Table of Contents   1. Introduction 2. Concept of S1 Handover 2.1 S1 Protocol Stacks 2.2 S1AP Procedures and Messages Relating to Handover 2.3 S1 Handover Procedure at a Glance 2.4 UE State and Connection Information Before and After S1 handover 3. Procedure of S1 Handover 4. EPS Entity Information: Before/After S1 Handover 5. Closing

 

 

2. Concept of S1 Handover

 

2.1 S1 Protocol Stacks

 

S1 handovers are performed between a source eNB and a target eNB through the S1 interface, which connects eNB and EPC. eNB communicates with MME through S1AP signaling in the control plane, and communicates with S-GW through GTP tunnel in the user plane. Figure 1 shows the protocol stacks over the S1 interface in control and user planes.

 

 

 

Figure 1. Protocol Stacks over S1 Interface

 

When a new eNB is installed, an “S1 Setup” procedure is performed between the eNB and MME(s). The eNB provides the MME(s) with eNB configuration information by sending an S1 Setup Request (eNB ID, eNB Name, TAC) message. Then, each MME returns an S1 Setup Response (GUMMEI, MME Name, Relative MME Capacity) message to the eNB so that it can update its configuration information. Here, Relative MME Capacity parameter is used in load balancing among MMEs in an MME. Its value, marked in weight factor, shows each MME’s relative capacity to handle UE connection. eNBs connected to more than one MME use this value when selecting a MME to establish a new UE connection with.

 

UE connections between eNB and EPC are as follows: In the control plane, each user’s signaling between eNB and MME is provided through S1 Application Protocol (S1AP) signaling connection¹, and identified by {eNB UE S1AP ID, MME UE S1AP ID}. In the user plane, each user’s S1 bearer between eNB and S-GW is provided through GTP (GPRS Tunneling Protocol) tunnel, and identified by {DL S1 TEID (S1 eNB TEID), UL S1 TEID (S1 S-GW TEID)}.

 

2.2 S1AP Procedures and Messages Relating to Handover

 

Tables 1 and 2 in 3GPP TS 36.413 S1AP show the elementary procedures of S1AP, which include both non-UE and UE related procedures. This document is about handover, and hence only discusses UE related procedures, particularly those related to the handover procedures to be explained in Chapter III. Table 1 lists the elementary S1AP procedures related to S1 handover, and their associated S1AP messages.

 

Table 1. S1 Messages for Handover related S1AP Elementary Procedures [2]

 

Among the S1AP messages listed the table above, those to be used in Chapter III (those used in successful handovers) are briefly explained below.

• Handover Required message: This message is used during the handover preparation phase. It is sent by the source eNB to MME, and includes information about the target eNB and the radio resources at the source cell.
• Handover Request message: This message is used during the handover preparation phase. It is sent by MME to the target eNB, and includes the user’s UE context.
• Handover Request Acknowledge message: This message is used during the handover preparation phase. It is sent by the target eNB to MME when the resource allocation for the UE is successfully completed at the target eNB. The target eNB allocates DL S1 TEID for S1 bearer to be used after the handover, and DL S1 TEID for S1 bearer (indirect tunnel) to be used for DL packet delivery during the handover, and then forwards them as included in the message.
• Handover Command message: This message is used during the handover preparation phase, and is sent by MME to the source eNB. It includes the information required when the UE accesses the target eNB (e.g. Target C-RNTI, Target eNB AS Security algorithm, DRB ID, etc.), and UL S1 TEID for S1 bearer (indirect tunnel) to be used by S-GW for DL packet delivery during the handover.
• eNB Status Transfer message: This message is used during the handover execution phase, and is sent by the source eNB to MME. It indicates from which packet the target eNB should receive or send.
• MME Status Transfer message: This message is used during the handover execution phase, and is sent by MME to the target eNB. It indicates from which packet the target eNB should receive or send.
• Handover Notify message: This message is used during the handover completion phase, and is sent by the target eNB to MME. It indicates that the UE has completed the handover to the target eNB.
• UE Context Release Command message: This message is used during the handover completion phase, and is sent by MME to the source eNB to request release of the UE context.
• UE Context Release Complete message: This message is used during the handover completion phase, and is sent by the source eNB to MME to inform that the UE context has been released.

 

2.3 S1 Handover Procedure at a Glance

 

As seen in the previous document [3], an S1 handover procedure consists of preparation, execution and completion phases. Before we go further into detail, we will briefly preview the S1 handover procedure.

 

 

Figure 2. Simplified Procedure of S1 Handover

 

Figure 2 above illustrates at a glance the procedures required before, during (preparation, execution and completion phases) and after S1 handover. For convenience’s sake, S-GW and P-GW are marked as SAE-GW, and source and target eNBs are marked as SeNB and TeNB, respectively.

 

Before S1 Handover

In the figure above, the UE is being served through eNB A (a serving cell in eNB A, to be more exact) that it has connected to. When the UE detects a measurement event, it sends a Measurement Report message to eNB A.

 

S1 Handover Preparation

The source eNB (i.e. eNB A in the figure) chooses a target eNB (i.e. eNB B in the figure) to handover to, based on the neighbor cell list information it has kept and the information on the signal strength of the neighbor cells included in the Measurement Report message. Next, it, realizing a handover to the target eNB through the X2 connection is not possible, decides to perform a S1 handover instead, and prepares to perform one through MME. Both eNBs communicate with the MME through S1AP signaling. At this time, the target eNB allocates radio resource in advance to ensure the same services currently provided by the source eNB are also available at the target eNB. The MME also provides the source eNB with the information required for the UE to access the target cell.  

 

In the meantime, the target eNB and S-GW allocate resources needed to create an indirect tunnel through which DL packets arriving at the source eNB are forwarded to the S-GW and finally to the target eNB while a handover is being performed, as follows:

• The source eNB sends the information about the target eNB, as included in a Handover Required message, to the MME (❶).
• The MME then sends a Handover Request message that includes AS security information required for the target eNB to create the AS security base key along with the UE Context to the target eNB (❷).
• Target eNB

▪   establishes an UL S1 bearer through which to forward UL packets after the handover by using the S1 S-GW TEID obtained from the MME, and allocates S1 target eNB TEID for a DL S1 bearer (❸).

▪   allocates S1 target eNB TEID for the tunnel connecting the S-GW and the target eNB (this tunnel is a part of the indirect tunnel² connecting all the way from the source eNB, S-GW and the target eNB) to be used for forwarding DL packets while the UE attempts to access (i.e. perform a handover to) the target eNB.

▪   configures a Handover Command message that includes information needed for the UE to access the target cell (e.g. Target C-RNTI, Target DRB ID, etc.).

▪   and sends the information to the MME by including it in a Handover Request Ack message (❹).

• The MME, upon receiving the message, includes the S1 target eNB TEID that the target eNB has allocated for the indirect tunnel in a Create Indirect Data Forwarding Tunnel Request message, and sends the message to the S-GW (❺).
• S-GW

▪   Creates an indirect tunnel connecting the target eNB (❻).

▪   allocates S1 S-GW TEID for the tunnel connecting the source eNB and the S-GW (this tunnel is a part of the indirect tunnel connecting all the way from the source eNB, S-GW and the target eNB), and sends it to the MME through a Create Indirect Data Forwarding Tunnel Response message.

• The MME includes i) the S1 S-GW TEID that the S-GW has allocated for the indirect tunnel, and ii) the information required for the UE to access the target cell, in a Handover Command message, and sends the message to the source eNB (❼).
• Then, the source eNB creates an indirect tunnel connecting to the S-GW (❽).

 

Through Steps ❽ and ❻, the entire indirect tunnel connecting all the three entities, the source eNB, S-GW and target eNB, is created.

 

S1 Handover Execution

Now the two eNBs are ready to perform a handover, it is time to command the UE to perform one.

• Source eNB

▪   commands the UE to perform a handover to the target cell by sending a Handover Command message that includes all the information needed for the UE’s access to the target cell (❶).

▪   informs the MME about from which UL/DL packet it should receive/send from/to the UE by sending an eNB Status Transfer message (❷).

▪   sends the DL packets received from the S-GW on to the target eNB through the indirect tunnel connected to the target eNB via the S-GW (❹).

• The MME informs the target eNB about from which UL/DL packet it should send/receive to/from the UE by sending an MME Status Transfer message (❸).
• The UE disconnects from the source eNB, and connects to the target eNB (❺).
• Once the UE is successfully accessed to the target eNB, it becomes immediately capable of sending or receiving packets (❻). 

 

S1 Handover Completion

As the MME already knew that the UE was about to perform a handover, the target eNB, unlike in X2 handover, does not request the MME for path modification. Instead, the target eNB sends the MME a Handover Notify message to indicate the UE has completed the handover once the UE is connected to the target eNB.

• As soon as the UE is connected, the target eNB sends the MME a Handover Notify message to inform about the completed handover (❶).
• Then, the MME requests the S-GW for S1 bearer modification (❷). The S-GW modifies the DL S1 bearer path to connect to the target eNB, as requested (❸).
• The S-GW changes the bearer path as follows:

▪   It stops DL packet delivery by sending an End Marker (EM) packet through the DL S1 bearer connected to the source eNB.

▪   Then it creates a DL S1 bearer that connects to the target eNB, and resumes DL packet delivery to the target eNB.

• The target eNB sends DL packets to the UE as follows:

▪   It sends DL packets arriving through the indirect tunnel to the UE until an EM packet arrives.

▪   Once an EM packet arrives, it sends the UE the ones arriving through the new path.

• The MME:

▪   requests the source eNB to release S1 resources related to the source eNB and the UE Context it has by sending an UE Context Release Command message (❹).

▪   request the S-GW to release resources associated with the indirect tunnel by sending a Delete Indirect Data Forwarding Tunnel Request message (❺).

 

After S1 Handover

The UE is now being served through eNB B (the serving cell at eNB B, to be more exact) that it has connected to.

 

2.4 UE State and Connection Information Before and After S1 Handover

 

Figure 3 illustrates the connection establishments in the user/control planes, and the UE and MME states before, during and after the S1 handover.

 

•        Before S1 Handover

The UE stays in EMM-Registered and ECM/RRC-Connected and keeps all the resources allocated by E-UTRAN and EPC.

•        During S1 Handover

Even during the handover phase, the UE’s state on the NAS layer remains unchanged. Both the source and target eNBs are connected to the MME through the S1 signaling connection established over the S1-MME interface. They are also connected to the S-GW through the indirect tunnel created over the S1-U interface for DL packet forwarding. In Figure 3, Step 2) shows the connections and states while the handover is interrupted during the handover execution phase. During this period, no radio link connection is active, but the UE still remains Connected.

•        After S1 Handover

The UE remains in EMM-Registered and ECM/RRC-Connected states. The E-RAB (DRB + S1 bearer) path is switched to connect to a new eNB in the user plane while a new RRC connection is established in the control plane. 

 

 

Figure 3. Connections and States before/after S1 Handover