4G LTE: Technology, Architecture, Protocols & KPIs

Explore the 4G system architecture, detailing data links versus signaling links, and examine the access network with e nodeBs, the core network, gateways, and key network elements.

The eNodeB handles radio transmission and reception, manages radio resources with admission control and channel allocation, and enforces encryption, integrity, and handover procedures.

Learn how eNB selects an MME from a pool of MMEs in the 4G core network, avoiding MME relocation and reducing signaling load.

Explore how the EPS bearer forms an IP tunnel from user equipment through eNB to PDN gateway. Compare voice bearers with internet bearers by data rate, latency, and priority levels.

Routes user data between user equipment, the media gateway, the PDN gateway, and the eNB, and inserts diffserv qos markers to meet bearer requirements and anchor mobility during inter-eNB handovers.

Explore how the PDN-GW in the 4G core assigns IP addresses, acts as the internet gateway, anchors inter-SGW handovers, and enables deep packet inspection with DiffServ Code Points for QoS.

PCRF defines QoS policies and charging rules for data flows, decides when to allocate EPS bearers, throttles users in bad channels, and passes rules to the PCEF for implementation.

Explains the policy and charging enforcement function (PCEF) in the PDN gateway on the user plane, which enforces QoS on EPS bearers and charges data flows by volume and type.

The home subscriber server (HSS) acts as the central database for 4G subscribers, supplying security keys to the MME for authentication and storing user services, QoS, and roaming rules.

Explore the 4g interfaces through a diagram from 3GPP official documents, then divide and study these interfaces by the protocols they run.

Explains how the GTP protocol carries encapsulated IP traffic between the PDN gateway, SGW, and eNB, forming EPS bearers and E-RAB across the 4G network.

Explain how GTPv1-U carries user data by establishing S1-U tunnels between the eNB and serving gateway and S5 tunnels to the PGW, including S8 roaming tunnels.

Explain gtpv2-c control signaling for creating and modifying eps bearers and tunnels across s5, s8, and s11, with s10 mmes signaling during handover and tunnel switching, carried over udp/ip.

Explore how the S1-AP operates on the S1-MME interface between eNB and MME to transfer UE context, establish ERAB and GTP tunnels, and set up radio bearers.

Explore the X2 interface between eNBs, covering the control and user planes, GTP tunnels for data, handover coordination, buffering, and load reporting with X2AP.

Explore how the diameter protocol links the MME and HSS to download user data. See how QoS policy and charging rules move from PCRF to the PDN gateway over S7/Gx.

Explore how 4G networks use PLMN-ID (MCC+MNC), MME group IDs and GUMMEI, TA IDs, and ECGI to create globally unique identities for E-UTRAN cells and the core.

Explore how the APN in the P-GW uses two-part network and operator identifiers, resolves to an IP via DNS, and connects EPS bearers to data networks.

Identify ue identifiers: imei, imsi, and msisdn. IMSI is the concatenation of mcc, mnc, and msin. On power-on, devices register with the 4G network and obtain an IP address.

Understand how 4g ue identifiers GUTI, M-TMSI, and S-TMSI form from MCC, MNC, and MME ID to provide a globally unique temporary identity, replacing IMSI over the air for security.

Understand how tracking areas divide the 4g lte service area and govern idle mode location, paging with S-TMSI, and signaling load.

Explore how MME pool areas group MMEs to serve tracking areas and eNBs, with any pool member serving its eNB and associated cells, and potential overlaps.

Explain how serving gateway service areas form pools, allow any gateway to serve any eNB in its area, and feature overlapping areas with non one-to-one mapping to MME pool areas.

Explore how the 4g network tracks user equipment state across radio resource control (rrc), eps connection management, and eps mobility management to ensure reachability and track location.

RRC state describes whether the user equipment has an active connection with the eNB, switching from idle to connected during registration, tracking area updates, or calls.

The EPS connection management state shows whether the UE has an active link to 4G core; MME uses RRC with eNB to move ECM from idle to connected and back.

Explain how EPS mobility management tracks user equipment location via MME across idle and connected modes, detailing the EMM deregistered and registered states during attach, tracking area updates, and failures.

Explore the combined UE state diagram for 4g lte, detailing how EMM deregistered and registered states relate to RRC and ECM connections, traffic, and the default bearer context.

Explain how a user equipment registers with the 4G network and is assigned a default EPS bearer with minimum quality of service, while dedicated bearers meet voice call requirements.

Explore how an EPS bearer moves between active and inactive states, with S5/S8 and S1 tunnels linking the SGW, PGW, eNB, and user equipment, and how bearer context is managed.

Define the EPS bearer's QoS using four parameters—QoS class identifier, allocation and retention priority, and, if applicable, guaranteed and maximum bitrate—and explain PCEF enforcement in the PDN gateway.

Explore qci concepts in eps bearer, including guaranteed bitrate and non guaranteed bitrate qcis, their priorities, delay budgets, and service mappings for voice, video, signaling, and data.

During busy periods, the EPC uses ARP to prioritize and drop EPS bearers, with fifteen levels and pre-emption capability and vulnerability.

Explore how the traffic flow template function links uplink traffic to PDN gateway and maps it to EPS bearer using TCP or UDP board numbers and DiffServ code points.

Powering on triggers cell acquisition, where the UE reads primary and secondary synchronization sequences to determine the physical cell id, then selects a network and completes 4g aka authentication.

The MME updates the HSS with the UE location during attach, exchanges diameter messages over S6a, downloads subscriber data, and confirms completion with insert subscriber data and update location responses.

Explain the LTE attach procedure for default bearer establishment, from MME selecting the PDN gateway to S-GW/PGW GTP signaling and PCRF-driven IP-CAN decisions.

The tracking area update procedure activates when a UE in idle state moves between tracking areas. The UE sends a tracking area update request via RRC to the eNB.

Shows how idle UE with an inactive eps bearer is paged via S1AP, with GTP signaling carrying IMSI and TMSI to trigger SGW buffering and bearer activation for downlink data.

Learn the X2-based handover procedure in 4G LTE, from RRC measurement reports and ERAB negotiation to X2AP messaging, path switch, and bearers switching from source eNB to target eNB.

Trigger the S1 based handover from the source to the target eNB via S1-AP, reconfigure the UE with RRC, switch E-RABs and the S1 tunnel through serving and PDN gateways.

Trigger an RRC connection setup to activate an EPS bearer from idle state, coordinating with MME, S1 tunnel, PCRF, and PDN gateway.

Describe the dedicated bearer creation in 4G LTE: a registered device requests voice QoS, travels through MME, PDN/serving gateways, PCRF diameter, and S1/S5 tunnels to activate a dedicated EPS bearer.

Explain the UE initiated detach: UE powers off, sends EMM detach request via RRC setup to MME, which deletes EPS bearer and S1 and S5/S8 tunnels, and returns detach accept.

Explore 4g security terminologies, including mutual authentication between user equipment and the network, ciphering with keys, and integrity protection with distinct keys derived from a master key via 4g aka.

Understand 4g lte roaming architecture: a user equipment roams in a visiting network while the home hss, pdn gateway, and pcrf interact with the serving mme, s-gw, and enb.

Explore the 4g authentication and key agreement procedure, detailing Milenage-based vectors and the K_ASME, K_eNB, K_NASint, K_NASenc, K_RRCenc, K_RRCint, and K_UPenc keys used to secure NAS and RRC signaling.

Trace the eps key hierarchy from the master key to ck, ik, and k_asme, then derive nas, enb, and rrc encryption and integrity keys for both network and user equipment.

Learn 4g lte encryption and integrity protection, including eea1 snow 3g, eea2 aes, eia1 snow 3g, and eia2 aes, with key stream generation and mac-i verification.

explain that LTE is an all IP system, with voice as packets via VoLTE and IMS. note that the circuit-switched core is eliminated, replaced by a packet-switched core interfacing PSTN.

Understand how VoLTE uses SRVCC and CSFB to support circuit-switched voice calls by handing over to 2G or 3G networks when 4G coverage is unavailable or during call setup.

Explore voice over LTE codecs, including AMR and EVS, their data rates and compatibility, and how encoded voice travels via RTP in UDP and IP to deliver VoLTE.

Understand how session initiation protocol enables signaling in the IMS network to create, modify, and terminate sessions, with sdp carried inside sip for negotiating ip addresses, ports, codecs, and bandwidth.

Explore how SIP provides user location, availability, and capabilities services via SDP and supports session setup and session management signaling for voice calls.

Explain the SIP client-server model, where a SIP user agent client sends requests to a SIP user agent server using methods like INVITE, acknowledge, BYE, cancel, register, and options.

Discover how IMS enables 4G VoLTE using SIP on the SGi interface between the PDN gateway and IMS, with diameter signaling across Sh, Rx, and Cx to HSS and PCRF.

Explain the roles of proxy, interrogating, and serving CSCFs in IMS, including SIP routing for registration and calls, HSS interaction, and QoS for VoLTE.

Serving call session control functions handle basic call processing and routing. The telephony application server adds features like line ID hiding and call diversion during voice call setup.

Learn how the service centralization and continuity application server enables mid-call handovers from 4G to 2G or 3G, ensuring voice call continuity via the single radio voice call continuity mechanism.

Shows how device registers to IMS network after LTE attach, uses EPS bearer for IMS signaling to enable PDN connectivity, and establishes IMS media bearer for voice with QoS 1.

Explore how user equipment registers with the IMS network via PCSCF discovery, obtaining the PCSCF IP address through PDN gateway assignment, static configuration, or DHCP, with optional DNS translation.

Describe registration of user equipment with IMS network via SIP messages through proxy, interrogating, and serving call session control functions, with Diameter authentication against the HSS and service server assignment.

Explain how the serving call session control function coordinates session routing and management with TAS and SCC during third party registration to enable voice over LTE communication.

IMS enables subscription to the proxy call session control function so user equipment and the application servers are notified of registration status changes when a SIP network de-registers a user.

Explain how VoLTE calls are established over IMS network using SIP signalling, with SIP invite and SDP offer, SDP answer, PRACK, and 200 OK, followed by IMS media bearer setup.

Explain how the default EPS bearer carries IMS signaling to set up a dedicated IMS media bearer for voice packets, using SIP, SDP, and diameter messages via PCRF and PCEF.

Show how a voice call ends at the SIP level with BYE and 200 OK, while the proxy session control function tears down the EPS bearer for IMS media.

Master the SR-VCC mechanism that hands over 4G voice calls to 2G/3G networks, guided by measurement reports, MME, SCC, and the switch from PS to CS via MGW and MSC.