Express YourSelf !

Last article, I started a series on LTE NAS. I wrote some basics about NAS and its root to 3G. I focused more on EMM. This article is about ECM. ECM is used to establish connection. The connection is established between UE and MME either for session management or for SMS transfer. Let’s start with ECM specific procedure named.

So, what is paging? Yes it is also memory management technique, that we learnt in computer science. However in cellular wireless context paging is different. If someone dial your mobile number, your mobile start ringing. How it happens? First, network start paging procedure to intimate mobile about incoming call. Then mobile and network performs security procedures, radio resource allocation and finally it starts ringing. The call can be CS or PS and so paging also. We can foresee that initial LTE network will co-exist with 3G or even 2G network. Voice call will not move to PS VoIP over night. If valid NAS context exist at MME, LTE has “CS Service notification” ECM specific procedure use for CS paging. In the absence of NAS context, “Paging” ECM specific procedure is used establish NAS for incoming CS or PS call. NAS context consists of security parameters between UE and MME for NAS message exchanges. Generally LTE network address the UE with its S-TMSI in “Paging” procedure. However if MME restart or somehow, MME lost S-TMSI of UE, then it uses IMSI. It is rare case, abnormal condition and used to recover the error.

UE initiates “Service Request” ECM specific procedure, in response to paging. As part of this ECM specific procedure, the network may initiate optional common procedure(s): (1) Authentication and/or (2) Security Mode Control. We saw in last article, that specific procedures are made up of zero or more common procedure(s). The successful Service Request procedure result into ECM connected (EMM connected) state. NAS ECM has one more variant for Service Request procedure, that is Extended Service Request. It is used for CS fallback for voice call and handoff with non-3GPP networks. Non-3GPP networks are CDMA network, EVDO (HRPD) network, WiMAX network, etc.

The last NAS ECM specific procedure is “Transport of NAS”. It is used for SMS.

Paging always initiated by network. Detach and “Transport of NAS” procedures can be invoked by either network or UE. All other ECM and EMM NAS procedures are UE initiated. Service Request ECM specific procedure and all EMM specific procedures (i.e. Attach, Detach and TAU) are starting Initial NAS messages. NAS context may not present during this procedure. So the first message is not encrypted. These procedures may invoke other common EMM procedure for security purpose.

One can consider ECM as separate category of NAS procedure, or they are just part of EMM. Let me recap. So far we have seen EMM and ECM specific NAS procedure. Next is ESM. Here are various procedures that we cover in a tree format. Generally each procedure contains a pair of message exchange. Request and Response. A message contains IE.

EMM Elementary procedure.

1. EMM specific procedure
   1. Attach
      1. Attach
      2. Combined Attach
   2. Detach
      1. Detach
      2. Combined Detach
   3. TAU
      1. Normal TAU
      2. Periodic TAU.
2. ECM specific procedure
   1. Service Request
      1. Service Request
      2. Extended Service Request
   2. Paging
      1. With S-TMSI
      2. With IMSI
   3. CS Service Notification
   4. Transport of NAS

So here let me focus on NAS signally aspects of LTE. It is highly preferable to have some prior knowledge about any wireless technology : 2G, 3G or 4G. This LTE-NAS series will provide some idea about LTE basic procedures and signaling message exchanges. They are called NAS messages. One can always refer 3GPP standard to learn NAS. But here I wrote it differently, in my own wordings, at my blog 'Express YourSelf !' Enjoy it and let me know your feedback.

Even UMTS has NAS. NAS messages are for (1) Mobility (2) Session Management and (3) Security. Security has two aspects: (1)integrity and (2)ciphering. Today’s article is about EMM. EMM includes determining UE's location, user's authentication, confidentiality, and connection management. Procedure is a group of NAS messages exchange with specific purpose. There are two kinds of EMM elementary procedures. (1) Common procedures and (2) specific procedures.

Let’s see specific procedures, (1)Attach, (2)Detach and (3) TAU are EMM’s specific procedures. As the name suggest, UE invokes attach procedure to attach to LTE network and to detach from LTE network, the detach procedure. These procedures are invoked when UE is powered ON (attach) or OFF (detach). Also when UE enters to LTE coverage area (attach) or leave LTE coverage area (detach). Simple to understand. Is not it? Generally UE and network both are backward compatible. So UE may perform combined attach/detach for (1) new LTE network and (2) legacy GPRS/UMTS network. To support such combine procedure is optional. Normal attach and combined attach are differ only by presence of few optional IEs. There are three kinds of UEs. PS only mode UE works only with EPS (EPS is synonymous for LTE). These UEs are not mobile handsets but they are USB dongle or PC card. They never perform combined procedure. “CS/PS mode 1 UE” and “CS/PS mode 2 UE” are dual mode. If UE is under coverage of both LTE and legacy GPRS/UMTS, then Mode 1 UE prefers non-EPS (GPRS/UMTS) and mode 2 prefers EPS(LTE) service. However, they can attach to both networks, (1) EPS network and (2) non-EPS network.

What is TAU? TA is formed by coverage are of a group of cell sites (eNBs). LA in 2G GSM, RA in GPRS. eNB broadcasts TAI. When the moving UE change its TA, it informs the network about its new TA or TA list with “normal TAU procedure”. Even if UE is stationary, it periodically reports its TA with “periodic TAU procedure”. Our 2G GSM MS perform LAU at about every 3 hours. GPRS MS perform RAU at about every 50 to 55 minutes. TAU can also be combined TAU, to inform legacy GPRS/UMTS network, with help of eUTRAN LTE infrastructure. So if network supports combine procedures, then dual mode UEs can perform combine procedure. The combined procedures save UE’s battery power and network’s scare radio resources. :)

After knowing the purpose of EMM procedure, let’s have closer look to them. The EMM Specific procedures in turn may optionally invoke common procedures. For example, EMM specific procedure named Attach may invoke other EMM common procedure(s) like (1)GUTI relocation, (2)Authentication, (3)Security Mode control, (4)Identification, (5)EMM Information and (6)ESM Information. They are optional. The common procedures and specific procedures, both are EMM elementary procedure. Let me describe this concept with a class diagram !!

Yes, I know, we use UML class diagram for design a software module. Here I have used just to make the point clear. It is not for design of NAS module neither at UE nor at MME.

Have you noticed? I used italic fonts in diagram to indicate abstract class They are still category only, not any concrete procedure. Here all EMM Specific procedures and few ECM specific procedures may optionally invoke EMM common procedure(s). So these specific procedures are “whole”, common procedure(s) are “part” and this is aggregation relationship. Also, if you observe carefully the class diagram looks like Composite design pattern.

RRC carries NAS messages. In UMTS, RRC is terminating at RNC. LTE network, does not have RNC so RRC is terminating at eNB. NAS terminates at MME. NAS messages are between UE and MME. RRC and NAS both provides data integrity. Ciphering is mandatory for RRC, but optional for NAS. NAS can have at least two FSMs for (1) ESM FSM and (2) EMM FSM. EMM FSM has seven states. (1) EMM Null, (2) EMM DeRegistered, (3) EMM DeRegistered initiated, (4) EMM Registered, (5) EMM Registered initiated, (6) EMM TAU initiated, (7) EMM Service Request initiated. Have you noticed? Out of these seven states, most of them are transient states. EMM FSM has major two states only. EMM DeRegistered and EMM Registered. They are correspond to UE is power OFF and UE power ON (with valid subscription :-) ) respectively. ECM can have its FSM. For EMM Registered state, ECM FSM has two states. (1) ECM idle and (2) ECM connected. They are also known as EMM Idle and EMM Connected respectively.

Subsequent articles will cover more details about ECM, ESM and security etc...