# 陳毅 - 讀書會 - 21/09/01

:::info
- [x] 閱讀 Netmanias-18-EMM Procedure 6. Handover without TAU - Part 3. S1 Handover
:::

This document will focus on procedures for an S1 handover performed between two eNBs with intervention of EPC.

So, we will assume both source and target eNBs are connected to the same MME/S-GW in an intra-LTE environment.

## Concept of S1 Handover

### S1 Protocol Stacks

eNB communicates with MME through S1AP signaling in the control plane, and communicates with S-GW through GTP tunnel in the user plane.


當新的 eNB 被安裝，**S1 Setup** 流程會在 eNB 與 MME(s) 上執行。eNB 透過發送 **S1 Setup Request** 提供 MME(s) 一些 eNB configuration info，**S1 Setup Request** 包含了這些內容:
- eNB ID
- eNB Name
- TAC

接著，每個收到請求的 MME 會回傳 **S1 Setup Response** 給 eNB，以便 eNB 更新自己的 Configuration info。至於 **S1 Setup Response** 則是包含了以下內容:
- GUMMEI
- MME Name
- Relative MME Capacity
Relative MME Capacity 用於 MME 之間的平衡附載。

在 Control plane 上，每個使用者在 eNB 與 MME 之間訊號是透過 S1 Application Protocol (S1AP) signaling connection 提供的。
並由 eNB UE S1AP ID, MME UE S1AP ID 進行識別。
在 Data plane 上，每個使用者在 eNB 和 S-GW 之間的 S1 bearer通過 GPRS Tunneling Protocol (GTP) tunnel 連線，且由 DL S1 TEID, UL S1 TEID 識別。

### S1AP Procedures and Messages Relating to Handover


- Handover Required
This message is used during the handover preparation phase. It is sent by the source eNB to MME, and includes information about the target eNB and the radio resources at the source cell.

- Handover Request message
This message is used during the handover preparation phase. It is sent by MME to the target eNB, and includes the user’s UE context.

- Handover Request Acknowledge message
This message is used during the handover preparation phase. **It is sent by the target eNB to MME when the resource allocation for the UE is successfully completed at the target eNB.** The target eNB allocates DL S1 TEID for S1 bearer to be used after the handover, and DL S1 TEID for S1 bearer (indirect tunnel) to be used for DL packet delivery during the handover, and then forwards them as included in the message.
- Handover Command message
This message is used during the handover preparation phase, and **is sent by MME to the source eNB.** It **includes the information required when the UE accesses the target eNB (e.g. Target C-RNTI, Target eNB AS Security algorithm, DRB ID, etc.), and UL S1 TEID for S1 bearer (indirect tunnel) to be used by S-GW for DL packet delivery during the handover.**

- eNB Status Transfer message
This message is used during the handover execution phase, and is **sent by the source eNB to MME.** It **indicates from which packet the target eNB should receive or send.**
- MME Status Transfer message
This message is used during the handover execution phase, and is **sent by MME to the target eNB.** It **indicates from which packet the target eNB should receive or send.**
- Handover Notify message
This message is used during the handover completion phase, and is **sent by the target eNB to MME.** It **indicates that the UE has completed the handover to the target eNB.**
- UE Context Release Command message
This message is used during the handover completion phase, and is sent by MME to the source eNB to request release of the UE context.
- UE Context Release Complete message
This message is used during the handover completion phase, and is sent by the source eNB to MME to inform that the UE context has been released.

### S1 Handover Procedure at a Glance

為了方便，S-GW 與 P-GW 會標記為 **SAE-GW**，source 與 target eBNs 被標記為 **SeNB** 與 **TeNB**。


#### Before S1 Handover
觀察上圖，UE 由 eNB A 服務，當 UE 偵測到 measurement event，便會發送 **Measurement Report** message 給 eNB A。
#### S1 Handover Preparation
- SeNB 會選擇出 TeNB 為 Handover 的對象
- 由於 X2 handover 不可行，所以改採 S1 handover 替換
- TeNB 會事先準備服務使用者所需要的資源 (e.g. C-RNTI)，再發送給 SeNB

While a handover is being performed, as follows:
- SeNB 發送 **Handover Required**，裡面包含了 TeNB 的資訊
- 然後，MME 向 TeNB 發送包含 TeNB 創建 AS 安全基礎密鑰所需的 AS 安全信息以及 UE 上下文的 **Handover Request** message。
- Target eNB
- 使用從 MME 獲取的 S1 S-GW TEID 建立一個 UL S1 Bearer，用於在 Handover 後轉發 UL 封包，並為 DL S1 Bearer 分配 S1 TeNB TEID。
- 為了在 S-GW 與 TeNB 之間使用 Tunnel connecting 分配 S1 TeNB TEID，該 TEID 用於 UE 嘗試連接到 TeNB 時 Forward 所有的下行封包，以避免資料遺失。
- 設置 **Handover Command** 訊息，它包含了 UE 存取 TeNB 所需的資料 (e.g. Target C-RNTI, Target DRB ID, etc.)。
- 發送 **Handover Request Ack** 訊息給 MME。

- 當 MME 收到訊息，將先前分配好的 S1 TeNB TEID 放入 **Create Indirect Data Forwarding Tunnel Request** 訊息並傳送給 S-GW。
- S-GW
- 創建連接 TeNB 的間接隧道
- 為連接 SeNB 和 S-GW 的隧道分配 S1 S-GW TEID 並透過 **Create Indirect Data Forwarding Tunnel Response** 訊息傳送給 MME。
- 現在 MME 持有用於創建間接隧道的 S1 S-GW TEID 以及其他讓 UE 能夠存取 TeNB 的資訊，MME 會將這些資訊放入 **Handover Command** 訊息傳送給 SeNB。
- 接著，SeNB 會連線到 S-GW 的間接通道。

這樣一來，間接通道就順利的將 SeNB, S-GW, TeNB 串連起來了!
#### S1 Handover Execution

#### S1 Handover Completion


### UE State and Connection Information Before and After S1 Handover


## Procedure of S1 Handover

下圖繪製出在 S1 Handover 開始前與 S1 Handover preparation phase 時 EPS bearer 與 signaling connection 的狀態。


### Before Handover

#### 1. Measurement Report

當 measurement event 被觸發，UE 會測量鄰近細胞的訊號強度並發送 **Measurement Report** message 給 Serving cell。

### Handover Preparation

#### 2. Handover Decision

SeNB 會依據 Measurement Report 選擇出 TeNB，在真實的 Handover procedure 中是可以選擇多個 TeNB 的，不過在文件中一概假設僅有一個 eNB 會被選為 TeNB。

### 3. Requesting a Handover
The source eNB sends a Handover Required message to the MME, requesting a handover to the target eNB. The information included in the message is as follows:

#### 4. Deriving Security Context to Forward to the Target eNB

#### 5. Requesting the Target eNB for a Handover

MME 發送 **Handover Request** 訊息給 TeNB，資訊如下:

#### 6. Preparing S1 Handover

:::info
**懶人包**

- 設定 E-RAB，如果 SeNB 提供的 QoS 在 TeNB 也同樣可行，就會建立 UL S1 bearer connection (連線到 S-GW)。
- 當 UE 執行 Handover，位於 SeNB 的下行封包需要 Forward 到 TeNB 上，為了達到這個需求，TeNB 會分配 S1 Target eNB TEID ，這樣 S-GW 就能建立 indirect tunnel 達到 DL packets Re-Routing 的作用。
- 基於 E-RAB QoS 資訊，TeNB 會保留 UE 在 radio link 所需的 RRC 資源，並分配 C-RNTI。
- 透過 $K_{eNB}$ 產生出其他 AS Security key。
:::

#### 7. Notifying the MME of Preparation Completion

TeNB 會傳送在上一步提到與資源有關的資訊給 MME，這些資訊會包含在 **Handover Request Ack** 之中。


#### 8. Requesting for Creation of S1 Bearer for DL Packet Delivery

MME 發送**Create Indirect Data Forwarding Tunnel Request** 訊息給 S-GW，要求它在 UE 執行換手時建立 Indirect Tunnel 以轉送下行封包，**Create Indirect Data Forwarding Tunnel Request** 訊息包含了由 target eNB 為 Indirect Tunnel 分配的 GTP TEID (S1 Target eNB TEID)。

#### 9. Notifying that S1 Bearer is Created for DL Packet Delivery
當 S-GW 收到 **Create Indirect Data Forwarding Tunnel Request** 訊息，會建立連接到 TeNB 的 Indirect Tunnel，此外，S-GW 會分配 S1 S-GW TEID 並透過 **Create Indirect Data Forwarding Tunnel Response** 訊息通知 MME，這樣一來，SeNB 也能連線到間接隧道上。

#### 10. Notifying of the Completed Handover

現在 MME 持有用於創建間接隧道的 S1 S-GW TEID 以及其他讓 UE 能夠存取 TeNB 的資訊，MME 會將這些資訊放入 **Handover Command** 訊息傳送給 SeNB。
SeNB 收到訊息後可得知 eNB 與 EPC 已經為 UE Handover 做好準備

### Handover Execution


#### 11. Commanding UE to Perform a Handover

當 SeNB 為換手做好準備，便會透過 **Handover Command** (RRC Configuration) 命令 UE 去執行 Handover。

#### 12. Executing a Handover
當 UE 獲得可用於 Target Cell 的 C-RNTI 與 DRB ID，便會對 SeNB 進行 Detach。
此刻，所有與 SeNB 交互的封包都會暫停，並開始 handover interruption time。

#### 13. AS Security Setup

The UE derives AS security keys to be used over the radio link of the target eNB. First it derives $K_{eNB}*$, the AS base key, then it derives AS security keys ($K_{RRCint}$, $K_{RRCenc}$, $K_{UPenc}$) by using the AS security algorithms that the target eNB selected.

#### 14. - 15. Notifying the No. of the Packet to Send/Receive


#### 16. - 18. UE’s Access to the Target eNB


#### 19. Secure Communication over the Radio Link

All RRC signaling messages and user packets sent over the radio link between the UE and the target eNB are now securely delivered using the AS security keys. RRC signaling messages are integrity protected and encrypted while user packets are encrypted before being sent.

#### 20. Resuming DL Packet Delivery to the UE


### Handover Completion


#### 21. Requesting the EPS Bearer (S1 Bearer) Path Switch

TeNB 藉由發送 **Handover Notify** message 通知 EPC: UE 已經完成換手，且該訊息包含了 ECGI 以及 TAI。

#### 22. - 27. Modifying the EPS Bearer

MME 會透過 **Modify Bearer Request** message 將 Target eNB 分配的 S1 Target eNB TEID 發送給 S-GW。
這樣可以通知 S-GW: DL S1 bearer 切換 bearer path，隨後，S-GW 根據要求建立 DL S1 bearer 以連線到 target eNB。
根據 UE initial attache 的 options set，部分 S-GW 需要在 EPS session 建立後且 UE 的 Serving cell 改變的情況下透過 **Modify Bearer Request** 通知 P-GW，P-GW 會根據 EPS session modification procedure 定義的方式回報給 PCRF 知道 UE 的 Serving cell 已被更動。

#### 28. - 29. Modifying the EPS Bearer Path and Sending EM Packets

#### 30. Packet Re-odering

#### 31. - 32. Releasing the UE Context and S1 Resources Stored at the Source eNB

#### 33. - 34. Releasing the Indirect Tunnel


## EPS Entity Information: Before/After S1 Handover

As, in an intra-LTE environment, the information elements stored at EPS entities before and after S1 handover are the same as in X2 handover, see our previous document for the details (For EPS entities information, see below).

### Before S1 Handover

UE stays in EMM-Registered and ECM/RRC-Connected state.


### After S1 Handover

UE still remains in EMM-Registered and ECM/RRC-Connected state.
In the figure, information elements that are changed after the handover are marked in blue.