Select a result to preview

01_4g_lte_fundamentals

Part 1: 4G / LTE Fundamentals

Learning Objective: Understand the 4G LTE Evolved Packet Core (EPC) architecture, network functions, interfaces, and subscriber procedures.

Table of Contents

What is LTE / EPC?

LTE (Long-Term Evolution) is the 4G radio access technology that replaced 3G UMTS/HSPA. The EPC (Evolved Packet Core) is the all-IP core network that supports LTE.

Key Characteristics

4G EPC Architecture

The EPC consists of control plane functions (for signaling) and user plane functions (for data traffic).

Note

Reading the diagram below: "Core Network Signaling" contains functions that are inherently signaling-only — they were never split because they have no user plane component (there is no "MME-U" or "HSS-U"). "CUPS Gateways" contain functions that CUPS split apart from originally monolithic gateways (SGW, PGW) into control and user halves, reconnected via PFCP (Sxa/Sxb). Thick green lines show the UE's user data path; thin lines are signaling/control interfaces.

graph TB
    subgraph "Radio Access Network"
        UE[📱 UE
User Equipment]
        eNB[📡 eNodeB
Base Station]
    end
    
    subgraph "Core Network Signaling"
        MME[🎛️ MME
Mobility Management]
        HSS[(🔐 HSS
Subscriber DB)]
        PCRF[📋 PCRF
Policy & Charging]
    end
    
    subgraph "CUPS Gateways - Control"
        SGWC[⚙️ SGW-C
Serving GW Control]
        PGWC[⚙️ PGW-C/SMF
PDN GW Control]
    end
    
    subgraph "CUPS Gateways - User"
        SGWU[📦 SGW-U
Serving GW User]
        PGWU[📦 PGW-U/UPF
PDN GW User]
    end
    
    subgraph "IMS - VoLTE"
        AF[📞 AF / P-CSCF
Application Function]
    end
    
    Internet[🌐 Internet]
    
    UE <-->|Uu
Air Interface| eNB
    eNB <-->|S1-MME
S1AP/SCTP| MME
    eNB <-->|S1-U
GTP-U| SGWU
    
    MME <-->|S6a
Diameter| HSS
    MME <-->|S11
GTP-C| SGWC
    HSS <-->|Cx
Diameter| AF
    
    SGWC <-->|Sxa
PFCP| SGWU
    SGWC <-->|S5-C
GTP-C| PGWC
    SGWU <-->|S5-U
GTP-U| PGWU
    
    PGWC <-->|Gx
Diameter| PCRF
    PGWC <-->|Sxb
PFCP| PGWU
    PCRF <-->|Rx
Diameter| AF
    
    PGWU <-->|SGi| Internet
    PGWU <-->|SGi
SIP/RTP| AF
    
    style UE fill:#e1f5ff
    style eNB fill:#fff4e1
    style MME fill:#ffe1e1
    style HSS fill:#f0e1ff
    style PCRF fill:#e1ffe1
    style SGWC fill:#ffe1f0
    style SGWU fill:#ffe1f0
    style PGWC fill:#fff0e1
    style PGWU fill:#fff0e1
    style AF fill:#fff8e1
    
    linkStyle 0 stroke:#2ecc71,stroke-width:3px
    linkStyle 2 stroke:#2ecc71,stroke-width:3px
    linkStyle 8 stroke:#2ecc71,stroke-width:3px
    linkStyle 12 stroke:#2ecc71,stroke-width:3px
    linkStyle 13 stroke:#2ecc71,stroke-width:3px

Control Plane vs User Plane Separation (CUPS)

CUPS (introduced by the 3GPP — the 3rd Generation Partnership Project, the global body responsible for defining cellular standards) in Release 14 physically separates control and user plane functions for better scalability and independent resource management.

Why CUPS?

In traditional LTE architectures, control and user plane functions were often bundled within the same physical node (e.g., the SGW was one box handling both signaling and forwarding). CUPS explicitly separates these gateway functions:

Note

CUPS only applies to gateway functions (SGW, PGW, TDF). Core signaling functions like MME, HSS, and PCRF were always signaling-only and are not affected by CUPS.

Benefit Description
Scalability Scale control and user planes independently
MEC Support Deploy user plane close to edge (low latency)
Cost Efficiency Use cheaper hardware for user plane forwarding
Flexibility Centralize control, distribute user plane

CUPS Interfaces

Interface Protocol Description
Sxa PFCP SGW-C ↔ SGW-U: Enables the Control Plane to manage session contexts, usage reporting, and data path selection on the Serving Gateway (SGW) User Plane.
Sxb PFCP PGW-C ↔ PGW-U: Used by the PDN Gateway (PGW) Control Plane to install Packet Detection Rules (PDRs), Forwarding Action Rules (FARs), and QoS enforcement on the User Plane.
Sxc PFCP TDF-C ↔ TDF-U: Facilitates communication between the Traffic Detection Function (TDF) Control and User planes for application-specific traffic steering and policy enforcement.

PFCP (Packet Forwarding Control Protocol) is the signaling protocol (3GPP TS 29.244) that allows the gateway control plane to program its user plane's forwarding behavior without being involved in the data path itself.

Tip

Why these three interfaces? Sxa, Sxb, and Sxc are the only interfaces that exist purely because of CUPS. Other EPC interfaces (S1, S6a, S11, Gx, S5, SGi, etc.) predate CUPS and existed in the original monolithic architecture. Without CUPS, the SGW, PGW, and TDF are each a single box with no internal C↔U communication needed — the Sx family was created specifically to reconnect the split halves via PFCP. Sxc (TDF) is included here for completeness per the 3GPP spec, even though Open5GS does not implement a TDF; it is relevant for threat modeling carriers that deploy TDF for DPI or application-aware policy enforcement.

Note

Open5GS implements CUPS by default. In configs, you'll see separate daemons for sgwc/sgwu and smf/upf.

Core Network Functions

MME (Mobility Management Entity)

Role: Main control plane hub for LTE

Responsibilities:

Interfaces:

HSS (Home Subscriber Server)

Role: Subscriber database (like a SIM card registry)

Stores:

Interfaces:

PCRF (Policy and Charging Rules Function)

Role: Policy enforcement and charging control

Responsibilities:

Interfaces:

Note

The Rx interface connects PCRF to an Application Function (AF), such as an IMS P-CSCF for VoLTE. It is not PCRF↔HSS.

AF / P-CSCF (Application Function)

Role: Bridge between application-layer services (e.g., VoLTE) and the EPC policy framework

The Application Function (AF) is a 3GPP-defined logical role for any service that needs to request specific network resources (bandwidth, QoS, priority) from the core network. In practice, the most common AF in LTE deployments is the P-CSCF (Proxy-Call Session Control Function), the entry point into the IMS (IP Multimedia Subsystem) used for VoLTE (Voice over LTE).

Important

The P-CSCF is a server in the carrier's network, not the user's phone. The UE has a built-in SIP client (VoLTE dialer) that connects to the P-CSCF over the LTE data bearer.

What is IMS?

What does the P-CSCF do?

How does UE data reach the P-CSCF?

The P-CSCF sits on the SGi side — the same network side as the Internet. The UE's SIP signaling travels the same GTP tunnel path as regular internet traffic:

📱 UE (SIP client sends SIP REGISTER/INVITE)
  ↓ [Uu: radio]
📡 eNodeB
  ↓ [S1-U: GTP-U]
📦 SGW-U
  ↓ [S5-U: GTP-U]
📦 PGW-U/UPF
  ↓ [SGi: regular IP]
📞 P-CSCF  ← just another IP destination, like the Internet

There is no special "IMS tunnel." The UE sends SIP packets (typically UDP/TCP port 5060 or TLS port 5061) over its existing default bearer. What makes VoLTE different from browsing the web is what happens after the P-CSCF receives the SIP signaling:

  1. UE sends SIP REGISTER → normal data path → P-CSCF
  2. P-CSCF asks HSS (via Cx): "Is this subscriber authorized for IMS?"
  3. UE sends SIP INVITE (initiate a call) → normal data path → P-CSCF
  4. P-CSCF asks PCRF (via Rx): "Allocate a dedicated GBR bearer for this voice session"
  5. PCRF tells PGW-C (via Gx): "Create a high-priority bearer"
  6. PGW-C programs PGW-U (via Sxb): "Install QoS forwarding rules for voice"
  7. Voice RTP (Real-time Transport Protocol) packets now flow on a separate, prioritized bearer — not competing with web traffic

Interfaces:

Note

Open5GS does not include a built-in IMS/P-CSCF. For VoLTE testing in labs, external IMS implementations like Kamailio or sipp are used alongside Open5GS.

SGW-C (Serving Gateway - Control Plane)

Role: Anchor point for inter-eNB handovers

Responsibilities:

Interfaces:

SGW-U (Serving Gateway - User Plane)

Role: User data forwarding

Responsibilities:

Interfaces:

PGW-C / SMF (PDN Gateway - Control Plane / Session Management Function)

Role: PDN session management and IP address allocation

Responsibilities:

Interfaces:

Important

In Open5GS, SMF is the 5G name for PGW-C. It handles both 4G and 5G sessions.

PGW-U / UPF (PDN Gateway - User Plane / User Plane Function)

Role: Gateway to external networks (Internet)

Responsibilities:

Interfaces:

Important

In Open5GS, UPF is the 5G name for PGW-U. It handles both 4G and 5G user plane traffic.

Key Interfaces

Uu (UE ↔ eNB)

S1-MME (eNB ↔ MME)

S1-U (eNB ↔ SGW-U)

S6a (MME ↔ HSS)

S11 (MME ↔ SGW-C)

S5-C (SGW-C ↔ PGW-C)

S5-U (SGW-U ↔ PGW-U)

Gx (PGW-C ↔ PCRF)

Cx (HSS ↔ IMS / P-CSCF)

Rx (PCRF ↔ AF / P-CSCF)

Sxa / Sxb (Control ↔ User Plane)

SGi (PGW-U ↔ Internet)

Subscriber Lifecycle

1. UE Attach Procedure

sequenceDiagram
    participant UE as 📱 UE
    participant eNB as 📡 eNodeB
    participant MME as 🎛️ MME
    participant HSS as 🔐 HSS
    participant SGWC as ⚙️ SGW-C
    participant SGWU as 📦 SGW-U
    participant PGWC as ⚙️ PGW-C/SMF
    participant PGWU as 📦 PGW-U/UPF
    
    UE->>eNB: RRC Connection Request
    eNB->>UE: RRC Connection Setup
    UE->>eNB: RRC Connection Setup Complete
(NAS: Attach Request)
    eNB->>MME: S1AP: Initial UE Message
(IMSI, Attach Request)
    
    MME->>HSS: S6a: Authentication Info Request
(IMSI)
    HSS->>MME: S6a: Authentication Info Answer
(RAND, AUTN, XRES, KASME)
    
    MME->>UE: NAS: Authentication Request
(RAND, AUTN)
    UE->>MME: NAS: Authentication Response
(RES)
    
    Note over MME: Verify RES == XRES
    
    MME->>UE: NAS: Security Mode Command
    UE->>MME: NAS: Security Mode Complete
    
    MME->>HSS: S6a: Update Location Request
    HSS->>MME: S6a: Update Location Answer
(Subscriber Profile)
    
    MME->>SGWC: S11: Create Session Request
(IMSI, APN, QoS)
    SGWC->>PGWC: S5-C: Create Session Request
    PGWC->>PGWU: Sxb: PFCP Session Establishment
(Install forwarding rules)
    PGWU->>PGWC: Sxb: PFCP Session Establishment Response
(UE IP: 10.45.0.2)
    PGWC->>SGWC: S5-C: Create Session Response
(UE IP, PGW-U GTP TEID)
    SGWC->>SGWU: Sxa: PFCP Session Establishment
    SGWU->>SGWC: Sxa: PFCP Session Establishment Response
    SGWC->>MME: S11: Create Session Response
(UE IP, SGW-U GTP TEID)
    
    MME->>eNB: S1AP: Initial Context Setup Request
(UE IP, SGW-U TEID, Security Keys)
    eNB->>UE: RRC: Connection Reconfiguration
(Radio bearers)
    UE->>eNB: RRC: Connection Reconfiguration Complete
    eNB->>MME: S1AP: Initial Context Setup Response
    
    MME->>UE: NAS: Attach Accept
(UE IP: 10.45.0.2)
    UE->>MME: NAS: Attach Complete
    
    Note over UE,PGWU: GTP-U tunnel established:
UE ↔ eNB ↔ SGW-U ↔ PGW-U ↔ Internet

2. PDN Session Establishment

After attach, the UE has:

3. User Data Flow

📱 UE (10.45.0.2)
  ↓ [S1-U: GTP-U tunnel TEID=0x12345678]
📡 eNodeB
  ↓ [S1-U: GTP-U]
📦 SGW-U
  ↓ [S5-U: GTP-U]
📦 PGW-U/UPF
  ↓ [SGi: NAT to public IP]
🌐 Internet (e.g., 8.8.8.8)

4. Tracking Area Update (TAU)

When UE moves to a new Tracking Area:

  1. UE sends TAU Request to new eNB
  2. New eNB forwards to MME
  3. MME updates location in HSS
  4. If SGW changes, MME triggers path switch

Authentication and Security

AKA (Authentication and Key Agreement)

graph LR
    subgraph "SIM Card"
        IMSI[IMSI
001010123456789]
        K[K
Secret Key
128-bit]
    end
    
    subgraph "HSS"
        K2[K
Same Secret Key]
        OPc[OPc
Operator Key]
    end
    
    subgraph "Authentication Vectors"
        RAND[RAND
Random Challenge]
        AUTN[AUTN
Auth Token]
        XRES[XRES
Expected Response]
        KASME[KASME
Base Key]
    end
    
    K --> RAND
    K2 --> RAND
    OPc --> RAND
    RAND --> AUTN
    RAND --> XRES
    RAND --> KASME
    
    style K fill:#ff9999
    style K2 fill:#ff9999
    style KASME fill:#99ff99

Key Hierarchy

KASME (256-bit base key from AKA)
  ├─ KeNB (key for eNB, used for AS security)
  │   ├─ KRRCenc (RRC encryption)
  │   ├─ KRRCint (RRC integrity)
  │   ├─ KUPenc (user plane encryption)
  │   └─ ... (other AS keys)
  └─ NAS keys
      ├─ KNASenc (NAS encryption)
      └─ KNASint (NAS integrity)

Security Algorithms

Layer Algorithm Purpose
NAS EEA0/EEA1/EEA2 Encryption (EEA0 = null)
NAS EIA0/EIA1/EIA2 Integrity (EIA0 = null)
AS (RRC) EEA0/EEA1/EEA2 Encryption
AS (RRC) EIA0/EIA1/EIA2 Integrity
Warning

Security Gap: S1-U (user plane between eNB and SGW-U) is NOT encrypted by default. This is a known vulnerability exploited by IMSI catchers and rogue eNBs.

🔬 Exercises

  1. Diagram Exercise: Draw the data path for a UE pinging 8.8.8.8. Label every GTP tunnel (TEID) and interface.
  2. Security Exercise: Which interfaces in the EPC are encrypted by default? Which are not? (Hint: check the Security Warning box above)
  3. Config Exercise: In the Open5GS mme.yaml, what happens if you change mcc/mnc to 999/99? What error would the UE see?
  4. Wireshark Exercise: What Diameter Application-Id would you see on the S6a interface? (Answer: 16777251 for S6a)

Real-World Context

Operator Example Detail
T-Mobile US Deployed CUPS in 2019 to prepare for 5G SA migration
Vodafone Uses Diameter Edge Agent (DEA) to secure S6a
Open5GS Implements dual-stack (4G+5G) — SMF handles both PGW-C and 5G session management
Tip

In Open5GS, the same open5gs-smfd binary handles both 4G PGW-C (via GTP-C/Diameter) and 5G SMF (via SBI/HTTP2). This is why the Docker labs use Open5GS in combined mode.

Summary

You now understand:

Next: Part 2: 5G NSA Architecture →