from 20 to 60 kbps.

48
On the other hand, to use the advantages of the new 8PSK modulation technique it
was necessary to adapt the data format on the RLC/MAC layer, especially regarding
the size of the transport blocks and the time transmission interval of the transport
blocks.

Different transport block formats require a different CS. Thus, the so-called
Modulation and Coding Scheme (MCS) and CS for GPRS and EGPRS as shown above
have been defined.

These MCSs stand for defined radio transmission capabilities on the UE and BTS side.

It is important to mention this, because in a similar way capability definition with UE

physical layer categories instead of MCS were introduced for HSPA and will be found
again in LTE.

49
In comparison to GSM/GPRS the EGPRS technology also offered a more efficient
retransmission of erroneous data blocks, mostly with a lower MCS than the one used
previously.

The retransmitted data also does not need to be sent in separate data blocks, but can
be appended piece by piece to present regular data frames.

This highly sophisticated error correction method, which is unique for EGPRS, is called
Incremental Redundancy or Automatic Repeat Request (ARQ) II and is another reason
why higher data transmission rates can be reached using EGPRS.

As a matter of fact, as shown above the risk of interference and transmission errors
becomes much higher when the distance between the base station and a UE is large.

Consequently, the MCS that allows the highest maximum bit rate cannot be used in
the overall cell coverage area, but only in a smaller area close to the base station’s
antenna.

Also for this specific behaviour, an adequate expression will be found in LTE radio
access.

50
Since the early days two key parameters have driven the evolution of packet services
further toward LTE; higher data rates and shorter latency.

EGPRS (or EDGE) focused mostly on higher data rates, but did not include any latency
or algorithms to guarantee a defined Quality of Service (QoS) in early standardisation
releases.

Meanwhile in parallel to the development of UMTS standards, important

enhancements to EDGE have been defined that allow pre-emption of radio resources
for packet services and control QoS.

Due to its easy integration in existing GSM networks, EDGE is widely deployed today
in cellular networks and is expected to coexist with LTE for the long haul.

Nevertheless the first standard that promised complete control of QoS was UMTS
Release 99. in contrast to the TBFs of EGPRS the user is assigned dedicated radio
resources for PS data that are permanently available through a radio connection.
These resources are called bearers.

In Release 99, when a PDP Context is activated the UE is ordered by the RNC to enter
Radio Resource Control (RRC) CELL_DCH state. Dedicated resources are assigned by
the Serving Radio Network Controller (SRNC): these are the dedicated physical

51
channels established on the radio interface.

Those channels are used for transmission of both IP payload and RRC Signalling as
shown in the diagram overleaf.

RRC signalling includes the exchange of Non-Access Stratum (NAS) messages between
the UE and SGSN.

The spreading factor of the radio bearer (as the combination of several physical
transport resources on the air interface is called) depends on the expected UL/DL IP
throughput.

The expected data transfer rate can be found in the RANAP (Radio Access Network
Application Part) part of the Radio Access Bearer (RAB) assignment request message
that is used to establish the Iu bearer, a GPRS Tunnelling Protocol (GTP) tunnel for
transmission of IP payload on the IuPS interface between the SRNC and SGSN.

While the spreading factor controls the bandwidth of the radio connection, a
sophisticated power control algorithm guarantees the necessary quality of the radio
transmission.

For instance this power control ensures that the number of retransmitted frames
does not exceed a certain critical threshold.

Activation of PDP context results also in the establishment of another GTP tunnel on
the Gn interface between the SGSN and GGSN.

In contrast to IuPS, where the tunnel management is a task of the RANAP, on the Gn
interface – as in EGPRS – the GPRS Tunnelling Protocol – Control (GTP-C) is
responsible for context (or tunnel) activation, modification and deletion.

52
However in Release 99 the maximum possible bit rate is still limited to 384kbps for a
single connection and more dramatically the number of users per cell that can be
served by this highest possible bit rate is very limited (only four simultaneous
384kbps connections per cell are possible on the DL due to the shortness of DL
spreading codes).

To increase the maximum possible bit rate per cell as well as for the individual user,
HSPA was defined in Release 5 & 6 of 3GPP.

In High-Speed Downlink Packet Access (HSDPA) the High-Speed Downlink Shared

Channel (HS-DSCH) which bundles several High-Speed Physical Downlink Shared
Channels (HS-DSCHs) is used by several UEs simultaneously – that is why it is called a
shared channel.

A single UE using HSDPA works in the RRC CELL_DCH state. For DL payload transport
the HSDSCH is used, that is, ,mapped onto the HS-PDSCH.

The UL IP payload is still transferred using a dedicated physical data channel (and
appropriate Iub transport bearer): in addition, the RRC signalling is exchanged
between the UE and RNC using the dedicated channels as shown in the diagram
above.

53
All these channels have to be setup and (re) configured during a call. In all these cases
both parties of the radio connection, cell and UE, have to be informed about the
required changes.

While communication between the NodeB (cell) and CRNC (Controlling RNC) uses
NBAP (Node B Application Part) the connection between the UE and the SRNC
(physically the same unit, but different protocol) uses the RRC protocol.

The big advantage of using a shared channel is higher efficiency in the usage of the
available radio resources.

There is no limitation due to the availability of codes and the individual data rate
assigned to a UE can be adjusted quicker to the real needs.

The only limitation is the availability of processing resources (represented by channel

card elements) and buffer memory in the base station.

In 3G networks the benefits of an Uplink Shared Channel (UL-SCH) have not yet been
introduced due to the need for UL power control, that is, a basic constraint of
Wideband CDMA networks.

Hence, the UL channel used for High-Speed Uplink Packet Access (HSUPA) now
commonly called Enhanced Uplink, is an Enhanced Dedicated Channel (E-DCH)).

The UL transmission data volume that can be transmitted by the UE on the UL is

controlled by using so-called “grants” to prevent buffer overflow in the base station
and RNC. The same “grant” mechanism will be found in LTE.

54
55
Hence from the user plane QoS perspective the two major targets of LTE are:
 A further increase in the available bandwidth and maximum data rate per
cell as well as for the individual subscriber
 Reducing the delays and interruptions in user data transfer to minimum

These are the reasons LTE has an always on concept in which the radio bearer is setup
immediately when a subscriber is attached to the network.

And all radio resources provided to subscribers by the E-UTRAN are shared resources
as shown overleaf.

56
The diagram above shows that the IP payload as well as the RRC and NAS signalling
are transmitted on the radio interfaces using unidirectional shared channels, the UL-
SCH and the Downlink Shared Channel (DL-SCH).

The payload part of this radio connection is called the radio bearer. The radio bearer
is the bidirectional point-to-point connection for the user plane between the UE nd
the eNodeB (eNB)

The RAB is the user plane connection between the UE and the Serving Gateway (S-
GW) and the S5 bearer is the user plane connection between the S-GW and public
data network gateway (PDN-GW).

The end-to-end connection between the UE and PDN-GW, that is, the gateway to the
IP world outside the operator’s network, is called a PDN connection in the E-UTRAN
standard documents and a session in the core network standards.

Regardless, the main characteristics of this PDN connection is that the IP payload is
transparently tunnelled through the core and the radio access network.

To control the tunnels and radio resources a set of control plane connections run in
parallel with the payload transport.

57
On the radio interface RRC and NAS signalling messages are transmitted using the
same shared channels and the same RLC transport layer that is used to transport the
IP payload.

58
59
60
61
62
63
64
For the EPC a complete new NAS was designed including a new NAS protocol layer
described in 3GPP 24.301.

Although the EPC does not include any Circuit Switched Domain it still distinguishes
between AS and NAS signalling and functions as shown above.

The AS comprises the radio chipset of the UE including the RRC protocol entity and all
underlying transport layer entities.

Here all parameters that more or less frequently change during radio access can be
found, including transport formats and radio-specific identities of serving cell and
possible handover candidates (neighbour cells).

The NAS covers all signalling exchanged between the USIM (UMTS Subscriber Identity
Module) and the core network node, in case of the LTE radio access: the MME.

This is the home of all parameters that allow unambiguous identification of a

subscriber or the handset hardware such as International Mobile Subscriber Identity
(IMSI) and International Mobile Equipment Identity (IMEI).

There are also temporary identities stored on the USIM card like Temporary Mobile
Subscriber Identity (TMSI) and Globally Unique Temporary UE Identity (GUTI).

65
66
The IMSI allows unambiguous identification of a particular SIM or USIM card. The
IMSI is composed of three parts as shown above.

 The Mobile Country Code (MCC) consisting of three digits. The MCC
uniquely identifies the country of domicile of the mobile subscriber. MCC
values are administered by an international numbering plan

 The Mobile Network Code (MNC), consisting of two or three digits for
GSM/UMTS applications. The MNC identifies the home PLMN of the mobile
subscriber. The length of the MNC (two or three digits) depends on the
value of the MCC. A mixture of two- and three-digit MNC codes within a
single MCC area is not recommended

 The Mobile Subscriber Identification Number (MSIN), identifying the

mobile subscriber within a PLMN. As a rule the first two or three digits of
the MSIN reveal the identity of the Home Location Register (HLR) or HSS
that is used for Signalling Connection Control Part (SCCP) Global Title
Translation procedures when roaming subscribers register in foreign
networks

67
68
Temporary subscriber identifier are used for several purposes. They provide a level of
privacy since permanent identity does not need to be sent over the radio interface.
But more importantly they provide a mechanism to find the resources where the
subscriber’s temporary context is stored. The temporary context for the subscriber is
stored in the MME (or SGSN in the 2G/3G case) and for example the eNodeB needs to
be able to send signalling from the UE to the correct MME where the Subscriber’s
context resides. Pooling MMEs was an integral part of the SAE/LTE design. Hence the
temporary identifiers.
The diagram above shows the temporary identities. The GUTI (Globally Unique
Temporary ID) is a worldwide unique identity that points to a specific subscriber
context in a specific MME. The S-TMSI is unique within a particular area of a single
network. The UE can use the S-TMSI when communicating with the network as long
as it stays within a TA that is part of the TA list it has received.
The GUTI consists of two main components. (1) the GUMMEI (Globally Unique MME
Identifier) that uniquely identifies the MME which allocated the GUTI and (2) the M-
TMSI (MME Temporary Subscriber Identity) that identifies the subscriber within the
MME
The GUMMEI is in turn made up of the MCC, MNC and MMEI (MME identifier, the
MME within the network). The MMEI is constructed from an MMEGI (MME group ID)
and MMEC (MME Code).
The S-TMSI is constructed from the MMEC and the M-TMSI as used instead of the
longer GUTI where possible.

69
70
The Location Area (LA) and Routing Area (RA), known from 2G/3G RAN, will be used
in the E-UTRAN only if the UE was involved in inter-RAT mobility procedures.

The LA is a set of cells (defined by the mobile operator) throughout which a mobile
that is camping on UTRAN or GERAN will be paged.

The LA is identified by the Location Area Identity (LAI) within a PLMN.

The LAI consists of the MCC, MNC and Location Area Code (LAC).

The RA is defined as a sub-area of a LA with specific means for PS services. Each UE

informs the SGSN about the current RA.

RAs can consist of one of more cells. Each RA is identified by a Routing Area Identity
(RAI).

The RAI is used for paging and registration purposes and consists of the LAC and
Routing Area Code (RAC).

The RAC (length 1 octet, fixed) identifies a RA within a LA and is part of the RAI.

71
The Tracking Area Identity (TAI) is the identity used to identify tracking areas. The TAI
is constructed from the MCC, MNC and TAC (Tracking Area Code).

The Tracking Area (TA) includes one or several E-UTRAN cells. Although the details of
TA design are subject to individual radio network planning, it can be guessed that a TA
will typically be defined as a single E-UTRAN cell or all cells of an eNB.

In theory a single eNB or even a single cell may also belong to multiple TAs, for
example, in the case of network sharing.

In any case the details of area configuration are defined in radio network planning
using proprietary definitions and rules.

The scheme shown above is based on the assumption that in a typical network plan
one TA covers all cells of one eNB.

The network allocates a list with one or more TAs to the UE. In certain operating
modes, the UE may move freely in all TAs of the list without updating the MME.

The E-UTRAN Cell Global Identity (CGI) consists of the PLMN-ID (MCC + MNC) plus the
E-UTRAN Cell Identity (CI), a 28-bit string. The leftmost bits of the CI correspond to
the eNB ID.

72
Mobility is the core feature of mobile systems and many of the major systems design
decisions for EPC are derived directly from the necessity of ensuring mobility. The
functionality of mobility management is required to ensure the following:
• That the network can reach the user, e.g., in order to notify the terminal
about incoming calls
• That the user can initiate communication towards other users or services
such as Internet access
• That on-going sessions can be maintained as the user moves

Associated functionality also ensures the authenticity and validity of the user’s access
to the system. It authenticates and authorises the subscription and prepares the
user’s device with subscription information and security credentials.

Shown above are registration areas, which are areas the UE can move into and out off
when idle without the necessity to constantly update the network with its location.
This would only increase the amount of signalling required when the UE is idle.

The base stations broadcast registration information and if the UE moves from one
registration area to another it will recognise the registration is not the same as before
and therefore performs a registration area update

73
In EPS the registration areas are known as Tracking Areas (TA). In order to distribute
the registration update signalling the concept of tracking area lists was introduced in
EPS.

The concept allows the UE to belong to a list of different TAs. Different UEs can be
allocated to different list in tracking areas.

As long as the UE moves within its list of allocated TAs, it does not have to perform
tracking area updates.

By allocating different lists of tracking areas to different UEs, the operator can give
UEs different registration area borders and by that reduce peaks in registration
update signalling, for example, when a train passes a TA border.

74
Using the E-UTRAN CGI, any cell in any E-UTRAN in the world can be unambiguously
identified.

To have a unique format for cells in all RATs also for GERAN and UTRAN cells, a global
CI is defined, since Release 8 it is requested that these identities are broadcast in each
cell and included in RRC measurement reports.

Indeed, on the radio interface the cells of the different RATs are identified by the
following parameters:

 GERAN: Absolute Radio Frequency Chanel Number (ARFCN) + Base Station

Colour Code (BCC)

 UTRAN: UMTS Absolute Radio Frequency Channel Number (uARFCN) +

primary scrambling code

 E-UTRAN: eARFCN + physical Cell ID (c-ID) (in fact also a scrambling code)

The ARFCN values are used to identify the frequency of the cell.

75
76
The above means in turn that for 2.5G and 3G phones the APN is an important
parameter to be stored on the (U)SIM card, but in 4G phones the APN does not need
to be configured by the end user.

This will also resolve the problem where many PDP Context setup failures seen
currently in the GERAN and UTRAN are due to an unknown or missing APN.

77
The APN is made up of two parts as follows:

 The APN network identifier; this defines to which external network the
GGSN is connected and optionally a requested service by the MS. This part
of the APN is mandatory

 The APN operator identifier; this defines in which PLMN GPRS backbone
the GGSN is located. This part is optional.

The APN operator identifier is place after the APN network identifier. An APN
consisting of both the network and operator identifiers corresponds to the DNS name
of a GGSN; the APN has after encoding as defined below; a maximum length of 100
octets.

78
Typical APN are:

mms.tim.net
wap.eplus.net
wap.beeline.ru
wap.debitel.de
web.vodafone.de
internet.t-mobile

79
80
81
The EPS bearer service layered architecture is shown above. Besides the different
names of the bearers and reference points, this architecture does not look very
different from the bearer service architecture of Release 99. however there is a major
difference that is not obvious at first sight.

In 3G UMTS the request of a subscriber for a defined QoS of an end-to-end service

starts the QoS negotiation procedure.

This depends on the subscriber’s subscribed QoS stored in the HLR and the available
network resources which QoS is granted to a particular connection at the end.

The QoS negotiation and control process starts on the NAS layer with the first SM
message sent by the UE.

In LTE – different to 2.5 and 3G PS connections – a default bearer with a default QoS is
already established when the UE attaches to the network.

The QoS attributes of this default bearer are determined by the subscribed QoS
parameters stored in the HSS. This is still as seen in 2.5/3G networks.

However if now the first user plane packet is sent by the UE , it is routed toward the
PDN where the PCRF analyses the requested end-to-end service.

82
Depending on the service, the PCRF may now trigger a modification of QoS
parameters in all the involved bearers. There is no option for the subscriber to
request a particular QoS; only the network is in charge of QoS control.

There is also no way for the UE to request something known as a secondary context
in 3G.

In LTE all QoS management is tied to the application, not to SM signalling. It is

important to understand that one UE in LTE can have multiple end-to-end services
active and each of these services will have its own individual bearer.

It is not intended by LTE standards that, for example, non real-time services like web-
browsing and e-mail will be mapped onto the same bearer (e.g., the same S1-U GTP
tunnel) as we have seen in 3G UMTS.

For this reason also 256 individual E-RABS for a single UE can be addressed by E-
UTRAN protocols while in UMTS only 15 different RAB-IDs had been defined by the
standard organisations.

83
In the 3GPP specs there is also a Traffic Flow Template (TFT) mentioned for UL as well
as for the DL part of the connection.

These TFTs are bound to the EPS bearers. In general, a TFT can be described as a set
of filters for a particular end-to-end service.

Each TFT consists of a destination IP address and a set of source/destination port

numbers.

On the DL, the IP address is the address of the assigned UE; on the UL, it I the address
of the PDN.

If we assume, for example, an HTTP 1.1 end-to-end service, the DL TFT of this service
consists of the UE’s IP address, the TCP source port number, 80 and the TCP
destination port number 80.

On the UL, the port numbers are the same, but the IP address is the address of the
server that hosts the web site.

To standardise the QoS handling, a set of nine QCIs have been defined by 3GPP. There
are four classes with a Guaranteed Bit Rate (GBR) and five classes with a Non-
Guaranteed Bit Rate (Non-GBR). Besides the bit rate, the parameter priority, packet
delay budget and packet error loss rate are also critical factors.

84
85
Some aspects of the user plane handling of EPS bearers were introduced already, in
particular it was here shown how packet filters in the UE and the GW are used to
determine which IP flows shall be carried over a certain EPS bearer.

The diagram above shows how different QoS parameters present on EPS bearers are
handled and which ones are present in different areas of the EPS network.

86
PCC provides the network operator with tools for service-aware QoS and charging
control. In wireless networks, where the bandwidth is typically limited by the radio
network, it is important to ensure an efficient utilisation of the radio and transport
network resources. Furthermore different services have very different requirements
on the QoS, which are needed for packet transport. Since a network in general carries
many different services for different users simultaneously, it is important to ensure
that the services can co-exist and that each service is provided with an appropriate
transport path.

87
88
89
Once the service session is set up and the media traffic for the service is flowing the
PCEF and the BBERF use the packet filters of the installed PCC and QoS rules to
classify IP Packets to authorised SDFs. This process is referred to as SDF detection.

Each filter in the SDF filter is associated with a precedence value. The PCEF (or BBERF)
matches the incoming packets against the available filters of the installed rules on
order of precedence. The precedence is important if there is an overlap between
filters in different PCC rules.

One example is a rule which contains a wildcard filter that overlaps with more
narrowly scoped filters in other PCC rules.

In this case the wildcard filter should be evaluated after the more narrowly scoped
filter; otherwise the wildcard filter will cause a match before the PCEF/BBERF even
tries the narrowly scoped filters. If the packet matches a filter and the gate of the
associated rule I open, then the packet may be forwarded to its destination.

For the downlink part the classification of an IP packet to an SDF also determines
which bearer should be used to transfer the packet, see the diagram above

90
An additional aspect related to SDF detection occurs when DSMIPv6 is used as a
mobility protocol. In that case the user plane traffic is tunnelled between UE and PDN
GW and thus also when passing through the BBERF. Since the packet filters of the PCC
rule refer to un-tunnelled packet flows, the BBERF has to ‘look inside’, the DSMIPv6
tunnel to be able to apply packet filters in the SDF template.

This is something often referred to as ‘tunnel look-through’ and is illustrated above.

The outer tunnel header is determined when the DSMIPv6 tunnel is established by
the UE and the PDN GW. Information about the tunnel header that is, the outer
header IP addresses, etc., is sent from the PDN GW to the BBERF via the PCRF so that
the BBERF can apply the right packet filters for the tunnel.

91
The diagram above shows a high level view of information transfer for both off path
and on path PCC architecture.

92
93