LTE Frequently Asked Questions for HRD

LTE Frequently Asked Questions
•    What is LTE?
•    What is goal of LTE?
•    What speed LTE offers?
•    What is LTE Advanced?
•    What is LTE architecture?
•    What is EUTRAN?
•    What are LTE Interfaces?
•    What are LTE Network elements?
•    What are LTE protocols & specifications?
•    What is VoLGA?
•    What is CS Fallback in LTE?
•    How does LTE Security works?
•    What is IP Multimedia Subsystem (IMS)?
•    How does measurements work in LTE?
•    What is Automatic Neighbour Relation?
•    How does Intra E-UTRAN Handover is performed?
•    How does policy control and charging works in LTE?
•    What is SON & how does it work in LTE?
•    How does Network Sharing works in LTE?
•    How does Timing Advance (TA) works in LTE?
•    How does LTE UE positioning works in E-UTRAN?
•    How many operators have committed for LTE?
•    What is Single Radio Voice Call Continuity (SRVCC)?
•    How does Location Service (LCS) work in LTE network?
•    How does Lawful Interception works in LTE Evolved Packet System?
•    What is carrier aggregation in LTE-Advanced?
•    What is Relay Node and how does Relaying works in LTE-Advanced?

What is LTE?
LTEi (Long Term Evolution) is initiated by 3GPPi to improve the mobile phone standard to cope with future technology evolutions and needs.
•    Login or register to post comments

•  
What is goal of LTE?
The goals for LTE include improving spectral efficiency, lowering costs, improving services, making use of new spectrum and reformed spectrum opportunities, and better integration with other open standards.
•    Login or register to post comments

•  
What speed LTE offers?
LTE provides downlink peak rates of at least 100Mbit/s, 50 Mbit/s in the uplink and RAN (Radio Access Network) round-trip times of less than 10 ms.
•    Login or register to post comments

•  
What is LTE Advanced?
LTE standards are in matured state now with release 8 frozen. While LTE Advanced is still under works. Often the LTE standard is seen as 4G standard which is not true. 3.9G is more acceptable for LTE. So why it is not 4G? Answer is quite simple - LTE does not fulfill all requirements of ITU 4G definition.
Brief History of LTE Advanced: The ITU has introduced the term IMT Advanced to identify mobile systems whose capabilities go beyond those of IMT 2000. The IMT Advanced systems shall provide best-in-class performance attributes such as peak and sustained data rates and corresponding spectral efficiencies, capacity, latency, overall network complexity and quality-of-service management. The new capabilities of these IMT-Advanced systems are envisaged to handle a wide range of supported data rates with target peak data rates of up to approximately 100 Mbit/s for high mobility and up to approximately 1 Gbit/s for low mobility.
See LTE Advanced: Evolution of LTE for more details.
•    Login or register to post comments

•  
What is LTE architecture?
The evolved architecture comprises E-UTRAN (Evolved UTRAN) on the access side and EPC (Evolved Packet Core) on the core side.

The figure below shows the evolved system architecture


•    Login or register to post comments

•  
What is EUTRAN?
The E-UTRAN (Evolved UTRAN) consists of eNBs, providing the E-UTRA user plane (PDCP/RLC/MAC/PHY) and control plane (RRC) protocol terminations towards the UE. The eNBs are interconnected with each other by means of the X2 interface. The eNBs are also connected by means of the S1 interface to the EPC (Evolved Packet Core), more specifically to the MME (Mobility Management Entity) by means of the S1-MME and to the Serving Gateway (S-GW) by means of the S1-U.
•    Login or register to post comments

•  
What are LTE Interfaces?
The following are LTE Interfaces : (Ref: TS 23.401 v 841)
•    S1-MME :- Reference point for the control plane protocol between E-UTRAN and MME.
•    S1-U:- Reference point between E-UTRAN and Serving GW for the per bearer user plane tunnelling and inter eNodeB path switching during handover.
•    S3:- It enables user and bearer information exchange for inter 3GPP access network mobility in idle and/or active state.
•    S4:- It provides related control and mobility support between GPRS Core and the 3GPP Anchor function of Serving GW. In addition, if Direct Tunnel is not established, it provides the user plane tunnelling.
•    S5:- It provides user plane tunnelling and tunnel management between Serving GW and PDN GW. It is used for Serving GW relocation due to UE mobility and if the Serving GW needs to connect to a non-collocated PDN GW for the required PDN connectivity.
•    S6a:- It enables transfer of subscription and authentication data for authenticating/authorizing user access to the evolved system (AAA interface) between MME and HSS.
•    Gx:- It provides transfer of (QoS) policy and charging rules from PCRF to Policy and Charging Enforcement Function (PCEF) in the PDN GW.
•    S8:- Inter-PLMN reference point providing user and control plane between the Serving GW in the VPLMN and the PDN GW in the HPLMN. S8 is the inter PLMN variant of S5.
•    S9:- It provides transfer of (QoS) policy and charging control information between the Home PCRF and the Visited PCRF in order to support local breakout function.
•    S10:- Reference point between MMEs for MME relocation and MME to MME information transfer.
•    S11:- Reference point between MME and Serving GW.
•    S12:- Reference point between UTRAN and Serving GW for user plane tunnelling when Direct Tunnel is established. It is based on the Iu-u/Gn-u reference point using the GTP-U protocol as defined between SGSN and UTRAN or respectively between SGSN and GGSN. Usage of S12 is an operator configuration option.
•    S13:- It enables UE identity check procedure between MME and EIR.
•    SGi:- It is the reference point between the PDN GW and the packet data network. Packet data network may be an operator external public or private packet data network or an intra operator packet data network, e.g. for provision of IMS services. This reference point corresponds to Gi for 3GPP accesses.
•    Rx:- The Rx reference point resides between the AF and the PCRF in the TS 23.203.
•    SBc:- Reference point between CBC and MME for warning message delivery and control functions.
•    Login or register to post comments

•  
What are LTE Network elements?
eNB
eNB interfaces with the UE and hosts the PHYsical (PHY), Medium Access
Control (MAC), Radio Link Control (RLC), and Packet Data Control
Protocol (PDCP) layers. It also hosts Radio Resource Control (RRC)
functionality corresponding to the control plane. It performs many
functions including radio resource management, admission control,
scheduling, enforcement of negotiated UL QoS, cell information
broadcast, ciphering/deciphering of user and control plane data, and
compression/decompression of DL/UL user plane packet headers.
Mobility Management Entity
manages and stores UE context (for idle state: UE/user identities, UE mobility state, user security parameters). It generates temporary identities and allocates them to UEs. It checks the authorization whether the UE may camp on the TA or on the PLMN. It also authenticates the user.

Serving Gateway
The SGW routes and forwards user data packets, while also acting as the mobility anchor for the user plane during inter-eNB handovers and as the anchor for mobility between LTE and other 3GPP technologies (terminating S4 interface and relaying the traffic between 2G/3G systems and PDN GW).
Packet Data Network Gateway
The PDN GW provides connectivity to the UE to external packet data networks by being the point of exit and entry of traffic for the UE. A UE may have simultaneous connectivity with more than one PDN GW for accessing multiple PDNs. The PDN GW performs policy enforcement, packet filtering for each user, charging support, lawful Interception
and packet screening.
•    Login or register to post comments

•  
What are LTE protocols & specifications?
In LTE architecture, core network includes Mobility Management Entity (MME), Serving Gateway  (SGW), Packet Data Network Gateway (PDN GW) where as E-UTRAN has E-UTRAN NodeB (eNB).
See LTE protocols & specifications for specification mappings.
Protocol links are as below
•    Air Interface Physical Layer
•    GPRS Tunnelling Protocol User Plane (GTP-U)
•    GTP-U Transport
•    Medium Access Control (MAC)
•    Non-Access-Stratum (NAS) Protocol
•    Packet Data Convergence Protocol (PDCP)
•    Radio Link Control (RLC)
•    Radio Resource Control (RRC)
•    S1 Application Protocol (S1AP)
•    S1 layer 1
•    S1 Signalling Transport
•    X2 Application Protocol (X2AP)
•    X2 layer 1
•    X2 Signalling Transport
          Login or register to post comments

What is VoLGA?
VoLGA stands for "Voice over LTE via Generic Access". The VoLGA service resembles the 3GPP Generic Access Network (GAN). GAN provides a controller node - the GAN controller (GANC) - inserted between the IP access network (i.e., the EPS) and the 3GPP core network.

The GAN provides an overlay access between the terminal and the CS core without requiring specific enhancements or support in the network it traverses. This provides a terminal with a 'virtual' connection to the core network already deployed by an operator. The terminal and network thus reuse most of the existing mechanisms, deployment and operational aspects.

see VoLGA - Voice over LTE via Generic Access for more details.
•    Login or register to post comments

•  
What is CS Fallback in LTE?
LTE technology supports packet based services only, however 3GPP does specifies fallback for circuit switched services as well. To achieve this LTE architecture and network nodes require additional functionality, this blog is an attempt to provide overview for same.
In LTE architecture, the circuit switched (CS) fallback in EPS enables the provisioning of voice and traditional CS-domain services (e.g. CS UDI video/ SMS/ LCS/ USSD). To provide these services LTE reuses CS infrastructure when the UE is served by E UTRAN.
See Understanding CS Fallback in LTE for more details.
•    Login or register to post comments

•  
How does LTE Security works?
 The following are some of the principles of 3GPP E-UTRAN security based on 3GPP Release 8 specifications:
•    The keys used for NAS and AS protection shall be dependent on the algorithm with which they are used.
•    The eNB keys are cryptographically separated from the EPC keys used for NAS protection (making it impossible to use the eNB key to figure out an EPC key).
•     The AS (RRC and UP) and NAS keys are derived in the EPC/UE from key material that was generated by a NAS (EPC/UE) level AKA procedure (KASME) and identified with a key identifier (KSIASME).
•    The eNB key (KeNB) is sent from the EPC to the eNB when the UE is entering ECM-CONNECTED state (i.e. during RRC connection or S1 context setup).
See LTE Security Principles for more details.
•    Login or register to post comments

•  
What is IP Multimedia Subsystem (IMS)?
The 3GPP IP Multimedia Subsystem (IMS) technology provides an architectural framework for delivering IP based multimedia services. IMS enables telecom service providers to offer a new generation of rich multimedia services across both circuit switched and packet switched networks. IMS offers access to IP based services independent of the access network e.g. wireless access (GPRS, 3GPP’s UMTS, LTE, 3GPP2’s CDMA2000) and fixed networks (TISPAN’s NGN)
IMS defines a architecture of logical elements using SIP for call signaling between network elements and Provides a layered approach with defined service, control, and transport planes. Some of IMS high level requirements are noted below:
The application plane provides an infrastructure for the provision and management of services, subscriber configuration and identity management and defines standard interfaces to common functionality.
The IMS control plane handles the call related signaling and controls transport plane. Major element of control plane is the Call Session Control Function (CSCF) , which comprises Proxy-CSCF (P-CSCF),  Interrogating-CSCF (I-CSCF) and Serving-CSCF (S-CSCF). The CSCF (Call/Session Control Function) is essentially a SIP server.
The IMS transport plane provides a core IP network with access from subscriber device over wireless or wireline networks.
•    Login or register to post comments

•  
How does measurements work in LTE?
In LTE E-UTRAN measurements to be performed by a UE for mobility are classified as below
•    Intra-frequency E-UTRAN measurements
•    Inter-frequency E-UTRAN measurements
•    Inter-RAT measurements for UTRAN and GERAN
•    Inter-RAT measurements of CDMA2000 HRPD or 1xRTT frequencies
See Measurements in LTE E-UTRAN for details.
•    Login or register to post comments

•  
What is Automatic Neighbour Relation?
According to 3GPP specifications, the purpose of the Automatic Neighbour Relation (ANR) functionality is to relieve the operator from the burden of manually managing Neighbor Relations (NRs). This feature would operators effort to provision.
Read Automatic Neighbour Relation in LTE for more details.
•    Login or register to post comments

•  
How does Intra E-UTRAN Handover is performed?
Intra E-UTRAN Handover is used to hand over a UE from a source eNodeB to a target eNodeB using X2 when the MME is unchanged. In the scenario described here Serving GW is also unchanged. The presence of IP connectivity between the Serving GW and the source eNodeB, as well as between the Serving GW and the target eNodeB is assumed.

The intra E-UTRAN HO in RRC_CONNECTED state is UE assisted NW controlled HO, with HO preparation signalling in E-UTRAN.
Read LTE Handovers - Intra E-UTRAN Handover for more details.
•    Login or register to post comments

•  
How does policy control and charging works in LTE?
A important component in LTE network is the policy and charging control (PCC) function that brings together and enhances capabilities from earlier 3GPP releases to deliver dynamic control of policy and charging on a per subscriber and per IP flow basis.
LTE Evolved Packet Core (EPC) EPC includes a PCC architecture that provides support for fine-grained QoS and enables application servers to dynamically control the QoS and charging requirements of the services they deliver. It also provides improved support for roaming. Dynamic control over QoS and
charging will help operators monetize their LTE  investment by providing customers with a variety of QoS and charging options when choosing a service.
The LTE PCC functions include:
•    PCRF (policy and charging rules function) provides policy control and flow based charging control decisions.
•    PCEF (policy and charging enforcement function) implemented in the serving gateway, this enforces gating and QoS for individual IP flows on the behalf of
•    the PCRF. It also provides usage measurement to support charging
•    OCS (online charging system) provides credit management and grants credit to the PCEF based on time, traffic volume or chargeable events.
•    OFCS (off-line charging system) receives events from the PCEF and generates charging data records (CDRs) for the billing system.
Refer following whitepapers for more details.
Introduction to Evolved Packet Core
Policy control and charging for LTE networks
Quality of Service (QoS) and Policy Management in Mobile Data Networks
•    Login or register to post comments

•  
What is SON & how does it work in LTE?
Self-configuring, self-optimizing wireless networks is not a new concept but as the mobile networks are evolving towards 4G LTE networks, introduction of self configuring and self optimizing mechanisms is needed to minimize operational efforts. A self optimizing function would increase network performance and quality reacting to dynamic processes in the network.
This would minimize the life cycle cost of running a network by eliminating manual configuration of equipment at the time of deployment, right through to dynamically optimizing radio network performance during operation. Ultimately it will reduce the unit cost and retail price of wireless data services.
See Self-configuring and self-optimizing Networks in LTE for details.
•    Login or register to post comments

•  
How does Network Sharing works in LTE?
3GPP network sharing architecture allows different core network operators to connect to a shared radio access network. The operators do not only share the radio network elements, but may also share the radio resources themselves.
Read Network Sharing in LTE for more.
•    Login or register to post comments

•  
How does Timing Advance (TA) works in LTE?
In LTE, when UE wish to establish RRC connection with eNB, it transmits a Random Access Preamble, eNB estimates the transmission timing of the terminal based on this. Now eNB transmits a Random Access Response which consists of timing advance command, based on that UE adjusts the terminal transmit timing.
The timing advance is initiated from E-UTRAN with MAC message that implies and adjustment of the timing advance.
See Timing Advance (TA) in LTE for further details.
•    Login or register to post comments

•  
How does LTE UE positioning works in E-UTRAN?
UE Positioning function is required to provide the mechanisms to support or assist the calculation of the geographical position of a UE. UE position knowledge can be used, for example, in support of Radio Resource Management functions, as well as location-based services for operators, subscribers, and third-party service providers.
See LTE UE positioning in E-UTRAN for more details.

•    Login or register to post comments

•  
How many operators have committed for LTE?
List of operators committed for LTE has been compiled by 3GAmericas from Informa Telecoms & Media and public announcements. It includes a variety of commitment levels including intentions to trial, deploy, migrate, etc.
For latest info visit http://ltemaps.org/
•    Login or register to post comments

•  
What is Single Radio Voice Call Continuity (SRVCC)?
Along with LTE introduction, 3GPP also standardized Single Radio Voice Call Continuity (SRVCC) in Release 8 specifications to provide seamless continuity when an UE handovers from LTE coverage (E-UTRAN) to UMTS/GSM coverage (UTRAN/GERAN). With SRVCC, calls are anchored in IMS network while UE is capable of transmitting/receiving on only one of those access networks at a given time.
See Evolution of Single Radio Voice Call Continuity (SRVCC) for more details.
•    Login or register to post comments

•  
How does Location Service (LCS) work in LTE network?
In the LCS architecture, an Evolved SMLC is directly attached to the MME. The objectives of this  evolution is to support location of an IMS emergency call,  avoid impacts to a location session due to an inter-eNodeB handover, make use of an Evolved  and support Mobile originated location request (MO-LR) and mobile terminated location request MT-LR services.
Release 9 LCS solution introduces new interfaces in the EPC:
•    SLg between the GMLC and the MME
•    SLs between the E-SMLC and the MME
•    Diameter-based SLh between the HSS and the HGMLC
For details read LCS Architecture for LTE EPS and LTE UE positioning in E-UTRAN
•    Login or register to post comments

•  
How does Lawful Interception works in LTE Evolved Packet System?
3GPP Evolved Packet System (EPS) provides IP based  services. Hence, EPS is responsible only for IP layer interception of Content of Communication (CC) data. In addition to CC data, the Lawful Interception (LI) solution for EPS offers generation of Intercept Related Information (IRI) records from respective control plane (signalling) messages as well.
See Lawful Interception Architecture for LTE Evolved Packet System for more details.
•    Login or register to post comments

•  
What is carrier aggregation in LTE-Advanced?
To meet LTE-Advanced requirements, support of wider transmission bandwidths is required than the 20 MHz bandwidth specified in 3GPP Release 8/9. The preferred solution to this is carrier aggregation.
It is of the most distinct features of 4G LTE-Advanced. Carrier aggregation allows expansion of effective bandwidth delivered to a user terminal through concurrent utilization of radio resources across multiple carriers. Multiple component carriers are aggregated to form a larger overall transmission bandwidth.
See Carrier Aggregation for LTE-Advanced for more details.
•    Login or register to post comments

•  
What is Relay Node and how does Relaying works in LTE-Advanced?
For efficient heterogeneous network planning, 3GPP LTE-Advanced has introduced concept of Relay Nodes (RNs). The Relay Nodes are low power eNodeBs that provide enhanced coverage and capacity at cell edges.  One of the main benefits of relaying is to provide extended LTE coverage in targeted areas at low cost.
The Relay Node is connected to the Donor eNB (DeNB) via radio interface, Un, a modified version of E-UTRAN air interface Uu. Donor eNB also srves its own UE as usual, in addition to sharing its radio resources for Relay Nodes.

LTE Interview Questions?
1)     What happens when a LTE UE is powered on? From PHY Layer Point of view & NAS Point of view?
2)     Explain attach procedure in LTE?
3)     Why there is two types of security in LTE?
4)     What are the measurement events in LTE?
Ans:
Intra/Inter Frequency Events:

Event A1 (Serving becomes better than threshold)
Event A2 (Serving becomes worse than threshold)
Event A3 (Neighbour becomes offset better than PCell)
Event A4 (Neighbour becomes better than threshold)
Event A5 (PCell becomes worse than threshold1 and neighbour becomes better than threshold2)
Event A6 (Neighbour becomes offset better than SCell)

Inter RAT Events:

Event B1 (Inter RAT neighbour becomes better than threshold)
Event B2 (PCell becomes worse than threshold1 and inter RAT neighbour becomes better than
threshold2)
5)     What is DCI?
6)     What are the contents of DCI?
7)     What are the main difference between DCI0 and DCI1a?
8)     What is contention resolution?
9)     When Radio Link Failure is detected?
Ans:
 Radio link failure to be detected:
  1) upon T310 expiry
  2) upon random access problem indication from MAC while neither T300, T301, T304 nor T311 is running
  3) upon indication from RLC that the maximum number of re-transmissions has been reached

10)   What is SRS used for?
Ans: UL reference signal used to measure the channel quality over a section of the bandwidth.
Node B use this information for frequency selective scheduling and link adaptation decisions.
11)   What is DMRS/DRS?
Ans: DMRS/DRS is uplink reference signal.
     Used for : 1)Channel Estimation and synchronization in UL
                2)EnodeB can use DMRS for calculating TA command for each UE.
     Two Types: 1) PUSCH DMRS.
                2) PUCCH DMRS.
     PUSCH DMRS:
                1) Included in every resource block allocated to UE for PUSCH transmission.
                2) Distributed only in Frequency domain to preserve the PAPR characteristic of SC-FDMA.
                3) 12 Resource element per resource block allocated to PUSCH DMRS.
     PUCCH DMRS:
                1) Included in every resource block allocated to UE for PUCCH transmission(if transmitted).PUCCH occupies 2 resource block per 1 ms subframe when transmitted.
                2) No of REs used for PUCCH DMRS depends on a) PUCCH format to be transmitted and whether b) normal or extended cyclic prefix used.
                3) PUCCH DRMS used more no of bits in case of format 1,1a,1b and less no of bits in caseof format 2, 2a, 2b.
12)   What is SPS? Explain SPS?
Ans: http://howltestuffworks.blogspot.in/2013/10/semi-persistent-scheduling.html
13)   What is DRX?
14)   Explain Connected mode DRX and Idle mode DRX?
15)   Why PHICH configuration is mentioned in MIB?
16)   In what are the scenario RACH is triggered?
17)   What is RACH Procedure?
18)   How UE come to know which RACH Preamble to USE?
19)   Why there is no SOFT HO in LTE?
20)   What PLMN Selection Order UE follows during  Automatic PLMN selection and Manual PLMN Selection?
21)   What is Timing Advance? What happens if Timing Advance Timer Expires?
Ans: The timing of UL radio frame is relative to DL radio frame. EnB provides timing advance command to each UE such that all UL transmissions arrive at the eNodeB in synchronous manner.

   If TA timer expires UE goes of reestablishment procedure or move to idle.
22)   What is SR? What is the use of SR?
23)   What is MAC CE?
24)   What is BackOff Indicator? What is the use of Backoff indicator?
Ans :
     Backoff Indicator is a special MAC subheader that carries the parameter indicating the time delay between a PRACH and the next PRACH.

if the Random Access Response contains a Backoff Indicator subheader
   set the backoff parameter value in the UE as indicated by the BI field of the Backoff Indicator subheader
else,
   set the backoff parameter value in the UE to 0 ms.



25)   What is BSR?
      Ans: The Buffer Status reporting procedure is used to provide the serving eNB with information about the amount of data available for transmission in the UL buffers of the UE.

26)   At what scenario UE triggers BSR?
Ans:
•    UL data, for a logical channel which belongs to a LCG, becomes available for transmission in the RLC entity or in the PDCP entity and either the data belongs to a logical channel with higher priority than the priorities of the logical channels which belong to any LCG and for which data is already available for transmission, or there is no data available for transmission for any of the logical channels which belong to a LCG, in which case the BSR is referred below to as "Regular BSR";
•    UL resources are allocated and number of padding bits is equal to or larger than the size of the Buffer Status Report MAC control element plus its subheader, in which case the BSR is referred below to as "Padding BSR"
•     retxBSR-Timer expires and the UE has data available for transmission for any of the logical channels which belong to a LCG, in which case the BSR is referred below to as "Regular BSR"
•    periodicBSR-Timer expires, in which case the BSR is referred below to as "Periodic BSR".

27)   When different types of BSR are Triggered?
Ans:
For Regular and Periodic BSR:

 if more than one LCG has data available for transmission in the TTI where the BSR is transmitted
      report Long BSR
 else,
      report Short BSR.

For Padding BSR:

if the number of padding bits is equal to or larger than the size of the Short BSR plus its subheader but smaller than the size of the Long BSR plus its subheader:
       if more than one LCG has data available for transmission in the TTI where the BSR is transmitted: report Truncated BSR of the LCG with the highest priority logical channel with data available for transmission;
      else
      report Short BSR.
 else if the number of padding bits is equal to or larger than the size of the Long BSR plus its subheader,       
      report Long BSR.

28)   What is the use of system info modification period?
29)   What is the content of RAR?
Ans:
A MAC RAR consists of the four fields
•             R
•             Timing Advance Command
•             UL Grant
•             Temporary C-RNTI


30) What is the USE of UE specific Reference signal?
31) What is Cell Specific Reference Signal?
32) In what are the scenario UE Triggers RRC Connection Reestablishment?
Ans:
      UE Triggers RRC Connection Reestablishment procedure on following condition:
•    Upon detecting Radio Link Failure
•    Handover Failure
•    Mobility From E-UTRA Failure
•    Integrity Failure Indication Received From Lower Layers
•    RRC Connection Reconfiguration Failure
      33) What is GUTI?
      34) What is the significance of S-TMSI?
      35) What is the content of Paging Message?
      36) When UE activates integrity and ciphering?
Ans:
•    The SECURITY MODE COMMAND message is used to command the UE for the activation of AS security. E-UTRAN always initiates this procedure prior to the establishment of Signalling Radio Bearer2 (SRB2) and Data Radio Bearers (DRBs).
•    AS security comprises of the integrity protection of RRC signalling (SRBs) as well as the ciphering of RRC signalling (SRBs) and user plane data (DRBs). The integrity protection algorithm is common for signalling radio bearers SRB1 and SRB2. The ciphering algorithm is common for all radio bearers (i.e. SRB1, SRB2 andDRBs). Neither integrity protection nor ciphering applies for SRB0.
•    The eNodeB sends integrity protected SECURITY MODE COMMAND message to the UE. The UE shall derive KeNB and KRRCint which is associated with integrity protection algorithm indicated in the SECURITY MODE COMMAND. Then, UE verifies the Integrity of the received SECURITY MODE COMMAND by checking the Message Authentication Code (MAC) in the SECURITY MODE COMMAND message. If the SECURITY MODE COMMANDmessage fails the integrity protection check, then the UE sends SECURITY MODE FAILURE to the eNodeB.
•    If the SECURITY MODE COMMAND passes the integrity protection check, then the UE shall derive the encryption keys KRRCenc key and the KUPenc keys associated with the ciphering algorithm indicated in theSECURITY MODE COMMAND.
•    The UE shall apply integrity protection using the indicated algorithm (EIA) and the integrity key, KRRCintimmediately, i.e. integrity protection shall be applied to all subsequent messages received and sent by the UE, including the SECURITY MODE COMPLETE message.
•     The UE shall apply ciphering using the indicated algorithm (EEA), KRRCenc key and the KUPenc key after completing the procedure, i.e. ciphering shall be applied to all subsequent messages received and sent by the UE, except for the SECURITY MODE COMPLETE message which is sent un-ciphered.