Untitled
unknown
plain_text
a year ago
78 kB
12
Indexable
Overview
Project life cycle
Concept – Commercialization plan
PPA – Product Proposal Approval: Phê duyệt đề xuất sản phẩm.
Plan – Development plan
DIA – Development Investment Approval: Phê duyệt đầu tư phát triển
PIA – Product Implementation Approval: Phê duyệt thực hiện sản phẩm
Development – Implementation
DVR – Design Verification Review: Đánh giá kiểm tra thiết kế.
PVR – Product Validation Review: Đánh giá xác thực sản phẩm. Yêu cầu: HW đảm bảo ổn định; SW (% issue có thể có còn lại).
PRA – Product Readiness Approval: Phê duyệt sự sẵn sàng sản phẩm. Yêu cầu: SW và HW đều ổn định (không còn issue) để đưa sp vào sản xuất.
Production – Mass production
SRA – Ship Release Approval:
PSA – Plus One Release Approval:
Android architecture
Applications
Lớp trên cùng của kiến trúc
Type: Hệ thống (apps basic được cài sẵn), bên thứ ba (app được cài từ cửa hàng)
Chạy cùng với Runtime, dưới sự hỗ trợ của Framework (class và service)
Application Framework
Hỗ trợ call app.
Provide: (cung cấp) các class và service, dung để khởi tạo các ứng dụng.
Contains: (bao gồm) các điều kiện tiên quyết để phát trển app
Các dịch vụ
Trình quản lý: hoạt động, thông báo
Hệ thống: xem và quản lý gói v.v…
Android Runtime (environment) - Solution
1 phần rất quan trọng của Android.
Provide: (cung cấp) base cho Framework; và power của app dưới sự hỗ trợ của các thư viện lõi.
Contains: (bao gồm)
core libraries
Dalvik virtual machine (DVM): là máy ảo thiết kế trên thanh ghi; được thiết kế và tối ưu hóa cho Android nhằm có thể chạy nhiều phiên 1 cách hiệu quả.
Depend on (sự phụ thuộc): phụ thuộc vào Linux kernel để phân luồng và quản lý bộ nhớ cấp thấp (low-level memory).
Từ các thư viện lõi (core libraries) cho phép triển khai app bằng các ngôn ngữ lập trình Java, Kotlin
Platform Libraries (các thư viện nền tảng) - Solution
Cung cấp thư viện cho việc phát triển ứng dụng
Bao gồm: các thư viện lõi C/C++, Java.
Media cung cấp hỗ trợ để phát và ghi lại các định dạng âm thanh và video.
Surface manager quản lý quyền truy cập vào hệ thống con hiển thị.
SGL & OpenGL sử dụng cho đồ họa 2D và 3D.
SQLite cung cấp hỗ trợ cơ sở dữ liệu và FreeType cung cấp hỗ trợ phông chữ.
Web-kit cung cấp tất cả các chức năng để hiển thị nội dung web và đơn giản hóa việc tải trang.
SSL là công nghệ bảo mật để thiết lập liên kết được mã hóa giữa máy chủ web và trình duyệt web.
Linux kernel
Là lõi của kiến trúc Android.
Quản lý all như: được yêu cầu trong thời gian chạy của Android
Điều khiển hiển thị, máy ảnh, âm thanh
Điều khiển bộ nhớ
Điều khiển Bluetooth
v.v…
Provide (cung cấp): các lớp trừu tượng giữa phần cứng và các thành phần khác của Android.
Các tính năng
Security xử lý bảo mật giữa ứng dụng và hệ thống.
Memory Management xử lý hiệu quả việc quản lý bộ nhớ, do đó cung cấp sự tự do để phát triển các ứng dụng
Process Management quản lý tiến trình, phân bổ tài nguyên cho các quy trình bất cứ khi cần
Network Stack xử lý hiệu quả các giao tiếp mạng
Driver Model đảm bảo rằng ứng dụng hoạt động bình thường trên các: device, hardware
Modem architecture
SoC
Primary components:
Application processor: Bộ xử lý ứng dụng thực thi phần mềm ứng dụng của user với sự hỗ trợ của middleware và OS (phần mềm trung gian và hệ điều hành)
Modem processor: (các thành phần thuôc OS) thực hiện truyền dẫn vô tuyến và tiếp nhận audio, video, data.
Peripheral devices: Các thiết bị ngoại vi cho giao diện người dung.
CP
CP (Cellular Processor/ Communication Processor) hoặc Modem processor
Giao tiếp với các nhà mạng
Chạy trên Real Time OS: đáp ứng ngay lập tức. Schedule: đảm bảo các task được thực hiện ở độ trễ nhất định.
Cần có đáp ứng nhanh: ≠ APchip; giao tiếp trực tiếp vs network. (time slot dưới 1ms).
CS / PS.
Hight-performance: video call liền mạch, …
Kiến trúc ARM: sử dụng năng lượng rất thấp
modem đầu cuối chịu trách nhiệm thực hiện cuộc gọi và truyền và nhận dữ liệu bằng cách trao đổi tín hiệu với các trạm gốc
CP chipset
Digital baseband
Audio codec –thuoc-> DSP
Không còn SRAM
RFIC: RF transver
Radio, Analog baseband
RIL: Trao đổi giữa AP(ARM) và CP(RTOS)
Baseband: chip modem
Tín hiệu số: tầng cao
Tín hiệu tương tự: song âm, song radio, tầng thấp (đồ thị sóng)
Truyền: số => tương tự
Nhận: tương tự => Số > Digital baseband < đóng gói, mã hóa >
Logging
Thuật ngữ
Dumpstate là file log của AP và 1 phần thông tin liên quan đến CP <make a call <AP gửi cho CP>>
CP Log
Modem Silent Log log của CP
sử dụng *#9900# để tạo file log và ghi log file.
Log file tệp nhật ký, lưu trữ các thông tin của các sự kiện
Download binary
PLM S/W Coop S/W Output Binary Separation Release
RDX with LogCatcher
Get CP log (modem)
upload mode: mục đích đóng băng crash point; hiển thị lên màn hình
1. Set Debug level to MID [*#9900#] [Debug Level Enable] MID
2. Xóa các log cũ [*#9900#] [Delete dumpstate/logcat]
Xóa file “log” trong Internal storage
3. Bắt đầu ghi log [*#9900#] [Silent log] Default
Tái hiện lại issue crash [*#9900#] [Run Forced CP crash dump]
Take CP crash log by RDX LogCatcher: <PC - RDX tool>
- Setup: Reset after download, open folder after download
- [Get It]
5. Dừng ghi log [*#9900#] Silent Log OFF
6. Get DumpState log [*#9900#] [Run dumpstate/logcat/modem log]
[Copy to sdcard (include CP Ramdump)] <Copy Success!> [OK]
Open log file on Tool
Crash mode
Tool:
Chip Tool File log File debug
MTK ELT muxz axf
LSI ShanoonDM sdm
Get <PC> copy "log" folder in storage
quickbuild ID https://cp.qb.sec.samsung.net/build/<id> download: file debug (7z), modem.bin
Download mode
CP common
Binaries
Build types:
Based on components:
AP - Application Package
BL - Boot Loader (Boot Mode):
CP - Common Package (Common Package For All Models)
CSC - Consumer Software Customization
Based on production:
User
Factory
Based on debug level:
User: User build is the one flashed on production phones. Has no root access.
Eng: Engineering build comes with default root access.
Userdebug: User debug build does not come with default root access but can be rooted. It also contains extra logging.
Name rules:
Model name
Sales Region or GPG Customer name
Binary type
Major change like OS upgrade
<mỗi model của Samsung hỗ trợ 4 đời OS, trong đó có 1 bản RA(launching và 3 đời upgrade)>
- A: First market release, B ~ Z: MR or OS Upgrade (PL decision)
- Don’t have to change ALL binary(AP/CP/CSC) versions simultaneously
Release Year, Month
- 1st byte: A (2001) ~ Z (2026)
- 2nd byte: A (January) ~ L (December)
Release number of this particular month
- 1 ~ 9, A ~ Z (Maximum 35 times)
Sales Code
OLB – sea
OLE –
RP count: Rollback Prevention không thể flash các bản bé hơn RP count
- Rollback prevention is not applied: 0
- After RP applied, sequence: 1 ~ 9, A ~ Z
A346EXXE4AWG8
Model name: A346E
Sales Region: XX
Binary type: E (normal Engineer binary)
RP count: 4
Major change: A (First market release)
Release date: WG 2023/07
Release number of this particular moth: 8
Flash ???
Model name
Secure download:
Nếu chưa enable thì RP count sẽ = 0
ENG MODE:
DEV device (anti-rollback) cho biết có thể flash tất cả các bản OS bỏ qua value RP
Perforce
<wiki>
- Tìm một nhánh DEV/MAIN/PROD
Map to workspace
Checkout file "makel_shannon.sh"
Echo log
Shelve file
Build test
Tải log build về check
Build
PLM
Issue status
Open
Register
Reply in Process
Reject
Re-register
Resolve
Close
Processing (A/B/C)
CPBSP
Some CP binary Security
Secure boot
Secure Boot is a security feature that works in BIOS in UEFI mode that prevents malware from working during computer booting.
UEFI: Unified Extensible Firmware Interface is a specification that defines the architecture of the platform firmware used for booting the computer hardware and its interface for interaction with the operating system
FOTA: Firmware Over-The-Air is a feature used to update phone software to a new version via the network
Rollback Prevention
If an RP version increases, any attempt to download a previous binary is blocked.
If ENG MODE: The DEV device (anti-rollback) indicates that it is possible to flash all OSs that ignore the RP value
CP branch
Role of each banch:
DEV: Only for R&D TG (Protocol, System);
All the TG engineers submit new features, bug fixes, refactoring changes.
maintainer makes sure build success and integrate them into MAIN
MAIN: Only for Release, need PBS link before submit by limited integrator
PROD:
TRUNCUS: for common PROD;
Branched out from MAIN between PVR~PRA
TG engineers submit to TRUNCUS, not RELs directly
Cherry pick from MAIN or DEV is recommended
REL: for delta projects from above
SETUP: new solution, project bring up
Branch ../Combination for Qualcom chip
Branch ../Strawbery for LSI chip
Branch ../Mojito for MTK chip
Search project: Model A346E first release
Release version:
First release: Galaxy-A34-5g PH TSSM_PHL … SM-A346E_SEA_PHL
OS upgrade: Galaxy-A34-5g PH TSSMPHL_14 … SM-A346E_SEA_14_PHL; “14” is the 4th upgrade version
Type of binary
the first version of Face Binary was released: the first “Purpose: Factory Binary” version is registered.
the first version of User Binary was released: the first “Purpose:H/W Test or S/W Test” version is registered.
the last released version of the PR process:
Process to change CP binary release branch
Factory process
IMEI PGM
IMEI PGM is an important factory process in Samsung Mobile Production line as any issue while IMEI writing in Factory process will stop the production line. <là quá trình quan trọng, nếu có vấn đề thì phải dừng hoạt động cả dây chuyền>
It is done
+ for complete S/W check and
+ for updating the device security (GAK, SAK,…) & IMEI number in the phones. [GAK- Global Authentication Key, SAK-Samsung Attestation Key]
<Quá trình này thực hiện: kiểm tra sự hoàn thiện của S/W và cập nhật bảo mạt thiết bị và số IMEI cho thiết bị>
It writes various information, including IMEI number from the server to the phone's fixed NV memory <Non-volatile memory: non volathai lưu dữ liệu mãi mãi sau khi được lưu vào, >, downloads user binary and then verifies the information written. <Write: số IMEI từ server đến bộ nhớ NV cố định của máy, tải các user binary và xác thực lại các thông tin trên>
*** Factory binary ***
IMEI Write Process: Write
+ IMEI number
+ all security codes: GAK, SAK, …
+ sales code, BT ID, WIFI MAC address
providing the security
<Cung cấp tính an ninh bảo mật cho thiết bị>
*** Download mode ***
*** User binary ***
IMEI Check Process: After the IMEI write part is complete, device is put into Download mode and User binary is downloaded.
to verify if all the information is written correctly in device during IMEI write part.
<Xác minh lại tất cả thông số đã được wirte>
RF
Definition Purpose
Amplifier the signal after passing this block will be magnified quantities such as: Current, Voltage, Power. Gain: represents how much the amplifier magnifies the input signal which means the ratio between input signal and output signal power.
Efficiency: represents with how small energy the amplifier can achieve its desired amplification.
Mixer is just a component which multiplies two input signal. In most real application:
f1 port of a mixer is for RF input.
f2 port is for Local oscillator.
Filter Filter has the task of selecting and removing unnecessary frequency bands. Low pass filter: Block high frequency signals
Band pass filter: Blocks signals outside a specific frequency range.
High pass filter: Blanking low frequency signals.
Band reject filter: Blocks a specific frequency band.
Antenna is a device which convert Electrical Energy (Electrical Signal) into Electromagnetic Wave which is transmitted into space. Antenna Impedance matching:
- Usually: change in turn the values of each component until the best transmission is obtained. It takes a lot of time to do this. When changing the operating frequency you will have to repeat the component test.
- Automatic (dynamic) tuning of the matching circuit: replaced with components that can change the quantity value: variable capacitor, resistance and variable sensor coil
Duplexer is a device that allows us to connect both the Tx path and the Rx path to a single/common antenna without interfering with each other. The reason that we need Duplexer: If don't have the duplexer and both RF receiver path and Transmitter directly connected to the common (single) antenna.
- A small fractions of the signal would spill over to the receiver path, it can be pretty serious interference to the receiver path since the receiver path is designed to respond to the very low signal strength.
- The signal spilled over from transmitter cannot get in
Mobile network generation
Overview
1G Đáp ứng gọi thoại. (analog voice), phục vụ gọi thông thường
2G Gọi thoại (digital voice), sms
Thêm mới: ứng dụng kết nối mạng
3G Tập trung dữ liệu gói, tăng tốc độ truyền dữ liệu
Thêm mới:
Quan sát video qua mạng 3G.
Điều khiển máy móc.
4G Tốc độ truyền rất lớn
Thêm mới: Thay thế truyền mạch dữ liệu gói trên miền IP
5G Tốc độ truyền tải x10 lần 4G
Thêm mới: kỳ vọng
Độ trễ rất thấp
Số lượng thiết bị có thể sp trong cùng 1 thời điểm (phù hợp IoT, message machine), đáp ứng số thiết bị truy cập tăng nhanh
What is the different between 4G and previous generations?
High throughput: data transfer rates upto 100MBps
Low latency: The time required to connect to the network is within a few hundred milliseconds.
Superior end-user experience: Optimize signals for connection setup and other mobile management interfaces and wireless interfaces.
Seamless Connection: LTE supports seamless connectivity to existing networks such as GSM, CDMA and WCDMA.
Plug and play: system automatically identifies the device, loads new drivers for the hardware if needed and starts working with the newly connected device.
Simple architecture: Hybrid network
FDD and TDD in the same platform
What are the 3 key benefits of 5G?
Massive Internet of Things:
deep coverage: to reach challenging locations
ultra-low enery: 10+ years of battery life
ultra-low complexity: 10 bps
ultra-high density: 1 million nodes per km2
Enhanced mobile broadband:
extreme capacity: 10 Tbps per km2
extreme data rates: multi-Gbps peak rates; 100+ Mbps user experienced rates
deep awareness: Discovery and optimization
Missioncritical control:
strong security: health/goverment/financial trusted.
ultra-high reliability: < 10^-5 per 1 millisecond.
ultra-low latency: as low as 1 millisecond.
extreme user mobility: upto 500 km/h
How many frequency ranges in 5G spectrum? What frequency range should bre preferred for 5G deployment?
There are 2 frequency ranges in 5G spectrum: FR1 and FR2.
FR1 (450MHz – 6GHz) is preferred for 5G deployment because it has a frequency break close to 4G so it can take advantage of 4G. FR2 (24.25GHz – 52.6GHz) has a big data transfer rate but very low coverage.
How to solve 5G coverage problem?
Increase Transmit power.
Use Supplementary Uplink/Downlink channel: Use another transmission channel with a lower frequency when uploading (uplink).
Use small cell, macro cell.
Beamforming: focusing energy in one direction (orientation instead of isotropic) increases the coverage significantly as the energy is more concentrated.
UE
UE mode
PS -
CS -
Mode Description
CS mode
PS mode 1 UE get attach EPS service only;
UE usage setting is “Voice centric”
PS mode 2 UE get attach EPS service only;
UE usage setting is “Data centric”
CS/PS mode 1 UE registers with network for: EPS (LTE) and non-EPS services (2G/3G/CDMA);
UE usage setting is “Voice centric”
CS/PS mode 2 UE registers with network for: EPS (LTE) and non-EPS services (2G/3G/CDMA);
UE usage setting is “Data centric”
N1 mode UE allowing access to the 5G core via 5G access network
Re-enable: Pwer Cycle (Off to On) / USIM removal / Disable to Timer Expiration / Voice to Data
S1 mode
UE usage setting
Adrress
IPv4 Internet Protocol version 4 is a data-oriented protocol, used for packet-switched systems.
< là một giao thức định hướng dữ liệu, được sử dụng cho các gói-switched system>
length of 32bit (4 octets) = [Network ID: Identifies the first 8 bits] + [Host ID: Identified by the remaining 24 bits]
IPv6 Internet protocol version 6 is a new generation of Internet addresses designed to replace IPv4 addresses in Internet operations (IPv4 resources are gradually running out).
< là một thế hệ địa chỉ Internet mới được thiết kế để thay thế địa chỉ IPv4 trong hoạt động Internet (tài nguyên IPv4 đang dần cạn kiệt).>
128bit length (8 fields (16 bits, contains hexa numbers.))
Structure = site prefix (48bits) + subnet ID(16bits) + interface ID(64bits)
RRC
Radio Resource Control
Status
RRC Status IDLE
UE is known in EPC and has IP address but not known in E-UTRAN/eNB
<tb không hoạt động trong mạng 4G, trạng thái tbi đagn chờ kết nối và ko tiêu tốn nhiều năng lượng>
CONNECTED UE is known to both Evolved Packet Core(EPC) and E-UTRAN eNB
<tb đã thiết lập kết nối với mạng 4G, tb có thể tham gia vào các hoạt động của mạng 4G: gửi nhận >
4G – LTE
Overview
LTE Network Refernce Model
UE User Equipment is actually a Mobile Equipment.
<thực chất là 1 thiết bị di động bao gồm: SIM và điện thoại>
eNB eNodeB is a base station that controls the mobiles in one or more cells. The base station that is communicating with a mobile is known as its serving eNB.
<- là trạm phát sóng điều khiển các thiết bị di động trong phạm vi 1 hoặc nhiệu cell.
- serving eNB: trạm điều khiển đang giao tiếp với thiết bị.>
E-UTRAN Evolved UMTS/Universal Terrestrial Radio Access Network is the air interface of 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE) upgrade path for mobile networks.
<là giao diện của lộ trình nâng cấp LTE của 3GPP cho mạng di động>
EPC Evolved Packet Core is the core network
MME Mobility Management Entity controls the high-level operation of the mobile by means of signaling messages and HSS
<điều khiển hđ cấp cao của tb di động bằng các bản tin báo hiệu và HSS>
S-GW Serving Gateway - is used to handle data transmission packets on mobile networks.
< Định tuyến và chuyển tiếp IP; Lọc gói dựa trên mỗi SDF / Mỗi người dung; Phân bổ địa chỉ IP UE; Neo di động giữa 3GPP và không phải 3GPP; Chức năng PCEF; Sạc theo SDF/mỗi người dùng>
P-GW Packet Gateway - Connect EPC and PDN
HSS Home Subscriber Serve - component has been carried forward from UMTS and GSM and is a central database that contains information about all the network operator's subscribers.
<là thành phần đã được chuyển tiếp từ UMTS và GSM là cơ sở dữ liệu chứa tất cả các thuê bao của nhà mạng>
PCRF Policy Control and Charging Rules Function - is the policy and charging control entity. make policy decisions for SDFs and provide the PCC rules to the PCE
<là chính sách và thực thể kiểm soát cước đưa ra quyết định chính sách cho SDF và cung cấp các quy tắc PCC cho PCEF>
SPR Subscriber Profile Repository - Provides subscription information (access profile per subscriber) to the PCRF. Receiving the information, the PCRF perform subscriber-based policy and creates PCC rules.
<cung cấp thông tin đăng ký cho PCEF; nhận thông tin <PCEF thực hiện chính sách dựa trên người đăng ký và tạo quy tắc PCC>>
OCS Online Charging System - provides real-time credit control. charging functions based on volume, time, events.
<Cung cấp kiểm soát tín dụng theo thời gian thực Chức năng sạc dựa trên khối lượng, thời gian, sự kiện>
OFCS OFfline Charging System - provides CDR-based charging information
<cung cấp thông tin sạc dựa trên CDR1.>
LTE Protocol Stacks side UE
NAS ESM It is responsible for managing data service connection sessions, such as data transmission over cellular networks.
<chịu trách nhiệm quản lý các phiên kết nối dịch vụ dữ liệu, chẳng hạn như truyền dữ liệu qua mạng di động.>
EMM manages events related to mobile device movement in the network, device authentication, network state management (such as standby and connection mode) and changes change another state when the mobile device changes its location or state
<quản lý các sự kiện: chuyển động thiết bị di động trong mạng, xác thực thiết bị, quản lý trạng thái mạng (như chế độ chờ và kết nối) và thay đổi trạng thái khác khi thiết bị di động thay đổi vị trí hoặc trạng thái>
RRC RRM Radio resource management: Establish connection, Manage and control wave resources
<Quản lý tài nguyên vô tuyến: Thiết lập kết nối, Quản lý và kiểm soát tài nguyên sóng>
PDCP PDCP handles header compression, encryption, and integrity protection of user data.
<xử lý nén header, mã hóa, và bảo vệ toàn vẹn dữ liệu người dùng>
RLC RLC is responsible for segmentation and reassembly of data block, error correction, and flow control.
<tách đoạn, ghép nối lại khối dữ liệu, sửa lỗi, và kiểm soát luồng>
MAC MAC controls how the radio resource are shared among different UEs, managing scheduling and multiplexing.
<kiểm soát cách tài nguyên vô tuyến được chia sẻ giữa các UE khác nhau, quản lý lịch trình và bội âm.>
PHY The PHY layer is responsible for converting binary data into radio signals and vice versa. It handles modulation, coding, and transmission over air.
<chuyển đổi dữ liệu nhị phân thành tín hiệu vô tuyến và ngược lại. Nó xử lý điều chế, mã hóa, và truyền qua không khí.>
EMM
EMM - EPS mobility management
Common definition
Definition Purpose
IMEI International Mobile Station Equipment Identity is a unique number be allocated to each individual mobile station equipment.
<là một số duy nhất được phân bổ cho mỗi thiết bị trạm di động riêng lẻ.> The main objective is to be able to take measures against the use of stolen equipment or against equipment of which the use in the PLMN cannot or no longer be tolerated for technical reasons.
< có thể thực hiện các biện pháp chống lại việc sử dụng thiết bị bị đánh cắp hoặc chống lại thiết bị mà việc sử dụng PLMN không thể hoặc không còn được dung thứ vì lý do kỹ thuật.>
Attach APN Access Point Name is a kind of Gateway (or Anchoring point) to which the UE get attached (combination of UE setting (for request) and Network configuration)
< là một loại Gateway (hoặc Anchoring point) mà UE được đính kèm (kết hợp cài đặt UE (cho yêu cầu) và cấu hình mạng)> To get access to the core network for most of the data service.
< Để có được quyền truy cập vào mạng cốt lõi cho hầu hết các dịch vụ dữ liệu.>
GUTI The Globally Unique Temporary UE Identity (GUTI) provides an unambiguous identification of the UE that does not reveal the UE or the user's permanent identity in the EPS. It’s a temporary identifier used to enhance user privacy and security during communication between a mobile device and the network.
Khi attach request gửi GUTI như 1 mã
<cung cấp một nhận dạng rõ ràng về UE không tiết lộ UE hoặc danh tính vĩnh viễn của người dùng trong EPS. Đó là một định danh tạm thời được sử dụng để tăng cường quyền riêng tư và bảo mật của người dùng trong quá trình liên lạc giữa thiết bị di động và mạng.> To prevent the exposure of the long-term IMSI to the network, which helps protect user identity and location information.
< Để ngăn chặn sự tiếp xúc của IMSI dài hạn với mạng, giúp bảo vệ danh tính người dùng và thông tin vị trí >
IMSI International Mobile Subscriber Identity is a unique number used to identify individual mobile subscribers in a cellular network.
It is stored as a 64-bit field and is sent by the mobile device to the network.
<là một số duy nhất được sử dụng để xác định các thuê bao di động cá nhân trong một mạng di động. Nó được lưu trữ như một trường 64-bit và được gửi bởi thiết bị di động đến mạng.> To facilitate the proper routing of calls, messages, and data to the correct user and to enable authentication and security protocols within the network.
<Để tạo điều kiện cho việc định tuyến thích hợp các call, mesages, và data cho người dùng chính xác và cho phép xác thực và các giao thức bảo mật trong mạng.>
EMM EPS Mobility Management manages events related to mobile device movement in the network, device authentication, network state management (such as standby and connection mode) and changes change another state when the mobile device changes its location or state.
< EMM quản lý các sự kiện liên quan đến chuyển động thiết bị di động trong mạng, xác thực thiết bị, quản lý trạng thái mạng (như chế độ chờ và kết nối) và thay đổi trạng thái khác khi thiết bị di động thay đổi vị trí hoặc trạng thái.> The main functionality of providing mobility service to User Equipment, that means to provide a mechanism to keep track of UEs whereabouts in a network.
<chức năng chính của việc cung cấp dịch vụ di động cho thiết bị người dùng, có nghĩa là cung cấp một cơ chế để theo dõi nơi ở của UEs trong một mạng.>
MME Mobility Management Entity is the main signaling node in the EPC
< nút tín hiệu chính trong EPC> responsible for initiating paging and authentication of the mobile device.
< MME chịu trách nhiệm bắt đầu tìm kiếm và xác thực thiết bị di động.>
NAS NAS is a functional layer in LTE mobile network architecture.
< NAS là một lớp chức năng trong kiến trúc mạng di động LTE.>
To manage the signaling and control plane communications between the UE or device and the Core Network.
< Để quản lý các tín hiệu và điều khiển thông tin liên lạc máy bay giữa UE hoặc thiết bị và Core Network.>
TAC Tracking Area Code is the unique code (consisting of 16 bits) To distinguish different TAs (cells or eNBs)
< nhiều eNBs quản lý bởi MME dùng chung 1 TAC;
nếu TAC ko được update thì NW không biết thiết bị đang ở khu vực nào >
TAI Tracking Area Identifier is a globally unique tracking area identifier, made up of the Public Land Mobile Network and the TAC.
<là một định danh khu vực theo dõi duy nhất trên toàn cầu, được tạo thành từ PLMN và TAC.> The Tracking Area identity is the identity used to identify tracking areas.
< là danh tính được sử dụng để xác định vùng theo dõi.>
MCC/MNC Mobile Country Code consisting of three digits identifies uniquely the country of domicile of the mobile subscriber.
<bao gồm ba chữ số xác định duy nhất quốc gia thân thiện của thuê bao di động.>
Mobile Network Code consisting of two or three digits identifies the home Public Land Mobile Network of the mobile subscriber.
<bao gồm ba chữ số xác định duy nhất quốc gia thân thiện của thuê bao di động.>
TMSI Temporary Mobile Subscriber Identities
<Danh tính thuê bao di động tạm thời> TMSI is allocated to mobile subscribers by VLRs, SGSNs, and MME in order to support the subscriber identity confidentiality
< được phân bổ cho thuê bao di động bởi VLRs, SGSNs, và MME để hỗ trợ bảo mật danh tính thuê bao>
Voice domain prefer The voice domain preference for E-UTRAN
<preference voice domain cho E-UTRAN> shows whether UE is configured as one of below:
+ CS Voice only,
+ CS Voice preferred and IMS PS Voice as secondary,
+ IMS PS Voice preferred and CS Voice as secondary, or
+ IMS PS Voice only.
EMM states
<ts_124301-5.1.3.2>
EMM state
<ts_124301-5.1.3.2> EMM-NULL <flight mode>
EMM-DEREGISTERED < INITIATED > khi tbi chưa đăng ký với mạng hoặc đã hủy đăng ký.
EMM-REGISTERED < INITIATED > khi tbi đăng ký thành công với mạng.
EMM-IDENTITY-REQUEST-INITIATED
EMM-TRACKING-AREA-UPDATING-INITIATED
EMM-ATTACH-INITIATED
EMM-DETACH-INITIATED
EMM-SERVICE-REQUEST-INITIATED
Attach
< Initial Attach , spec >
Procedure
Attach with IMSI
Attach with GUTI
Known UE (MME viewpoint)
Unknown UE (MME viewpoint)
MME Changed
MME Unchanged
Attach Request (IMSI)
Attach Request (GUTI) 2 types of attach requests: GUTi and IMSI. IMSI request when attach new sim
Identification Request to Old MME (GUTI) UE send an identity request and receive a response containing information: mobile identity - IMSI, MCC (Viet Nam 452), MNC (Mobifone 01)
Identity Request to UE (IMSI)
Authentication (IMSI) UE send an authentication request and receive a response containing the information: RAND value, AUTN value, AMF, MAC
NAS Security Setup containing security mode command and security mode complete
Location Update (New MME) update location if new MME
EPS Session Establishment containing request and reponse Notification of Successful Session Registration
Purpose of Attach procedure
by a UE in PS mode of operation to attach for EPS services only;
by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services;
by a UE supporting NB-S1 mode only in PS mode of operation to attach for EPS services and "SMS only";
to attach for emergency bearer services;
an attach for access to RLOS.
When UE need trigger attach procedure (spec)? Type (EPS only, combination, Emergency call)?
EPS attach: indicate the attach for EPS services only
Combined EPS/IMSI attach: indicate the attach for both EPS and non-EPS services
EPS emergency attach: indicate the attach for emergency bearer services
Casue attach
Cause Actions
6 Illegal ME:
7 EPS services not allowed:
10 Implicitly detached:
11 PLMN not allowed:
14 EPS services not allowed in this PLMN:
15 No suitable cells in tracking area:
Diagram: New SIM
Service request
Purpose
- to transfer the EMM mode from EMM-IDLE to EMM-CONNECTED mode.
<chuyển mode của EMM từ IDLE sang CONNECTED>
- to invoke MO/MT CS fallback or 1xCS fallback procedures.
<gọi các procedures fallback-dự phòng MO/MT CS hoặc 1xCS>
- when the UE is not using EPS services with control plane CIoT EPS optimization: to establish the radio and S1 bearers when user data or signaling is to be sent.
<với trường hợp UE k sử dụng các EPS services …. Để thiết lập song … Khi dữ liệu hoặc tín hiệu của người dung được gửi đi>
- when the UE is using EPS services with control plane CIoT EPS optimization: use for UE initiated transfer of user data via the control plane.
<với th UE sử dụng … sử dụng để truyền dữ liệu người dung do UE khởi tạo thông qua mặt phẳng điều khiển>
Service request procedure
Network
Has [downlink] / [downlink cdma2000®] signaling pending
UE
Has [uplink] / [uplink cdma2000®] signaling pending
Has to request resources for [ProSe direct discovery] / [Prose direct communication] / [V2X communication over PC5]
Mode EMM-IDLE: the UE or the network has user data pending
Mode EMM-CONNECTED and has a NAS signaling connection only: the UE is using EPS services with control plane CIoT EPS optimization, and it has user data pending which is to be transferred via user plane radio bearers;
Mode EMM-IDLE or EMM-CONNECTED: has requested to perform mobile originating/terminating CS fallback or 1xCS fallback
Mode EMM-IDLE and is MUSIM UE: requests the network to remove the paging restriction or to indicate to the network that the MUSIM UE requests the release of the NAS signaling connection or reject paging
Type of request <UE send to Network> Type (initial, Ecall)? (detail clear request)
Service request: to request the establishment of a NAS signalling connection and of the radio and S1 bearers
<để yêu cầu thiết lập kết nối tín hiệu NAS và của các đài phát thanh và bearers S1>
Extended service request:
to initiate a CS fallback or 1xCS fallback call or respond to a mobile terminated CS fallback or 1xCS fallback request from network;
< để bắt đầu một cuộc gọi dự phòng CS hoặc 1xCS hoặc trả lời một cuộc gọi dự phòng CS đã chấm dứt di động hoặc yêu cầu dự phòng 1xCS từ mạng;>
to request establishment of a NAS signalling connection and of radio and S1 bearers for packet services, if UE needs to provide additional information that cannot be provided via a SERVICE REQUEST
< yêu cầu thiết lập kết nối tín hiệu NAS và các bộ phát thanh và S1 cho các dịch vụ gói tin, nếu UE cần cung cấp thêm thông tin không thể cung cấp thông qua một REQUEST SERVICE>
Send Request when … SR
ESR
A The UE in EMM-IDLE mode receives a paging request with CN domain indicator set to "PS" from the network X X
B The UE, in EMM-IDLE mode, has pending user data to be sent X X
C The UE, in EMM-IDLE mode, has uplink signalling pending X X
D The UE in EMM-IDLE or EMM-CONNECTED mode is configured to use CS fallback and has a mobile originating CS fallback request from the upper layer X
E The UE in EMM-IDLE mode is configured to use CS fallback and receives a paging request with CN domain indicator set to "CS", or the UE in EMM-CONNECTED mode is configured to use CS fallback and receives a CS SERVICE NOTIFICATION message X
F The UE in EMM-IDLE or EMM-CONNECTED mode is configured to use 1xCS fallback and has a mobile originating 1xCS fallback request from the upper layer X
G The UE in EMM-CONNECTED mode is configured to use 1xCS fallback and accepts cdma2000® signalling messages containing a 1xCS paging request received over E-UTRAN X
H The UE, in EMM-IDLE mode, has uplink cdma2000® signalling pending to be transmitted over E-UTRAN X X
I The UE, in EMM-IDLE or EMM-CONNECTED mode, is configured to use 1xCS fallback, accepts cdma2000® signalling messages containing a 1xCS paging request received over cdma2000® 1xRTT, and the network supports dual Rx CSFB or provide CS fallback registration parameters X
J The UE, in EMM-IDLE or EMM-CONNECTED mode, has uplink cdma2000® signalling pending to be transmitted over cdma2000® 1xRTT, and the network supports dual Rx CSFB or provide CS fallback registration parameters X
K The UE performs an inter-system change from S101 mode to S1 mode and has user data pending X X
Cause service request
Cause Actions
10 Implicitly detached:
UE in CS/PS mode 1 or CS/PS mode 2 is IMSI detached for both EPS services and non-EP services.
+ UE enter the state EMM-DEREGISTERED.NORMAL-SERVICE, delete mapped EPS security
+ If service request was initiated for CS fallback and a CS fallback cancellation request was not received, UE finds a suitable GERAN or UTRAN cell
+ If service request was initiated for 1xCS fallback, UE select cdma2000® 1x radio access technology with appropriate cdma2000® 1x CS procedures
+ If service request was initiated for 1xCS fallback and UE has dual Rx/Tx configuration and supports enhanced 1xCS fallback, UE perform a new attach procedure
+ If service request was initiated for any reason other than CS fallback, 1x CS fallback or initiating a PDN connection for emergency bearer services, UE perform a new attach procedure
11 PLMN not allowed:
+ UE set the EPS update status to EU3 ROAMING NOT ALLOWED, delete any GUTI, last visited registered TAI, TAI list, delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH
+ UE store the PLMN identity in the "forbidden PLMN list"
+ UE find another PLMN
15 No suitable cells in tracking area:
+ UE enter the state EMM-REGISTERED.LIMITED-SERVICE
+ UE store the current TAI in the list of "forbidden tracking areas for roaming", remove the current TAI from the stored TAI list
+ If service request was initiated for CS fallback and a CS fallback cancellation request was not received, UE finds a suitable GERAN or UTRAN cell
+ If service request was not initiated for mobile originated CS fallback, UE search for a suitable cell in another tracking area
Diagram: Send SMS
Using SG interface
<truyền tải các thông điệp kiểm soát và tín hiệu giữa trạm eNB và các thành phần khác của mạng: MME và S-GW>
Step 1: Cấu hình lại kết nối RRC
Step 2: Hoàn tất cấu hình lại kết nối RRC
Step 3: Uplink NAS transport – SMS message – CP Data
Step 4: Downlink NAS transport – nhúng CP-ACK vào message
Step 5: Downlink NAS transport – Delivery Report
Step 6: Uplink NAS transport – CP-ACK
Tracking area update
Purpose
helps the MME to know the location of the UE when the UE moves to the new TA
Note:
UE will trigger TAU after UE completes Attach Procedure.
UE can trigger TAU in RRC Idle state or RRC Connected state, but the procedure will only end when the UE is in RRC Connected State.
When trigger
UE moves to a new Tracking Area.
The Periodic update timer T3412 expired. The value of T4312 is in the attach accept message.
Registering with the Non EPS services (CS Domain) when the UE is already attached for EPS services.
Re-Registering to LTE after CS fallback.
MME load balancing
When UE changes the UE specific DRX parameter;
Normal TAU: When UE enters a tracking area that is not in the list of tracking areas in MME that the UE has currently registered.
Combined TAU: When the UE is operating in CS/PS and enters a tracking area that is not in the list of tracking area in MME that the UE has currently registered.
Periodic TAU: Upon expiry of T3412, Periodic TAU procedure is initiated to notify the availability of UE to network.
Message type
REQUEST
UE will initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME.
Some of the IE’s included are:
EPS update type: It will be based on the first 3 bits
Old GUTI
Additional update type:
If the bit is 0, then no additional update type.
If the bit is 1, then it is SMS.
Last Visited Registered TAI
Device properties
EPS update type
001 - combined TA/LA updating
combined TA/LA updating with IMSI attach
periodic updating
TA updating
ACCECPT
If the Tracking Area Update Request has been accepted by MME, then MME will send Tracking Area Update Accept to UE.
Below are some of the IE’s that will be sent:
T3412 value
GUTI: If this value is present, then UE will use this GUTI for EPS services and store the new GUTI.
TAI list
Equivalent PLMNs 5. EPS bearer context status
COMPLETE:
Tracking Area Update Complete will be sent by UE to MME as a response to Tracking Area Update Accept.
REJECT:
MME will send Tracking Area Update Reject if Tracking Area Update cannot be accepted by MME.
Cause service request
Cause Actions
6 Illegal ME:
7 EPS services not allowed:
10 Implicitly detached:
If the MME locally deactivates EPS bearer contexts for the UE and no active EPS bearer contexts remain for the UE, the MME shall send the TRACKING AREA UPDATE REJECT message including the EMM cause value #10 "implicitly detached"
11 PLMN not allowed:
EMM send a TRACKING AREA UPDATE REJECT message to UE.
The chosen PLMN identity shall be stored in the "forbidden PLMN list" and if the UE is configured to use timer T3245 then the UE shall start timer T3245
14 EPS services not allowed in this PLMN:
15 No suitable cells in tracking area:
UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message.
UE shall remove the current TAI from the stored TAI list if present and UE shall search for a suitable cell in another tracking area or in another location area.
Diagram: TAU
ESM
ESM - EPS session management
Common definition
ESM: supports all aspects of signalling for PDN (Packet Data Network) session management, such as EPS Bearer Activation and Modification. ESM messages that setup and manage the EPS bearer
SRB: Signalling Radio Bearer is the control data transmission channel between the UE and the eNB
<là kênh truyền dữ liệu điều khiển giữa UE và eNB>
Transmitting control data that maintains or ends network access
<truyền các dữ liệu điều khiển duy trì hoặc kết thúc truy cập mạng giữa UE và eNB>
DRB: Data Radio Bearer is used to carry the data associated with an ESP bearer
<là kênh truyền các gói dữ liệu giữa UE và eNB>
transports the packets of an EPS bearer
<truyền các gói tin của EPS bearer giữa UE và eNB >
APN (PDN ID): is an identifier that lives in the LTE core network, otherwise known as the Evolved Packet Core (EPC)
<là mã định danh trong core network 4G>
PDN Identify = APN = APN.NI + APN.OI (variable length)
Network Identifier (NI) and Operator Identifier (OI)
Each PDN connection (or EPS session) is represented by an IP address of the UE and a PDNID ~ APN
~PDN_ID, nó cùng với ID của UE tạo nên 1 mã định danh cho mỗi kết nối PDN (EPS session, phiên).
EPS session is the IP connection between the UE and the PDN.
<là 1 phiên kết nối giữa UE và PDN> mỗi session gắn với 1 PDN và đi ra mỗi gateway khác nhau
Setting up the EPS session means:
i) a PDN through which the user will use the selected service (according to user input or based on registration information provided by HSS),
ii) has the IP address used in the PDN been assigned to the user,
iii) policy rules to be applied to selected user IP packets (QoS and charging rules)
iv) a default EPS bearer channel for delivering IP packets over the established LTE network. Through this EPS session established, IP packets can be exchanged between the user and the PDN according to the rules set by the operator.
EPS bearer is a pipe through which IP packets are delivered over the LTE network, i.e., between a UE and a P-GW (UE – eNB – S-GW - P-GW)
<Chỉ 1 kênh hoặc luồng dữ liệu được bảo vệ bởi ESP>
EPS bearer ID: Is an identifier, different EPS bearers are identified by their EPS bearer ID, which is allocated by an MME
<là mã định danh cho mỗi EPS bearer>
Default EPS bearer: EPS bearer, gets established when UE connects to PDN, remains connected, until UE detaches from network. Even when there is no user traffic to send, default EPS bearer always stays activated and ready for possible incoming user traffic
<>
Dedicated EPS bearer: EPS bearer, can be established if default EPS bearer itself is not sufficient or for other purposes, multiple dedicated bearers can be created if required by UE or network. When there is no user traffic, these dedicated EPS bearers can be removed. Each PDN must have one default EPS bearer, but may have none to many dedicated EPS bearers.
<>
QCI: QoS Class Identifier is a special indentifier defining the quality of packet communication provided by LTE.
The specific QCI value is allocated for each UE and is informed to UE via 'Activate default EPS bearer context request' message as shown below
PDN gateway: The P-GW serves as an ingress and egress point to the EPC from a PDN (Packet Data Network) such as the Internet. The PDN Gateway performs policy enforcement, packet filtering for each user, charging support, lawful interception and packet screening.
QoS: Quality of service (QoS) refer to the measurement of the overall performance of a service experienced by the users of the network.
To quantitatively measure the QoS packet loss, bit rate, throughput, transmission delay, availability, jitter, etc. related aspects of service are considered.
QoS parameter:
QCI (QoS Class Identifier): int 1-9 QoS performance characteristics
ARP (Allocation and Retention Priority): an integer ranging from 1 to 15, with 1 being the highest level deciding whether to create a new EPS bearer or not
GBR (Guaranteed Bit Rate): bandwidth (bit rate) to be guaranteed or not
MBR (maximum bit rate): packets arriving at the bearer after the specified MBR is exceeded will be discarded
APN-AMBR (Access Point Name - Aggre): In case of non-GBR bearers, it is the total bandwidth of all the non-GBR EPS bearers in a PDN that is limited, not the individual bandwidth of each bearer
UE-AMBR: maximum bandwidth allowed for all the non-GBR EPS bearers associated to the UE no matter how many PDN connections the UE has
PDN establishment
Overview
Definition
Purpose
To request the setup of a default EPS bearer to a PDN.
The UE requests connectivity to a PDN by sending a PDN CONNECTIVITY REQUEST message to the network. If accepted by the network, this procedure initiates the establishment of a default EPS bearer context.
Address type
IPv4
IPv6
IPv4v6
Non-IP
unused; shall be interpreted as "IPv6" if received by the network
Request type
Initial request
Emergency
Handover
Handover of emergency bearer services
Procedure
Diagram: HO WIFI to LTE
Bearer
Overview
Definition
Purpose
Type
Default bearer
Dedicated bearer
Procedures
Bearer resource allocation
is for a UE to request an allocation of bearer resources for a traffic flow aggregate. The UE requests a specific QoS demand (QCI) and optionally sends a GBR requirement for a new traffic flow aggregate.
<Quá trình cấp phát tài nguyên mạng cho các kết nối dữ liệu <bearer> giữa UE và eNB, Đảm bảo việc truyền tải dữ liệu hiệu quả và đáng tin cậy>
Bearer resource modification
request a modification;
release of bearer resources for a traffic flow aggregate;
modify a traffic flow aggregate by replacing packet filters or adding packet filters
re-negotiate header compression configuration associated to an EPS bearer context;
indicate a change of 3GPP PS data off UE status for a PDN connection; or
transmit information for the C2 authorization for the UAS services.
<Thay đổi tài nguyên mạng mà 1 kết nối dữ liệu <bearer> đang sử dụng để truyền tải dữ liệu để đáp ứng yêu cầu của dịch vụ.>
VoLTE
Common definition
Definition Purpose
SIP message SIP - Session Initiation Protocol; is a protocol that establishes, modifies, and terminates multimedia sessions over the Internet
<là giao thức có nhiệm vụ: establishes, modifies, and terminates multimedia sessions qua mạng> SIP uses Uniform Resource Identifiers (URIs) to identify the participants of a session, and Session Description Protocol (SDP) to describe the media capabilities and parameters.
SIP can also use other protocols, such as Real-time Transport Protocol (RTP), to carry the media streams.
IMS service IMS - IP Multimedia Subsystem; IMS defines different profiles and interfaces for different types of services and devices, such as Voice over IP (VoIP), Video over IP (VoIP), or Rich Communication Services (RCS).
<định nghĩa profiles và interfaces khác nhau cho các thiết bị và dịch vụ khác nhau. Vd: VoIP, RCS> IMS uses SIP as the main signaling protocol, but also relies on other components, such as Home Subscriber Server (HSS), Call Session Control Function (CSCF), and Media Resource Function (MRF).
VoLTE Voice over LTE; is a service that allows users to make and receive voice calls over the LTE network, using IMS as the core network and SIP as the signaling protocol VoLTE uses a dedicated bearer for voice traffic, which ensures a low latency and a high quality of service.
VoLTE also supports features such as call waiting, call forwarding, or conference calling.
PS domain Packet Switched;
The LTE architecture builds entirely on the PS domain and has no CS domain of 2G/3G. the PS domain provides data services (such as Internet access)
CS domain Circuit Switched; The CS domain deals with voice services (such as telephony)
VoLTE Codecs Nén và giải nén dữ liệu âm thanh hoặc video quá trình truyền tải
Voice preference:
IPC process:
Call drop: mất bearer, mute trong 20s<RPP time out>, mất data ở 1 trong số các layer => check lần lượt các layer
IMS Registration
Once the UE attaches to the 4G network and the default EPS bearer is created successfully with the IMS APN, the UE registers to the IMS network before accessing the VoLTE service.
<sau khi UE kết nối mạng LTE và default EPS bearer được tạo ra với IMS APN UE sẽ đăng ký mạng IMS trước khi truy cập vào dịch vụ VoLTE>
SIPRegistration 1st attempt
Registration 2nd attempt
SIP registration field
<23.228 5.2.2.3> <24.229 5.1.1.2> <Registration> <Basic Form>
Public/Private User Identity
Home network domain name
UE IP address
Instance Identifier
GRUU Support Indication
SIP message
SIP Request Description Definition
INVITE Why: Calling (A) Party informs IMS Network & B Party user about New Call
How: SDP (Session Description Protocol) is used for Carrying & Negotiating Media Information such Bandwidth & Codec
Parameters <A Party, B Party, SDP offer> RFC 3261
ACK Confirms that the client has received a final response to an INVITE request
BYE Terminates a call; can be sent by either the caller or the called party
CANCEL Cancels any pending request
OPTIONS Queries the capabilities of servers
PRANK What: Provisional Response ACK to 183 Session Progress Message received
<là phản hồi tạm thời về việc nhận được 183> RFC 3262
SUBSCRIBE Subscribes to event notification RFC 3265
NOTIFY Notifies the subscriber of a new Event
UPDATE Modifies the state of a session without changing the state of the dialog. RFC 3311
MESSAGE Transports instant messages using SIP RFC 3428
REFER Asks recipient to issue a SIP request (call transfer) RFC 3515
PUBLISH Publishes an event to the Server RFC 3903
INFO Sends mid-session information that does not modify the session state RFC 6086
SIP Call Flow <link>
Messages Direct
<IMS B> Description
SIP INVITE message AIMS A thông báo cho IMS rằng B có cuộc gọi mới
Params <A, B, new call>
SIP 100 Trying A IMS Why: để A tránh bị gửi lại INVITE
How: B sẽ phản hồi ngay lập tức khi nhận được INVITE từ A;
SIP 183 Progress SDP A IMS Why: Tạo ra dedicated bearer trên cả A và B trên mạng <voice bearer QCI=1>; B thông báo cho A về Codec supported và chỉ ra các precondition không được đáp ứng.
How: SDP answer được gửi tới A <có: Codec supported> từ B
SIP PRACK A IMS A phản hồi <Final Selected Codec> tới B rằng đã nhận được 183… cho quyết định “voice call” thông qua lần offer thứ 2
SIP 200 OK (PRACK) A IMS B xác nhận rằng PRACK có Final Selected Codec
SIP UPDATE SDP A IMS A điều chỉnh các thông số hoặc thuộc tính <băng thông, Codec, delay> của cuộc call nhằm tránh khỏi việc phải chấm dứt rồi thiết lập lại call.
SIP 200 OK (UPDATE) A IMS B cũng thực hiện điều chỉnh theo A và gửi phản hồi lại cho A.
SIP 180 Ringing A IMS Tất cả precondition đều đã được đáp ứng.
IMS phản hồi 183 <thông báo rằng cuộc call đang được gọi và B đang đổ chuông>
SIP 200 OK (INVITE) A IMS Thông báo rằng B trả lời cuộc call
Khi A nhận được 200 OK, A sẽ cấp phát tài nguyên media để thực hiện cuộc call
SIP ACK A IMS Xác nhận B đã nhận được phản hồi cuối cùng Cuộc call đã được thực hiện.
voice traffic từ B truyền qua dedicated bearer tới A
EPS bearer establish <VoLTE> and when trigger
<link>
Default EPS bearer:
This Default bearer is Established during LTE Attach
It Allocate IP address to UE
Default EPS Bearer is used for Always connected bearer:
Internet Connectivity (QCI: 6-9)
SIP Signaling Connectivity (QCI: 5)
Dedicated EPS bearer:
Dedicated is Child Bearer which is Established during call
There is No IP Address Allocated to this bearer, It uses IP address of Parent which is allocated to Default Bearer
Linked to particular Default EPS Bearer
This has a specific QoS which is usually guaranteed
Used for On-Demand bearer for:
Voice Call (QCI: 1)
Video Call (QCI: 2)
5G
Overview
Definition
Thế hệ mạng không dây mới (thứ 5)
Provides some key services:
Enhanced Mobile Broadband (eMBB) <Hướng đến người dùng tốc độ nhanh hơn, băng thông rộng hơn>
Critical Communications (CC) and Ultra Reliable and Low Latency Communications (URLLC) <hướng đến xe tự lái>
Massive Internet of Things (mIoT) <phục vụ nhiều thiết bị hơn>
Flexible network operations <Nhà mạng có thể triển khai nhiều dịch vụ hơn>
Options for 5G deployment
Non-Stand-alone
Stand-alone
Icon
3 tham số quyết định icon:
RestrictDCNR: Restriction on the use of dual connectivity with NR (RestrictDCNR) (octet 4, bit 6). This bit indicates if the use of dual connectivity with NR is restricted or not.
UpperLayerIndication-r15: this parameter indicates whether the UE supports 5G NSA option 3 (eNB is master cell) or not
Secondary cell group bearer (SCG bearer):
5G icon display concept: activate / in-activate
Config A: 5G Icon is displayed only when NR is connected (Bearer status (5G) && SIB2 contains ULI && RestrictDCNR is FALSE)
Config B: In idle mode, display 5G icon if (SIB2 contains ULI && RestrictDCNR is FALSE). In Connected mode, display 5G icon if (Bearer status(5G) && SIB2 contains ULI && RestrictDCNR is FALSE).
Config C: Based on detection of NR coverage, icon is decided in both Idle/Connected. If NR coverage detected, then whether 5G is added or not, 5G is displayed. In Idle/Connected state, display 5G icon if(SIB2 contains ULI && RestrictDCNR is FALSE && NR Coverage detected)
Config D: In Idle/Connected, display 5G if(SIB2 contains ULI && RestrictDCNR is FALSE).
5G QoS:
NSA
Non-Stand Alone
Phục thuộc vào core 4G, cần có mạng 4G để có thể hoạt động được
Tốc độ truyền tải nhanh hơn tốn pin hơn
Components
eNB: LTE base station; it continues to play a crucial role 5G NSA deployments by connecting to the 5G NR
gNB: 5G new radio base station; it communicates with the eNB for control and user data during the initial phase of 5G rollout
Core network: 4G EPC (Evoled Packet Core) and 5G core
User Equipment: devices connect to network
2 types of data that UE exchanges with Base station:
C-plane: truyền tín hiệu điều khiển radio; chỉ truyền qua Master cell
U-plane: truyền dữ liệu tốc độ cao ex: Youttube, …; có thể truyền qua cả 2 loại cell
Dual Connectivity
UE giao tiếp với 2 trạm BTS
Macro/master cell:
Tần số thấp (800MHz ~ 2.5GHz),
vùng phủ rộng
Small/secondary cell:
Tần số cao (3GHz ~ 6GHz)
băng thông rộng
Activation/de-activation procedure
SCG failure
4 reason
SCG radio link failure
failure of SCG reconfiguration with sync
SCG configuration failure for RRC message on SRB3
SCG integrity check failure, and consistent uplink LBT failures on PSCell for operation with shared spectrumchannel access.
Purpose: thông báo cho E_UTRAN hoặc NR MN rằng UE đã gặp phải SCG failure
RACH
SplitBearer
Definition
In Dual Connectivity, a bearer which is transmitted and received via both the master and secondary base stations.
Split bearer is the function that allow the split of data going to gNB from the core side into two paths.
One path is the 1st path through the 5G air interface toward the UE.
And the 2nd path is X2 interface with the anchored eNodeB.
Purpose
So in split bearer UE receiving the data from two paths simultaneously.
The aim of split bearer is to utilize the radio resources in case of multi carriers to improve the UE throughput.
The Main difference between CA and DC is the CA can be implement between between different carriers of same cells but in case of DC is is implemented between different carriers of two different cells.
In case of CA there will be only one C-RNTI and but in case of DC the UE have two C-RNTI one for MCG and one for SCG and get asperated PUCCH resources.
Layer in charge of split bearer: PDCP
The process data through gets split
Pick a logical channel specified by LogicalChannelIdentity specified by RRC. <lựa chọn kênh logic>
Estimate how much data the UE has to transmit (this process is tightly related to the data volumn calculation in BSR process). <Ước tính lượng dữ liệu truyền đi từ UE>
Based on the estimated data volumn, UE need to determine whether it need split or not. <xác định có cần phân chia hay không>
Once it is decided to split the data, now it has to determine how much portions of the data to be transmitted through each cell. <Xác định số phần cần chia>
RRC Parameters
CellGroupId - The IE CellGroupId is used to identify a cell group. 0 identifies the master cell group. Other values identify secondary cell groups. In Jun 2018 Specification, only values 0 and 1 are supported.
LogicalChannelIdentity - LogicalChannelIdentity is used to identify one logical channel (LogicalChannelConfig) and the corresponding RLC bearer (RLC-BearerConfig).
ul-DataSplitThreshold - Indicates the threshold value for uplink data split operation specified in TS 36.323. Value b100 means 100 Bytes, b200 means 200 Bytes and so on. E-UTRAN only configures this field for split DRBs.
SA
Stand Alone
Stand Alone
Registration
Overview
Type value (3bits)
1 = initial registration: when UE powers on or enter a 5G SA network’ coverage area.
2 = mobility registration updating:
3 = periodic registration updating: After the initial registration, UE need to periodically re-register with the network to maintain its connection. It is performed to update the network with the UE’s current location and status.
4 = emergency registration: To connect to the network for emergency calls or services.
6 = reserved
When trigger:
when the UE performs initial registration for 5GS services (airplane mode off, power on, …)
when the UE enters new tracking area
mobility from 4G
Registration Request Structure
Elements
<Trường dữ liệu lớn> Description
<Mô tả>
Registration type
Mobile Identity
5GMM capability
UE network capability
UE’s usage setting
5GS update type
Procudures
Diagram signalling
When UEs power on or enters a new 5G SA network’s coverage area, it initiates an initial attach procedure by sending an “Registration request” to the gNB (5G core).
5G core authentication the UE by verifying its credentials, such as the International Mobile Subscriber Indentity (IMSI) or other identifiers.
The 5G core establishes secure communication channels with the UE using encryption and integrity protection.
When 5G core completes the necessary processing and verifiers the UE’s credentials, it sens a “Registration accept” message back to the UE.
Cause reject
<link>
Cause Description
#3
#6
#7 Illegal UE: when NW refuses service to the UE either, because:
an identify of the UE is not acceptable to the NW; or
UE does not pass the authentication check.
Illegal ME: ME is not acceptable to the NW
5GS services not allowed
Consider the USIM as invalid (until switch off the UICC containing the USIM is removed)
Delete: the list of quivalent PLMSs and enter the state 5GMM-DEREGISTERED
#11 PLMN not allowed: sent to UE when UE request / initiates a de-registration request; and PLMN:
is not allowed to operate
barring: by subscription or due to operator
Delete: list of equivalent PLMNs;
Reset: registration attempt counter; and
Store: PLMN identity in the "forbidden PLMN list"
Enter state: 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection
#12 Tracking area not allowed: sent to UE when UE request / initiates a de-registration request;
Delete: 5G-GUTI, last visited registered TAI, TAI list, ngKSI.
Reset: registration attempt counter
Store: current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and
Enter state: 5GMM-DEREGISTERED.LIMITED-SERVICE.
#13 Roaming not allowed in this tracking area
Delete: 5G-GUTI, last visited registered TAI, TAI list and ngKSI, list of equivalent PLMNs.
Reset: registration attempt counter
Store: current TAI in the list of "5GS forbidden tracking areas for roaming" and
Enter state: 5GMM-DEREGISTERED.LIMITED-SERVICE; or optionally 5GMM-DEREGISTRERED.PLMN-SEARCH
#15 No suitable cells in tracking area: ue find another allowed tracking area in the same PLMN or an equivalent PLMN.
Delete: 5G-GUTI, last visited registered TAI, TAI list and ngKSI, list of equivalent PLMNs.
Reset: registration attempt counter
Store: current TAI in the list of "5GS forbidden tracking areas for roaming" and
Enter state: 5GMM-DEREGISTERED.LIMITED-SERVICE; or optionally 5GMM-DEREGISTRERED.PLMN-SEARCH
search for a suitable cell in another tracking area
#22 Congesion:
If T3346 ≠ 0 and ≠ deactivated in REGISTRATION REJECT message
Else abnormal case
Initial registration procedure, set the “5GS update status” to 5U2 NOT UPDATED and
Enter state: 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.
Stop timer T3346 if it is running
Stays in the current serving cell and applies the normal cell reselection process.
Initial registration procedure if still needed when timer T3346 expires or is stopped.
#27 N1 mode not allowed
Delete: any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
Reset: registration attempt counter
Enter state: 5GMM-NULL.
Disable: N1 mode capability for both 3GPP access and non-3GPP access.
#72 Non-3GPP access to 5GCN not allowed
Delete: 5G-GUTI, last visited registered TAI, TAI list and ngKSI
Reset: registration attempt counter
Enter state: 5GMM-DEREGISTERED.
#73 Serving network not authorized
Reset: the registration attempt counter
Store: the PLMN identity in the "forbidden PLMN list"
Enter state: 5GMM-DEREGISTERED.PLMN-SEARCH
Parameters
GUTI 5G
This is a temporary identifier used in 5G networks to identify a mobile device and its associated subscription information. The 5G-GUTI is used instead of the IMSI to protect the device's identity and provide improved security and privacy.
Parameters:
Mcc: Mobile Country Code (octet 5, octet 6 bits 1 to 4)
The MCC field is coded as in ITU-T Recommendation E.212 [42], annex A.
Mnc: Mobile Network Code (octet 6 bits 5 to 8, octet 7)
AMF Region ID (8 bit) (octet 8)
This field contains the binary encoding of the AMF Region ID. Bit 8 of octet 7 is the
most significant bit and bit 1 of octet 7 is the least significant bit.
AMF Set ID (10 bit) (octet 9, octet 10 bits 7 to 8)
This field contains the binary encoding of the AMF Set ID. Bit 8 of octet 9 is the most
significant bit and bit 7 of octet 10 is the least significant bit.
AMF Pointer (6 bit) (octet 10 bits 1 to 6)
This field contains the binary encoding of the AMF Pointer. Bit 6 of octet 9 is the most
significant bit and bit 1 of octet 9 is the least significant bit
5G TMSI (32 bit) (octet 11 to 14)
Bit 8 of octet 11 is the most significant bit and bit 1 of octet 14 is the least significant
bit
The main difference between 4G GUTI and 5G GUTI
the 5G GUTI contains a temporary identifier (SUCI) that provides enhanced security and privacy features, while the 4G GUTI contains the IMSI which can be used to track a user's location and identity.
Additionally, the 5G GUTI is used to identify the UE within a specific network slice, while the 4G GUTI is used to identify the UE within a specific PLMN.
IMS voice over PS in 5GS network feature support
.... ...1 = IMS voice over PS session indicator (IMS VoPS): Supported
(support different type of voice over NR)
If this value = 1, IMS voice over PS session supported over 3GPP/non-3GPP access
PDU session status
The purpose of the PDU session status information element is to indicate the state of each PDU session that can be identified by a PDU session identity (PSI)
This IE carriies a bitmap of 16 bits as labeled below.
[■(■(■( PSI(7) & PSI(6) & PSI(6) ) &■( PSI(4) & PSI(3) ) &■( PSI(2) & PSI(1) & PSI(0) ))@■(■(PSI(15)&PSI(14)&PSI(13))&■(PSI(12)&PSI(11)&PSI(10))&■(PSI(9)&PSI(8))))],{█(0∶ PDU SESSION INACTIVE.@1∶ not PDU SESSION INACTIVE)┤
PDU establishment
Overview
Definition
*/ PDU: Protocol Data Unit
*/ PDU session: is a logical connection between the UE and a data network, such as the internet or a private network. It is used to carry user data and can support different types of services, such as voice, video, and data.
*/ PDU session establishment:
- is the process of establishing a data path between the UE and the 5G core network.
- is equivalent to PDN Establishment in LTE
- to assign UE IP and inform the UE of various the IP address of various corenetwork components (application layer component).
*/ SMF: session management function
*/ SSC mode: SSC (Session and Service Continuity) modes refer to different ways of handling mobility and data flow during a PDU session when the User Equipment (UE) moves between different access networks or between 4G and 5G networks.
- SSC Mode 1: In this mode, the PDU session is anchored at the User Plane Function (UPF) in the 5G Core Network (5GC)
- SSC Mode 2: In this mode, the UE establishes separate PDU sessions for different access networks or for 4G and 5G networks
- SSC Mode 3: This mode is a combination of SSC Mode 1 and SSC Mode 2
Type
Types defines the end-user protocol carried by the PDU Session. It can be:
IP PDU Session
IPv4 PDU Session
IPv6 PDU Session
Dual-Stack IPv4v6
Ethernet PDU Sessionk: Neither a MAC nor an IP address is allocated by the 5GCN to the UE for Ethernet PDU session type;
Unstructured PDU Session
Procedures
Three types of 5GSM procedure:
Procedures related to PDU session:
Request by the network; for authentication and authorization or manipulation of PDU sessions:
PDU authentication and authorization,
modification,
release,
Request by the UE; for establishment of PDU sessions or to perform handover of an existing PDU session between 3GPP access and non-3GPP access, or to transfer an existing PDN connection in the EPS to the 5GS:
UE-requested PDU session establishment.
Transaction related procedure:
Request by the UE; for handling of PDU sessions:
modification,
release.
Request by the 5G ProSe UE-to-network relay UE; for the manipulation of PDU sessions:
remote UE report.
Common procedure:
5GSM status procedure
Establishment
Purpose: to establish a PDU session to exchange of PDUs between the UE and the DN,
the following specific cases:
to establish a new PDU session with a DN; or
to perform handover of an existing PDU session between 3GPP access; or
to transfer an existing PDN connection in the EPS to the 5GS; or
to transfer existing PDN connection in an untrusted non-3GPP access connected to the EPC to the 5GS; or
to establish an MA PDU session to support ATSSS; or
to relay the service associated with the RSC for 5G ProSe layer-3 UE-to-network relay
except for the following cases: <t24-501 page.531>
Call flow
If the UE requests to establish an always-on PDU session, the UE includes an ‘Always-on PDU Session Requested’ IE in the PDU Session Establishment Request message.
The SMF checks the DNN profile to determine whether the “always-on” support is enabled.
The SMF includes an ‘Always-on PDU Session Indication’ in the PDU Session Establishment Accept message if any one of the following is true:
'Always-on PDU Session Indication' is sent with value as "enabled" if the always-on configuration is enabled under the DNN profile.
'Always-on PDU Session Indication' is sent with value as "disabled" when 'Always-on PDU Session Request' IE is received and configuration is disabled.
The SMF does not include an ‘Always-on PDU Session Indication’ only when both these conditions are true:
If the UE did not send an ‘Always-on PDU Session Requested’ IE
If always-on configuration is disabled in the DNN profile.
Abnormal cases on the network side
Expiry
Abnormal cases in the UE
Expiry of timer T3580
Stop of timer T3580
T3580 value:
16s, WBN1/CE mode,
24s, access via a satellite NG-RAN cell,
21s
Authentication & Authorization
Purpose:
to authenticate / authorize the upper layers of the UE, when establishing the PDU session; or
to re-authenticate the upper layers of the UE, after establishing the PDU session;
Initiation
SMF send a SERVICE-LEVEL AUTHENTICATION COMMAND message to UE
NW start T3594 to limit the time to receive a response from the UE.
Accept by UE
UE send a SERVICELEVEL AUTHENTICATION COMPLETE message to SMF
Stop T3594
Abnormal cases on the network side
Expiry of timer T3594 (the SMF shall send the SERVICE-LEVEL AUTHENTICATION COMMAND message four times; if fifth and not receive reponse of UE Expiry of timer T3594)
Abnormal cases in the UE
During the UErequested PDU session release procedure, the UE shall ignore the SERVICE-LEVEL AUTHENTICATION COMMAND message
T3594 value:
15s, WBN1/CE mode,
23s, access via a satellite NG-RAN cell,
21s
Modification
Call flow UE request
The UE sends an ‘Always-on PDU Session Requested’ IE in the PDU Session Modification Request message.
The SMF checks the DNN profile to determine whether the “always-on” support is enabled.
The SMF includes an ‘Always-on PDU Session Indication’ in the PDU Session Modification Command when any one of the following is true:
'Always-on PDU Session Indication' is sent with the value as "enabled" when the always-on configuration is enabled under the DNN profile.
'Always-on PDU Session Indication' is sent with the value as "disabled" when an 'Always-on PDU Session Request' IE is received and configuration is disabled.
The SMF does not include an ‘Always-on PDU Session Indication’ only when both these conditions are true:
If the UE did not send an ‘Always-on PDU Session Requested’ IE.
If always-on configuration is disabled in the DNN profile.
Call flow NW request
The SMF decides to trigger a PDU Session Modification due to PCF, UDM, or RAN initiated procedures.
The SMF checks the DNN profile to determine whether the “always-on” support is enabled.
The SMF determines whether the current DNN configuration for “always-on” is different from the last indication sent to UE. If it differs, the SMF includes an ‘Always-on PDU Session Indication’ IE in the PDU Session Modification Command message.
T3581 value:
16s, WBN1/CE mode,
24s, access via a satellite NG-RAN cell,
21s
T3591 value:
16s, WBN1/CE mode,
24s, access via a satellite NG-RAN cell,
22s
Release
Purpose:
PDU Session Release procedure is used to release all the resources associated with a PDU Session.
Call flow
When trigger initiation:
the timer T3396, T3584, T3585 is running
the UE is outside the LADN service area.
Accept by the network NW request PDU session request to UE
Not accept by the network: reject causes Invalid PDU session identity: SMF send cause code when does not have any session; Protocol Error or Semantically incorrect message: SMF report receipt with semantical error also.
T3582 value:
16s, WBN1/CE mode,
24s, access via a satellite NG-RAN cell,
21s
T3592 value:
16s, WBN1/CE mode,
24s, access via a satellite NG-RAN cell,
22s
Parameters
PDU Session Identifier: PDU Session ID is an identifier of the PDU Session at the UE and 5G network
S-NSSAI (Slice identifier): Slice Identifier refers to the network slice in which the PDU Session is established
DNN (Data Network Name): DNN is the name of the Data Network to which the PDU Session provides connectivity
PDU Session Type: Types defines the end-user protocol carried by the PDU Session. It can be IPv4, IPv6, dual-stack IPv4/IPv6, Ethernet or Unstructured
SSC Mode (Service and Session Continuity mode): SSC mode refer to the longevity of the User Plane anchor point of the PDU Session, whether it can be re-allocated or not
User Plane Security Information: This indicates whether ciphering and integrity protection user-plane is to be activated for the PDU Session
Always-on PDU session
Some applications like the IP Multimedia Subsystem (IMS) require an always-on Protocol Data Unit (PDU) session that the User Plane resource establishes for every transition from the 5GMM-IDLE mode to the 5GMM-CONNECTED mode. The UE requests the establishment of a PDU session as an always-on PDU session based on the request indication of the upper layers. It is the network that decides whether to establish a PDU session as an always-on PDU session.
It sure that the connection remains active even when there is no user data being transmitted.
Use cases:
Mission-critical services: to ensure the reliable functioning of critical systems and services.
Reduced connection setup time: reducing the connection setup time and providing a more seamless user experience.
Network registration and maintenance: maintain the UE's registration with the network
Timely delivery of notifications and incoming data: services with real-time requirements, like voice calls or instant messaging.
IoT devices and applications: to maintain a persistent connection with these devices and support efficient data transfer with minimal latency.
Multi-access PDU session
MA PDU session is a PDU session which can use one 3GPP access network or one non-3GPP access network at a time, or simultaneously one 3GPP access network and one non-3GPP access network.
Attributes: DNN, SSC mode, S-NSSAI, PDU session type
MA PDU session can have user-plane resources established on both 3GPP access and non-3GPP access, or on one access only (either 3GPP access or non-3GPP access), or can have no user-plane resources established on any access.
Mapped EPS bearer contexts
This mapping ensures that the ongoing data sessions and services are seamlessly continued during the network transition.
"Mapped EPS bearer contexts" may be included in the PDU Session Establishment Request and PDU Session Establishment Accept messages.
This information indicates which EPS bearer contexts from the 4G LTE network are being mapped to the new 5G PDU session and the corresponding QoS flow identifiers.
Reject causes:
Establishment
insufficient resources
missing or unknown DNN
unknown PDU session type
user authentication or authorization failed
request rejected, unspecified
service option not supported
requested service option not subscribed
network failure
out of LADN service area
PDU session type IPv4 only allowed
PDU session type IPv6 only allowed
PDU session does not exist
missing or unknown DNN in a slice
Protocol Error or Semantically incorrect message
Modification & Release
Invalid PDU session identity: SMF send cause code when does not have any session
Protocol Error or Semantically incorrect message: SMF report receipt with semantical error also