5G to 4G Interworking: Handover Call Flow

by

The process of 5G-4G internetworking involves interworking between the 5GS (5G System) and EPS (Evolved Packet System) to ensure the continuity of services provided to the UE (User Equipment) while moving between the 5GC (5G Core) network and the EPC (Evolved Packet Core) network.

The N26 interface between the MME (Mobility Management Entity) and the AMF (Access and Mobility Management Function) facilitates the interworking between the EPS and 5GS.

During the 5GS to EPS handover procedure, various steps are taken, such as sending Handover Required message from the NG-RAN (Next Generation Radio Access Network) to the AMF, SMContext_Retrieve message preparation, UPF (User Plane Function) selection, PFCP (Packet Forwarding Control Protocol) session modification, and sending Handover Command message to the UE.

5G to 4G Interworking
5G to 4G Interworking: Handover Call Flow and Functions Mapping

The N26-based handover procedures enable handover of the UE between the EPS and 5GS, which includes scenarios like 5GS to EPS handover, EPS to 5GS handover, and handover cancellations.

5G NSA Option 3 Deployment Options: Option 3, Option 3a, Option 3x
5G NSA Option 3 Deployment Options: Option 3, Option 3a, Option 3x

The combined SMF (Session Management Function) and PGW-C (Packet Data Network Gateway – Control Plane) performs UPF selection based on local configuration and decides whether to remove the I-UPF (In-line UPF) or not.

The SMF also sends a PFCP Session Modification Request message to the combined UPF and PGW-U (Packet Data Network Gateway – User Plane) to establish the CN (Control Plane) tunnel for each EPS bearer.

5GS to EPS Handover Procedure

Steps taken into 5GS to EPS Handover Procedure:

  1. The NG-RAN sends a Handover Required message to AMF.
  2. AMF sends an Nsmf_PDUSession_RetrieveSMContext Request message to the combined SMF and PGW-C.
  3. SMF checks if the EBI of the QoS flow associated with the default QoS rule is included in the notToTransferEbiList IE. a. If it is, SMF sends a 403 Forbidden HTTP status code with DEFAULT_EBI_NOT_TRANSFERRED error to the AMF and deletes the corresponding PDU session. b. If not, SMF retains the EPS bearer context mapped to the QoS flow.
  4. Optionally, PCF can send a SMPolicyControl_UpdateNotify Request message to the combined SMF and PGW-C.
  5. The combined SMF and PGW-C performs UPF selection and sends a PFCP Session Modification Request message to the combined UPF and PGW-U.
  6. The combined UPF and PGW-U sends a PFCP Session Modification Response message.
  7. SMF sends an Nsmf_PDUSession_RetrieveSMContext Response message to AMF.
  8. AMF sends a Forward Relocation Request message to MME.
  9. MME sends Create Session Request messages to SGW-C.
  10. SGW-C sends Create Session Response messages to MME.
  11. MME sends Handover Request message to E-UTRAN.
  12. E-UTRAN sends Handover Request Acknowledge message to MME.
  13. MME sends Forward Relocation Response message to AMF.
  14. AMF sends Handover Command message to NG-RAN.
  15. NG-RAN sends Handover Command message to UE.
  16. UE sends Handover Confirm message to E-UTRAN.
  17. E-UTRAN sends Handover Notify message to MME.
  18. MME sends Relocation Complete Notification message to AMF.
  19. AMF sends Relocation Complete Acknowledge message to MME.
  20. MME sends Modify Bearer Request messages to SGW-C.
  21. SGW-C sends Modify Bearer Request messages to the combined SMF and PGW-C.
  22. SMF validates the Modify Bearer Request message.
    • a. If validation fails, SMF rejects the request from SGW-C.
    • b. If validation succeeds, SMF stops the T5to4ho timer.
  23. The combined UPF and PGW-U sends a PFCP Session Modification Response message to the combined SMF and PGW-C.
  24. The combined SMF and PGW-C sends an Nsmf_PDUSession_UpdateSMContext Request message to the AMF, which includes the ueEpsPdnConnection IE in the SmContextToBeUpdatedData data type.
  25. The AMF sends a Handover Command message to the NG-RAN.
  26. The NG-RAN sends the Handover Command message to the UE. After the UE has successfully synchronized to the target cell, the UE sends a Handover Confirm message to the E-UTRAN.
  27. The target E-UTRAN sends a Handover Notify message to the MME.
  28. The MME sends a Relocation Complete Notification message to the AMF.
  29. The AMF sends a Relocation Complete Acknowledge message to the MME.
  30. The AMF sends an Nsmf_PDUSession_UpdateSMContext Response message to the combined SMF and PGW-C.
  31. The combined SMF and PGW-C sends a PFCP Session Modification Request message to the combined UPF and PGW-U to modify the CN tunnel for each EPS bearer with mapped EBIs that are not included in the notToTransferEbiList IE.
  32. The combined UPF and PGW-U sends a PFCP Session Modification Response message to the combined SMF and PGW-C.
  33. The 5GS to EPS Handover procedure is now complete.
5G to 4G Interworking: 5GS to EPS Handover Procedure
5G to 4G Interworking: 5GS to EPS Handover Procedure

EPS to 5GS Handover Procedure

Steps taken into EPS to 5GS Handover Procedure:

  1. The E-UTRAN sends a Handover Required message to the MME.
  2. The MME sends a Forward Relocation Request message to the AMF, which includes the MME/SGSN/AMF UE EPS PDN Connections IE.
  3. The AMF sends an Nsmf_PDUSession_CreateSMContext Request message to the combined SMF and PGW-C, including the hoState and ueEpsPdnConnection IEs.
  4. The hoState IE is set to PREPARING.
  5. The combined SMF and PGW-C finds a corresponding PDU Session based on the EPS Bearer ID and PGW S8-C F-TEID IEs received in the ueEpsPdnConnection IE.
  6. The combined SMF and PGW-C sends a PFCP Session Modification Request message to the combined UPF and PGW-U to establish the uplink CN tunnel for the PDU Session for both default and dedicated QoS flows.
  7. The combined UPF and PGW-U sends a PFCP Session Modification Response message to the combined SMF and PGW-C to allocate the PGW-U uplink CN tunnel information.
  8. The combined SMF and PGW-C sends an Nsmf_PDUSession_CreateSMContext Response message to the AMF, which includes the following IEs:
    • The hoState IE set to PREPARING
    • The PDU Session ID IE
    • The S-NSSAI IE
    • The allocatedEbiList IE
    • The PDU Session Resource Setup Request Transfer IE in the N2 SM Information container
  9. The combined SMF and PGW-C starts the configurable tn2ressetupreq timer to wait for receiving the N2 Handover Request Acknowledge Transfer IE in the Nsmf_PDUSession_UpdateSMContext Request message from the AMF.
  10. The combined SMF and PGW-C provides user plane security enforcement to the NG-RAN if user plane security is enabled.
  11. If the user plane security integrity is set to required, the allocatedEbiList IE is not included in the Nsmf_PDUSession_CreateSMContext Response message.
  12. The AMF sends a Handover Request message to the NG-RAN.
  13. The NG-RAN sends a Handover Request ACK message to the AMF.
  14. The AMF sends an Nsmf_PDUSession_UpdateSMContext Request message to the combined SMF and PGW-C, including the following:
    • The hoState IE set to PREPARED
    • The N2 SM informationcontainer received from the target 5G-AN
  15. Upon receiving the Nsmf_PDUSession_UpdateSMContext Request message with the hoState IE set to PREPARED, the combined SMF and PGW-C stops the tn2ressetupreq timer.
  16. The combined SMF and PGW-C sends an Nsmf_PDUSession_Update_SMContext Response message to the AMF, including the following:
    • The hoState IE set to PREPARED
  17. The combined UPF and PGW-U sends a PFCP Session Modification Response message to the combined SMF and PGW-C to confirm the switching of the downlink CN tunnel and release of the CN tunnels for EPS bearers.
  18. The combined SMF and PGW-C sends an Nsmf_PDUSession_UpdateSMContext Response message to the AMF to confirm the completion of the PDU session handover, including the hoState IE set to COMPLETED.
  19. The AMF sends a Forward Relocation Complete Notification message to the MME.
  20. The MME sends a Forward Relocation Complete Notification ACK message to the AMF.
  21. The UE sends a Path Switch Request message to the NG-RAN to establish a 5GS data path.
  22. The NG-RAN sends a Path Switch Request Acknowledge message to the UE.
  23. The UE sends a Path Switch Request message to the AMF.
  24. The AMF sends a Path Switch Request Acknowledge message to the UE, including the N2 SM information container.
  25. The AMF sends a Path Switch Request message to the combined SMF and PGW-C, including the N2 SM information container.
  26. The combined SMF and PGW-C sends a Path Switch Request Acknowledge message to the AMF, including the N2 SM information container.
  27. The UE sends a Handover Complete message to the E-UTRAN.
  28. The E-UTRAN sends a Handover Complete message to the MME.
  29. The MME sends a Handover Complete message to the AMF.
  30. The AMF sends an Nsmf_PDUSession_DeleteSMContext Request message to the combined SMF and PGW-C to request the deletion of the PDU session.
  31. The combined SMF and PGW-C sends an Nsmf_PDUSession_DeleteSMContext Response message to the AMF to confirm the deletion of the PDU session.
  32. The UE is now fully connected to the 5GS network and can start accessing 5G services.
5G to 4G Interworking: EPS to 5GS Handover Procedure
5G to 4G Interworking: EPS to 5GS Handover Procedure

Hope this article was able to cover the 5G to 4G Interworking call flow in detail. if you want to know how 5GC is different than 4G EPC then read here.

Also Read:  GSMA 5G Cybersecurity Knowledge Base

Related posts:

  1. 2G to 6G: The Evolution of Mobile Networks
  2. 5G Security Standards: 3GPP, ETSI, NIST, GSMA
  3. 5G Core Network Architecture: Detailed Guide
  4. 5G RAN Architecture: Nodes and Components
  5. 5G Interfaces: Understanding X2/Xn, S1/NG, F1 and E1 Interfaces
  6. 5G Deployment Options: Know All in Details
  7. 5G Security: In Detail Points and Enhancements over 4G
  8. GSMA 5G Cybersecurity Knowledge Base
Photo of author

Som D

Som is Network and Cloud Security expert with 12+ years of experience in the field and years of experience into 5G Security. She has researched, tested and written hundreds of articles on a variety of topics such as Network Security, Cloud Security, Wireless Security, Networking Basics, Mobile Operators services guides and 5G Security. In addition to her professional pursuits, Som is also a passionate into researching and publishing the content on other education platforms surrounding network security, cloud security and 5G security. She also creates guides, walkthroughs, solutions and more to help others with their progression in the same field.