# 陳毅 - 讀書會 - 21/08/28

:::info
- [x] 閱讀 Netmanias-17-EMM Procedure 6. Handover without TAU - Part 2. X2 Handover
:::

This document will focus on procedures for X2 handover that is performed through the x2 interface in an intra-LTE environment.
So, we will assume both source and target eNBs are connected to the same MME/S-GW.

## Concept of X2 Handover

### X2 Protocol Stacks

- LTE networks allow eNBs to directly exchange status information with each other via the X2 interface
- Without any intervention by EPC nodes


在 Control plane 上，兩個 eNB 在單一的 Stream Control Tansmission Protocol 上為多個用戶提供 X2 Application Protocol (X2AP) signaling。
在 X2AP 層上，會由 eNB UE X2AP ID 區別使用者，在 Data plane 上，兩個 eNB 之間使用 GPRS Tunneling Protocol (GTP) tunnel 連線。

### X2AP Functions
X2AP signaling information 可以被大致分為兩個類別:
- 與 load/interference (Load Management function) 有關
- 與 handover (Mobility Management, Mobility Parameter Management, Mobility Robustness Optimization functions) 有關

與 2G/3G 想比，LTE 有著更低的細胞覆蓋率但會使用更多 base station 改善該問題。
因此，適用在 2G/3G 的管理方式已經不適用於 LTE 網路。為了解決這個問題，LTE 網路、X2AP protocol 被定義來提供 providing Self-Organizing Networks (SON) functionality，他可以允許 eNB 連結到鄰近的 eNB(s)、蒐集 status information 以及使用收集到的資料對其參數做自動優化與調整。
- Load Management
enhances the interception performance among cells by exchanging load and interference information between two eNBs
- eNB Configuration Update
performs automatic eNB configuration
- Mobility Parameters Management
negotiates on handover triggering setting information among peer eNBs and uses the information for handover optimization
- Mobility Robustness Optimization
provides information on a handover failure event
- Energy Saving
help eNBs to consume less energy by exchanging information on cell activation/deactivation
### X2 Messages Relating to Mobility Management Function
response message from a target eNB is required during the handover preparation procedure.

- Handover Request message
This message is used during the handover preparation phase. It is delivered by a source eNB to a target eNB, and includes a user’s UE context.

- Handover Request Acknowledge message
This message is used during the handover preparation phase. It is delivered by the target eNB to the source eNB if resource allocation is successfully completed by the target eNB
- Handover Preparation Failure message
This message is used during the handover preparation phase.
It is delivered by the target eNB to the source eNB if resource allocation at the target eNB fails.
- SN Status Transfer message
This message is used during the handover execution phase. The source eNB delivers it to the target eNB to indicate from which packet it should receive or send.
- UE Context Release message
This message is used during the handover completion phase. The target eNB sends it to the source eNB, to request release of the UE context.
- Handover Cancel message
This message is used during the handover preparation phase. The source eNB sends it to the target eNB when it needs to cancel a handover in preparation.


### X2 Handover Procedure at a Glance

為了方便，S-GW 與 P-GW 會標記為 **SAE-GW**，source 與 target eBNs 被標記為 **SeNB** 與 **TeNB**。


#### Before X2 Handover
觀察上圖，UE 由 eNB A 服務，當 UE 偵測到 measurement event，便會發送 **Measurement Report** message 給 eNB A。
#### X2 Handover Preparation
- SeNB 會選擇出 TeNB 為 Handover 的對象
- TeNB 會事先準備服務使用者所需要的資源 (e.g. C-RNTI)，再發送給 SeNB
#### X2 Handover Execution

#### X2 Handover Completion


### UE State and Connection Information Before and After X2 Handover

The figure below illustrates the connection establishments in the user/control planes, and the UE and MME states before, during and after the X2 handover.



## Procedure of X2 Handover

下圖繪製出在 X2 Handover 開始前與 X2 Handover preparation phase 時 EPS bearer 與 signaling connection 的狀態。


### Before Handover

#### 1. Measurement Report

當 measurement event 被觸發，UE 會測量鄰近細胞的訊號強度並發送 **Measurement Report** message 給 Serving cell。

### Handover Preparation

#### 2. Handover Decision

SeNB 會依據 Measurement Report 選擇出 TeNB，在真實的 Handover procedure 中是可以選擇多個 TeNB 的，不過在文件中一概假設僅有一個 eNB 會被選為 TeNB。

#### 3. Deriving the AS Security Base Key (KeNB*) to be Used by the Target eNB
在 handover 的過程中，Seving eNB 會被切換，因此:
- RRC signaling messages and user packets still have to be delivered seamlessly and securely
- Over the radio link, it is AS security keys that ensure secured delivery of such data
- AS security keys are derived from $K_{eNB}$, the AS security base key. $K_{eNB}$ is derived from $K_{ASME}$ by MME after user authentication, and sent to eNB
- X2 handover is performed between two eNBs without any intervention by EPC (MME), the target eNB cannot obtain $K_{eNB}$* ($K_{eNB}$ to be used by the target eNB) from MME. So, the source eNB derives it and sends to the target eNB.


#### 4. Requesting X2 Handover
Handover Request message 包含了 UE context 的資訊。
此外，UE history 包含了在這次的 Handover 之前，UE 連線過的細胞。

#### 5. Preparing X2 Handover

:::info
**懶人包**
- 透過 $K_{eNB}$ 產生出其他 AS Security key。
- 設定 E-RAB，如果 SeNB 提供的 QoS 在 TeNB 也同樣可行，就會建立 UL S1 bearer connection。
- 基於 E-RAB QoS 資訊，TeNB 會保留 UE 在 radio link 所需的 RRC 資源，並分配 C-RNTI。
- 當 UE 執行 Handover，位於 SeNB 的下行封包需要 Forward 到 TeNB 上，為了達到這個需求，TeNB 會分配 X2 Target eNB TEID 以建立 X2 transport bearer (GTP tunnel)。
:::

#### 6. Notifying the Source eNB of Preparation Completion

TeNB 會傳送在上一步提到與資源有關的資訊給 SeNB，這些資訊會包含在 **Handover Request Ack** 之中。


#### 7. Establishing X2 Transport Bearer for DL Packets Delivery

收到 **Handover Request Ack** 後，SeNB 會知道 TeNB 已經有能力服務 UE。這時，SeNB 就會使用 X2 Target eNB TEID 並建立 X2 transport bearer，以開始傳送下行封包。

### Handover Execution


#### 8. Commanding a Handover
Once the source eNB completes the handover preparation with the target eNB, it orders the UE to perform a handover by sending a **Handover Command** message.

#### 9. Executing a Handover
The UE, from the received Handover Command message, obtains C-RNTI and DRB ID to be used at the
target cell, and detaches from the source eNB. Now, all packet delivery between the UE and the source
eNB is stopped, and the handover interruption time period begins.

#### 10. AS Security Setup

The UE derives AS security keys to be used over the radio link of the target eNB. First it derives $K_{eNB}$* (AS base key for the target eNB) from the source eNB’s $K_{eNB}$, the target cell’s PCI and frequency. Next, it derives AS security keys for the target eNB ($K_{RRCint}$, $K_{RRCenc}$, $K_{UPenc}$) by using the AS security algorithms that the target eNB selected.

#### 11. Notifying the No. of the Packet to Send/Receive


#### 12. - 14. UE’s Access to the Target eNB


#### 15. Secure Communication over the Radio Link

All RRC signaling messages and user packets sent over the radio link between the UE and the target eNB are now securely delivered using the AS security keys. RRC signaling messages are integrity protected and encrypted while user packets are encrypted before being sent.

#### 16. Resuming DL Packet Delivery to the UE


### Handover Completion

#### 17. Requesting the EPS Bearer (S1 Bearer) Path Switch

TeNB 藉由發送 **Path Switch Request** message 通知 EPC: UE 的 Serving cell 已經改變，以更動 EPS bearer 的路徑。

#### 18. - 23. Modifying the EPS Bearer

MME 會透過 **Modify Bearer Request** message 將 Target eNB 分配的 S1 Target eNB TEID 發送給 S-GW。
這樣可以通知 S-GW: DL S1 bearer 已經切換並要求它切換 bearer path，隨後，S-GW 根據要求建立 DL S1 bearer 以連線到 target eNB。
根據 UE initial attache 的 options set，部分 S-GW 需要在 EPS session 建立後且 UE 的 Serving cell 改變的情況下透過 **Modify Bearer Request** 通知 P-GW，P-GW 會根據 EPS session modification procedure 定義的方式回報給 PCRF 知道 UE 的 Serving cell 已被更動。

#### 24. Modifying the EPS Bearer Path and Sending EM Packets

#### 25. Packet Re-odering

#### 26. Notifying the Modified Bearer Path

#### 27. Notifying to Release UE Context

Target eNB 會保存 {NCC, NH} 並藉由發送 **UE Context Release** 告訴 Source eNB 可以釋放 UE context (因為 UE's bearer path 已經切換了)。

## EPS Entity Information: Before/After X2 Handover

### Before X2 Handover

UE stays in EMM-Registered and ECM/RRC-Connected state.


### After X2 Handover

UE still remains in EMM-Registered and ECM/RRC-Connected state.
In the figure, information elements that are changed after the handover are marked in blue.