Select a result to preview

01_4g_lte_fundamentals

Part 1: 4G / LTE Fundamentals

Learning Objective: Understand the 4G LTE Evolved Packet Core (EPC) architecture, network functions, interfaces, and subscriber procedures.

Table of Contents

What is LTE / EPC?

LTE (Long-Term Evolution) is the 4G radio access technology that replaced 3G UMTS/HSPA. The EPC (Evolved Packet Core) is the all-IP core network that supports LTE.

Key Characteristics

4G EPC Architecture

The EPC consists of control plane functions (for signaling) and user plane functions (for data traffic).

graph TB
    subgraph "Radio Access Network"
        UE[📱 UE
User Equipment]
        eNB[📡 eNodeB
Base Station]
    end
    
    subgraph "Control Plane"
        MME[🎛️ MME
Mobility Management]
        HSS[(🔐 HSS
Subscriber DB)]
        PCRF[📋 PCRF
Policy & Charging]
    end
    
    subgraph "User Plane - CUPS"
        SGWC[⚙️ SGW-C
Serving GW Control]
        SGWU[📦 SGW-U
Serving GW User]
        PGWC[⚙️ PGW-C/SMF
PDN GW Control]
        PGWU[📦 PGW-U/UPF
PDN GW User]
    end
    
    Internet[🌐 Internet]
    
    UE <-->|Uu
Air Interface| eNB
    eNB <-->|S1-MME
S1AP/SCTP| MME
    eNB <-->|S1-U
GTP-U| SGWU
    
    MME <-->|S6a
Diameter| HSS
    MME <-->|S11
GTP-C| SGWC
    
    SGWC <-->|Sxa
PFCP| SGWU
    SGWC <-->|S5-C
GTP-C| PGWC
    SGWU <-->|S5-U
GTP-U| PGWU
    
    PGWC <-->|Gx
Diameter| PCRF
    PGWC <-->|Sxb
PFCP| PGWU
    
    PGWU <-->|SGi| Internet
    
    style UE fill:#e1f5ff
    style eNB fill:#fff4e1
    style MME fill:#ffe1e1
    style HSS fill:#f0e1ff
    style PCRF fill:#e1ffe1
    style SGWC fill:#ffe1f0
    style SGWU fill:#ffe1f0
    style PGWC fill:#fff0e1
    style PGWU fill:#fff0e1

Control Plane vs User Plane Separation (CUPS)

CUPS (3GPP Release 14) physically separates control and user plane functions for better scalability.

Why CUPS?

Benefit Description
Scalability Scale control and user planes independently
MEC Support Deploy user plane close to edge (low latency)
Cost Efficiency Use cheaper hardware for user plane forwarding
Flexibility Centralize control, distribute user plane

CUPS Interfaces

Interface Protocol Purpose
Sxa PFCP SGW-C ↔ SGW-U control
Sxb PFCP PGW-C ↔ PGW-U control
Sxc PFCP TDF-C ↔ TDF-U (traffic detection)
Note

Open5GS implements CUPS by default. In configs, you'll see separate daemons for sgwc/sgwu and smf/upf.

Core Network Functions

MME (Mobility Management Entity)

Role: Main control plane hub for LTE

Responsibilities:

Interfaces:

HSS (Home Subscriber Server)

Role: Subscriber database (like a SIM card registry)

Stores:

Interfaces:

PCRF (Policy and Charging Rules Function)

Role: Policy enforcement and charging control

Responsibilities:

Interfaces:

Note

The Rx interface connects PCRF to an Application Function (AF), such as an IMS P-CSCF for VoLTE. It is not PCRF↔HSS.

SGW-C (Serving Gateway - Control Plane)

Role: Anchor point for inter-eNB handovers

Responsibilities:

Interfaces:

SGW-U (Serving Gateway - User Plane)

Role: User data forwarding

Responsibilities:

Interfaces:

PGW-C / SMF (PDN Gateway - Control Plane / Session Management Function)

Role: PDN session management and IP address allocation

Responsibilities:

Interfaces:

Important

In Open5GS, SMF is the 5G name for PGW-C. It handles both 4G and 5G sessions.

PGW-U / UPF (PDN Gateway - User Plane / User Plane Function)

Role: Gateway to external networks (Internet)

Responsibilities:

Interfaces:

Important

In Open5GS, UPF is the 5G name for PGW-U. It handles both 4G and 5G user plane traffic.

Key Interfaces

S1-MME (eNB ↔ MME)

S1-U (eNB ↔ SGW-U)

S6a (MME ↔ HSS)

S11 (MME ↔ SGW-C)

Gx (PGW-C ↔ PCRF)

Sxa / Sxb (Control ↔ User Plane)

SGi (PGW-U ↔ Internet)

Subscriber Lifecycle

1. UE Attach Procedure

sequenceDiagram
    participant UE as 📱 UE
    participant eNB as 📡 eNodeB
    participant MME as 🎛️ MME
    participant HSS as 🔐 HSS
    participant SGWC as ⚙️ SGW-C
    participant SGWU as 📦 SGW-U
    participant PGWC as ⚙️ PGW-C/SMF
    participant PGWU as 📦 PGW-U/UPF
    
    UE->>eNB: RRC Connection Request
    eNB->>UE: RRC Connection Setup
    UE->>eNB: RRC Connection Setup Complete
(NAS: Attach Request)
    eNB->>MME: S1AP: Initial UE Message
(IMSI, Attach Request)
    
    MME->>HSS: S6a: Authentication Info Request
(IMSI)
    HSS->>MME: S6a: Authentication Info Answer
(RAND, AUTN, XRES, KASME)
    
    MME->>UE: NAS: Authentication Request
(RAND, AUTN)
    UE->>MME: NAS: Authentication Response
(RES)
    
    Note over MME: Verify RES == XRES
    
    MME->>UE: NAS: Security Mode Command
    UE->>MME: NAS: Security Mode Complete
    
    MME->>HSS: S6a: Update Location Request
    HSS->>MME: S6a: Update Location Answer
(Subscriber Profile)
    
    MME->>SGWC: S11: Create Session Request
(IMSI, APN, QoS)
    SGWC->>PGWC: S5-C: Create Session Request
    PGWC->>PGWU: Sxb: PFCP Session Establishment
(Install forwarding rules)
    PGWU->>PGWC: Sxb: PFCP Session Establishment Response
(UE IP: 10.45.0.2)
    PGWC->>SGWC: S5-C: Create Session Response
(UE IP, PGW-U GTP TEID)
    SGWC->>SGWU: Sxa: PFCP Session Establishment
    SGWU->>SGWC: Sxa: PFCP Session Establishment Response
    SGWC->>MME: S11: Create Session Response
(UE IP, SGW-U GTP TEID)
    
    MME->>eNB: S1AP: Initial Context Setup Request
(UE IP, SGW-U TEID, Security Keys)
    eNB->>UE: RRC: Connection Reconfiguration
(Radio bearers)
    UE->>eNB: RRC: Connection Reconfiguration Complete
    eNB->>MME: S1AP: Initial Context Setup Response
    
    MME->>UE: NAS: Attach Accept
(UE IP: 10.45.0.2)
    UE->>MME: NAS: Attach Complete
    
    Note over UE,PGWU: GTP-U tunnel established:
UE ↔ eNB ↔ SGW-U ↔ PGW-U ↔ Internet

2. PDN Session Establishment

After attach, the UE has:

3. User Data Flow

📱 UE (10.45.0.2)
  ↓ [S1-U: GTP-U tunnel TEID=0x12345678]
📡 eNodeB
  ↓ [S1-U: GTP-U]
📦 SGW-U
  ↓ [S5-U: GTP-U]
📦 PGW-U/UPF
  ↓ [SGi: NAT to public IP]
🌐 Internet (e.g., 8.8.8.8)

4. Tracking Area Update (TAU)

When UE moves to a new Tracking Area:

  1. UE sends TAU Request to new eNB
  2. New eNB forwards to MME
  3. MME updates location in HSS
  4. If SGW changes, MME triggers path switch

Authentication and Security

AKA (Authentication and Key Agreement)

graph LR
    subgraph "SIM Card"
        IMSI[IMSI
001010123456789]
        K[K
Secret Key
128-bit]
    end
    
    subgraph "HSS"
        K2[K
Same Secret Key]
        OPc[OPc
Operator Key]
    end
    
    subgraph "Authentication Vectors"
        RAND[RAND
Random Challenge]
        AUTN[AUTN
Auth Token]
        XRES[XRES
Expected Response]
        KASME[KASME
Base Key]
    end
    
    K --> RAND
    K2 --> RAND
    OPc --> RAND
    RAND --> AUTN
    RAND --> XRES
    RAND --> KASME
    
    style K fill:#ff9999
    style K2 fill:#ff9999
    style KASME fill:#99ff99

Key Hierarchy

KASME (256-bit base key from AKA)
  ├─ KeNB (key for eNB, used for AS security)
  │   ├─ KRRCenc (RRC encryption)
  │   ├─ KRRCint (RRC integrity)
  │   ├─ KUPenc (user plane encryption)
  │   └─ ... (other AS keys)
  └─ NAS keys
      ├─ KNASenc (NAS encryption)
      └─ KNASint (NAS integrity)

Security Algorithms

Layer Algorithm Purpose
NAS EEA0/EEA1/EEA2 Encryption (EEA0 = null)
NAS EIA0/EIA1/EIA2 Integrity (EIA0 = null)
AS (RRC) EEA0/EEA1/EEA2 Encryption
AS (RRC) EIA0/EIA1/EIA2 Integrity
Warning

Security Gap: S1-U (user plane between eNB and SGW-U) is NOT encrypted by default. This is a known vulnerability exploited by IMSI catchers and rogue eNBs.

🔬 Exercises

  1. Diagram Exercise: Draw the data path for a UE pinging 8.8.8.8. Label every GTP tunnel (TEID) and interface.
  2. Security Exercise: Which interfaces in the EPC are encrypted by default? Which are not? (Hint: check the Security Warning box above)
  3. Config Exercise: In the Open5GS mme.yaml, what happens if you change mcc/mnc to 999/99? What error would the UE see?
  4. Wireshark Exercise: What Diameter Application-Id would you see on the S6a interface? (Answer: 16777251 for S6a)

Real-World Context

Operator Example Detail
T-Mobile US Deployed CUPS in 2019 to prepare for 5G SA migration
Vodafone Uses Diameter Edge Agent (DEA) to secure S6a
Open5GS Implements dual-stack (4G+5G) — SMF handles both PGW-C and 5G session management
Tip

In Open5GS, the same open5gs-smfd binary handles both 4G PGW-C (via GTP-C/Diameter) and 5G SMF (via SBI/HTTP2). This is why the Docker labs use Open5GS in combined mode.

Summary

You now understand:

Next: Part 2: 5G NSA Architecture →