无线网络-LTE (03) 通信过程之 TAU procedures -- with Serving GW change

当手机在GPRS网络或E-UTRAN网络中完成附着后，如果出现如下情况，会触发Tracking Area Update过程。

-   手机发现进入到了一个新的TA，并且这TA不在TAIs 列表中。

-   到了TA更新的周期

-   当手机从UTRAN通过重选进入E-UTRAN时期状态为PMM_Connected。

-   手机重选 E-UTRAN时，其状态为GPRS READY

-   手机重选到E-UTRAN时TIN为"P-TMSI"

-   RRC连接释放时，释放原因load re-balancing TAU required"

-   手机的RRC层通知UE的NAS层，RRC连接失败

-   手机如下参数发生变化：
         UE Network Capability
         MS Network Capability
         UE Specific DRX Parameters
         MS Radio Access capability

-   对于有SR-VCC 的手机，MS Classmark 2，MS Classmark 3 或 Supported Codecs参数发生了变化。

Tracking Area Update 根据不同的情况也有几种不同的流程与其对应

这里先整理出第一种

Tracking Area Update procedure with Serving GW change

Step 1

One of the triggers described in clause 5.3.3.0 for starting the TAU procedure occurs.

手机被触发TAU过程原因如文档开篇所述。

Step 2

The UE initiates the TAU procedure by sending, to the eNodeB, a TAU Request  ( UE Core Network Capability, old GUTI, last visited TAI, active flag, EPS bearer status, P TMSI Signature, additional GUTI, eKSI, NAS sequence number, NAS-MAC, KSI) message together with RRC parameters indicating the Selected Network and the old GUMMEI. An exception is that, if the TAU was triggered for load re-balancing purposes (see clause 4.3.7.3), the old GUMMEI is not included in the RRC parameters.If the UE's TIN indicates "GUTI" or "RAT related TMSI" and the UE holds a valid GUTI then the old GUTI indicates this valid GUTI. If the UE's TIN indicates "P TMSI" and the UE holds a valid P TMSI and related RAI then these two elements are indicated as the old GUTI. Mapping a P TMSI and RAI to a GUTI is specified in Annex H. When the UE is in connected mode (e.g. in URA_PCH) when it reselects to E UTRAN, the UE shall set its TIN to "P TMSI". If the UE holds a valid GUTI and the old GUTI indicates a GUTI mapped from a P-TMSI and RAI, then the UE indicates the GUTI as additional GUTI. If the old GUTI indicates a GUTI mapped from a P-TMSI and RAI, and the UE has a valid P-TMSI signature, the P-TMSI signature shall be included. The additional GUTI in the Tracking Area Update Request message allows the new MME to find any already existing UE context stored in the new MME when the old GUTI indicates a value mapped from a P-TMSI and RAI. The RRC parameter "old GUMMEI" takes its value from the identifier that is signalled as the old GUTI according to the rules above.  For a combined MME/SGSN the eNB is configured to route the MME code(s) of this combined node to the same combined node.  This eNB is also configured to route MME code(s) of GUTIs that are generated by the UE's mapping of the P TMSIs allocated by the combined node. Such an eNB configuration may also be used for separate nodes to avoid changing nodes in the pool caused by inter RAT mobility. The last visited TAI shall be included in order to help the MME produce a good list of TAIs for any subsequent TAU Accept message. Selected Network indicates the network that is selected. Active flag is a request by UE to activate the radio and S1 bearers for all the active EPS Bearers by the TAU procedure when the UE is in ECM-IDLE state. The EPS bearer status indicates each EPS bearer that is active in the UE. The TAU Request message shall be integrity protected by the NAS-MAC as described in TS 33.401 [41]. KSI, NAS sequence number and NAS-MAC are included if the UE has valid EPS security parameters. NAS sequence number indicates the sequential number of the NAS message. KSI is included if the UE indicates a GUTI mapped from a P TMSI in the information element "old GUTI".

手机会初始化TAU过程，首先向eNodeB发送TAU Request，参数见原文中标示部分，同时 RRC 参数标识了Selected Network 和 the old GUMMEI。

Step 3

The eNodeB derives the MME from the RRC parameters carrying the old GUMMEI and the indicated Selected Network. If that MME is not associated with that eNodeB or the GUMMEI is not available or the UE indicates that the TAU procedure was triggered by load re-balancing, the eNodeB selects an MME as described in clause 4.3.8.3 on "MME Selection Function". The eNodeB forwards the TAU Request message together with the TAI+ECGI of the cell from where it received the message and with the Selected Network to the new MME.

eNodeB从RRC 参数 老的 GUMMEI 和 已选择网络ID中获得MME地址。如果MME与eNodeB并没有关联或者GUMMEI是无效的，再或者TAU过程是由负载平衡触发的，eNodeB会通过"MME Selection Function" 功能选择一个MME。eNodeB向前转发TAU Request(TAI+ECGI) 到新的MME。

Step 4

The new MME uses the GUTI received from the UE to derive the old MME/S4 SGSN address, and sends a Context Request (o ld GUTI, complete TAU Request message, P TMSI Signature, MME Address, UE validated) message to the old MME/old S4 SGSN to retrieve user information. UE Validated indicates that the new MME has validated the integrity protection of the TAU message, e.g. based on native EPS security context for the UE. To validate the Context Request the old MME uses the complete TAU Request message and the old S4 SGSN uses the P TMSI Signature and responds with an appropriate error if integrity check fails in old MME/S4 SGSN. This shall initiate the security functions in the new MME. If the security functions authenticate the UE correctly, the new MME shall send a Context Request ( IMSI, complete TAU Request message, MME Address, UE Validated) message to the old MME/S4 SGSN with the UE Validated set. If the new MME indicates that it has authenticated the UE or if the old MME/old S4 SGSN correctly validates the UE, then the old MME/old S4 SGSN starts a timer.

新的MME通过从手机得到的GUTI来获得老的MME/S4 SGSN的地址，并且发送Context Request(参数间原文中彩色部分)到old MME/old S4 SGSN来取得用户信息。
老的S4 SGSN会对Context Request进行验证。

Step 5

If the Context Request is sent to an old MME the old MME responds with a Context Response (ME Identity (if available), MM Context, EPS Bearer Context(s), Serving GW signalling Address and TEID(s), ISR Supported, MS Info Change Reporting Action (if available), UE Core Network Capability, UE Specific DRX Parameters) message. If the Context Request is sent to an old S4 SGSN the old S4 SGSN responds with a Context Response (MM Context, EPS Bearer Context(s), Serving GW signalling Address and TEID(s), ISR Supported, MS Info Change Reporting Action (if available), UE Core Network Capability, UE Specific DRX Parameters). The MM Context contains security related information as well as other parameters (including IMSI, ME Identity (if available) and MSISDN) as described in TS 29.274 [43]. The unused Authentication Quintets in the MM Context are also maintained in the SGSN. The PDN GW Address and TEID(s) (for GTP-based S5/S8) or GRE Keys (PMIP-based S5/S8 at the PDN GW(s) for uplink traffic) and the TI(s), is part of the EPS Bearer Context. If the UE is not known in the old MME/old S4 SGSN or if the integrity check for the TAU Request message fails, the old MME/old S4 SGSN responds with an appropriate error cause. ISR Supported is indicated if the old MME/old S4 SGSN is capable to activate ISR for the UE. The MSISDN is included if the old MME/old S4 SGSN has it stored for that UE.

Context Request可能会被发送到老的MME或老的S4 SGSN，他们都会返回Context Response给新的MME，但消息中包含的参数会有所区别(见原文中彩色部分)。

Step 6

If the integrity check of TAU Request message (sent in step 2) failed, then authentication is mandatory. The authentication functions are defined in clause 5.3.10 on "Security Function". Ciphering procedures are described in clause 5.3.10 on "Security Function". If GUTI allocation is going to be done and the network supports ciphering, the NAS messages shall be ciphered.

TAU Request完整性检查失败了，系统则会启动身份验证过程。

Step 7

The new MME determines to relocate the Serving GW. The Serving GW is relocated when the old Serving GW cannot continue to serve the UE. The new MME may also decide to relocate the Serving GW if a new Serving GW is expected to serve the UE longer and/or with a more optimal UE to PDN GW path, or if a new Serving GW can be co-located with the PDN GW. Selection of a new Serving GW is performed according to clause 4.3.8.2 on "Serving GW selection function". The new MME sends a Context Acknowledge (Serving GW change indication) message to the old MME/old S4 SGSN. Serving GW change indication indicates a new Serving GW has been selected. The old MME/old S4 SGSN marks in its UE context that the information in the GWs and the HSS are invalid. This ensures that the old MME/old S4 SGSN updates the GWs and the HSS if the UE initiates a TAU procedure back to the old MME/old S4 SGSN before completing the ongoing TAU procedure. If the security functions do not authenticate the UE correctly, then the TAU shall be rejected, and the new MME shall send a reject indication to the old MME/old S4 SGSN. The old MME/old S4 SGSN shall continue as if the Identification and Context Request was never received.ISR is not indicated in the Context Acknowledge as ISR is not activated due to the S GW change.

当老的Serving GW 不能继续为手机服务时，新的MME会决定重新选择Serving GW。也有一些情况MME会决定使用新的SGW,例如新的的SGW可以为手机提供更长时间的服务, 或者提供更多的到PGW的路径。新MME 会发送 Context Acknowledge (Serving GW change indication) 到老的MME/老的 S4 SGSN。

Step 8

The MME constructs an MM context for the UE. The MME verifies the EPS bearer status received from the UE with the bearer contexts received from the old MME/old S4 SGSN and releases any network resources related to EPS bearers that are not active in the UE. If there is no bearer context at all, the MME rejects the TAU Request. If the new MME selected a new Serving GW it sends a Create Session Request ( IMSI, bearer contexts, MME Address and TEID, Type, the Protocol Type over S5/S8, RAT type) message per PDN connection to the selected new Serving GW. The PDN GW address and TFT (for PMIP-based S5/S8) are indicated in the bearer Contexts. Type indicates to the Serving GW to send the Create Session Request the PDN GW. The Protocol Type over S5/S8 is provided to Serving GW which protocol should be used over S5/S8 interface. RAT type indicates a change in radio access. If the PDN GW requested UE's location info, the MME also includes the User Location Information IE in this message.

MME为手机构造了MM context。MME会验证EPS承载的状态，如果不存在bearer context,MME会拒绝TAU Request。如果新MME选择了一个新的SGW,它会
发送Create Session Request。

Step 9

The Serving GW informs the PDN GW(s) about the change of for example the RAT type that e.g. can be used for charging, by sending the message Modify Bearer Request ( Serving GW Address and TEID, RAT type) per PDN connection to the PDN GW(s) concerned. User Location Information IE is also included if it is present in step 8.

当信息有修改时，SGW会通知PDN GW， 例如RAT type被修改了，可以通过每个PDN连接发送Modify Bearer Request到PDN GW来进行通知。

Step 9a

If dynamic PCC is deployed, and RAT type information needs to be conveyed from the PDN GW to the PCRF, then the PDN GW shall send RAT type information to the PCRF by means of an IP CAN Session Modification procedure as defined in TS 23.203 [6]. NOTE 2: The PDN GW does not need to wait for the PCRF response, but continues in the next step. If the PCRF response leads to an EPS bearer modification the PDN GW should initiate a bearer update procedure.

如果部署了动态PCC，并且RAT type信息需要由PDN GW 传达到PCRF，这时需要PDN GW通过IP CAN Session Modification过程发送RAT type信息到PCRF。

Step 10

The PDN GW updates its bearer contexts and returns a Modify Bearer Response (MSISDN Charging Id) message. The MSISDN is included if the PDN GW has it stored in its UE context.

PDN GW更新了承载上下文并且返回Modify Bearer Response。

Step 11

The Serving GW updates its bearer context. This allows the Serving GW to route bearer PDUs to the PDN GW when received from eNodeB. The Serving GW returns a Create Session Response (Serving GW address and TEID for user plane and control plane and PDN GW TEIDs (for GTP-based S5/S8) or GRE keys (for PMIP-based S5/S8) for uplink traffic and control plane) message to the new MME.

Serving GW更新了它的承载上下文。这样Serving GW就可以把从eNodeB收到的PDU路由发送到 PDN GW。Serving GW返回Create Session Response给新的MME。

Step 12

The new MME verifies whether it holds subscription data for the UE identified by the GUTI, the additional GUTI or by the IMSI received with the context data from the old CN node. If there are no subscription data in the new MME for this UE then the new MME sends an Update Location Request (MME Identity, IMSI, Update Type, MME Capabilities) message to the HSS. Update Type indicates that only the MME registration shall be updated in HSS. Update Type indicates whether HSS should cancel location to the other RAT as well. The MME capabilities indicate the MME's support for regional access restrictions functionality.

新的MME验证是否持有验证过的订阅数据(可以通过GUTI，additional GUTI，IMSI)。如果新的MME对于当前手机不存在订阅数据，MME将会发送Update Location Request
到HSS。Update Type标识了是否只有MME注册应该被更新到HSS。Update Type标识了是否需要取消其他RAT的信息。

Step 13

The HSS sends the message Cancel Location (IMSI, Cancellation Type) to the old MME with Cancellation Type set to Update Procedure.

Step 14

If the timer started in step 4 is not running, the old MME removes the MM context. Otherwise, the contexts are removed when the timer expires. It also ensures that the MM context is kept in the old MME for the case the UE initiates another TAU procedure before completing the ongoing TAU procedure to the new MME. The old MME acknowledges with the message Cancel Location Ack (IMSI).

在第四步时系统启动了一个计时器，如果这个计时器没有被启动，则MME删除MM context，如果计时器超时contexts被删除。另外还需要确保UE启动另一次TAU过程前老的MME保持MM context。老的MME返回Cancel Location Ack。

Step 15

When old S4 SGSN receives the Context Acknowledge message and if the UE is in Iu Connected, the old S4 SGSN sends an Iu Release Command message to the RNC after the timer started in step 4 has expired.

Step 16

The RNC responds with an Iu Release Complete message.

Step 17

The HSS acknowledges the Update Location Request message by sending an Update Location Ack (IMSI, Subscription Data) message to the new MME. If the Update Location is rejected by the HSS, the new MME rejects the TAU Request from the UE with an appropriate cause. The new MME validates the UE's presence in the (new) TA. If due to regional subscription restrictions or access restrictions the UE is not allowed to access the TA, the MME rejects the Tracking Area Update Request with an appropriate cause to the UE.

HSS通过向新的MME返回Update Location Ack确认Update Location Request。如果HSS拒绝了 Update Location，新的MME将拒绝TAU。新的MME验证手机在新的TA中是否存在。如果由于订阅限制或接入限制手机不允许被接入TA，MME将会拒绝Tracking Area Update Request。

Step 18

When the timer started in step 4 expires the old MME/old S4 SGSN releases any local MME or SGSN bearer resources and if it received the Serving GW change indication in the Context Acknowledge message, the old MME/old S4 SGSN deletes the EPS bearer resources by sending Delete Session Request (Cause, TEID) messages to the old Serving GW. Cause indicates to the old Serving GW that the old Serving GW shall not initiate a delete procedure towards the PDN GW. If ISR is activated the cause also indicates to the old S GW that the old S GW shall delete the bearer resources on the other old CN node by sending Delete Bearer Request message(s) to that CN node. If the MME has not changed, step 11 triggers the release of EPS bearer resources when a new Serving GW is allocated.

如果第四步启动的计时器超时，老的 MME/S4 SGSN会释放所有的本地MME 或 SGSN承载的资源，并且如果它收到的Context Acknowledge中有Serving GW变更标识老的MME/S4 SGSN会通过向老的Serving GW发送Delete Session Request删除 EPS承载的资源。

Step 19

The Serving GW acknowledges with Delete Session Response (TEID) messages. The Serving GW discards any packets buffered for the UE.

Step 20

The MME sends a TAU Accept (GUTI, TAI list, EPS bearer status, NAS sequence number, NAS-MAC, IMS Voice over PS session supported Indication) message to the UE. If the active flag is set the MME may provide the eNodeB with Handover Restriction List.  GUTI is included if the MME allocates a new GUTI. If the "active flag" is set in the TAU Request message the user plane setup procedure can be activated in conjunction with the TAU Accept message. The procedure is described in detail in TS 36.300 [5].  The message sequence should be the same as for the UE triggered Service Request procedure specified in clause 5.3.4.1 from the step when MME establishes the bearer(s). The MME indicates the EPS bearer status IE to the UE. The UE removes any internal resources related to bearers that are not marked active in the received EPS bearer status. Handover Restriction List is described in clause 4.3.5.7  "Mobility Restrictions". The MME sets the IMS Voice over PS session supported Indication as described in clause 4.3.5.8. When receiving the TAU Accept message and there is no ISR Activated indication the UE shall set its TIN to "GUTI". For a S GW change, ISR Activated is never indicated by the MME as it needs a RAU with the same S GW first to activate ISR. For an MME change, ISR is not activated by the new MME to avoid context transfer procedures with two old CN nodes.

MME会发送TAU Accept到UE。如果设置了active flag，MME 会向eNodeB提供Handover Restriction 列表。如果MME分配了新的GUTI，这个ID将会被包含在消息中。如果在TAU Request 消息中"active flag"被设置了，接着TAU Accept消息可以直接启动user plane建立的过程。

Step 21

If GUTI was included in the TAU Accept, the UE acknowledges the received message by returning a TAU Complete message to the MME. When the "Active flag" is not set in the TAU Request message and the Tracking Area Update was not initiated in ECM-CONNECTED state, the new MME releases the signalling connection with UE, according to clause 5.3.5.

如果GUTI被包含在TAU Accept中，UE会通过向MME发送TAU Complete来进行确认。