UMTS Call Flow

Motorola Confidential Proprietary

UMTS Call Flows Approved Motorola: ANDC-MA-00-0.3.4-RQ November 4, 2000 1 Version 1.01

UMTS

Detailed Call Flows

Authors Flix Bejarano Cebrin

(GSD, Advanced Network Development Centre)

Status: Approved

Document ID: ANDC-MA-00-0.3.4-RQ

Version: 1.01

Date: November 4, 2000

Motorola Network Solutions Sector

1501 W. Shure Drive Arlington Heights, Illinois 60004, USA

Abstract

This document describes UMTS Detailed end-end Call Flows.

MOTOROLA CONFIDENTIAL PROPRIETARY

This document and the information contained in it is CONFIDENTIAL INFORMATION of Motorola and shall not be used, or published, or disclosed, or

disseminated outside of Motorola in whole or in part without the expressed written consent of Motorola. This document contains trade secrets of Motorola.

Reverse engineering of any or all of the information in this document is prohibited.

The copyright notice does not imply publication of this document. 1999, 2000

Copyright 1999, 2000 Motorola, USA



Release History Version Release Date Author(s) Change History Draft 0.1 June 19, 2000 Flix Bejarano (ANDC) Original Document Draft 0.2 June 27, 2000 Flix Bejarano (ANDC) Change requests from version 0.1 revision Draft 0.3 July 24, 2000 Flix Bejarano (ANDC) Mobile Terminated Call Establishment, Call

Release and Soft Handover sections Draft 0.4 August 2, 2000 Flix Bejarano (ANDC) Inter-frequency FDD to FDD Hard Handover

section Draft 0.5 September 1, 2000 Flix Bejarano (ANDC) Update to 3GPP R99 June 2000 versions Draft 0.6 September 7, 2000 Flix Bejarano (ANDC) Section 6 included Approved 1.0 October 4, 2000 Flix Bejarano (ANDC) Change requests from version 0.6 revision.

This version is now section 2.15 in UTRAN SFRAS version 1.5

Draft 1.01 November 4, 2000 Flix Bejarano (ANDC) Minor cosmetic changes



Table of Contents Release History .................................................................................................................................. 2 Table of Contents ............................................................................................................................... 3 Table of Figures ................................................................................................................................. 5 Reference List .................................................................................................................................... 6 Glossary of terms ............................................................................................................................... 7 1 Introduction ............................................................................................................................. 23

1.1 Scope ................................................................................................................................. 23 1.2 Notation for Signalling Procedures ..................................................................................... 23 1.3 Explanation of Terms ......................................................................................................... 24

2 End-End Call Establishment .................................................................................................... 26 2.1 Mobile Originated Call Establishment ................................................................................ 26

2.1.1 RRC Connection Establishment procedures ................................................................. 27 2.1.2 Iu Signalling Connection Establishment procedure ...................................................... 30 2.1.3 UE-CN Signalling Messages ....................................................................................... 31 2.1.4 Common ID procedure ................................................................................................ 32 2.1.5 Security Functions....................................................................................................... 33

2.1.5.1 Identity Check Procedure......................................................................................................33 2.1.5.2 Authentication and Key Agreement procedure ......................................................................34 2.1.5.3 Security Mode Setup procedure ............................................................................................36

2.1.6 MM Connection Established........................................................................................ 38 2.1.7 RAB Establishment ..................................................................................................... 39

2.1.7.1 DCH DCH RAB Establishment procedure .........................................................................39 2.1.7.2 RACH/FACH DCH Establishment procedure ....................................................................44 2.1.7.3 RACH/FACH RACH/FACH Establishment procedure.......................................................46

2.1.8 Service Request and PDP Context Activation procedure (PS domain only) .................. 48 2.1.9 CS Domain Call Setup procedure (CS domain only) .................................................... 51

2.2 Mobile Terminated Call Establishment ............................................................................... 54 2.2.1 Service Request and PDP Context Activation procedure (PS domain only) .................. 54 2.2.2 CS Domain Call Setup procedure (CS domain only) .................................................... 57 2.2.3 Paging procedures ....................................................................................................... 59

3 Call Release............................................................................................................................. 63 3.1 Mobile Originated Call Release .......................................................................................... 63

3.1.1 PDP Context Deactivation procedure (PS domain only)............................................... 63 3.1.2 Call Clearing procedure (CS domain only) .................................................................. 65 3.1.3 UTRAN Resources Release procedures ....................................................................... 66

3.1.3.1 Iu Signalling Connection Release procedure .........................................................................66 3.1.3.2 RRC Connection Release procedure......................................................................................67 3.1.3.3 RAB Release procedure........................................................................................................70

3.1.3.3.1 DCH-DCH RAB Release Synchronised procedure.......................................................72 3.1.3.3.2 DCH-DCH RAB Release Unsynchronised procedure...................................................75 3.1.3.3.3 RACH/FACH DCH RAB Release procedure...............................................................77 3.1.3.3.4 RACH/FACH RACH/FACH RAB Release procedure .................................................79

3.2 Mobile Terminated Call Release......................................................................................... 80 3.2.1 PDP Context Deactivation procedure (PS domain only)............................................... 80 3.2.2 Call Clearing procedure (CS domain only) .................................................................. 82

4 Soft Handover.......................................................................................................................... 86 4.1 Radio Link Addition (Branch Addition) ............................................................................. 87 4.2 Radio Link Deletion (Branch Deletion) .............................................................................. 89 4.3 Radio Link Addition & Deletion (Branch Addition & Deletion - simultaneously) ............... 91

5 Hard Handover ........................................................................................................................ 94



5.1 Inter-frequency FDD to FDD Hard Handover procedure......................................................94 5.1.1 Without Switching in the CN (DCH state) ....................................................................94 5.1.2 With Switching in the CN (UE connected to two CN nodes, DCH state).......................99

5.1.2.1 Intra CN node procedure ...................................................................................................... 99 5.1.2.2 Inter CN node procedure .................................................................................................... 105

6 Other UMTS procedures.........................................................................................................112 6.1 SRNS Relocation Procedure..............................................................................................112 6.2 Other Mobility Management procedures............................................................................114

6.2.1 Example message flows for the paging procedure.......................................................114 6.2.2 Mobility Management of active calls ..........................................................................115

6.2.2.1 Soft/hard handover ............................................................................................................. 115 6.2.2.2 Intra-RNS URA Update ..................................................................................................... 116 6.2.2.3 Inter-RNS URA Update without SRNS relocation .............................................................. 116 6.2.2.4 Intra-RNS Cell Update ....................................................................................................... 117 6.2.2.5 Inter-RNS Cell Update without SRNS relocation ................................................................ 119

6.2.2.5.1 Without C-RNTI re-allocation nor Physical Channel Reconfiguration........................... 120 6.2.2.5.2 With C-RNTI re-allocation or physical channel reconfiguration.................................... 121

Annex A. UMTS Call Flows Proposal.............................................................................................123



Table of Figures Figure 1: Example of signalling procedure notation .......................................................................... 24 Figure 2: NAS Signalling connections ................................................................................................... 26 Figure 3: Establishment of the RRC connection on RACH/FACH ............................................................. 27 Figure 4: RRC connection establishment on DCH ................................................................................... 28 Figure 5: Initial UE message to the CN .................................................................................................. 30 Figure 6: Direct Transfer ..................................................................................................................... 31 Figure 7: Common ID procedure........................................................................................................... 32 Figure 8: Identity Check Procedure ....................................................................................................... 33 Figure 9: Authentication and Key Agreement Procedure .......................................................................... 35 Figure 10: Security Mode Set-up Procedure............................................................................................ 36 Figure 11: (CM) Service Accept ........................................................................................................... 38 Figure 12: Radio Access Bearer Establishment - DCH - DCH Establishment - Synchronized ........................ 41 Figure 13: Radio Access Bearer Establishment RACH/FACH - DCH Establishment Unsynchronised ....... 45 Figure 14: Radio Access Bearer Establishment RACH/FACH RACH/FACH Establishment

Unsynchronised .......................................................................................................................... 47 Figure 15: Service Request and PDP context Activation Initiated by UE Procedures (PS domain only)49 Figure 16:CS Domain Call Setup (CS domain only) ................................................................................ 52 Figure 17: Successful Network-Requested PDP Context Activation Procedure ............................................ 55 Figure 18: Successful Mobile Terminated CS Domain Call Establishment .................................................. 58 Figure 19:Paging Procedure for different UE RRC modes ........................................................................ 61 Figure 20: PDP Context Deactivation Initiated by UE procedure ............................................................... 63 Figure 21: Call Clearing Initiated by UE procedure ................................................................................. 65 Figure 22: Iu Signalling Connection Release Procedure............................................................................ 67 Figure 23: RRC Connection release of a common transport channel........................................................... 68 Figure 24: RRC Connection release of a dedicated channel....................................................................... 69 Figure 25: RAB Release Procedure ....................................................................................................... 71 Figure 26: Radio Access Bearer Release - DCH - DCH Release - Synchronised .......................................... 73 Figure 27: Radio Access Bearer Release - DCH - DCH Release - Unsynchronised....................................... 76 Figure 28: Radio Access Bearer Release RACH/FACH - DCH Release - Unsynchronised.......................... 78 Figure 29: Radio Access Bearer Release - RACH/FACH - RACH/FACH Release ....................................... 79 Figure 30: PDP Context Deactivation Initiated by SGSN procedure ........................................................... 80 Figure 31: PDP Context Deactivation Initiated by GGSN procedure .......................................................... 81 Figure 32: Call Clearing Initiated by MSC with Release message procedure ............................................... 82 Figure 33: Call Clearing Initiated by MSC with Disconnect message procedure........................................... 84 Figure 34: Soft Handover - Radio Link Addition (Branch Addition) .......................................................... 88 Figure 35: Soft Handover - Radio Link Deletion (Branch Deletion) ........................................................... 90 Figure 36: Soft Handover - Radio link Addition & Deletion (Branch Addition & Deletion - simultaneously) ... 92 Figure 37: Inter-frequency FDD to FDD Hard Handover via Iur (UE in DCH state) ..................................... 96 Figure 38: Intra CN nodes Hard Handover with switching in the CN (UE connected to two CN nodes, DCH

state) ........................................................................................................................................101 Figure 39: Inter CN nodes Hard Handover with switching in the CN (PS domain only, UE in DCH state) .....107 Figure 40: SRNS Relocation procedure (UE connected to two CN nodes, DCH state) .................................113 Figure 41: Paging message flow over Iu, Iub and Iur .......................................................................115 Figure 42: Intra RNS URA Update ..................................................................................................116 Figure 43: Inter RNS URA update without SRNS relocation ...........................................................117 Figure 44: Intra RNS Cell Update in case SRNC=CRNC.................................................................118 Figure 45: Cell Update via Iur (case without C-RNTI re-allocation).................................................120 Figure 46: Inter-RNS cell update via Iur (case with C-RNTI re-allocation) ......................................122



Reference List

[1] 23.060 version 3.4.0 (2000-07): General Packet Radio Service (GPRS); Service Description

[2] 23.108 version 3.2.0 (2000-03): Mobile radio interface layer 3 specification; CN Protocols Stage 2

[3] 23.121 version 3.3.0 (2000-03): Architectural Requirements for Release 1999

[4] 24.008 version 3.4.1 (2000-07): Mobile radio interface layer 3 specification; CN Protocols - Stage 3

[5] 25.331 version 3.3.0 (2000-06): RRC protocol specification

[6] 25.401 version 3.3.0 (2000-06): UTRAN Overall Description

[7] 25.410 version 3.2.0 (2000-03): UTRAN Iu Interface: General Aspects and Principles

[8] 25.413 version 3.2.0 (2000-06): UTRAN Iu Interface RANAP Signalling

[9] 25.420 version 3.1.0 (2000-03): UTRAN Iur Interface: General Aspects and Principles

[10] 25.423 version 3.2.0 (2000-06): UTRAN Iur Interface RNSAP Signalling

[11] 25.430 version 3.2.0 (2000-06): UTRAN Iub Interface: General Aspects and Principles

[12] 25.433 version 3.2.0 (2000-06): UTRAN Iub Interface NBAP Signalling

[13] 25.931 version 3.0.0 (2000-06): UTRAN Functions, Examples on Signalling Procedures

[14] 29.060 version 3.5.0 (2000-06): General Packet Radio Service (GPRS); GPRS Tunnelling Protocol

(GTP) across the Gn and Gp interface

[15] 33.102 version 3.5.0 (2000-07): 3G Security; Security Architecture

[16] UTRAN SFRAS ver. 1.5: UTRAN System Feature Requirements and Architecture

Specifications Motorola GSM-3894-SFRAS-045



Glossary of terms Acronym Definition

3GPP 3rd Generation Partnership Program

AAL ATM Adaptation Layer

AAL2 ATM Adaptation Layer of type 2

AAL5 ATM Adaptation Layer of type 5

ABT/DT ATM Block Transfer / Delayed Transmission

ABT/IT ATM Block Transfer / Immediate Transmission

A&C Authentication and Ciphering

ACCH Associated Control Channel

ACD Automatic Configuration Data

ACFE Access Control Function Entity

ACP Adjacent Channel Protection

ACSE Association Control Service Element

ADM Add and Drop Multiplexer

AE Application Entity

AI Acquisition Indication

AICH Acquisition Indication Channel

AIS Alarm Indication Signal

ALCAP Access Link Control Application Part

AM Acknowledged Mode (of RLC)

AMR Adaptive Multi Rate (Transcoder)

AN Access Network

AOA Angle Of Arrival

AP Application Process

APDU Application Protocol Data Unit

APId Access Point Identifier

APN Access Point Name

APS Automatic Protection Switching

ARIB Association of Radio Industries and Business

ARQ Automatic Repeat Request

ASAP Alarm Severity Assignment Profile

ATC ATM Transfer Capability

ATM Asynchronous Transfer Mode



AUG Administrative Unit Group

AU-n Administrative Unit n with n being 4 or 3

AUTN Authentication Token

AWGN Added White Gaussian Noise

BBE Background Block Error

BCCH Broadcast Control Channel

BCH Broadcast Channel

BER Bit Error Rate

BIP-X Bit Interleaved Parity-X

BLER Block Error Rate

BMC Broadcast Multicast Controller

BPSK Binary Phase Shift Keying

BS Base Station

BSC Base Station Controller

BSS Base Station System

BTS Base Transceiver Station

C- Control-

CA Capacity Allocation

CAA Capacity Allocation Acknowledgement

CAC Connection Admission Control

CAMEL Customized Applications for Mobile network Enhanced Logic

CAS Channel Associated Signalling

CASC Current Alarm Summary Control

CBR Constant Bit Rate

CC Call Control

CCBS Call Completion Busy Subscriber

CCCH Common Control Channel

CCH Control Channel

CCPCH Common Control Physical Channel

CCTrCH Coded Composite Transport Channel

CD Capacity Deallocation (radio context)

CD Calibration Data (O&M context)

CDA Capacity Deallocation Acknowledgement

CDMA Code Division Multiple Access

CDR Charging Detail Record

CDV Cell Delay Variation



CDVT Cell Delay Variation Tolerance

CFN Connection Frame Number

CID Channel Identifier

Ck Cipher Key

CLP Cell Loss Priority

CM Configuration Management

CM Call Management (in e.g. CM Service Request)

CmCH Common Transport Channel

CMIP Common Management Information Protocol

CMIS Common Management Information Service

CMISE Common Management Information Service Element

CN Core Network

C-n Container-n (n=1-4)

COL Collocated Equipment

CP Chip Period

CPCH Common Packet Channel

CPICH Common Pilot Channel

CPS Common Part Sublayer

CRC Cyclic Redundancy Check

CRCI CRC Indicator

CRC-N Cyclic Redundancy Check-N

CRNC Controlling RNC

c-RNTI RNTI allocated by CRNC

CS Circuit Switched

CSES Consecutive Severely Errored Second

CSN Ciphering Sequence Number

CSUM Checksum

CTCH Common Traffic Channel

CTDMA Code Time Division Multiple Access

CTP Connection Termination Point (OAM context)

CTP Common Transport Protocol (Protocol context)

DBR Deterministic Bit Rate

DC Dedicated Control (SAP)

DCA Dynamic Channel Allocation

DCC Data Communication Channel

DCCH Dedicated Control Channel



DCH Dedicated Channel

DCN Data Communication Network

DHO Diversity Handover (functional unit)

DL DownLink

DoCoMo Do Communication with Mobiles

DPCCH Dedicated Physical Control Channel

DPCH Dedicated Physical Channel

DPDCH Dedicated Physical Data Channel

DRAC Dynamic Resource Allocation Control

DRNC Drift RNC

DRNS Drift RNS

DRX Discontinuous Reception

DS-CDMA Direct-Sequence Code Division Multiple Access

DSCH Downlink Shared Channel

DT Data Transport

DTCH Dedicated Traffic Channel

DTX Discontinuous Transmission

EBER Excessive Bit Error Ratio

ECASC Extended Current Summary Alarm Control

EFCI Explicit Forward Congestion Indication

EFD Event Forwarding Discriminator

EIR Equipment Identity Register

EIRP Equivalent Isotropic Radiated Power

E-OTD Enhanced OTD

ES Errored Second

ETSI European Telecommunication Standardisation Institute

F8 access link encryption function

FACH Forward Access Channel

FAUSCH Fast Uplink Signalling Channel

FBI Feed Back Indicator

FCS Frame Check Sequence

FDD Frequency Division Duplex

FDMA Frequency Division Multiple Access

FEC Forward Error Correction

FEEB Far End Errored Block

FEES Far End Errored Second



FER Frame Erasure Rate

FESES Far End Severely Errored Second

FFS For Further Study

FM Fault Management

FP Frame Protocol

FTAM File Transfer Access Management

FTP File Transfer Protocol

Gb Gb interface (between SGSN and BSC)

GC General Control (SAP)

GCRA Generic Cell Rate Algorithm

GFR Guaranteed Rate

GGSN Gateway GPRS Serving Node

GMM MM for GPRS services

GMSK Gaussian Minimum Shift Keying

G-PDU T-PDU plus GTP header

GPRS General Packet Radio Service

GPRS-CSI GPRS CAMEL Subscription Information

GPS Global Positioning System

GRNC Generic RNC

GSM Global System for Mobile communications

GTP GPRS Tunnelling Protocol

GTP-u GTP user plane

HCS Hierarchical Cell Structure

HE Home Environment

HEC Header Error Control

HFN Hyper Frame Number

HHO Hard Handover

HO Handover

HOP High Order Path

HOVC Higher Order Virtual Container

IBTS uplink Interference signal power level at Node B

ICB Inter Carrier Board

ICD Interface Control Document

ICH Indicator CHannel

ICI Inter Carrier Interface

IE Information Element



IEC Incoming Error Count

IETF Internet Engineering Task Force

IK Integrity Key

IMA Inverse Multiplexing for ATM

IMEI International Mobile Equipment Identity

IMEISV International Mobile Equipment Identity Software Version

IMSI International Mobile Subscriber Identity (identical for IMUI; used in GSM context)

IMUI International Mobile User Identity (identical to IMSI; seems to replace IMSI in UMTS context)

INI Inter Network Interface

IP Internet Protocol

ISCP Interference Signal Code Power

ISDN Integrated Services Digital Network

ISF Incoming Signal Failure

IS-FL Idle Slot Forward Link

ISID Idle Signal Identification

ISO International Organisation for Standardization

IT Information Technology

ITU International Telecommunication Union

Iu Reference point between Access and Serving Network domains

Iub Iub interface (between Node B and RNC)

Iu-CS Iu towards the Circuit Switched-Service Domain of the Core Network

Iu-PS Iu towards the Packet Switched-Service Domain of the Core Network

Iur Iur interface (between RNC and RNC)

IWF Inter Working Function

IWU Inter Working Unit

JD Joint Detection

Kbps kilo-bits per second

KSI Key Set Identifier

Ksps kilo-symbols per second

L1 Layer 1 (physical layer)

L2 Layer 2 (data link layer)

L3 Layer 3 (network layer)

L3-CE Layer 3 Compression Entity

LAC Link Access Control

LAI Location Area Identity



LAN Local Area Network

LAPD Link Access Protocol for D-channel

LB Laser Bias

LCAF Location Client Authorisation Function

LCCF Location Client Control Function

LCCTF Location Client Coordinate Transformation Function

LCD Loss of Cell Delineation (transmission context)

LCD Low Constrained Delay (traffic context)

LCF Location Client Function

LCS Localisation Client Service

LDD Low Delay Data

LIR Limited IP Routing entity (in the RNC)

LLC Link Layer Control

LMT Local Maintenance Terminal

LNA Low Noise Amplifier

LOF Loss of Frame

LOP Low Order Path

LOP Loss of Pointer

LOS Loss of Signal

LPA Linear Power Amplifier

LSA Localised Service Area

LSB Least Significant Bit

LSBF Location System Billing Function

LSCF Location System Control Function

LSN Local Sub Network

LSPF Location Subscriber Privacy Function

LT Laser Temperature

MA Multiple Access

MAC Medium Access Control

MAC-b MAC entity handling BCH

MAC-c MAC entity handling common channels (RACH, FACH)

MAC-d MAC entity handling dedicated channels (DCH)

MAC-I Message Authentication Code used for data Integrity of signalling messages

MAC-p MAC entity handling paging channel (PCH)

MAC-sh MAC entity handling shared channel (DSCH)

MAHO Mobile Assisted Handover



MBS Maximum Burst Size

MCC Mobile Country Code

MCD Manual Configuration Data

Mcps Mega-chips per second

MD Macro-diversity

ME Mobile Equipment

MEHO Mobile evaluated handover

MIB Management Information Base

MM Mobility Management

MNC Mobile Network Code

MNRG Mobile station Not Reachable for GPRS flag

MNRR Mobile station Not Reachable Reason

MO Mobile Originated

MOHO Mobile Originated Handover

MS Multiplex Section (transmission context)

MS Mobile Station (GSM or security context)

MS-AIS Multiplex Section Alarm Indication Signal

MSB Most Significant Bit

MSC Multi-Slot Cell (MPSR context)

MSC Mobile services Switching Centre (Core Network Context)

MSID Mobile Station Identifier

MSOH Multiplex Section Overhead

MSP Multiplex Section Protection

MS-RDI Multiplex Section Remote Defect Indication

MS-REI Multiplex Section Remote Error Indication

MSTE Multiplex Section Terminating Element

MT Mobile Terminated (call context)

MT Mobile Terminal (equipment context)

MTP Message Transfer Part

MUI Mobile User Identifier

NAS Non Access Stratum

NBAP Node B Application Part

NCSES Number of Consecutive Severely Errored Second

NDF New Data Flag

NE Network Element

NEHO Network evaluated handover



NEM Network Element Manager

NMC Network Management Centre

NNI Network Node Interface (includes INI and ICI interfaces)

NP Nectar Pilot

NPC Network Parameters Control

NRT Non-Real Time

NSS Network Sub System

NT Nectar Telecom

Nt Notification (SAP)

NW Network

N-PDU Network PDU

O&M Operation and Maintenance

OAM Operation Administration and Maintenance

OCCCH ODMA Common Control Channel

ODCCH ODMA Dedicated Control Channel

ODCH ODMA Dedicated Channel

ODI Outgoing Defect Indication

ODMA Opportunity Driven Multiple Access

ODTCH ODMA Dedicated Traffic Channel

OEI Outgoing Error Indication

OFS Out of Frame Second

OMC Operation and Maintenance Centre

OOF Out of Frame

ORACH ODMA Random Access Channel

OS Operation System

OSF Offset Field

OSI Open System Interconnection

OSL Optical Signal Level

OTD Observed Time Difference

OVSF Orthogonal Variable Spreading Factor

PA Power Amplifier

PC Power Control

PCCH Paging Control Channel

PCF Positioning Calculation Function

PCH Paging Channel

PCM Pulse Code Modulation



PCR Peak Cell Rate

PDCP Packet Data Convergence protocol

PDH Plesiochronous Digital Hierarchy

PDN Packet Data Network

PDP Packet Data Protocol

PDU Protocol Data Unit

PG Processing Gain

PHY Physical layer

PhyCH Physical Channel

PI Paging Indicator

PICH Page Indicator Channel

PID Packet Identification

PJC Pointer Justification Count

PJE Pointer Justification Event

Pkg Packages

PLM Payload Mismatch

PLMN Public Land Mobile Network

PM Performance Management/Performance Monitoring

PMM MM for PS domain

PN Pseudo Noise

POH Path Overhead

PPI Plesiochronous Physical Interface

PPM Parts Per Million

PRACH Physical Random Access Channel

PRCF Positioning Radio Co-ordination Function

PS Packet Switched

PSAP Presentation Service Access Point

PSC Protection Switch Count

PSD Protection Switch Duration

PSMF Positioning Signal Measurement Function

PSN Plane Switch Node

PSTN Public Switched Telephone Network

PTE Path Terminating Element

PVC Permanent Virtual Connection

P-TMSI Packet TMSI (equivalent to P-TMUI, used in GPRS context)

P-TMUI Packet TMUI (equivalent to P-TMSI, new name for it in the UMTS context)



PTR Pointer

PUF Power Up Function

QE Quality Estimate

QoS Quality of Service

QPSK Quadrature Phase Shift Keying

R0 UTRAN Release 0 (Pilot version)

R1 UTRAN Release 1 (First Commercial version)

RA Routing Area

RAB Radio Access Bearer

RAC Routing Area Code

RAC Radio Admission Control

RACH Random Access Channel

RAI Routing Area Identity (GPRS or Iu-PS context)

RAI Remote Alarm Indication (transmission context)

RAID Redundant Array of Independent Disks

RAN Radio Access Network

RANAP Radio Access Network Application Part

RAND Random Challenge

RB Radio Bearer

RDI Remote Defect Indication

RDN Relative Distinguished Name

REI Remote Error Indication

RF Radio Frequency

RFC Request For Comment

RFN Reference Frame Number

RLC Radio Link Control

RLCP Radio Link Control Protocol

RNC Radio Network Controller

RNCC Radio Network Connection Control

RNS Radio Network Subsystem

RNSAP Radio Network Subsystem Application Part

RNTI Radio Network Temporary Identity

RP Radio Processing

RRC Radio Resource Control

RRM Radio Resource Management

RS Regenerator section



RSCP Received Signal Code Power after despreading

RSOH Regenerator Section Overhead

RSSI Received Signal Strength Indicator

RT Real Time

RU Resource Unit

RX Receive

SAAL Signalling AAL (equivalent to SSCF over SSCOP over AAL5)

SACCH Slow Associated Control Channel

SAP Service Access Point

SBR Statistical Bit Rate

SC Service Control

SCCH Synchronization Control Channel

SCCP Signalling Connection Control Part

SCD Selective Cell Discard

SCH Synchronization Channel

SCR Sustainable Cell Rate

SCTP Simple Control Transmission Protocol

SD Supervision Data (context configuration management)

SD Signal Degrade (context SDH)

SDCCH Stand-Alone Dedicated Control Channel

SDH Synchronous Digital Hierarchy

SDU Service Data Unit

SES Severely Errored Second

SF Signal Fail (transmission context)

SF Spreading Factor (radio context)

SFN System Frame Number

SG Study Group

SGSN Serving GPRS Support Node

SHO Soft Hand Over

SIM Subscriber Information Module

SIR Signal-to-Interference Ratio

SLM Signal Label Mismatch

SMS Short Message Service

SN Serving Network

SN Sequence Number

SNMP Simple Network Management Protocol



SOH Section Overhead

SONET Synchronous Optical Network

SP Switching Point

SPA Signalling Point Accessible

SPI Signalling Point Inaccessible (SS7 context)

SPI Synchronous Physical Interface (SDH context)

SPROC System PROCessor

SRNC Serving RNC

SRNS Serving RNS

s-RNTI RNTI allocated by SRNC

SSA Signalling Subsystem Accessible

SSADT Service Specific Assured Data Transfer

SSCF Service Specific Coordination Function

SSCOP Service Specific Connection-Oriented Protocol

SSP Signalling Subsystem Prohibited

SSSAR Service Specific Segmentation And Reassembly

SSTED Service Specific Transmission Error Detection

STF Start Field

STM Synchronous Transport Module

STM(-N) Synchronous Transport Module (-N)

STS(-N) Synchronous Transport Signal (-N)

STTD Space Time Transmit Diversity

TB Transport Block

TBC To Be Confirmed

TBD To Be Defined

TBF Transport Block Format

TBS Transport Block Set

TCH Traffic Channel

TCM Tandem Connection Monitoring

TCOH Tandem Connection Overhead

TCP Transport Control Protocol

TCP Transport Control Protocol

TC-RDI Tandem Connection Remote Defect Indication

TC-REI Tandem Connection Remote Error Indication

TCT Tandem Connection Trace

TCTE Tandem Connection Terminating Element



TDD Time Duplex Division

TE Terminal Equipment

TEID Tunnel Endpoint ID

TFCI Transport Format Combination Indicator

TFCS Transport Format Combination Set

TFI Transport Format Indicator

TFS Transport Format Set

TFT Traffic Flow Template

TFTP Trivial File Transfer Protocol

TIM Trace Identifier Mismatch

TLLI Temporary Logical Link Identifier

TM Transparent Mode (of RLC)

TMN Telecommunication Management Network

TMSI Temporary Mobile Subscriber Identity (used in GSM context, equivalent to TMUI)

TMUI Temporary Mobile User Identity (new name for TMSI in the UMTS context)

TN Termination Node

TOA or ToA Time Of Arrival

TOAWE TOA Window End point

TOAWS TOA Window Start point

TP Termination Point

TPC Transmit Power Control

T-PDU Original packet, for example an IP datagram, from UE or an external PDN

TR Threshold Reset

TRX Transmitter/Receiver

TSID Test Signal Identification

TSS Telecommunication Standardization Sector

TTC Telecommunication Technology Committee

TTI Time Transmission Interval (Radio Context)

TTI Trail Trace Identifier (O&M context)

TTP Trusted Third Party (security context)

TTP Trail Termination Point (transmission context)

TU Tributary Unit

TUG Tributary Unit Group

TUG(-n) Tributary Unit Group (-n)

TU-n Tributary Unit-n



TX Transmit

U- User-

UARFCN UTRA Absolute Radio Frequency Channel Number

UAS Unavailable Second

UBR Unspecified Bit Rate

UDD Unconstrained Delay Data

UDP User Datagram Protocol

UE User Equipment

UEA UMTS Encryption Algorithm

UEFN User Equipment Frame Number

UIA UMTS Integrity Algorithm

UL UpLink

UM Unacknowledged Mode (of RLC)

UMTS Universal Mobile Telecommunication System

UNEQ Unequipped

UNI User to Network Interface

UP User Plane

UPC Usage Parameters Control

URA User Registration Area

USCH Uplink Shared CHannel

USIM UMTS Subscriber Identity Module

UTRA UMTS Terrestrial Radio Access

UTRAN UMTS Terrestrial Radio Access Network

Uu Reference point between User Equipment and Infrastructure domains, UMTS radio interface

UUI User to User Indicator

VA Voice Activity (factor)

VBR Variable Bit Rate

VC Virtual Channel

VCC Virtual Channel Connection

VCI Virtual Channel Identifier

VC-n Virtual Container n (n is 11, 12, 2, 3 or 4)

VLR Visitor Location Register

VP Virtual Path

VPC Virtual Path Connection

VPI Virtual Path Identifier



W-CDMA Wideband CDMA

WG Working Group

WG-n Working Group (of 3GPP)

WTR Wait-to-Restore

XMAC-I eXpected Message Authentication Code used for data Integrity of signalling messages

XOR eXclusive OR

XPU AuXiliary Processing Unit

XRES Expected Response

Yu Reference point between Serving and Transit Network domains

Zu Reference point between Serving and Home Network domains



1 Introduction

1.1 Scope

This document describes detailed end-end signalling procedures for UMTS. Only UTRAN will be considered as the Radio Access Network; however, GSM parameters transmitted within messages will be presented in order to document them for a possible UMTS-GSM handover, which is out of the scope of the first phase of this document according to the document proposal in Annex A.

In addition, only FDD solution is considered and only successful procedures will be presented.

1.2 Notation for Signalling Procedures

Following rules will apply:

Complex signalling procedures may involve several protocols in different nodes. Messages are always exchanged between nodes, i.e. the sender and the receiver of a message

are nodes and not single protocol entities; The protocol entity inside a node that is sending/receiving a message is represented by means

of an ellipse, containing the protocol entity name; Each message is numbered, so that a numbered list with explanations can be added below the

figure; Message parameters may be specified as shown in Figure 1 only when required for a clear

understanding of the procedures; Message parameters listed in explanations are not all parameters, but those of relevance for

the given procedure. Procedures within this document do not describe all possible cases, i.e., some assumptions

will be made and explained along the document. In principle, signalling is represented by means of continuous arrows; dotted arrows will be

used for optional signalling. A description of the relevant actions may be included as shown in Figure 1; The Setup and Release of Iub/Iur and Iu Data Transport Bearer with the ALCAP protocol is

represented as shown in Figure 1; The transport channel used by the MAC protocol or the logical channel used by the RLC and

RRC protocols may be indicated before the message name as shown in Figure 1.



U E Node B

Drift RNS Node B

Serving RNS RNC Drift

RNC Serving

CN

N B A P

M A C

NBAP

R A N A P R A N A P

RNSAP RNSAP

MAC 1. RACH : Message

RRC RRC 2. C CCH : Message

3. Message

6. Message

5. Message

[Paramet ers ]

[Parameters ]

[Parameters ]

[Parameters ]

[Parameters ]

Action descript ion

N B A P N B A P 4. Message

[Parameters ]

ALCAP Iub Bearer Setup/Release ALCAP Iur Bearer Se tup

Figure 1: Example of signalling procedure notation

1.3 Explanation of Terms

Term Definition Controlling Radio Network Controller (CRNC)

A role an RNC can take with respect to a specific set of Node B's. This represents the RNC functions that deal with control of subtending Node Bs. There is only one Controlling RNC for any Node B. The Controlling RNC has the overall control of the logical resources of its node B's.

Drift Radio Network Controller (DRNC)

This represents RNC functions that deal with control of functions during soft handover when the RNC is downstream from the serving RNC and has control over at least 1 Node B who has soft handover leg(s).

Generic Radio Network Controller (GRNC)

This represents the RNC functions that are not covered by any of the other three types. This also relates to global functions such as transit or ATM functions.

Hard Handover This is a category of handover procedures where all the old radio links in the UE are abandoned before the new radio links are activated.

Iu Interface reference point between the RNS and the Core Network. (See also Iu-CS and Iu-PS.)

Iu-CS Interface between the RNC and the circuit switched side of the Core Network, typically the MSC.

Iu-PS Interface between the RNC and the packet switched side of the Core Network, typically the SGSN.

Iub Interface between the RNC and the Node B. It is considered as a reference point.

Iur Interface between two RNSs. While this interface logically represents a point to point link between RNSs, the physical



Term Definition realisation may not be a direct link. It is also considered as a reference point.

Node B Application Part (NBAP)

NBAP is used for setting up Radio Access Bearers (RAB) in the Radio Network Layer over the Iub.

Radio Access Network Application Part (RANAP)

Radio Network Signalling over the Iu.

Radio Network Subsystem Application Part (RNSAP)

Radio Network Signalling over the Iur between the SRNC and DRNC.

Serving Radio Network Controller SRNC)

This represents the RNC functions that are used during an active call or data session.

Soft Handover Soft handover is a category of handover procedures where the radio links are added and abandoned in such manner that the UE always keeps at least one radio link to the UTRAN. This typically involves multiple Node Bs.

Softer Handover This is a type of soft handover that involves one or more cells of the same Node B.

Universal Mobile Telephone System (UMTS)

This represents the third generation mobile phone system that incorporates both Wideband CDMA for the FDD mode in the paired spectrum and Time Division CDMA for the TDD mode in the unpaired spectrum.



2 End-End Call Establishment

This clause presents the whole process to establish an end-end call for either CS or PS Core Network domains. This process is made up of different procedures that will be described separately in a time basis. A major distinction will be made between Mobile Originated procedures at calling end and Mobile Terminated procedures at called end.

2.1 Mobile Originated Call Establishment

In order to focus on procedures directly related to the call set-up, it is assumed the UE is already attached to the network, but in IDLE mode. At this point, the user wants to establish a call, and then it will initiate procedures for call establishment.

First of all, a signalling connection between the UE and the calling CN domain is required for transfer of higher layer (MM, CM) information. This is usually called a NAS signalling connection and refers to a logical connection composed of a RRC connection between UE and UTRAN and a RANAP or Iu signalling connection between UTRAN and CN.

An UE has either zero or one RRC connection and either zero or one RANAP connection for every CN domain as shown in Figure 2. At a CM service request to any of the CN service domains, UE will only request establishment of a new signalling connection when no such connection exists towards the applicable CN service domain.

UE is said to be in C/P-MM-CONNECTED mode if a signalling connection between UE and respective CS/PS CN is established.

U E PS -CN CS -CN U T R A N

RRC Connec t ion

RANAP Connec t i on

RANAP Connec t i on

Figure 2: NAS Signalling connections



2.1.1 RRC Connection Establishment procedures

If a RRC connection is already established, UE will use it. However, it is assumed UE is in IDLE mode for both CS and PS CN domains (i.e. CMM-IDLE and PMM-IDLE states), thus there is not even RRC signalling connection (RRC IDLE state) and its establishment is required to carry signalling messages between UE and UTRAN.

It is possible to establish it either on a dedicated channel (DCH) or on a common transport channel (FACH/RACH). The former requires more signalling not only for this procedure, but also because a Radio Link Reconfiguration is likely to happen later at RAB assignment. On the other hand, it allows UTRAN to set UE in soft handover state immediately, which is not possible if we use the latter procedure.

In release R0, only the case with RRC connection on RACH/FACH is applicable. As soon as both procedures are available, further studies will be required on the field in order to find out which one is optimal. So far, section 2.5.1 of UTRAN SFRAS describes an algorithm so that SRNC may choose between both procedures. The algorithm is based on the RRC Connection Establishment Cause IE that UE sends in step 1 below.

After the establishment of the RRC connection, UE will move into RRC-CONNECTED mode. Depending on the transport channel used (DCH or RACH/FACH), UE will be in Cell_DCH state or in Cell_FACH state within RRC-CONNECTED mode. Both cases are described next:

U E Node B Serving RNS

Serv ing RNC

Allocate RNTI Se lec t L1 and L2

parameters

RRC RRC

1. CCCH ( on RACH) : RRC Connec t i on Request

RRC RRC

6. CCCH (on FACH) : RRC Connec t ion Se tup

RRC RRC

7. DCCH ( on RACH) : RRC Connec t ion Se tup Comple t e

RRC RRC

8. DCCH (on FACH): Measurement Cont ro l

Figure 3: Establishment of the RRC connection on RACH/FACH



U E Node B

Serving RNS Serv ing

RNC

RRC RRC

7. DCCH (on DCH) : RRC Connec t ion Se tup Comple te

5. NodeB -SRNC Data Transport Bearer Sync (FDD only)

Allocate RNTI Se lec t L1 and L2

parameters

RRC RRC

1. CCCH ( on RACH) : RRC Connec t ion Reques t

N B A P NBAP

3 . Radio Link Setup Response

N B A P NBAP

2. Radio Link Setup Request

RRC RRC

6. CCCH (on FACH) : RRC Connec t io n Setup

Start RX

Start TX

4. ALCAP Iub Data Transport Bearer Setup

RRC RRC

8. DCCH (on DCH) : Measurement Contro l

DCH -FP DCH -FP

Figure 4: RRC connection establishment on DCH

1. The UE initiates set-up of an RRC connection by sending RRC message RRC Connection

Request on CCCH (mapped on RACH). UE starts timer T300. Parameters: Initial UE Identity, Establishment Cause and optionally a Measurement report

2. The SRNC may decide to use either the RACH/FACH or a DCH for this RRC connection. In

both cases, it allocates RNTI and radio resources for the RRC connection.

When the RRC connection is set-up over RACH/FACH, the next step is step 6. When a DCH is to be set-up, NBAP message Radio Link Setup Request is sent to Node

B for establishing the necessary resources for a new Node B Communication Context. Parameters: CRNC Communication Context ID, UL and DL DPCH Information (TFCS, UL Scrambling Code, etc.), DCH Information (general: Payload CRC Presence Indicator, UL FP Mode, ToAWS, ToAWE; specific: DCH ID, DL/UL Transport Format Set, Frame Handling Priority and QE-Selector), DSCH Information (DSCH ID, Transport Format Set, Frame Handling Priority, ToAWS and ToAWE), RL Information (RL ID, C-ID, First RLS Indicator, Frame Offset, Chip Offset, DL Code Information, etc.), and optional Transmission Gap Pattern Sequence Information and Active Pattern Sequence Information IEs. [see REF 25.433 for more details].

Note: UTRAN does not know what type of service is going to be required, so it uses default parameters at this point. That is why the DCH is likely to be reconfigured later at RAB assignment.



3. (DCH case only): Node B allocates resources, starts PHY reception, and responses with

NBAP message Radio Link Setup Response. After this message, a communication context is established between Node B and CRNC. Parameters: CRNC Communication Context ID, Node B Communication Context ID, Communication Control Port ID, RL Information Response IEs (RL ID, RL Set ID, UL Interference Level, DCH/DSCH IDs, Transport layer addressing information -AAL2 address, AAL2 Binding Identity for the Iub Data Transport Bearer, etc.), and optional Criticality Diagnostics. [see REF 25.433 for more details].

4. (DCH case only): SRNC initiates set-up of Iub Data Transport bearer using ALCAP protocol. This request contains the AAL2 Binding Identity to bind the Iub Data Transport Bearer to the DCH. The request for set-up of Iub Data Transport bearer is acknowledged by Node B.

5. (DCH case only): Node B and SRNC establish synchronism for the Iub Data Transport

Bearer. Then Node B starts DL transmission. (FDD only).

6. Message RRC Connection Setup is sent on CCCH (mapped on FACH) from SRNC to UE, which stops timer T300. Parameters: Initial UE Identity, Activation Time (by default now), New U-RNTI and optional New C-RNTI, UTRAN DRX cycle length coefficient, Capability Update Requirement, RB IEs for each signalling radio bearers to setup, TrCH IEs for TrCHs to add or reconfigure, and PhyCH IEs. See TS. 25.331 for more details.

7. UE sends back a RRC Connection Setup Complete message on DCCH to the SRNC. This

message is mapped either on RACH or on DCH depending on the decision made at step 2. Parameters: For each concerned CN domain, the CN domain Identity and the Hyper frame number to start in this CN domain. The message shall also include UE IEs (UE radio access capability and UE inter-system capability if requested in the RRC Connection Setup message).

At this point, RRC signalling connection is set up between UE and UTRAN and a UE context is built up in the SRNC. UE is in RRC-CONNECTED mode (either Cell_DCH or Cell_FACH state).

UTRAN/UE may initiate from now on any RRC procedure according to UE state. Step 8 is an

example procedure UTRAN may want to initiate at this point, i.e., this is a good moment to do it. Step 8 does not affect section 2.1.2 and vice versa, i.e., these procedures can be done at the same time.

8. SRNC sends RRC Measurement Control message in order to modify or to release measurement requests already configured by the System Information message, and in order to setup measurement request not configured by the System Information message. Parameters: Measurement Identity Number, Measurement Command, Measurement Reporting Mode (optional), Additional Measurements Lists (optional) and CHOICE Measurement Type (depending on the command).



2.1.2 Iu Signalling Connection Establishment procedure

Once the RRC connection for signalling has been set up, the UE can use it to send a signalling establishment request to the required CN domain as shown in Figure 5. The content of these messages depends on the CN domain involved. So, we have to distinguish between CS and PS for the initial NAS message for a call set-up.

- CS domain: for a GSM based CN (MSC), UE sends a CM Service Request message and starts timer T3230. Parameters: Mobile Identity (according to section 10.5.1.4 in [Ref 24.008]), Mobile Classmark 2, Ciphering Key Sequence Number (CKSN) and CM Service Type (mobile originating call establishment in this example).

- PS domain: for a GPRS based CN (SGSN), UE sends a Service Request message and starts timer T3317. Parameters: P-TMSI, Ciphering Key Sequence Number (CKSN) and Service Type (signalling in this example).

The main difference is the Service Type content for each message. For a GSM based CN (CS domain) it is possible to specify that a CM Call Establishment is going to be established. On the other hand, for a GPRS based CN (PS domain) it just indicates there is signalling to be transferred, which in our example will be an Activate PDP Context message. This is a new message for PS domain (i.e. this message does not exist in GPRS) and is specifically referred in standards as Service Request procedure (UMTS only) and it is described in section 2.1.8.

U E Serving RNC

CN

RRC RRC

9. DCCH :Initial Direct Transfer

RANAP RANAP 10. Ini t ial UE Message

Figure 5: Initial UE message to the CN

The description of the messages is the following:

9. UE sends RRC Initial Direct Transfer to SRNC. This message has to be used whenever a

new signalling flow is required and it will trigger the establishment of a signalling connection if it does not exist yet, which is the case in this example. A signalling connection comprises one or several signalling flows. Parameters: Flow Identifier (allocated for a particular flow), Initial NAS Message, CN domain identity (it indicates the correct CN node into which the NAS message shall be forwarded) and optionally IE Measured results.



Note: When not stated otherwise elsewhere, UE may initiate this procedure also when another procedure is ongoing, and in that case the state of the latter procedure shall not be affected. Likewise, the reception by UTRAN of this message shall not affect the state of any other ongoing RRC procedure, when not stated otherwise elsewhere.

10. If IE Measured results is present, SRNC shall extract it. For there is not Iu signalling connection yet in this example, SRNC initiates it and sends the RANAP message Initial UE Message. Parameters: NAS PDU, CN domain indicator (indicating the CN domain towards which this message is sent), the same LAI which was the last LAI indicated to UE by UTRAN, the same RAC which was the last RAC indicated to UE by UTRAN (only for PS domain), the Service Area corresponding to cells from which UE is consuming radio resources and the Global RNC-ID.

At this point, the NAS signalling connection between UE and CN is established and it can be used for NAS message transfer. These messages are UE-CN signalling messages that are transported as a parameter and are not interpreted by UTRAN, as described in section 2.1.3.

2.1.3 UE-CN Signalling Messages

As soon as the NAS connection is established, it is possible to transfer NAS messages transparently through UTRAN by means of the Direct Transfer procedures as shown in Figure 6.

B. Direct Transfer

C. Direct Transfer

A. DCCH: Uplink Direct Transfer

UE Node B Serving RNS

Serving RNC

CN

RRC RRC

RANAP RANAP

RANAP RANAP

D. DCCH: Downlink Direct Transfer RRC RRC

Figure 6: Direct Transfer

A. UE sends RRC Uplink Direct Transfer to S-RNC. Parameters: Flow Identifier (identify current flow), NAS message and optionally IE Measured Results.

B. If IE Measured results is present, SRNC shall extract it. UTRAN sends RANAP Direct Transfer message to CN without interpretation of NAS message.



Parameters: NAS-PDU and, if message is sent to PS domain, S-RNC shall also add RAC+LAI.

C. CN sends RANAP Direct Transfer message to SRNC. Parameters: NAS PDU and SAPI (to enable UTRAN to provide specific service for the transport of the message).

D. SRNC sends RRC Downlink Direct Transfer to UE without interpretation of NAS message. Parameters: NAS message and CN domain Identity (to indicate UE which CN domain NAS message is originated from).

After describing these procedures and in order to avoid excessive number of messages in following procedures, all UE-CN signalling messages will be presented from now on as singular UE-CN messages through UTRAN. The use of Direct Transfer procedures will be indicated before the message name as shown in Figure 8.

Note: When not stated otherwise elsewhere, Direct Transfer procedures may be initiated also when another RRC procedure is ongoing, and in that case the latter procedure shall not be affected.

2.1.4 Common ID procedure

The purpose of the Common ID procedure is to allow the SRNC to create a reference between the permanent NAS UE Identity of a UE and the RRC connection established for that UE in order to coordinate UTRAN paging from either CS or PS domain.

The SRNC associates the Permanent identity to the RRC connection of that UE and shall save it for the duration of the RRC connection. So, whenever a paging request is received, SRNC will check if an RRC connection exists by means of the Permanent NAS UE Identity (IMSI).

Serv ing RNC

CN

R A N A P RANAP 11 . Common ID

Figure 7: Common ID procedure

11. After having established an Iu signalling connection, and if the Permanent NAS UE identity (i.e. IMSI) is available, the CN shall send a RANAP Common ID message. Parameters: Permanent NAS UE Identity IE (IMSI).

Note: If IMSI is not available at the CN element, Identity Check Procedure is likely to take place and the Common ID procedure should be performed after that. This statement makes sense, however it has not been found yet within 3GPP specifications. On the other hand, in case of an emergency call,



for example, IMSI is not necessary and nor is the Common ID procedure, i.e., it is possible neither IMSI nor Common ID procedure shall be performed.

2.1.5 Security Functions

(Security functions are described in detail in [Ref 33.102].)

It is mandatory to start integrity protection of signalling messages by use of Security Mode Set-up procedure at each new signalling connection establishment between UE and CN, which is the case for this example. So, the only procedures between UE and CN that are allowed after step 10 and before the security mode set-up procedure are the following:

Identification by a permanent identity (i.e. request for IMSI), and Authentication and Key agreement. Depending on the information received on step 10 such as Mobile Identity and CKSN, the

network may initiate any of these common security procedures. In this case, for these messages are NAS signalling messages, they will be transparently transferred through UTRAN by means of Direct Transfer messages as described in 2.1.3.

2.1.5.1 Identity Check Procedure

This procedure should be invoked by CN whenever the user cannot be identified by means of a temporary identity sent in step 10 (either A or B). UE shall be ready for this procedure at any time whilst a RRC connection exists (CS domain) or whilst it is attached (PS domain).

U E Serv ing RNC

EIR CN

12. Direct Transfer : Ident i ty Request

13. Direct Transfer: Ident i ty Response

14. Check IMEI

15 . Check IMEI Ack

Figure 8: Identity Check Procedure

12. CN element (MSC/SGSN) sends NAS Identity Request message and starts timer (T3270 for CS domain; 3370 for PS domain). Parameters: IE Identity Type 1 (CS domain) or IE Identity Type 2 (PS domain), which specifies requested identification parameter.

13. UE responds with NAS Identity Response message. Upon reception, CN stops timer T3270 or 3370. Parameters: IE Mobile Identity as requested. UE may choose to send its IMSI encrypted, though this is FFS.



14. MSC/SGSN may decide to check IMEI against EIR. If so, it sends Check IMEI to EIR.

15. EIR responds with Check IMEI Ack.

2.1.5.2 Authentication and Key Agreement procedure

The purpose of this procedure is fourfold:

To permit the network to check whether the identity provided by UE is acceptable or not. To provide parameters enabling UE to calculate a new UMTS ciphering key and a new

UMTS integrity key.

To permit UE to authenticate the network. To let the network set the GSM ciphering mode (ciphering/no ciphering) and GSM

ciphering algorithm (PS domain only).

For the fourth statement is only applicable to PS domain, this procedure has different parameters and is named differently for each CS and PS domain. It is named Authentication procedure for CS domain and Authentication and ciphering procedure for PS domain. The latter one can be used for either:

Authentication only. Setting of GSM ciphering mode and the GSM ciphering algorithm only. Both of the above at the same time.

This procedure is always initiated and controlled by the network, though there is the possibility for UE to reject the network.

This procedure is not mandatory at call establishment. Therefore, there is the possibility of unlimited and malicious reuse of compromised UMTS keys. To avoid attacks using compromised keys, USIM contains a mechanism to limit the amount of data that is protected by an access link key set (a cipher key CK and an integrity key IK). This mechanism will ensure that a cipher/integrity key set cannot be reused beyond the limit set by the operator.

This mechanism consists basically in a counter the UE sends in step 7 (Ciphering hyper frame number). Authentication and Key Agreement procedure is mandatory performed if the counter reaches a maximum value.

In addition, Authentication and Key Agreement procedure may be initiated by the network as often as the network operator wishes. It can occur as soon as the identity of the mobile subscriber is known by the VLR/SGSN.

In CS domain, UE shall be ready to respond upon an Authentication Request at any time whilst a RRC connection exists.

In PS domain, UE shall be ready to respond upon an Authentication and Ciphering Request at any time whilst a PS signalling connection exists (which includes an RRC connection).

If an authentication procedure is performed during a connection establishment, the new cipher key CK and integrity key IK shall be taken in use in both RNC and UE as part of the security mode negotiation that follows the authentication procedure (see section 2.1.5.3).



U E Serv ing RNC

HLR/Auc CN

18. Direct Transfer : Authentication (and Cipher ing) Reques t

19. Direct Transfer: Authent ica t ion (and Cipher ing) Response

16. Send Authent icat ion Info

17. Send Authent icat ionInfo Ack

Figure 9: Authentication and Key Agreement Procedure

16. If CN element does not have previously stored UMTS Authentication Vector (quintuplets) for UE, a Send Authentication Info message is sent to HLR/AuC. Each quintuplet contains RAND, XRES, AUTN, CK and IK. Originally, all quintuplets are provided by HLR/AuC. Parameter: IMSI.

17. HLR/AuC responds with a send Authentication Info Ack message including an ordered array of quintuplets.

18. (PS domain) SGSN selects the next in-order quintuplet and sends Authentication and Ciphering Request message to UE. SGSN starts timer T3360. Parameters: Ciphering Algorithm, A&C reference number and, if authentication is to be performed, RAND, AUTN, CKSN. It may also request IMEISV.

(CS domain) MSC sends Authentication Request message and starts timer T3260. Parameters: CKSN, RAND and AUTN.

19. (PS domain) If UE is capable of UMTS only, it shall ignore the Ciphering Algorithm IE in step 17, otherwise it shall store it in order to be used at an inter system change from UMTS to GSM. If UMTS Authentication parameters (RAND, AUTN, CKSN) are included in step 17, USIM in UE verifies AUTN and, if accepted, USIM processes the challenge information and sends Authentication and Ciphering Response message. USIM computes information according to [Ref 33.102] and it results in USIM passing a GPRS UMTS ciphering key, a GPRS UMTS integrity key and a GPRS GSM ciphering key to the ME, which shall overwrite previous keys. Parameters: A&C reference number (the same received in step 17), Authentication Response parameter and, if requested, IMEISV.

(CS domain) USIM in UE verifies AUTN and, if accepted, USIM processes the challenge information and sends Authentication Response message. USIM computes information according to [Ref 33.102] and it results in USIM passing a UMTS ciphering key, a UMTS integrity key and a GSM ciphering key to the ME, which shall overwrite previous keys. Parameters: Authentication Response parameter.

Upon reception of the Authentication (and Ciphering) Response, network stops timer T3260 or T3360 and checks the validity of the response. In case authentication is not accepted by the network, it sends Authentication (and Ciphering) Reject and call establishment cannot proceed.



2.1.5.3 Security Mode Setup procedure

As stated above, this procedure is mandatory in this example, for a signalling connection has just been established. It starts integrity protection and possible ciphering.

User data towards CS domain shall always be ciphered according to the information received from CS domain and user data towards PS with the information received from PS domain. In addition, user data shall always be ciphered with the last received ciphering information and integrity protected with the last received integrity protection information.

At this point in the call set-up process, UTRAN knows initial UE capability and the ciphering hyper frame number (step 1 and 7) and CN knows UE Classmark 2 (CS domain only) and CKSN (step 10). In addition, if authentication (and ciphering) procedure has been performed, new ciphering and integrity keys (CK and IK) generated there shall be taken in use in both RNC and UE as part of the security mode negotiation.

U E Serv ing RNC

CN

Se lec t a l lowed UIA, UEAs

20 . Secur i ty Mode Command (UIA, UEA, IK, CK, UE classmark, etc)

21. Generate FRESH. Start Integr i ty Deciphering

22 . DCCH: Secur i ty Mode Command ( CN Domain , UIA, UEA, IK, CK, UE c lassmark, e tc)

23. Control of UE Classmark, Start of Integri ty, Verify Message, Start Ciphering

24 . DCCH: Secur i ty Mode Comple te

25. Verify received message s tar t Cipher ing

26. Secur i ty Mode Comple te

RRC RRC

RRC RRC

RANAP

RANAP RANAP

RANAP

Figure 10: Security Mode Set-up Procedure

20. CN node determines which UIAs and UEAs are allowed to be used. Then, CN initiates integrity (and possible also ciphering) by sending RANAP Security Mode Command message. Parameters: Integrity Protection Information (key(s) and permitted algorithms), Key status (new or already used keys) and optionally Encryption Information (key(s) and permitted algorithms).

Note: The set of permitted algorithms specified in the Security Mode Command message shall remain applicable for subsequent RAB Assignments and Intra-UTRAN Relocations.

21. SRNC decides which algorithms to use by selecting the first UEA and the first UIA UE/UTRAN capabilities support from the received list. SRNC generates a random value FRESH and initiates downlink integrity protection. If SRNC does not support any UIA in the list, it shall send back a Security Mode Reject message.



Note: prior to UTRAN initiates a security mode control procedure for control of ciphering and if the UE has radio bearers using RLC-AM or RLC-UM, UTRAN should suspend all radio bearers belonging to the CN domain for which the security mode control procedure is initiated. Signalling radio bearers are also suspended. Further, if the UE has radio bearers using RLC-TM, UTRAN sets the IE Activation time for DPCH in the IE Ciphering mode info to the CFN at which the new ciphering configuration shall become active.

When the transmission of the Security Mode Command has been confirmed by RLC, UTRAN should resume all suspended radio bearers.

22. SRNC sends RRC Security Mode Command message. Before sending this message to UE, SRNC generates MAC-I and attaches this information to the message. Parameters: Integrity Check Info, Security Capability (Ciphering and Integrity Protection algorithm capabilities), optional Ciphering Mode Info (optional extra ciphering info as activation time, in case ciphering shall be controlled), optional Integrity Protection Mode Info (which contains UIA and FRESH to be used) and CN Domain Identity (necessary to identify set of keys to be used, i.e. PS or CS domain set of keys).

23. UE checks that UE security capability received is equal to UE security capability sent in initial NAS message (step 10). UE computes XMAC-I on the message received by using the indicated UIA, the stored COUNT-I and the received FRESH parameter. UE verifies the integrity of the message by comparing the received MAC-I with the generated XMAC-I.

24. If all controls are successful, UE sends RRC Security Mode Complete message using the new ciphering if available, and/or the new integrity protection configuration. UE also generates MAC-I for this message. (If any control is unsuccessful, UE should send RRC Security Mode Failure message.) Parameters: Integrity Check Info, Uplink Integrity Protection Activation Info, Radio Bearer Uplink Ciphering Activation Time Info.

Note: prior to UE sends back RRC Security Mode Complete message, UE shall suspend (from sequence number on, which are greater than or equal to each radio bearers downlink ciphering activation time in the IE Ciphering Mode Info received in step 22) all radio bearers using RLC-AM or RLC-UM that belong to the CN domain indicated in the IE CN Domain Identity received in step 22. Signalling radio bearers are also suspended.

When the transmission of the Security Mode Command has been confirmed by RLC, UE shall resume data transmission on any suspended radio bearers.

25. At the reception of the response message, SRNC computes the XMAC-I on the message and verifies data integrity of the message by comparing the received MAC-I with the generated XMAC-I.

26. The transfer of the RANAP Security Mode Complete message from SRNC to CN ends the procedure. Parameters: Chosen Integrity Protection Algorithm and, if ciphering, Chosen Encryption Algorithm. In addition, it may also contain optional Criticality Diagnostics IE.

When UTRAN has received a Security Mode Complete message and the integrity protection has successfully been applied (step 25), UTRAN should continue applying integrity protection on all subsequent messages, though this will not be explicitly said any more. Regarding ciphering, UTRAN shall use:

For radio bearers using RLC-AM or RLC-UM:



The old ciphering configuration for received RLC PDUs with RLC sequence number less than the RLC sequence number indicated in the IE Radio bearer uplink ciphering activation time info sent by UE in step 24.

The new ciphering configuration for received RLC PDUs with RLC sequence number greater than or equal to the RLC sequence number indicated in the IE Radio bearer uplink ciphering activation time info sent by UE in step 24.

For radio bearers using RLC-TM:

The new ciphering configuration for received RLC PDUs at the CFN as indicated in the IE Activation Time for DPCH in the IE Ciphering Mode Info.

2.1.6 MM Connection Established

After receiving the first NAS message in step 10, CN may initiate common security functions as described above (Identity Check or Authentication and Ciphering) and shall perform the Security Mode Setup procedure, for this example establishes a new signalling connection.

An indication from lower layers that the Security Mode Setup procedure is completed, or reception of a Service Accept message, shall be treated as a service acceptance by the UE. So, if Security Mode Setup procedure is performed, step 27 is not needed, otherwise it is.

U E Serv ing RNC

CN

27: Direct Transfer : (CM) Service Accept

Figure 11: (CM) Service Accept

27. CN may send a CM Service Accept message (CS domain) or Service Accept (PS domain) message to UE in response to a Service Request message in order to inform UE of the acceptance of the request.

Timers started in section 2.1.2 shall be stopped now (T3230 for CS domain and T3317 for PS domain), and UE enters MM-CONNECTED mode, i.e., the MM connection is considered to be active. UE can now proceed with its pending UE-CN signalling procedure.

As described in section 2.1.3, UE-CN signalling procedures are carried on Direct Transfer Messages transparently through UTRAN and they do not affect any other RRC procedure, unless otherwise stated elsewhere.

In this example, the pending UE-CN signalling procedure is that in charge of originating a call, which is a different procedure for either PS or CS domain.

For any PS or CS domain examples, it will be necessary to assign a RAB service. However, it is not defined exactly when this assignment should be initiated. So, RAB Establishment procedure is



described next and will use numbers from 28 up to 47, but its real initialisation time will be discussed later. PS domain originating call procedure is described in section 2.1.8 and CS domain originating call procedure is described in section 2.1.9.

2.1.7 RAB Establishment

A Radio Access Bearer (RAB) service provides confidential transfer of data between UE and CN. CN shall translate the received service request to a RAB service, which is characterised by a set of attributes values CN communicates to SRNC in step 28 (this is further described in section 2.10.5 of UTRAN SFRAS).

SRNC will set up required radio bearers for a given UE. The procedure within UTRAN depends on the RRC connection UE has established, i.e., RRC on DCH or RRC on RACH/FACH. It is possible to establish a RAB on several channels: RACH/FACH, DSCH and DCH. So, there are at least six possibilities, though it will depend on UE capabilities. Furthermore, a RRC connection reconfiguration (from/to RACH/FACH to/from DCH) is likely to happen depending on channels chosen for RAB assignment (for example, if RAB is established on DSCH, a DCH channel is required and it will probably be used for the RRC connection).

SRNC shall decide which channel should be use depending on the received request from CN in step 28. Next sections presents three typical scenarios: DCH RAB establishment when RRC is on DCH; DCH RAB establishment when RRC is on RACH/FACH and RACH/FACH RAB establishment when RRC is on RACH/FACH. Section 2.5.1 of UTRAN SFRAS describes an algorithm so that SRNC may choose between different procedures depending on the combination of services requested. The algorithm is based on the RRC Connection Establishment Cause IE that UE sends in step 1 in section 2.1.1 RRC Connection Establishment procedures.

The RAB establishment can be done either in a synchronised or unsynchronised manner. The unsynchronised Radio Link and Radio Bearer procedures are used when there is no need to synchronise the time of switching from an old to a new configuration. This is the case when new TFCs are added or old TFCs are deleted without changing the TFCI values or the parameters values of the TFCs that are maintained. Otherwise the synchronised procedures must be used (See TS 25.331, TS 25.413, TS 25.423, TS 25.433 and TS 25.931 for additional information).

2.1.7.1 DCH DCH RAB Establishment procedure

In this case, an RRC connection on DCH is established. Then, RAB will be also established on a DCH. This case requires more signalling messages than the following ones because a Radio Link Reconfiguration is needed to modify the spreading code of the DCH already established.

If there were no individualized TFCs at all, the unsynchronised procedure could be use. However, in this case, for there is already a DCH configured, TFCs within that DCH must be reconfigured now for the required QoS. So, it is necessary to use the synchronised procedure.

In addition, it is assumed UE is in soft handover and communicates via two Nodes B. One Node B is controlled by SRNC and the other one is controlled by DRNC. The procedure is depicted in Figure 12.

28. CN translates Service Request received to a RAB service. Then, CN sends RANAP RAB Assignment Request message to SRNC in order to initiate establishment of the RAB. CN



starts timer TRABAssgt. CN may request to establish, release or modify one or several (3GPP allows up to 256) RABs at the same time. The message shall contain a list of RABs to establish or modify with their bearer characteristics and a list of RABs to release. In this example, for simplification, it will be considered only one RAB is going to be established, and for this is the first Request for the UE, there is none RAB to modify or to release. Parameters: For each RAB to be setup or modified, it shall contain the RAB ID, NAS Synchronisation Indication (if provided), RAB parameters ( QoS profile, Allocation/Retention Priority, etc.), User Plane Information (User Plane Mode, User Plane Mode Versions, Transport Layer Address, Iu Transport Association) and if PS domain, it shall also contain for each RAB to setup or modified the PDP Type Information, Data Volume Reporting Indication and DL/UL GTP-PDU and N-PDU sequence numbers. In case any RAB shall be released within this message, the message shall also contain those RABs ID and appropriate Cause IE for the release.

Note: UTRAN shall execute the requested RAB configuration. Resources shall be established according to the values of IEs sent within this message and the resource situation, including UE capabilities.

29. (CS domain only) SRNC selects L1, L2 and Iu Data Transport Bearer parameters and initiates Setup of Iu Data Transport Bearer using ALCAP protocol. This request contains the AAL2 Binding Identity to bind the Iu Data Transport Bearer to the RAB.

30. SRNC requests DRNC to prepare establishment of DCH to carry the RAB by sending a RNSAP Radio Link Reconfiguration Prepare message. Parameters: optional Allowed Queuing Time, optional UL and DL DPCH Information (TFCS, Scrambling Code, etc.), DCH to add Information IEs (general: Payload CRC Presence Indicator, UL FP Mode, ToAWS, ToAWE; specific: DCH ID, TrCh Source Statistics Descriptor, DL/UL Transport Format Set, DL/UL BLER, Allocation/Retention Priority, Frame Handling Priority, QE-Selector and DRAC Control) and RL Information (RL ID, etc.). Within this message SRNC may also reconfigure (add, modify or delete) any other DCH it has with DRNC [see REF 25.423 for more details].

31. DRNC shall reserve necessary resources for the new configuration of the Radio Link(s) according to the parameters given in step 30. So, it requests its Node B to prepare establishment of DCH to carry the RAB by sending a NBAP Radio Link Reconfiguration Prepare message (it is really sent by CRNC). Parameters: Node B Communication Context ID, optional UL and DL DPCH Information (TFCS, UL Scrambling Code, etc.), DCH to add Information (general: Payload CRC Presence Indicator, UL FP Mode, ToAWS, ToAWE; specific: DCH ID, DL/UL Transport Format Set, Frame Handling Priority and QE-Selector), RL Information (RL ID and optional DL Code Information as IE FDD DL Channelisation Code Number or the DL Scrambling Code), and optional Transmission Gap Pattern Sequence Information. Within this message DRNC may also reconfigure any other DCH and/or DSCH it has with concerned Node B [see REF 25.433 for more details].

32. SRNC requests its Node B to prepare establishment of DCH to carry the RAB by sending a NBAP Radio Link Reconfiguration Prepare message (it is really sent by CRNC). Parameters: Node B Communication Context ID, optional UL and DL DPCH Information (TFCS, UL Scrambling Code, etc.), DCH to add Information (general: Payload CRC Presence Indicator, UL FP Mode, ToAWS, ToAWE; specific: DCH ID, DL/UL Transport Format Set, Frame Handling Priority and QE-Selector), RL Information (RL ID and optional DL Code Information as IE FDD DL Channelisation Code Number or the DL Scrambling Code), and



optional Transmission Gap Pattern Sequence Information. Within this message DRNC may also reconfigure any other DCH and/or DSCH it has with concerned Node B [see REF 25.433 for more details].

33. Node B controlled by DRNC shall reserve necessary resources for the new configuration of the Radio Link(s) according to the parameters given in step 31. If this is possible, Node B notifies CRNC that the preparation is ready by sending a NBAP Radio Link Reconfiguration Ready message. Parameters: CRNC Communication Context ID, RL Information Response (RL ID and DCH Information Response IEs for DCHs to be Added and any other modified channel - DCH ID, Binding ID, Transport Layer Address -), and optionally IE Criticality diagnostics.

U E Node B

Drift RNS Node B

Serving RNS Drift RNC

Serv ing RNC

CN

RNSAP RNSAP 34. Radio Link Reconf igurat ion

Ready

RRC RRC

46. DCCH : Rad

UMTS Call Flow

Documents

Transcript of UMTS Call Flow