Attachment Types in the Registration Flow

Yesterday 18:58

Does anybody know how a subscriber registers

with the IMS network in the VoLTE solution?

A subscriber can register with the IMS network

through the EPC network, PS network, and CS
network.

EPC Attachment PS Attachment CS Attachment

Procedure Procedure Procedure

IMS-HSS IMS-HSS IMS-HSS

Requires the
Requires the Requires the
subscriber's
3 subscriber's 3 subscriber's 3 authentication data.
authentication data. authentication data.

P-CSCF I/S-CSCF P-CSCF I/S-CSCF I/S-CSCF

Sends a REGISTER Sends a REGISTER

2 request to the IMS through 2 request to the IMS mAGCF
the EPC network. through the PS network.

CS
EPC PS network
network network Sends a REGISTER
request to the IMS through
2 the mAGCF on the CS
network.

Attaches on the Attaches on the

1 EPC network.
1 PS network. 1 Attaches on the
CS network.

UE UE UE

NE Involved in the Registration Flow

Yesterday 18:59

Does anybody know which NEs registration messages

need to travel through?

I know this one! When a subscriber sends a registration

request, an access network is chosen according to signal
strength. Registration flow then travels through NEs on the
access network and the IMS network. Let me explain this
concept to everybody.

UE EPC/PS/CS Network IMS Network

Wireless Network Access Network IMS Network

2G/3G/4G UE P-CSCF: Initial contact point between

MME: Mobility management entity
subscribers and the IMS
eNodeB: Base station integrated with the base
station controller, which is used on 4G S-GW: Serving gateway I-CSCF: An entry point of the home IMS network
network
S-CSCF: Service switching center of the IMS
Soft terminal P-GW: PDN gateway network, which processes registration and
authentication.
BTS: Base station on 2G networks SGSN: Serving GPRS support node
IMS-HSS: Subscriber database of the IMS network

BSC: Base station controller GGSN: Gateway GPRS support node

MMTel AS: Service processing entity

NodeB: Base station on 3G networks

EMSC (mAGCF): Enhanced MSC Server
PCRF: Provides the PCC policy

RNC: Radio network controller

MGW: Media gateway

Complete Picture of the Registration Flow

Yesterday 19:30

So, what is the general process for registration flow?

Well, that's easy. Let me tell you about it in detail.

The following networking sample illustrates how a subscriber registers with the IMS network through the EPC network.

EPC network
Convergent HLR/HSS
attachment

ta
da
n
tio ata.
a
tic n d
en io
th ipt
a u scr
ns b
a i su
bt d
O an
2

S/P-GW PCRF
Sends a request to establish
3 the default bearer. 4 Requests the PCC policy.
MME
6 Sends a response. 5 Responds with the
PCC policy.
Default bearer (using SIP)
7
In
fo
r
1

m
s
th
Se

e
n

U
ds

E
of
an

th
At

e
ta

EP
c
h

C
R

at
eq

ta
ue

c hm
st

en
m
es

t.
sa
ge
.

UE

1 The UE sends an Attach Request message to the MME.

2 The MME sends a request to obtain data from the convergent HLR/HSS to authenticate the UE. After the authentication
is successful, the MME obtains the subscription data from the convergent HLR/HSS.

3 The MME selects the S-GW and P-GW based on the APN configuration and network topology. The MME, then, sends a Create Session Request
message to the S/P-GW to establish the default bearer.
4 The S/P-GW sends a request to the PCRF, setting up an IP-CAN session to obtain the default PCC policy of the UE.

5 The PCRF sends the PCC policy to the S/P-GW.

6 The S/P-GW notifies the MME that the default bearer has been established.

7 The MME notifies the UE that the EPC network attachment is successful.

Registration and User Network

Authentication on Authentication Authentication
the IMS
Convergent HLR/HSS Convergent HLR/HSS

t. Compares XRES
the se su D o w
ds tor bs
cri n l o a
l o a ve c and RES to
Obtains subscriber

Including XRES, RAND, n pti

w on on ds
Do icati da authenticate the UE.
AUTN, IK, and CK e nt ta.
18
data.

uth
22

a
10
17
11 I/S-CSCF
21 REGISTER
Saves XRES. I/S-CSCF
ATS
23 200
12 9 16 19
Including RAND,
401 REGISTER REGISTER 200
RES, IK, and CK

S/P-GW S/P-GW
13 8 REGISTER 15 REGISTER
Obtains and saves
IK and CK.
14 401 20 200
P-CSCF P-CSCF
Default bearer (using SIP)

Default bearer (using SIP)

UE UE

8 The UE obtains the IMSI from the USIM card to calculate the IMPI and T-IMPU. Then, the UE sends a REGISTER message to the P-CSCF.

The P-CSCF uses the domain name in the Request-URI to query the DNS server for the I-CSCF address. Then, the P-CSCF forwards the
9 REGISTER message to the I-CSCF. After obtaining the S-CSCF address from the convergent HLR/HSS, the I-CSCF forwards the REGISTER
message to the S-CSCF.

10 The S-CSCF sends a message to the convergent HLR/HSS, requesting the authorization vector (AV). The convergent /HSS responds with a
quintuple including Expected Response (XRES), Random Challenge (RAND), Authentication Token (AUTN), Integrity Key (IK), and Cipher Key (CK).

11 The S-CSCF saves XRES for authenticating the UE.

12 The S-CSCF uses RAND and AUTN to generate a nonce. Then, the S-CSCF includes the nonce with IK, CK, and authentication algorithm to the
WWW-Authenticate header field of a 401 message sent to the P-CSCF.

13 The P-CSCF extracts and saves IK and CK.

14 The P-CSCF resolves RAND and AUTN from the nonce and forwards them in the 401 message to the UE.

The UE authenticates the AUTN based on the shared encryption key stored in the local IMS Subscriber Identity Module (ISIM). The authentication
15 success indicates that the 401 message comes from the UE's hone network. Then, the UE uses the shared encryption key and RAND to calculate a
Response (RES) and includes the RES in another REGISTER message.

16 The P-CSCF sends the REGISTER message to the S-CSCF by following the transmission path of the first REGISTER message.

17 The S-CSCF verifies that the value of XRES is the same as the value of obtained RES, indicating that authentication is passed.

The S-CSCF sends a request to download the subscription data from the convergent HLR/HSS. The convergent HSS/HLR responds with the
18
subscription data.

19 The S-CSCF sends a 200 message to the P-CSCF, indicating that the registration is successful.

20 The P-CSCF forwards the 200 message to the UE.

21 The S-CSCF sends a third-party registration request to the ATS whose address is obtained from the iFC.

The ATS sends a request to obtain the subscriber data (including the subscriber ID and subscription data) from the convergent HLR/HSS. The
22
convergent HSS/HLR responds with the subscriber data.

After the ATS successfully authenticates the subscriber based on the subscriber data, the ATS saves the subscriber data in itself and responds
23
with a 200 message to the S-CSCF. The registration flow on the IMS network is complete.

For details about the specific message samples and key IE explanation, click the appendix.

Next Episode
VoLTE Call Flow

In the next episode, we will help to answer the following questions concerning VoLTE:
How does the VoLTE network process a call? How is a 3G network selected in a 4G-to-3G
call?