TM's Blog for 3GPP Spec

When you study the 5G user plane protocol stack, you must observe that the SDAP is added. Why does the NR system need SDAP?

In LTE system, one EPS bearer corresponds to a specific Quality of Service (QoS). For example, when you turn on your smartphone. The device could establish two EPS bearers with different QoS (one default bearer for internet the other for IP Multimedia Subsystem (IMS) signaling). If you want to make a phone call, the device will establish the third EPS bearer with higher QoS for VoLTE service. However, the concept of the EPS bearer is replaced by the PDU session in 5G NR.

A PDU session could contain more than one QoS flow. Different from the previous example, your smartphone can only establish one PDU session for IMS signaling. When you want to make a phone call, the device can just new a QoS flow for VoLTE service in the PDU session you already established. (no need to establish a new session). However, a problem derives from the change: how to map QoS flows to Radio Bearers (RBs)? SDAP is the answer

In my previous article “
RFC 3261 – Session Initiation Protocol (SIP) Parameters

”, I introduced the purpose of each header in SIP_REGISTER message. So today, I think we can go a step further to talk about Session Description Protocol (SDP). When initiating a VoLTE/VoWiFi call or streaming video, phones and networks need to decide some media-related parameters like transport protocol or address... In order to determine these configurations, we need SDP to help us!

It is important to realize that SDP is not used to negotiate media parameters in a session. Instead, one party tells the other party, “Here are all the media types I can support – pick one and use it.”

A valid SIP request must contain the following header fields: To, From, CSeq, Call-ID, Max-Forwards, and Via. So today, I will use SIP_REGISTER message to be an example to introduce these headers.

1. Request-URI (SIP Message):

- It is composed of three parts: command name (like... REGISTER, NOTIFY, INVITE...), request URI and protocol version.

- URI: Uniform Resource Identifier. It's an identifier to distinguish device/user in a live network. (URI ex., Terry@Verizon.com)

- Generally, the content of request URI should be same as To header. But, SIP_REGISTER is an exception. According to the chapter 10.2 of RFC 3261, the “user info” and “@” components of the SIP URI must not be present in SIP_REGISTER. So you can see the headers between Request-URI and To are different in this example.

上圖是UE向網路註冊VoLTE服務所送的SIP Message，以下介紹幾個SIP Header:

1. From & To:

- 註冊VoLTE的過程中，Register/Subscribe/Notify Message中的From和To header內容相同，都是帶UE的資訊

- user的值通常為MCC+MNC+Public User Identity，其中Public User Identity儲存於SIM卡中，與手機號碼不同，@後面為Operator的MCC & MNC

- From/To的值用來讓網路端識別是哪個user註冊VoLTE，通常不用IP Address (PUI儲存在網路端的Home Subscribe Server, HSS)

從上面的截圖可以知道System Information Block type 1 (SIB1)所帶的內容，都是UE在Idle/Connected mode用到的一些Timer值，如T302, T309…。這些Timer都很直觀，我這邊就不贅述。但Message中的cn-CommonGSM-MAP-NAS-SysInfo和cn-DomainSysInfoList我覺得可以介紹一下!

1. cn-CommonGSM-MAP-NAS-SysInfo: 形式為4個16進制數字: “XXXX”H，代表Location Area Code，當UE儲存的Serving LAC和Broadcast Information不同時，即表示UE移動到不同的LA => UE會做Location update

2. cn-DomainSysInfoList: 分為CS和PS domain

3. CS domain中gsm-MAP ‘0A01’，其中0A代表T3212 (Periodic Update timer)的長度，單位為6分鐘 => 0A x 6分鐘 => T3212為1小時，後面的01表示網路端是否允許UE做IMSI Attach/Detach，1代表允許/0表示不允許

4. PS domain中gsm-MAP ‘0101’，其中前面的01代表Routing Area Code，後面的01代表NMO (Network Mode of Operation)

CLIR:  Calling Line Identification Restriction (隱藏號碼)

1. 撥打電話時如果想隱藏自己的號碼，可輸入: "#31#" + "對方號碼"

2. 此時UE送給網路的CC/Setup OTA (for 3G)，其中的CLIR invocation會被設為1 => 收話端就會看不到發話者的號碼

3. 此功能在某些特定的Operator需要特別開通才能使用，若沒開通，網路可能會回覆: CC/Release with cause #50 (Request facility not subscribed)

4. 針對VoLTE Call的隱藏號碼，UE會在SIP_INVITE中的from欄位帶入: sip:anonymous@anonymous.invalid

Location Area Identification (LAI)用來定義一個Location Area (for circuit switch)，由三個部分所組成: Mobile Country Code (MCC)、Mobile Network Code (MNC)、Location Area Code (LAC)

1. MCC、MNC、LAC各別說明如下:

(1) MCC: 不同國家擁有不同的MCC，如台灣: 466、中國: 460…

(2) MNC: 一個國家內，不同電信商擁有不同的MNC (一個電信商也可能有多個MNC)，如中華電信: 92、台灣大哥大: 97…

(3) LAC: 用來定義一個Location Area，最小範圍可能是一個Cell，最大可能一個Visitor Location Register (VLR)底下的所有Cell都定義為相同LAC (看電信商自己定義)

當UE要送NAS Message給UTRAN時，RRC需要先建立一條Singalling Connection，NAS Message (如CM Service Request)才能藉由這個Connection傳送到網路端。而Initial Direct transfer procedure的目的，就是用來建立一條Uplink Signalling Connection。

1. 如果UE在Idle Mode下，(原則上)UE送出Initial Direct transfer後，後續要執行RRC Connection Establishment procedure。如果RRC Connection Establishment procedure失敗，則RRC需通知NAS並結束這個procedure

2. 如果UE的RRC State為CELL_PCH or URA_PCH，Initial Direct transfer procedure會將RRC State轉變成CELL_FACH

3. 當Initial Direct transfer Message成功傳送到網路端，經RLC確認後，這個procedure即結束。後續因為Uplink Signalling Connection已建立完成，UE即可透過Uplink Direct transfer傳送NAS Message

4. 訊息中有一參數: EstablishmentCause用來告知網路端建立Uplink Signalling Connection的目的。可能的值為:

Before starting this topic, we should know what is IDLE and CONNECTED mode first. (#LTE RRC States)

1. Cell re-selection: IDLE mode -> IDLE mode

When a UE stays in RRC IDLE state and the signal of the region becomes very poor. The UE could perform Cell re-selection to switch to a better cell.

2. Handover: CONNECTED mode -> CONNECTED mode

If a UE is on the phone (CONNECTED mode) and the signal gets worse and worse. The UE could perform handover procedure. (e.g. LTE RRC CONNECTED to 3G RRC CONNECTED)