# From GSM to LTE-Advanced
LTE uses frequency division duplex (**FDD**) to separate uplink and downlink transmissions.

In some parts of the world,spectrum for Time Division Duplex (**TDD**) has been assigned to network operators

The second major change of LTE compared to previous systems has been the adoption of
an all-Internet Protocol **(IP)** approach

---

### 4.2.1 LTE Mobile Devices and the LTE Uu Interface


LTE UE 5 categories

In practice, most devices are of categories 3 and 4, and peak datarates observed are between
100 and 150 Mbit/s under ideal conditions when using a 20-MHz carrier

---

### 4.2.2 The eNode-B and the S1 and X2 Interfaces

E-UTRAN (Evolved Universal Mobile Telecommunications System TerrestrialRadio Access Network) consist three elements

1. the antennas, which are the most visible parts of a mobile network;
2. radio modules that modulate and demodulate all signals transmitted or received on the air interface;
3. digital modules that process all signals transmitted and received on the air interface and that act as an interface to the core network over a high-speed backhaul connection

Radio network controller (RNC) into eNB

- **user management** in general and scheduling air interface resources;
- for ensuring QoS such as ensuring latency and minimum bandwidth requirements for
real-time bearers and maximum throughput for background applications depending on the
user profile
- for load balancing between the different simultaneous radio bearers to different users;
- **mobility** management;
- for interference management, that is, to reduce the impact of its downlink transmissions on **neighboring base stations in cell edge scenarios**. Further details are described below


The S1 interface is split into two logical parts, which are both transported over the same physical connection.

User data is transported over the **S1 User Plane (S1-UP)** part of the interface.

- General Packet Radio Service Tunneling Protocol (GTP) is reused for handovers between different LTE base stations andUMTSor GPRS/EDGE.

The **S1 Control Plane (S1-CP)** protocol, as defined in 3GPP TS 36.413, [7] is required fortwo purposes:

- the eNode-B uses it for interaction with the core network for its own purposes, that is, to make itself known to the network, to send status and connection keep-alive information and for receiving configuration information from the core network
- Second, the S1-CP interface is used for transferring signaling messages that concern the users of the system.
- Stream Control Transmission Protocol (SCTP) is used as defined in RFC 4960 [8] instead of TCP/UDP.

X2 interface for two purposes

1. First, **handovers are now controlled by the base stations themselves**. If the target cell is known and reachable over the X2 interface, the cells communicate directly with each other. Otherwise, the S1 interface and a core network are employed to perform the handover. Base station neighbor relations are either configured by the network operator in advance or can be detected by base stations themselves with the help of neighbor cell information being sent to the base station by mobile devices as **Automatic Neighbor Relation (ANR)**
2. Interference coordination. In UTMS, neighboring LTE base stations use the same carrier frequency so that there are areas in the network where mobile devices can receive the signals of several base stations. If the signals of two or more base stations have a similar strength, the signals of the base stations that the mobile device does not communicate with at that moment are perceived as noise and the resulting throughput suffers significantly. **X2 interface can then be used by that base station to contact the neighboring base station and agree on methods to mitigate or reduce the problem.**

SCTP 負責 connection management between X2.

GTP 負責 encapsulates the signaling messages forward the user packet during hand over between X2.

Aggregation router combine the traffic of many base stations into a single traffic flow.

---

### 4.2.3 The Mobility Management Entity (MME)

- Exchanges between the base stations andthe core network and between the users and the core network
- MME 不參與 air interface 因此它與無線電網路的信號稱為非接入層 (Non-access Stratum NAS)

MME task below

1. **Authentication,**
1. Request from HSS (Home Subscriber Server), forwards encryption keys( for ciphering and attach procedure and defaultbearer activation.)
2. **Establishment of bearers,**
1. for selecting a gateway router to the Internet,
3. **NAS mobility management,**
1. MME has to send paging messages to all eNode-Bs that are part of the current TA of the mobile device. Once the device responds to the paging, the bearer(s) is(are) reestablished.
4. **Handover support.**
1. help to forward the handover between eNB.
5. **Interworking with other radio networks**
1. hand over the mobile device to a GSM or UMTS network
2. perform a cell change to suitable cell
6. **SMS and voice Support.**

Different with SGSN(also user data), the MME only with the signaling tasks described above and leaves the user data to the Serving Gateway(S-GW)

---

### 4.2.4 The Serving Gateway (S-GW)

> S-GW

- Managing **user data** tunnels between the eNode-Bs in the radio network and the Packet Data Network Gateway (PDN-GW), which is the gateway router to the Internet
- S1-UP GTP
- S5-UP GTP
- 單個用戶的 S1 和 S5 隧道相互獨立，可以根據需要進行更改。 例如，如果切換到同一 MME 和 S-GW 控制下的 eNode-B，則只需修改 S1 隧道即可將用戶的數據流重定向到新基站或從新基站重定向。 如果連接被移交給在新 MME 和 S-GW 控制下的 eNode-B，則 S5 隧道也必須修改。
- **Tunnel creation** and **modification** are controlled by the **MME**, and commands to the S-GW are sent over the **S11** interface as shown in Figure 4.1
- S11 interface reuses the GTP-C (control) protocol of GPRS and UMTS by introducing new messages. (IP not SCTP)

---

### 4.2.5 The PDN-Gateway

- On the ==user plane==, this means that data packets for a user are encapsulated into an ==S5 GTP== tunnel and ==forwarded to the S-GW==
- Assigning IP addresses (request from MME via S5 control plane)
- A mobile device can also request the assignment of simultaneous IPv4 and IPv6 addresses
- Local IP address and Network Address Translation (NAT) can avoid malicious connection attempts (NAT not include IPv6)
- ==International roaming scenarios==


The international roaming disadvantage is that the user’s data is first transported back to the homenetwork before it is sent to the Internet.

[https://carrier.huawei.com/cn/technical-topics/core-network/LTE-roaming-whitepaper](https://carrier.huawei.com/cn/technical-topics/core-network/LTE-roaming-whitepaper)

---

### 4.2.6 The Home Subscriber Server (HSS)

LTE shares its subscriber database with GSM and UMTS. In these systems, the database is
referred to as the ==Home Location Register (HLR)== and the ==Mobile Application Part (MAP)== is used as the protocol between the Mobile Switching Center (MSC) and SGSN on the one side
and the HLR on the other side.

- In LTE, an IP-based protocol referred to as ==DIAMETER== is used to exchange information with the database.(==S6a==.)

Parameters in the HSS

- The user’s International Mobile Subscriber Identity (IMSI) (roaming abroad)
- ==Mobile Country Code (MCC)==
- ==Mobile Network Code (MNC)==
- Copy stored in SIM card
- Authentication information (encryption keys)
- Circuit-switched service properties
- user’s telephone number (Mobile Subscriber Integrated Services Digital Network (MSISDN) number) and SMS
- Packet-switched service properties
- Access Point Names (APNs)
- Maximum throughput
- IMS-specific information
- The ID of the current serving MSC so that incoming circuit-switched calls and SMS
messages can be routed correctly;
- The ID of the SGSN or MME, which is used in case the user’s HSS profile is updated to push
the changes to those network elements.

---

### 4.2.7 Billing, Prepaid and Quality of Service

The PCRF then translates this request and sends commands to the PDN-GW and the S-GW,

The PCRF is part of the 3GPP IMS specifications and was originally intended for use
by IMS services.

---

### 4.3 FDD Air Interface and Radio Network

==GSM== is based on ==narrow 200 -kHz== carriers that are split into ==eight repeating timeslots== for
voice calls.

==GPRS== for ==packet-switched== data transmission. The decision to use ==200 -kHz== carriers, however, remained the limiting factor.

==UMTS==, use carriers with a ==bandwidth of 5MHz.== ==CDMA==, where data streams are continuous
and separated with ==different codes==,

==HSPA==, same with ==CDMA== but a with the==timeslot== structure

---

### 4.3.1 OFDMA for Downlink Transmission

- OFDMA splits the data stream into many slower data streams that are transported
over ==many carriers== (subcarriers) simultaneously.
- As ==each subcarrier== uses a ==different frequency==, the receiver uses an FFT that shows which signal was sent in each of the subcarriers at a specific instant in time.


LTE uses the following physical ==parameters== for the ==subcarriers==

1. subcarrier spacing: 15kHz;
2. length of each transmission step (OFDM symbol duration): ==66.667== microseconds
3. standard cyclic prefix: ==4.7 microseconds.==
1. OFDM symbol to prevent inter symbol interference due to different lengths of several transmission paths.

---

### 4.3.2 SC-FDMA for Uplink Transmission

For ==uplink== data transmissions, the use of OFDMA is not ideal because of its high ==Peak to
Average Power Ratio (PAPR)== when the signals from multiple subcarriers are combined.

LTE use uplink for Single-Carrier Frequency Division Multiple Access (SC-FDMA).



---

### 4.3.3 Symbols, Slots, Radio Blocks and Frames

The smallest transmission unit on ==each subcarrier== is a single transmission step with a length of ==66.667 microseconds==.

If radio conditions are excellent, 64-QAM is used to transfer 6 bits 2^6(64) per symbol.

A ==symbol== is also referred to as a ==Resource Element (RE)==.


10 MHZ / 15 kHz = 600 subcarriers = 50 (RB) * 12 subcarriers.

Two ways to transmit subframe

1. ==Localized Virtual Resource Blocks (LVRBs)==
1. which are transmitted in a coherent group as shown in Figure 4.7. In this transmit mode, the eNode-B requires a narrowband channel feedback from the mobile device to schedule the RBs on subcarriers that do not suffer from narrowband fading.
2. ==Distributed Virtual Resource Blocks (DVRBs)==
1. where the symbols that form a block are scattered over the whole carrier bandwidth. In this case, the mobile device returns either no channel feedback or a wide band channel feedback over the whole bandwidth.

---

### 4.3.4 Reference and Synchronization Signals


To enable mobile devices to detect LTE carriers during a network search and to ==estimate== the ==channel quality== later on, reference symbols, also referred to as reference signals, are embedded in a predefined pattern over the entire channel bandwidth.

Reference signals are inserted on ==every seventh symbol== on the time axis and on ==every 6th subcarrier==(The pattern referred as ==Physical Cell Identity (PCI)==.) on the frequency axis as shown in Figure 4.8.

A total of ==504== different reference signal sequences exist, which help a mobile device to distinguish transmissions of different base stations.

==For initial synchronization==, two additional signal types are used. These are referred to as the ==primary and secondary synchronization signals (PSSs and SSSs)== and they are transmitted in every first and sixth subframe on the inner ==72 subcarriers of the channel==. On each of those subcarriers, one symbol is used for each synchronization signal. Hence, synchronization signals are transmitted ==every 5 milliseconds==.

---

### 4.3.5 The LTE Channel Model in Downlink Direction

Their aim is to offer different pipes for different kinds of data on the logical layer and to
separate the logical data flows from the properties of the physical channel below.

On the logical layer, ==data for each user is transmitted in a logical Dedicated Traffic Channel (DTCH)==.

==Each user has an individual DTCH==.

1. (All users DTCHs mapping the RBs into Downlink Shared Channel (DL-SCH))
2. Data stream is then mapped to the Physical Downlink Shared Channel (PDSCH).


Ex: An example is as follows: A UE that has been assigned a DTCH also requires a control channel for the management of the connection. Here, the messages that are required, for example, for handover control, neighbor cell measurements and channel reconfigurations are sent. The DTCH and the DCCH are multiplexed on the DL-SCH before they are mapped to the PDSCH, that is, to individual RBs. In addition, even most of the cell-specific information that is sent on the logical ==broadcast control channel (BCCH)== is also multiplexed on the transport downlink shared channel as shown in Figure 4.9.

In LTE, all higher layer ==data flows== are eventually mapped to the ==physical shared channel==,
including the ==Paging Control Channel (PCCH)==,

The ==PCCH== is first mapped to the transport layer ==Paging Channel== (PCH), which is then mapped
to the ==PDSCH==.

The only ==exception== to the general mapping of all higher layer information to the shared channel is the transmission of a ==small number of system parameters== that are required by mobile devices to ==synchronize== to the cell. They are transmitted on the ==Physical Broadcast Channel (PBCH)== which occupies three symbols on 72 subcarriers 6 RBs) in the middle of a channel
every ==fourth frame==. Hence, it is broadcast every ==40 milliseconds== and follows the ==PSSs and SSSs.==

---

### 4.3.6 Downlink Management Channels

A mechanism is required to ==indicate== to each mobile device as to when, where and what kind of data is scheduled for them on the shared channel and which RBs they are ==allowed to use in the uplink direction==. This is done via ==Physical Downlink Control Channel (PDCCH)== essages.

The downlink control information occupies the ==first one to four symbols== over the whole
channel bandwidth in each subframe.

==Physical Control Format Indicator Channel (PCFICH)== occupies 16 symbols.

- Identify the number of symbols on downlink control information. (1~4 symbols)

==Downlink control data== is organized in ==Control Channel Elements (CCEs)==.

- Split to search spaces to reduce power ...etc.
- Only those in the search spaces assigned

==Hybrid Automatic Retransmission Request (HARQ)== in ==Physical Hybrid Automatic Retransmission Request Indicator Channel (PHICH).==

==Paging Control Channel (PCCH)==


==Broadcast control channel (BCCH)==


==CCCH==

==DCCH==


==MCCH==


==DTCH==


==MTCH==



---

### 4.3.7 System Information Messages
- As in GSM and UMTS, LTE uses ==SI== messages to convey information that is required by all
mobile devices that are currently in the cell.
- Only the ==Master Information Block (MIB, **40 ms repeated**)== is transported over the ==broadcast channel(BCH)==. All other SI is scheduled in the PDSCH and their presence is announced on the PDCCH in a search space that has to be observed by all mobile devices.
- SIB 1 that is repeated every ==80 milliseconds== (Always broadcase, SIB2 also)

---

### 4.3.8 The LTE Channel Model in Uplink Direction


- ==Physical Uplink Shared Channel (PUSCH)==.
- carry user data in addition to signaling information and signal quality feedback.
- **DTCH** as user data
- **DCCH** as higher layer signaling information
- **Common Control Channel** (CCCH) as connection establishment, signaling messages

Before send data in uplink direction scenarios:
1. Dormant, want to re-connection
2. Ratio Link failure, the UE found a suitable cell.
3. During a handover process, the mobile needs to synchronize with a new cell before user data traffic can be resumed.
4. Optionally for requesting uplink resources.

==Physical Random Access Channel (PRACH)==
- Synchronizing and requesting initial uplink resources is performed with a random access procedure

==Random access procedure==

==PDSCH== include:
- a **timing** advance value so that the mobile can **synchronize** its transmissions;
- a **scheduling grant** to send data via the **PUSCH**;
- a **temporary identifier** for the UE that is only valid in the cell to identify further messages between a particular mobile device and the eNode-B.

When a mobile device has been granted resources, that is, it has been assigned ==RBs on the PUSCH==, the shared channel is used for transmitting user data and also for transmitting lower layer signaling data, which is required to keep the uplink connection in place and to optimize the data transmission over it.

User data in lower layer information
- The ==Channel Quality Indicator (CQI)== that the eNode-B uses to adapt the modulation and coding scheme for the downlink direction.
- ==MIMO-related parameters== (see Section 4.3.9).
- ==HARQ acknowledgments== so that the network can quickly retransmit faulty packets (see Section 4.3.10).

區分不同手機上傳的特性有兩種方式
- ==Demodulation Reference Signals (DRS)==
- 位於 RB 中的第四個 symbol row 因此可以知道 subcarrier 的傳輸路徑
- ==Sounding Reference Signal (SRS)==
- Last symbol of a configured subframe.
- 它允許網絡為每個移動設備估計整個信道的不同部分的上行鏈路信道質量。
- SRS interval can be configured between 2 and 160 milliseconds.

---

### 4.3.9 MIMO Transmission (3GPP release 8)
- Precoding Matrix Indicator (PMI)
- 在數據流通過空中發送之前對其應用預編碼矩陣，以有利的方式改變兩個信號路徑的調製，以增加接收端的整體吞吐量。 移動設備可以通知 eNode-B 預編碼矩陣中的哪些參數將給出最佳結果。
- Rank Indicator (RI)
- 從接收者的角度來看，RI 通知 eNode-B 可以通過信道發送的數據流的數量。
-
- eNode-B 使用 CQI 信息來決定採用哪種調製（QPSK、16-QAM、64-QAM）和哪種編碼率，即數據流中用戶數據比特和檢錯比特之間的比率

---

### 4.3.10 HARQ and Other Retransmission Mechanisms

- HARQ Operation in the ==MAC Layer==(Downlink)
- UE would return ACK/NACK if the data correctly or not
- HARQ sent via the **PUSCH** or **PUCCH** if UE has not been assigned uplink resources.
- If **NACK**, **retransmission** or **deferred**.

eNB has options for retransmission
- repeat the data block (require time to identify faulty and repetition of the data, the faulty block take ==five subframes== or ==5ms==)
- send redundancy version (RV)
- that contains a different set of redundancy bits, that is, some of those bits that were previously punctured from the data stream. On the receiver side, this data stream can then be combined with the previous one, thus increasing the number of available error detection and correction information.
- change modulation and coding scheme to increase the chance for proper reception
- can ==discard== in several attempts.


HARQ on uplink
- Acknowledges the proper receipt to the mobile device four subframes later.
- The ACK is given via the PHICH,
- which is transmitted over a number of symbols in the first symbol row of each subframe.
- Once the **positive ACK** has been received by the mobile device, the next data block of a HARQ process can be sent in the uplink direction.
- The first possibility for the network is to send a NACK and order a retransmission in a new format and possibly different location of the resource grid via a scheduling grant on the ==PDCCH==. The second option is to send only a NACK without any further information given via the ==PDCCH==.

==ARQ on the RLC(Radio link control) layer==
ARQ is split into two main functions:
- sliding window until the missing RCL frame has been received.
- Polling indicator bit in RLC header
- During normal operation, the sender periodically requests an ARQ status report by setting the polling indicator bit in the RLC header of a data frame. This way, unnecessary status reports do not have to be sent while it ensures that no RLC error message is missed.

---

### 4.3.11 PDCP Compression and Ciphering
- Cipher user data
- IP header compression
- Robust Header Compression (RoHC), group IP packet in to streams.

---

### 4.3.12 Protocol Layer Overview


- NAS protocol
- used for mobility management and other purposes between the mobile device and the MME
- RRS message
- manage the air interface connection
- for handover or bearer modification signaling
- PDCP Layer
- for ciphering, header compression and lossless handover support
- RLC Layer
- for segmentation and reassembly of higher layer packets to adapt them to a packet size that can be sent over the air interface
- detecting and retransmitting lost packets ==(ARQ)==.
- MAC Layer
- multiplexes data from different radio bearers and ensures QoS by instructing the RLC layer about the number and the size of packets to be provide
- for the ==HARQ== packet retransmission functionality
- addressing individual mobile devices and for functionalities such as bandwidth requests and grants, power management and time advance control

### 4.4 TD-LTE Air Interface
- Single channel
- transmission gap is required (guard period)
- The guard period can be up to 10 OFDM symbol durations
- switching intervals (5 milliseconds and 10 milliseconds)

---

### 4.5 Scheduling
### 4.5.1 Downlink Scheduling
Dynamic Scheduling
Scheduling downlink data for a user works as follows:
- For each subframe the eNode-B decides the number of users it wants to schedule and the number of RBs that are assigned to each user.
- Determines the required number of symbols on the time axis in each subframe for the control region.
- The eNode-B informs mobile devices about the size of the control region via the ==PCFICH==, which is broadcast with a very robust modulation and coding scheme.
- The 2 bits describing the length of the control region are secured with a code rate of 1/16, which results in 32 output bits. QPSK modulation is then used to map these bits to 16 symbols in the first symbol column of each subframe.

On the lowest layer, four symbols on the frequency axis are grouped into a ==Resource Element Group (REG)==. ==**Nine** REGs form a CCE==

If the message describes a downlink assignment for a mobile device on the downlink shared channel, the message contains the following information:
- the type of resource allocation (see below);
- a power control command for the PUCCH;
- HARQ information (new data bit, RV);
- modulation and coding scheme;
- number of spatial layers for MIMO operation;
- precoding information (how to prepare the data for transmission). The eNode-B has several ways to indicate a resource allocation:
- Type 0 resource allocations give a bitmap of assigned RB groups. For 10-MHz channels, the group size is three RBs. For the 50 RBs of a 10-MHz channel, the bitmap has a length of 17 bits. For 20-MHz carriers, a group size of four RBs is used and the 100 RBs are addressed with a bitmap of 25 bits.
- Type 1 resource allocations also use a bitmap, but instead of assigning full groups to a mobile device with a ‘1’ in the bitmap, only one of the RBs of a group is assigned. This way, resource assignments can be spread over the complete band and frequency diversity can thus be exploited.
- Type 2 resource allocations give a starting point in the frequency domain and the number of allocated resources. The resources can either be continuous or spread over the complete channel.


Semipersistent Scheduling (For Voice call)
- Instead of scheduling each uplink or downlink transmission, a transmission pattern is defined instead of single transmission opportunities.

---

### 4.5.2 Uplink Scheduling
為了在 PUSCH 上分配資源，移動設備必須向 eNode-B 發送分配請求。 如果當前不存在與 eNode-B 的物理連接，則移動設備首先需要重新建立鏈路。 這是通過在 RACH 上發送 RRC 連接請求消息來完成的，如上所述。
網絡然後建立信道並在PUSCH上分配資源，以便移動設備可以在上行鏈路方向上傳輸信令和用戶數據。 上行資源的分配是通過每個子幀的控制部分中的PDCCH消息進行的。

---

### 4.6 Basic Procedures

### 4.6.1 Cell Search
- Information on the ==SIM== card stored in the home network with access technology field. (Know GMS, UMTS, LTE, radio access technology)
- the mobile device stores the parameters of the ==last cell== it used before it was switched off.

1. Search freq. bands for initial signal and PSS(Primary sync. signal, 5ms)
2. Search for SSS (Second sync. signal, every 5 ms) to find beginning of the frame.

3. To make cell detection easier, the PSS and SSS are broadcast only on the inner ==1.25MHz== of the channel, irrespective of the total channel bandwidth
4. The PSSs and SSSs implicitly contain the PCI.(not equal the cell-ID, but simply a lower layer physical identify of the cell)
5. The PCI is important to distinguish neighboring cells transmitting on the same frequency


After PSS and SSS, know uses a normal
or an extended cyclic prefix.

> Next,
- Read the MIB from the PBCH (40 ms, in inner 1.26MHz)
- MIB contains configuration of the channel (total bandwidth, structure of the HARQ indicator channel, System Frame Number(SNF), ciphering and calculation of paging opportunities)

> Next, SIB-1 (80 ms on downlink shared channel)
有了來自 MIB 的信息，移動設備就可以開始搜索 SIB-1。 由於它每 80 毫秒在下行鏈路共享信道上廣播一次，因此移動設備需要對子幀控制區域中的“公共(Common)”搜索空間進行解碼，以找到一個下行鏈路控制信道 ==(PDCCH)== 消息，該消息宣布存在和位置子幀中的 SIB-1。
SIB-1 contains:
- The MCC and MNC of the cell. These parameters tell the mobile device if the cell belongs to the home network or not.
- The NAS cell identifier which is similar to the cell-ID in GSM and UMTS.
- The Tracking Area Code (TAC), which corresponds to the location and routing areas in GSM and UMTS.
- Cell barring status, that is, whether the cell can be used or not.
- Minimum reception level (q_RxLevMin) that the mobile device must receive the cell with. If the level is lower, the mobile device must not try to establish communication with the cell.
- A scheduling list of other SIBs that are sent and their intervals.

> Next, SIB2 contains
- the configuration of the RACH;
- the paging channel configuration;
- the downlink shared channel configuration;
- the PUCCH configuration;
- the SRS configuration in the uplink;
- uplink power control information;
- timers and constants (e.g., how long to wait for an answer to certain messages, etc.);
- uplink channel bandwidth.

---

### 4.6.2 Attach and Default Bearer Activation
- Deliver an IP address(LTE)


> Initial Connection Establishment
1. Request resource on the uplink shared channel via a request on RACH.
2. UE knows the eNB assigned a ==Cell Radio Network Temporary Identidy==(C-NRTI)
3. Establish an ==RRC channel== t exchange message with eNB and Core Network

Ex: mobile-originated signaling, and the mobile’s temporary core
network (==NAS==) identity, the ==SAE== (Service Architecture Evolution) Temporary Mobile Subscriber Identity (S-TMSI).

> RRC connection setup(from eNB) include
1. SRB1 (NAS signaling)
2. MAC and physical layer para.
3. uplink shard channel conf.
4. uplink power control
5. SRS in uplink and how scheduling

> RRC connection setup complete message contains embedded NAS message. (==Global Unique Temporary Identify, GUTI==)

> Mutual ==authentication== ensures that the network can be sure about
the identity of the device and that the device can validate that it is communicating to a network that has properly obtained the ==authentication== information from the ==HSS==.

> UE capability inquiry
- supported air interface and support of each technology, RoHC header compression support to ==MME==.

> Session Creation
- Aftern received the update location acknowledge message from the HSS, it starts the session establishment process in the core network that results in the creation of a tunnel over which the user’s IP packets can be sent.
- MME can communicate with more than one serving-GW (for user data)
- The serving-GW in turn forwards the request to a PDN-gateway.
- The PDN-GW selects an IP address from pool.

> Establishing a Context in the Radio Network

- After established, MME response the initial ==Attach Request== with an ==Initial Context Setup Request== messge which include the Attach Accept message (include ==Tunnel Endpoint Identify==, TEID)

- After that, eNode-B by sending an ==RRC Connection Reconfiguration ==message to the mobile device. (include ==Attach Accept message==, and ==Activate Default Bearer Context Request message== ) for ==lower priority singaling message== and a ==Data Ratio Bearer(DRB)==. (**IP assignment here**)
- After attach complete, MME send TEID on the serving-GW by ==Modify Bearer Request==.
- The serving-GW stores the TEID of the eNode-B forthis tunnel and can now forward any incoming IP packets for the user over the correct tunnel to the eNode-B.

Once the connection is established, the eNode-B exchanges a number of additional ==RRC Reconfiguration== messages to configure measurements and reporting of neighbor cells so that the connection can be handed over to a different cell later on if required.

---

### 4.6.3 Handover Scenarios
The eNode-B can take a decision if a handover of the connection to a neighboring cell with a better signal is necessary.
In LTE, there are two types of handovers. The ==most efficient one== is a handover where the source eNode-B and the target eNode-B directly communicate with each other over the ==X2 interface==.

> X2 Handover

- If the target eNB grants access, it prepares itself by selecting a ==new C-RNTI== for the mobile device and reserves resources on the uplink so that the mobile device can perform a noncontention-based random access procedure once it tries to access the new cell.

- an RRC Connection Reconfiguration message is used that contains all the parameters necessary to connect to the new cell.
- sends an SN Status Transfer message to the target eNode-B with the sequence number of the last valid uplink data block
- Redirect S1 tunnel from the source eNB to target eNB.
- Path Swith Request
- Modify Bearer Request

> S1 Handover

Before the handover can be executed, a **temporary tunnel** for downlink user data is established to ensure that no packets are lost during the handover
The MME requests a serving-GW to create a ==temporary indirect tunnel== between the source and the target eNode-B with a Create ==Indirect Forward Tunnel Request== message.
Once the indirect tunnel is created, the MME confirms the ==handover with a Handover Command== to the source eNode-B.
The source eNode-B then executes the handover by issuing an ==RRC Reconfiguration Command== to the **mobile device**, which includes the parameters of the target eNode-B.
User data packets still received in the uplink direction are ==forwarded directly to the serving-GW==.

> MME and S-GW Changes
In the X2 and S1 handover examples above, no core network node changes were shown. Under some circumstances, however, these have to be changed during or after a handover as well:
- for load balancing, processing and user plane capacity reasons;
- to optimize the user data path between the radio network and the core network;
- when the target eNode-B is in a TA that is not served by the source MME.
---

### 4.6.4 Default and Dedicated Bearers

- The difference of LTE between GSM, UMTS, is the ==attach process== already includes the assignment of an ==IP address==.
- The IP connection that is automatically established during the Attach procedure uses a ==default bearer==.

---
### 4.7 Mobility Management and Power Optimization

>　Measurement for Handover
- Measurement report parameters are sent to the mobile device after an RRC connection has been established as shown in Figure 4.18 and after a handover to a new cell with an RRC Connection Reconfiguration message.
- signal of the current serving
- signals of neighboring cells

- The Reference Signal Received Power, RSRP
- -50 dBm is strong signal than -90 dBm
- The Received Signal Strength Indication, RSSI
- This value includes the total power received, including the interference from neighboring cells and other sources.
- The Reference Signal Received Quality, RSRQ
- It equals the RSRP divided by the RSSI. The better this value the better can the signal of the cell be received compared to the interference generated by other cells
- RSRQ of -10 is low speed, RSRQ of -3 or higher is high speed

> Discontinuous Reception (DRX) in the Connected State to Save Power

---
### 4.7.2 Mobility Management in Idle State
During long times of inactivity, it is advantageous for both the network and the mobile device to put the air interface connection into the ==RRC Idle== state.
> RRC Idle state
- the mobile device autonomously performs cell reselections,
- contacted only when a cell is in a new TA.
- no user data tunnel is present on the S1 interface between the eNode-B and the serving-GW.
- IP tunnel, logical bearers 仍然存在被保留，只是必須重新建立連線
- 如果當有 IP Packet 從網路來，會由 S-GW 通知 MME，MME 發送 Paging command 給 eNB，轉發給 UE 重新建立連線
- UE 接到 Paging 則會進行 RA Procedure 並建立連線

Summary the states:
- RRC Connected state with an observation of the control region for assignment grants in every subframe.
- RRC Connected state with an observation of the control region for assignment grants in a short DRX cycle pattern. The receiver is switched off for short periods of time.
- RRC Connected state with an observation of the control region for assignment grants in a long DRX cycle pattern. The receiver is switched off for longer periods of time.
- RRC Idle state in which the mobile scans only periodically for incoming paging messages.

當 UE 從一個 cell 切換到另一個 cell 時，它不僅要檢查 new cell 是否在 new TA 中，還要讀取 SI message 並 decode 所有包含 cell reselection mechanism message

Cell reselection parameters,
- Cell barring status in SIB 1.
- A serving cell hysteresis in SIB 3.
- Prefer to neighboring cells.
- Speed state selection in SIB 3.
- Stationary or Moving
- Start of intrafrequency search in SIB 3.
- Start of interfrequency and inter-RAT (Radio Access Technology) search in SIB 3.
- RATs such as GSM, UMTS and CDMA
- Neighbor cell information in SIB 4–8.

---

### 4.7.3 Mobility Management And State Changes In Practice

- Timer to switch from Connected Mode to Connected with DRX Mode after inactivity: **100–500** milliseconds
- Short-DRX Cycle: **20** milliseconds (not used by many networks and not supported by all devices)
- Long-DRX Cycle: **40–320** milliseconds
- On-Duration Timer: **2–20** milliseconds
- Timer to switch from Connected to Idle state after inactivity: **5–10** seconds

---

### 4.8 LTE Security Architecture
- The architecture is based on a secret key which is stored on the SIM card of the subscriber and in the HSS in the network
- Afterward, ciphering and integrity protection can be activated for all NAS messages between the UE and the MME
- EPS Encryption Algorithm (eea0, eea1, eea2, etc.) and an EPS Integrity Algorithm (eia1, eia2, etc.) from a list of supported algorithms that is supported by both side

---

### 4.9 Interconnection with UMTS and GSM

> Procedure
- cell reselection from LTE(TA) to UMTS(NA) or GSM;
- RRC connection release with redirect from LTE to UMTS or GSM;
- inter-RAT handover from LTE to UMTS or GSM.


---

### 4.9.1 Cell Reselection between LTE and GSM/UMTS

Cell Reselection in ==RRC Idle== state.
1. eNBs broadcase info. on neighboring GSM, UMTS and CDMA cells in their S1 message.
2. When a network-configured ==signal level threshold== is reached, the mobile device starts searching for ==non-LTE cells== and reselects to them based on their reception level and usage priority.

Once the mobile device decides to move from an LTE cell to a GSM or UMTS cell, it performs a ==location area update== with the ==circuit-switched== side of the core network if it has circuit-switched voice and SMS capabilities.

如果 LTE 網絡中沒有使用基於運營商的 VoIP 解決方案，MSC 將無法從之前的 MSC 檢索訂閱信息，因此會要求移動設備識別自己，以便它可以從該 MSC 檢索用戶的訂閱記錄。 HLR完成位置更新
Packet-Switched Side of GSM or UMTS，UE 執行 routing area update
- 該請求包括之前使用的 MME/S-GW 的信息，從 GSM/UMTS SGSN 的角度來看，它是另一個 ==SGSN== (SGSN->SGNS)
- 根據這些信息，SGSN 推導出前一個 ==SGSN（MME）==的 IP 地址，並通過 Gn 接口請求訂戶的 current contexts
- 從 SGSN 的角度來看，這是一個標準的 SGSN 間 rounting area update 過程，也用於檢索已從連接到不同 SGSN 的 GSM 或 UMTS cell 執行 cell reselection 的 user contexts。
- 使用在 MME 中提供的信息，SGSN 然後驗證訂戶並向 PDN-GW 請求用戶數據隧道修改，PDN-GW 充當 Gn 接口上的 GGSN。
- The device then goes back to the Idle state

當支持 LTE 的移動設備在 GSM、UMTS 或 CDMA 網絡中漫遊時，它應該在漫游到 LTE 覆蓋區域後立即返回可用的 LTE 網絡。

- 一旦移動設備執行到 LTE cell 的 cell reselection，它就會與 MME 執行 TA 更新過程。
- 在 TA 更新消息中，移動設備包括上次使用的位置和路由區域的信息，以便 ME 可以確定之前使用的 SGSN。 然後它將通過 Gn 接口聯繫 SGSN 以請求訂閱者的 contexts 以保留 session。
- 2G/3G SGSN 將再次將此視為標準的 SGSN 間 routing area update。 一旦訂戶已通過身份驗證，MME 會聯繫服務 GW 和迄今為止充當 SGSN 的 PDN-GW 以重定向核心網絡用戶數據隧道。
- 最後，MME 還聯繫 HSS，將用戶的新位置通知給它。
- 之後，移動設備向移動設備確認 TA 更新，它可以返回到 RRC 空閒狀態。

---

### 4.9.2 RRC Connection Release with Redirect between LTE and GSM/UMTS
While the mobile device is in the LTE ==RRC Connected state==, the network is responsible for the ==mobility management==.

---

### 4.9.3 Handover between LTE and GSM/UMTS
As the outage time during a ==Cell Change Order procedure== is in the range of several seconds, it is ==not suitable== for a number of applications such as ==VoIP==.

> ==Intrafrequency LTE handover== from LTE to UMTS

- For measurements on other frequencies, the eNode-B needs to ==reconfigure the radio connection== so that reception and transmission ==gaps== for measurements on other channels can be ==inserted==.
- The handover command in the ==RRC reconfiguration message== contains the new frequency, RAT technologies and other parameters required to change to another RAT.
- Once the connection has been handed over, the mobile device has to perform a ==routing area update procedure== to update the core network nodes and the ==HSS with its current position==.
- Depending on the support of network operator voice and SMS service, a location update with the CS core network might have to be performed so that the mobile remains reachable for these services after the handover.

---

### 4.10 Interworking with CDMA2000 Networks

- cell reselection between LTE and CDMA2000;
- RRC connection release with redirect from LTE to CDMA2000;
- inter-RAT handover between LTE and CDMA2000.


---

### 4.10.1 Cell Reselection between LTE and CDMA2000 Networks
- On the LTE side, it is supported by neighbor cell information in the ==SIB-8== message.
- ==Home Agent(HA)== by ==CDMA2000== to ==keep IP address==
- The network then contacts the PDN-GW via the ==S2a== interface and moves the subscriber’s context to the CDMA2000 side.

---

### 4.10.2 RRC Connection Release with Redirect between LTE and CDMA2000

- Aided by signal strength measurements. The simplest form of such a transfer is to issue an RRC connection release with redirect information to a CDMA2000 cell.

- ==Non-optimized==. The mobile device changes the RAT and performs the same signaling message exchange as described above for cell reselection.
- ==Optimized==. ==preregistration with the CDMA2000 access== at the time it initially registers with the LTE network

---

### 4.10.3 Handover between LTE and CDMA2000
- Once a handover has to be made, the eNode-B sends an Evolved-UMTS Terrestrial Radio Access (E-UTRA) ==handover preparation request message== to the UE.

---

### 4.11 Network Planning Aspects
### 4.11.1 Single Frequency Network
- 由於多個網絡運營商在一個小頻段中共享可用頻譜，因此沒有足夠的頻譜可用。 一個例子是歐洲數字紅利頻段 20 頻段。 如本章開頭的表 4.2 所示，每個方向只有 30MHz 可用。 如果由兩個以上的運營商使用，每個網絡運營商的最大信道帶寬最多為 10MHz。
- 某些頻段不適合 20-MHz 信道，例如，因為上行鏈路和下行鏈路之間的雙工間隙很窄。 這使得移動設備中的濾波器難以正確分離收發器中的上行鏈路和下行鏈路數據流。 在此類頻段中，如果網絡運營商能夠獲得更多帶寬，則可能會使用多個載波。

---

### 4.11.2 Cell Edge Performance

> ==**Load indication message**== for ==**Intercell Interference Coordination**== (ICIC)
- the X2 interface can be used to exchange interference-related information between neighboring eNode-Bs,
- eNode-Bs can inform their neighbors of the power used for RBs on the frequency axis


Two-cell scenario (Downlink)
- Fractional Frequency Reuse (FFR)

In the uplink direction,
- an eNode-B can measure interference from mobile devices communicating with another eNode-B directly and take measures to avoid scheduling those RBs for its own users.
- In addition, the load indication message on the X2 interface can be used to inform neighboring eNode-Bs regarding the RBs in which high interference is experienced so that neighbors can change, limit or adapt the power usage of mobile devices on certain RBs.

---

### 4.11.3 Self-Organizing Network Functionality
> Self-configuring and Self-Organizing Network (SON)
- Initial self-configuration
- ANR (Automatic Neighbour Relation)
- Coverage and capacity optimization (drive tests)
- SON aims to use mobile device and base station measurements to detect these issues.
- Energy saving
- PCI(Physical Cell Identifier) configuration
- Only 504 IDs are available and neighboring base stations should use a certain combination for easier detection.
- Handover optimization
- Load balancing
- RACH optimization

---

### 4.12 CS-Fallback for Voice and SMS Services with LTE
- VoLTE based on packet-switched (IP based)
- Session Initiation Protocol (SIP)-based
- User Agent
- Proxy
- Register
- IP Multimedia Subsystem (IMS)
- Circuit-Switched Fallback (CSFB)

---

### 4.12.1 SMS over SGs

- Inform ==SMS capability== to MME during ==attach procedure==.
- Set ==combined attach SMS only flag==
- To deliver SMS messages over the SGs interface, the MME registers itself with ==HLR== for the delivery of SMS messages during the attach procedure.

---

### 4.12.2 CS Fallback