# 陳毅 - 讀書會 - 21/08/07

:::info
- [x] 閱讀 Netmanias-11-EMM Procedure 1. Initial Attach - Part 2
:::

## Initial Attach Procedure
### IMSI Acquisition
當 IMSI Acquisiton 這個步驟結束時，MME 會從 UE 端獲得 IMSI，整個流程如下:
- UE 發送 Attach Request 以嘗試初始化網路接觸。
- MME 會接收到來自 UE 的 IMSI。


為了達到這個目的，上述的流程又可以被細分為兩個子步驟:
1. The UE stays in the initial state after radio link synchronization.
2. The UE establishes ECM connection for delivering an Attach Request message to the MME.

至於 ECM Connection 的建立階段也可以被進一步的分成兩個子階段:
1. RRC connection establishment
2. S1 signaling connection establishment.

#### Initial State after Radio Link Synchronization

為了讓 UE 順利發送 Initial attach 到網路端，通訊的部分尤其重要。
為此，UE 透過 PLMN Selection 以及 Cell search procedure 去選擇 eNB，且做了 radio link synchronized。
此時，User可以與 eNB 做通訊 ( UE 處於 EMM-Deregistered, ECM-Idle, and RRC-Idle state 的狀態下)。
#### ECM Connection Establishment
在 NAS 層上，UE 發送了 Attach Request message 以要求 MME 完成 initial attach。
為了達到上述目的，UE 與 eNB 之間的 ECM connection, RRC connection 以及 MME 與 eNB 之間的S1 signaling connection 都是必備的。
NAS messages 會被當作 RRC messages 發送，當通過 RRC connection 時，作為 S1AP messages 通過 S1 signaling connection。
1. RRC Connection


2. S1 Signaling Connection Establishment

eNB 與 MME 之間的 Control messages 通過 S1-MME interface 內嵌到 S1AP messages 再被發送出去。
S1AP messages 會通過為每個用戶所建立的 S1 signaling connections 發送出去，S1 signaling connections 由 ID pair 定義。
> ID pair 被 eNB 與 MME 分配以分辨 UEs。

### Authentication

> 這部分之前已經提過，不補充。

### NAS Security Setup


### Location Update

當 LTE Authentication 與 NAS Security Setup 完成後，MME 就取得了 Subscriber 的資訊，最後，MME 會通知 HSS 訂閱戶已經註冊到網路中且被定位於 TAs 中。



### EPS Session Establishment


#### 1. [MME] Assigning EPS Bearer ID
The MME selects a value from 5~15, and allocates it as an EPS Bearer ID (EBI) in order to establish a default EPS bearer for the newly attached user.

#### 2. [MME] Selecting P-GW

The MME checks the APN received from the HSS, and decides to which P-GW to connect to access the APN. This decision can be made based on the subscription information received from the HSS (specifically, P-GW ID).
如果 HSS 沒有相關訊息，MME 會去查詢 DNS server 以取得 APN 的 FQDN （像是: internet.apn.epc.mnc05.mcc450.3gppnetwork.org），以及按照 P-GW selection policies 從返回的 P-GW IP addess list 選擇一個 IP。
同時間，也會選擇要走訪哪一個 S-GW。

#### 3. [MME -> S-GW] Request for EPS Session Creation
MME 與 S-GW 通過 S11 介面使用 GTP Protocol 達到 Control plane 的通訊。
MME 在上一個步驟所提到的 S-GW selection 中會發送 Create Session Request，它包含了這些參數:

#### 4. [S-GW -> P-GW] Request for EPS Session Creation
P-GW 與 S-GW 通過 S5 介面使用 GTP Protocol 達到 User plane 與 Control plane 的通訊。
S-GW 為了收到 Creation Session Request message 分配 downlink S5 TEID (S5 S-GW TEID) 以建立 S5 GTP。

#### 5. [S5 Bearer: Downlink]
Once Step 4) is completed, the downlink S5 GTP-U tunnel is created, allowing the P-GW to send downlink traffic to the S-GW.

#### 6. [P-GW] Allocating User IP Address

The P-GW, upon receiving the Create Session Request message, realizes the user is attempting to access the network again with IMSI. So, it allocates an IP address to the UE so that the UE can use it when using APN.

#### 7. [P-GW -> PCRF] Notifying of EPS Session Setup

The P-GW and the PCRF communicate over Gx interface using Diameter protocol. When creating an EPS session for a user, resources allocation and QoS control for the user must be determined based on the services that the user is subscribing to. It is PCRF that is in charge of controlling policies concerning all the users who accessed to the network. So, the P-GW provides the PCRF with subscription information about the user, and obtains the PCRF’s authorization for resources allocation in accordance with the network operator’s policies. From the UE’s subscription information received from the MME, the P-GW gathers information required for the PCRF’s decision-making on the operator’s policies, and sends it to the PCRF through a CCR (CC-Request) message. An example of
the message is as follows:


#### 8. [PCRF -> SPR] Requesting Access Profiles
The PCRF requests the SPR for the user’s access profile to determine PCC policies for the user.

#### 9. [PCRF <- SPR] Returning Access Profiles

The SPR returns an access profile for the user. The profile may include information such as SDF Filter, QCI, ARP, APN-AMBR (UL/DL), Charging Method (e.g. Offline), Changing Reporting Action (e.g. Start Reporting ECGI, TAI), etc.

#### 10. [PCRF] Determining Policies

The PCRF determines PCC policies for the EPS session to be established based on the user access profile.

#### 11. [P-GW <- PCRF] Acknowledging EPS Session Establishment
he PCRF delivers the PCC policies determined in Step 10) to the P-GW, as included in a CCA (CC-Answer) message. An example of the message is as follows:

#### 12. [P-GW] Policy Enforcement
The P-GW applies the PCC policies received from the PCRF. As the PCC policies are applied to each SDF, the P-GW sets up mapping between SDFs and the EPS bearer, and prepares a QoS profile to be applied to the default EPS bearer.

#### 13. ~ 15. EPS Session Creation Response

The P-GW informs the MME of the QoS information applied to the established EPS sessions and default EPS bearer, by sending it in a Create Session Response message. The PCRF may decide to keep the value the MME received from the HSS, or select a new value.

#### 16. [MME] Why MME Keeps S5 P-GW TEID?

Once attached to a network, if a UE performs a TAU or handover, its S-GW may be changed. For this reason, the MME informs the UE’s new S-GW of the uplink S5 TEID so that the new S-GW can deliver uplink traffic to the P-GW.

#### 17. [S1 Bearer: Uplink] Create S1 TEID (UL)

Completing Step 15 establishes the uplink S1 GTP-U tunnel. However, since the eNB does not have this value (S1 S-GW TEID) yet, it cannot deliver uplink traffic to the S-GW at this time.

#### 18. [MME] Calculating UE-AMBR

Now, the MME returns an Attach Accept message to the UE as a response to the Attach Request message, and prepares for E-RAB setup (i.e. for allocating resources to radio link and S1 bearer) by controlling the eNB. For this, the MME calculates the UE-AMBR value to send to the eNB. The MME has already received the UE-AMBR value, as included in subscription information, from the HSS. However, it can adjust the value to the extent not exceeding the total APN-AMBR of each APN, and allocates it instead.


#### 19. Determining Information needed for E-RAB and NAS Signaling


#### 20. [UE <- MME] Attach Accept
The MME includes information, such as the UE IP address allocated by the P-GW, the GUTI, TAI list,
EPS Bearer ID, UE-AMBR values allocated by itself, and QoS parameters received from the S-GW, in the Attach Accept message, and sends it to the UE as a response to the Attach Request message.
This message is delivered as included in the **Initial Context Setup Request** message through the S1 signaling connection, and then in the **RRC Connection Reconfiguration** message through the RRC connection.

#### 21. [MME] Creating $K_{eNB}$
The MME creates $K_{eNB}$, the AS security base key, from $K_{ASME}$. This is to ensure the eNB can generate AS security keys to be used for secured communication between the eNB and the UE over radio link.

#### 22. [eNB <- MME] Requesting E-RAB Setup


#### 23. [S1 Bearer: Uplink] Receive S1 TEID (UL)

When the eNB receives the MME’s Initial Context Setup Request message that requests E-RAB setup, it sets up DRB by sending an Attach Accept message to the UE. Then, it completes S1 bearer setup by including a downlink S1 TEID in the Initial Context Setup Response message, and sending the message as a response to the Initial Context Setup Request message to the MME, so that the MME can forward it to
the S-GW.

#### 24. - 27. AS Security Setup


#### 28. - 29. DRB Establishment


#### 30. [eNB -> S-GW] E-RAB Setup Response

The eNB allocates a downlink S1 TEID (S1 eNB TEID) for S1 bearer. Then it includes the allocated ID in an Initial Context Setup Response message, and sends it to the MME as a response to the Initial Context Setup Request message received in Step 22), so that the MME can forwards it to the S-GW.

#### 31. [eNB] Allocating a Downlink TEID for S1 Bearer

Once Step 29) is completed, a downlink TEID is allocated by the eNB to S1 bearer, establishing the downlink S1 GTP-U tunnel. However, since the S-GW does not know about the establishment yet, it cannot delivery downlink traffic to the eNB at this time.

#### 32. [UE -> MME] Sending Attach Complete Message

The UE sends an Attach Complete message to the MME, as a response to the message in Step 20).
The Attach Complete message is delivered through an UL Information Transfer message over the RRC connection, and then through an Uplink NAS Transport message over the S1 signaling connection.

#### 33. [UE][MME] EMM State

Now the UE and the MME stay in EMM-Registered state. If an Attach Reject message is sent from the MME to the UE in Step 20), the UE must release the ECM/RRC connection and transit to EMMDeregistered state.

#### 34. [MME -> S-GW] Requesting S1 Bearer Modification

The MME forwards the downlink S1 TEID (S1 eNB TEID) received from the eNB to the S-GW through a Modify Bearer Request message.

#### 35. [MME <- S-GW] Responding to S1 Bearer Modification Request

The S-GW sends the MME a Modify Bearer Response as a response to the Modify Bearer Request message. Now, the S-GW is ready to deliver downlink S1 traffic.

#### 36. [S1 Bearer: Downlink] S1 Bearer Setup Complete

Step 35) completes the setup procedure for S1 bearer. With the establishment of S1 bearer, the eNB and the S-GW can exchange traffic with each other. Now, the default EPS bearer from the UE all the way to the P-GW is finally established, allowing uplink/downlink EPS bearer communication between the UE and the P-GW.

## EPS Entity Information: Before/After Initial Attach

### Before Initial Attach


### After Initial Attach


#### Changes in UE ID Information


#### Changes in UE Location Information


#### Changes in Security Context Information

#### Changes in EPS Session/Bearer Information