4G is where telecom became IP. The radio (LTE) and the core (EPC) were redesigned together: flatter, faster, packet-only. Voice is just another IP service (VoLTE, see Module 9).
Names to know
- LTE — Long Term Evolution (the radio). LTE-Advanced / LTE-A Pro — later releases (carrier aggregation, 4×4 MIMO, 256QAM).
- E-UTRAN — Evolved UMTS Terrestrial Radio Access Network (the radio network) = all the eNodeBs.
- EPC — Evolved Packet Core (the core). EPS — Evolved Packet System = LTE + EPC.
- SAE — System Architecture Evolution (the name of the core work item).
1. Architecture
UE ─ eNodeB ──S1-MME── MME ──S6a── HSS
│ │S11
└──S1-U── SGW ──S5/S8── PGW ──SGi── Internet / IMS
│Gx
PCRF
| Node | Full name | Job | Older equivalent |
|---|---|---|---|
| UE | User Equipment | Phone + USIM | MS / UE |
| eNodeB (eNB) | evolved NodeB | Radio site and radio controller in one (no RNC) | BTS+BSC / NodeB+RNC |
| MME | Mobility Management Entity | Control plane: attach, authentication, tracking area, paging, bearer setup | VLR / SGSN control |
| SGW | Serving Gateway | User-plane anchor while the phone moves between eNBs | SGSN user plane |
| PGW (P-GW) | PDN Gateway | Gives the IP address, applies policy/charging, exit to internet/IMS | GGSN |
| HSS | Home Subscriber Server | Subscriber DB + authentication keys | HLR/AuC |
| PCRF | Policy and Charging Rules Function | Decides QoS and charging rules per flow | — |
| OCS / OFCS | Online / Offline Charging System | Prepaid / postpaid charging | SCP |
| ePDG | evolved Packet Data Gateway | Entry for untrusted Wi-Fi (VoWiFi) | — |
| SGSN-MME combo | Often co-located in practice | ||
| MBMS / eMBMS | Multimedia Broadcast Multicast Service | Broadcast TV/events over LTE | |
| EIR | Equipment Identity Register | IMEI blacklist check (S13) | |
| SMS over SGs / SMSoIP | SMS in LTE: via the MSC (SGs interface) or via IMS (IP-SM-GW) |
Interfaces (names you'll see in traces)
| Interface | Between | Protocol |
|---|---|---|
| LTE-Uu | UE – eNB | Radio (RRC, PDCP, RLC, MAC, PHY) |
| S1-MME | eNB – MME | S1AP over SCTP |
| S1-U | eNB – SGW | GTP-U over UDP |
| X2 | eNB – eNB | X2AP — handovers between neighbours |
| S11 | MME – SGW | GTP-C (GTPv2-C) |
| S5 / S8 | SGW – PGW (S5 = same network, S8 = roaming) | GTPv2-C / GTP-U (or PMIP) |
| S6a | MME – HSS | Diameter (authentication, location update) |
| S6d | SGSN – HSS | Diameter |
| S10 | MME – MME | GTPv2-C — context transfer |
| Gx | PGW – PCRF | Diameter — policy rules |
| Gy / Ro, Gz / Rf | PGW – OCS / OFCS | Diameter — online / offline charging |
| Rx | P-CSCF – PCRF | Diameter — IMS asks for QoS |
| SGi | PGW – external network | IP |
| SGs | MME – MSC | SGsAP — combined attach, CSFB, SMS |
| S13 | MME – EIR | Diameter — IMEI check |
| Cx / Sh | CSCF/AS – HSS | Diameter (IMS) |
Pattern: control plane signalling = S1AP / GTP-C / Diameter. User plane = GTP-U tunnels carrying the IP packets.
2. Radio concepts (LTE air interface)
| Concept | Explanation |
|---|---|
| OFDMA (downlink) | Orthogonal Frequency Division Multiple Access — the channel is split into many narrow, tightly packed subcarriers (15 kHz); different users get different groups of them |
| SC-FDMA (uplink) | Single-Carrier FDMA — lower peak-to-average power so phone batteries last longer |
| Resource block (RB) | 12 subcarriers × one 0.5 ms slot (the scheduler assigns them in pairs per 1 ms) — the smallest chunk the scheduler hands out |
| Channel widths | 1.4, 3, 5, 10, 15, 20 MHz (up to 100 MHz with aggregation) |
| FDD / TDD | Frequency vs Time Division Duplex: separate frequencies for down/up, or the same frequency in alternating time slots |
| Modulation | QPSK → 16QAM → 64QAM → 256QAM (more bits per symbol when signal is clean) |
| MIMO | Multiple antennas at both ends (2×2, 4×4, 8×8) to send parallel streams |
| CA | Carrier Aggregation — bundle up to 5 (LTE-A Pro: up to 32) carriers → more speed |
| CoMP, eICIC | Coordination between cells to reduce interference |
| Small cells, HetNet | Many small low-power cells added under the big macro cells |
| Scheduler | The eNB algorithm that decides every 1 ms who gets which resource blocks |
| CQI / RSRP / RSRQ / SINR / RSSI | Radio quality measures: Channel Quality Indicator / Reference Signal Received Power / Quality / Signal-to-Interference-plus-Noise Ratio / Received Signal Strength |
| UE categories | Cat 4 (150 Mbit/s), Cat 6 (300), Cat 12–20 (600 Mbit/s – 2 Gbit/s) |
Bands (Europe): B20 (800 MHz, coverage), B3 (1800), B7 (2600), B1 (2100), B28 (700), B38/B40 (TDD 2600/2300).
Radio protocol stack (UE ↔ eNB)
RRC (control) · PDCP (compression, ciphering) · RLC (segmentation, retransmission) · MAC (scheduling, HARQ) · PHY. Above RRC: NAS (UE ↔ MME: attach, tracking area update, session mgmt).
3. Key procedures
Attach (switching on the phone)
- UE sends RRC Connection Request → eNB; then Attach Request (NAS) to the MME.
- MME gets authentication vectors from the HSS (Authentication Information Request, S6a), authenticates the UE (EPS-AKA).
- Security mode — NAS and AS ciphering/integrity are turned on.
- MME sends Update Location Request to the HSS, receives the subscriber profile (APNs, QoS, AMBR).
- MME asks the SGW (Create Session Request, S11) → PGW (S5) which allocates the IP address.
- Default bearer is established (QCI 9), Attach Accept goes to the UE, radio bearer is set up.
Other procedures
| Procedure | Meaning |
|---|---|
| TAU (Tracking Area Update) | Phone tells the MME it moved to a new Tracking Area (TA) — the LTE equivalent of Location Update |
| Paging | Network wakes an idle phone in its TA list |
| Service Request | Idle phone becomes active to send/receive data |
| Handover (X2/S1) | Moving an active session between eNBs; X2 = direct, S1 = through the MME |
| IRAT handover | Between technologies (LTE ↔ 3G/2G) |
| Detach | Switching off / leaving the network |
| RRC states | IDLE (no radio connection, only tracking area known) vs CONNECTED |
| ECM / EMM | EPS Connection Management / EPS Mobility Management states |
| DRX | Discontinuous Reception — phone sleeps between checks to save battery |
Bearers and QoS
A bearer is a tunnel with a defined quality between UE and PGW. | Term | Meaning | |---|---| | Default bearer | Always on, best effort, created at attach | | Dedicated bearer | Extra bearer with special QoS (e.g. VoLTE audio) | | QCI | QoS Class Identifier (1–9, plus 65–85 for mission-critical) | | GBR / non-GBR | Guaranteed Bit Rate or not | | ARP | Allocation and Retention Priority — who gets dropped in congestion | | AMBR | Aggregate Maximum Bit Rate — subscriber/APN speed cap | | TFT | Traffic Flow Template — filter that maps packets to the right bearer |
| QCI | Type | Typical use |
|---|---|---|
| 1 | GBR | Conversational voice (VoLTE) |
| 2 | GBR | Live video |
| 5 | non-GBR | IMS signalling |
| 6–8 | non-GBR | Buffered video, TCP apps |
| 9 | non-GBR | Default internet |
4. Identities in LTE
IMSI, GUTI (Globally Unique Temporary Identity: replaces TMSI), S-TMSI, C-RNTI, TAI (Tracking Area Identity), ECGI (E-UTRAN Cell Global Identifier), EPS bearer ID, TEID (Tunnel Endpoint Identifier, GTP).
5. LTE for IoT
| Tech | What | Speed / use |
|---|---|---|
| LTE-M (eMTC / Cat-M1) | LTE for machines | ~1 Mbit/s, mobility, voice possible — trackers, wearables |
| NB-IoT (Cat-NB1) | Narrowband IoT, 180 kHz | ~30–60 kbit/s, deep indoor, 10-year battery — meters, sensors |
| PSM / eDRX | Power Saving Mode / extended DRX | Devices sleep for hours or days |
| SCEF | Service Capability Exposure Function | Sends small data via control plane to apps |
6. Weak points of 4G
LTE fixed many 2G/3G holes (mutual auth, strong ciphers EEA/EIA: SNOW 3G, AES, ZUC), but: - Diameter replaced SS7 as the interconnect protocol — and has many of the same trust problems (see Module 15). - GTP on roaming links (S8) can be abused. - IMSI catchers still force phones down to 2G or catch the IMSI at attach. - Fallback to 2G/3G (CSFB) reopens SS7 attacks.
Remember this: 4G = eNodeB + MME + SGW + PGW + HSS + PCRF, with Diameter for control, GTP for user data, and voice as VoLTE over IMS. Everything is IP; the "circuit" concept is gone.