Reference(s):
1. Netmanias
Technical Document: EMM Procedure 8 & 9. Handover and Cell
Reselection with TAU www.netmanias.com
2.
https://blog.3g4g.co.uk/2011/03/lte-to-3g-handover-procedure-and.html
Case
A: TAU during Handover while it stays in Connected state:
A TAU procedure is
required after handover/cell re-selection if UE moves to a
non-registered TA. The TAI list assigned to the UE is a list of the
areas where the UE has been registered. Because of this, if UE moves
to a TA not in the TAI list, it must perform a TAU procedure,
requesting for TA update, so that the network can update the UE’s
TAI list and assign the updated list accordingly.
Example:
A handover procedure
performed when UE in Connected state moves to a TA that it is not
registered to. When the UE initially attached the network, MME
selected TA1 and TA2 for the UE, and sent a TAI list = {TAI=1,
TAI=2}, as included in the Attach Accept message. Initially, the UE
was served through eNB2 (Cell 5 in it, to be exact) in TA1. Now it is
moving toward eNB5 (Cell 13, to be exact) in TA3 which is not in the
TAI list. This example concerns intra-LTE handover only, and assumed
both eNB2 and eNB5 are connected to the same MME and S-GW.
1. Handover:
As the UE moves
toward eNB5, a handover event is triggered. The UE measures the
signal strength of
the serving cell and neighbor cells, and sends the results to eNB2,
as included in the
Measurement Report
message. First, the source eNB (e.g. eNB2 above) chooses the type of
handover to perform, X2 or S1. In X2 handover, it is the source eNB
that selects the target eNB (e.g. eNB5 above), whereas it is MME in
S1 handover. Next, handover is performed from eNB2 (Cell 5 in it to
be more exact) to eNB5 (Cell 13 in it).
2. TAU request
sent by UE->MME:
UE when being handed
over to the target eNB (eNB5), it knows eNB5 does not belong to its
assigned
TAs. Thus, as soon
as the handover is completed, it sends a TAU Request message to MME,
requesting TA update. At this time, the message includes the
following information:
TAU Request (Update
Type=TA Updating, GUTI, Last Visited TAI, KSI ASME , NAS-MAC)
Update Type:
indicates the TAU type. Set as TA Updating unless UE is handed over
to a registered TA
GUTI: UE ID
previously allocated by MME. Used by MME for UE identification.
Last Visited
TAI: TAI reported through TAU Request last time
KSI ASME : index
for K ASME , the NAS security base key
NAS-MAC: message
authentication code (MAC) used in protecting the integrity of TAU
Request with NAS integrity Key (K NASint ).
The TAU Request
message is sent through an UL Information Transfer message from UE to
eNB (as RRC message), and then through an Uplink NAS Transport
(NAS-PDU (TAU Request), ECGI, TAI) message from eNB to MME (as S1AP
message). The Uplink NAS Transport message, including the TAU Request
message and the current cell’s ECGI and TAI, is forwarded to MME.
As the NAS security
context has already been established between the UE and MME, the TAU
Request
message that the UE
sends is integrity-protected with the NAS integrity key (K NASint ).
If the MME’s
integrity check on the received TAU Request message fails, the MME
performs user authentication and NAS security setup procedures.
3. [MME] TA
Update: Allocating New TAs:
Because the UE has
moved to a TA that it is not registered to, the MME selects a group
of TAs to allocate and configures a new TAI list for the UE. At this
time, a new Globally Unique Temporary Identifier (GUTI) may also be
allocated.
4. [MME→UE] TAU
Accept:
The MME sends the
newly selected TAs (and GUTI if applicable), as included in a TAU
Accept (GUTI, TAI List) message. This message, after being encrypted
and integrity-protected, is sent through a Downlink NAS Transport
message from MME to eNB (as S1AP message), and then through a DL
Information Transfer message from eNB to UE (as RRC message).
4) [UE → MME]
TAU Complete
If a new GUTI was
allocated, the UE sends the MME a TAU Complete message to acknowledge
the
receipt of the new
GUTI. Once the TAU procedure is completed, the UE, now with the new
TAI list (and GUTI if applicable), can be served through eNB5.
Case
B: TAU during Handover while it is
in Idle state:
Example: Same as above, but assuming the UE was in idle state
1. RRC connection establishment:
Steps are also same as above, but first the UE establishes an RRC
connection with the eNB, and sends the message, thereby transiting
from Idle state (EMM-Registered, ECM-Idle, RRC-Idle) to Connected
state (EMM-Registered, ECM-Connected, RRC-Connected).
2. [MME, S-GW, P-GW, PCRF] EPS Bearer/Session Modification:
As the UE’s location is changed, the MME informs the S-GW of such
change by sending a Modify Bearer Request message. If MME is required
to report any TA change to PCRF, as set in the Change Report Action
parameters received from PCRF when the UE established the EPS session
after initial attach, a session modification procedure is performed,
reporting the TA change to PCRF accordingly.
3. [MME → UE] TAU Accept:
The MME sends the UE a new TAI list (and GUTI if applicable) through
a TAU Accept (GUTI, TAI List) message. At this time, the message
includes the same information as listed above, and is
sent integrity-protected and encrypted.
4. [UE, eNB, MME] Transiting to Idle State:
After the TAU procedure is completed, the MME releases the S1
connection, thereby releasing the S1 signaling connection between
eNB5 and MME. Then, eNB5 releases the RRC connection established with
the UE. Now, the ECM connection between the UE and MME is removed,
and the UE turns to Idle state (EMM-Registered, ECM-Idle, RRC-Idle),
back from Connected state (EMM-Registered, ECM-Connected,
RRC-Connected).
5) [UE] Camping on Cell 13:
Once back to Idle state, the UE camps on Cell 13. Now with the new
TAI list, it wakes up at the end of
every DRX cycle and measures the signal of Cell 13 (RSRP, RSRQ).
[Reference
Signals Received Power (RSRP) and Reference Signal Received Quality
(RSRQ) are key measures of signal level
and quality for modern LTE networks.]
