2. EMM Case 8. Handover with TAU

Figure 1 shows a handover procedure performed when UE in Connected state moves to a TA that it is not registered to. When the UE initially attached the network, MME selected TA1 and TA2 for the UE, and sent a TAI list = {TAI=1, TAI=2}, as included in the Attach Accept message. Initially, the UE was served through eNB2 (Cell 5 in it, to be exact) in TA1. Now it is moving toward eNB5 (Cell 13, to be exact) in TA3 which is not in the TAI list. As this document concerns intra-LTE handover only, we assume both eNB2 and eNB5 are connected to the same MME and S-GW.

Figure 1. Handover (to a non-registered TA)

Handover

In the figure above, as the UE moves toward eNB5, a handover event¹ is triggered. The UE measures the signal strength of the serving cell and neighbor cells, and sends the results to eNB2, as included in the Measurement Report message. First, the source eNB (e.g. eNB2 above) chooses the type of handover to perform, X2 or S1. In X2 handover, it is the source eNB that selects the target eNB (e.g. eNB5 above), whereas it is MME in S1 handover. Next, handover is performed from eNB2 (Cell 5 in it to be more exact) to eNB5 (Cell 13 in it) (see the previous documents [2][3][4] for detailed handover procedure).

Tracking Area Update (TAU)

   1)   [UE → MME] TAU Request

When being handed over to the target eNB (eNB5), the UE knows eNB5 does not belong to its assigned TAs. Thus, as soon as the handover is completed, it sends a TAU Request (Update Type=TA Updating, GUTI, Last Visited TAI, KSI_ASME, NAS-MAC) message to MME, requesting TA update. At this time, the message includes the following information:

The TAU Request message is sent through an UL Information Transfer message from UE to eNB (as RRC message), and then through an Uplink NAS Transport (NAS-PDU (TAU Request), ECGI, TAI) message from eNB to MME (as S1AP message). The Uplink NAS Transport message, including the TAU Request message and the current cell’s ECGI and TAI, is forwarded to MME.

As the NAS security context has already been established between the UE and MME, the TAU Request message that the UE sends is integrity-protected with the NAS integrity key (K_NASint). If the MME’s integrity check on the received TAU Request message fails, the MME performs user authentication and NAS security setup procedures (see the previous document [6]). In this document, we will only discuss cases where the MME succeeds the integrity check. 

   2)   [MME] TA Update: Allocating New TAs

Because the UE has moved to a TA that it is not registered to, the MME selects a group of TAs to allocate and configures a new TAI list for the UE. At this time, a new Globally Unique Temporary Identifier (GUTI) may also be allocated.

   3)   [UE ← MME] TAU Accept

The MME sends the newly selected TAs (and GUTI if applicable), as included in a TAU Accept (GUTI, TAI List) message. This message, after being encrypted and integrity-protected, is sent through a Downlink NAS Transport message from MME to eNB (as S1AP message), and then through a DL Information Transfer message from eNB to UE (as RRC message).

   4)   [UE → MME] TAU Complete

If a new GUTI was allocated, the UE sends the MME a TAU Complete message to acknowledge the receipt of the new GUTI.

Once the TAU procedure is completed, the UE, now with the new TAI list (and GUTI if applicable), can be served through eNB5.