BlogLTE (4G EPC) Attach & Detach Procedures
Bố cục bài viết
LTE (4G EPC) Attach & Detach Procedures
1. Attach Procedure (TS 23.401 §5.3.2)
Notes relevant to S6a security analysis
2. Detach / Session Termination Procedures (TS 23.401 §5.3.8)
2.A — UE-Initiated Detach (normal / switch-off)
2.B — Network-Initiated Detach / HSS-Initiated (Cancel Location, S6a)
2.C — Implicit Detach (no NAS signaling — abrupt loss of contact)
Notes relevant to S6a security analysis
LTE Attach Flow — No old-MME/SGSN
Reference
Trang này
Sunex
05/08/2026 · 12 phút đọc
Ngày tạo
05/08/2026
Cập nhật
Lượt xem
11
Đọc
12m
LTE (4G EPC) Attach & Detach Procedures
Reference diagrams for full session lifecycle: Attach (initial registration + PDN connectivity establishment) through Detach (session teardown), covering all three detach variants. Diagrams follow 3GPP TS 23.401 §5.3.2 (Attach) and §5.3.8 (Detach).
1. Attach Procedure (TS 23.401 §5.3.2)
UE eNodeB MME old-MME/SGSN SGW PGW HSS PCRF
| | | | | | | |
|--Attach Request--------->| | | | | |
| (IMSI/GUTI, PDN Type, | | | | | |
| Attach Type, UE NetCap)| | | | | |
| |--S1AP:Initial UE Message---->| | | | |
| | | | | | | |
| | |==[1] Identification (if GUTI cannot be resolved)========>| |
| | |--Identification Request------>| | | |
| | |<-Identification Response------| | | |
| | | | | | | |
| | |==[2] EPS AKA Authentication (if no valid security ctx)===| |
| | |--Authentication Info Request------------------------------->| |
| | | (S6a: AIR, IMSI, PLMN-Id) | | | |
| | |<-Authentication Info Answer-------------------------------| |
| | | (S6a: AIA, E-UTRAN-Vector: RAND/AUTN/XRES/KASME) | |
|<--Authentication Request-| | | | | |
| (RAND, AUTN, KSIasme) | | | | | |
|--Authentication Response>| | | | | |
| (RES) | | | | | |
| | |-- (verify RES == XRES) -----> | | | |
| | | | | | | |
| | |==[3] NAS Security Mode Command============================| |
|<--Security Mode Command--| | | | | |
| (NAS algo, KSI) | | | | | |
|--Security Mode Complete->| | | | | |
| | | | | | | |
| | |==[4] ME Identity Check (IMEISV, optional)=================| |
| | |--ME Identity Check -----------------> (EIR, out of scope) | |
| | | | | | | |
| | |==[5] Update Location (S6a)================================| |
| | |--ULR (IMSI, MME-Id, RAT-Type,-------------------------------->| |
| | | ULR-Flags, Homogeneous-Support)| | | |
| | |<-ULA (Subscription-Data:---------------------------------------| |
| | | APN-Config-Profile, AMBR, | | | |
| | | RAT-Frequency-Selection...) | | | |
| | | | | | | |
| | |==[6] Create Session Request (GTPv2-C, S11)================| |
| | |--Create Session Req --------->| | | |
| | | (IMSI, MSISDN, MME-F-TEID, | | | |
| | | PDN Type, APN, PAA=0.0.0.0, | | | |
| | | Default EPS Bearer QoS) | | | |
| | | |--Create Session Req ------>| | |
| | | | (SGW-F-TEID, APN,...) | | |
| | | | |--CCR-Initial (Gx)----------->| |
| | | | | (Subscription-Id, IP-CAN=EUTRAN) |
| | | | |<-CCA-Initial (Gx)-------------| |
| | | | | (Charging-Rule-Install, QoS) | |
| | | |<-Create Session Rsp -------| | |
| | | | (PGW-F-TEID, PAA=UE IP, | | |
| | | | Bearer Context: EBI, | | |
| | | | SGW-F-TEID for S1-U) | | |
| | |<-Create Session Rsp ----------| | | |
| | | (PAA/UE IP, EBI, SGW S1-U F-TEID, | | |
| | | PGW-F-TEID, Bearer QoS/AMBR) | | | |
| | | | | | | |
| | |==[7] Bearer Setup + Attach Accept (S1AP)==================| |
| |<-Initial Context Setup Req---| | | | |
| | (E-RAB to Setup: S1-U SGW TEID, QoS, | | | |
| | NAS PDU: Attach Accept | | | |
| | [APN, PAA, TAI list, GUTI, ESM: Activate | | | |
| | Default EPS Bearer Context Req]) | | | |
|<--RRC Connection Reconfig| (E-RAB setup, radio bearer, NAS: Attach Accept piggybacked) | |
| (contains Attach Accept)| | | | |
|--RRC Connection Reconfig | | | | |
| Complete--------------->| | | | |
| |--Initial Context Setup Rsp-->| | | | |
| | (eNodeB S1-U TEID) | | | | |
| | | | | | | |
|--Attach Complete--------->| | | | | |
| (NAS: Activate Default |--S1AP:Uplink NAS Transport--->| | | |
| EPS Bearer Context | | | | | |
| Accept, EBI) | | | | | |
| | | | | | | |
| | |==[8] Modify Bearer (GTPv2-C, S11)=========================| |
| | |--Modify Bearer Req ---------->| | | |
| | | (eNodeB S1-U F-TEID, EBI) | | | |
| | | |--Modify Bearer Req ------->| | |
| | | | (only if PGW needs eNB TEID directly - usually not) |
| | |<-Modify Bearer Rsp -----------| | | |
| | | | | | | |
|<===================== U-Plane data (GTP-U) ready: UE <-> eNB <-> SGW <-> PGW ======================>|
| | | | | | | |
Notes relevant to S6a security analysis
- [5] ULR/ULA carries
RAT-Type,ULR-Flags(bit 1 = single-registration, bit 5 = S6a/S6d indicator),Homogeneous-Support-of-IMS-Voice-Over-PS-Sessions. ULA returnsSubscription-DatacontainingAPN-Configuration-Profile(list of APN-Configuration entries, each with its own AMBR plus a subscriber-default) — the exact structure where DRA tampering has no downstream reject mechanism. - [6] Create Session Request/Response is GTPv2-C, fully decoupled from S6a — the MME simply uses ULA-derived data (APN-Config, QoS profile) to build the Create Session Request sent to SGW/PGW. Any AMBR tampering at ULA propagates directly into the GTPv2-C session with no HSS visibility into that step.
- PGW has no S6a visibility — it only receives forwarded GTPv2-C IEs from the MME plus Gx CCR-I from PCRF, with no way to cross-check the original HSS-issued AMBR value.
- HSS has no GTPv2-C visibility — one-way trust: MME trusts ULA, builds the session, and HSS never learns how that data was subsequently used.
2. Detach / Session Termination Procedures (TS 23.401 §5.3.8)
2.A — UE-Initiated Detach (normal / switch-off)
UE eNodeB MME SGW PGW HSS PCRF
| | | | | | |
|--Detach Request---------->| | | | |
| (GUTI, Detach Type= | | | | |
| switch-off/normal, | | | | |
| EPS Mobile ID) | | | | |
| |--S1AP:Uplink NAS Transport--->| | | |
| | | | | | |
| | |==[1] Delete Session (GTPv2-C, S11)========| |
| | |--Delete Session Req --------->| | |
| | | (LBI = linked bearer id, | | |
| | | Cause) | | |
| | | |--Delete Session Req ------>| | |
| | | | (LBI) | | |
| | | | |--CCR-Terminate (Gx)-------->|
| | | | | (Termination-Cause) |
| | | | |<-CCA-Terminate (Gx)---------|
| | | |<-Delete Session Rsp -------| |
| | |<-Delete Session Rsp ----------| | |
| | | | | | |
| | |==[2] Release UE context (S1AP)=============| |
|<--Detach Accept-----------| (sent only if Detach Type != switch-off) | |
| |--UE Context Release Command-->| | | |
| |<-UE Context Release Complete--| | | |
| | | | | | |
| [radio bearer + S1 signaling connection released] | |
| | | | | | |
| Note: MME does NOT send Cancel-Location to HSS here — the S6a session | |
| remains active; the subscriber stays "registered" at this MME until | |
| the implicit-detach timer expires or the UE re-attaches elsewhere. | |
| | | | | | |
2.B — Network-Initiated Detach / HSS-Initiated (Cancel Location, S6a)
Triggered e.g. when the subscriber is deleted/suspended at the HSS, or the UE attaches via a different MME.
HSS MME (old) eNodeB UE SGW PGW PCRF
| | | | | | |
|==[1] Cancel Location (S6a)===================================================| |
|--CLR (Cancellation-Type: -------->| | | | |
| SUBSCRIPTION_WITHDRAWAL / | | | | |
| UPDATE_PROCEDURE, IMSI) | | | | |
|<-CLA (Result-Code)----------------| | | | |
| | | | | | |
| |==[2] Detach Request (network-initiated, NAS)===| | |
| |--S1AP:Downlink NAS Transport--->| | | |
| | |--Detach Request (Detach Type,| | |
| | | Cause=re-attach required/ | | |
| | | not required)-------------->| | |
| | |<--Detach Accept---------------| | |
| | |<-S1AP:Uplink NAS Transport----| | |
| | | | | | |
| |==[3] Delete Session (GTPv2-C, S11)==============| | |
| |--Delete Session Req ----------->| | | |
| | |--Delete Session Req --------->| | |
| | | |--CCR-Terminate (Gx)-------->| |
| | | |<-CCA-Terminate (Gx)---------| |
| | |<-Delete Session Rsp ----------| | |
| |<-Delete Session Rsp -------------| | | |
| | | | | | |
| |==[4] Release UE context (S1AP)==================| | |
| |--UE Context Release Command---->| | | |
| |<-UE Context Release Complete----| | | |
| | | | | | |
| [MME deletes all EPS bearer context + MM context for this IMSI] | |
| | | | | | |
2.C — Implicit Detach (no NAS signaling — abrupt loss of contact)
MME SGW PGW PCRF
| | | |
| Mobile Reachability Timer | | |
| or Periodic TAU Timer | | |
| expires -> no response | | |
| | | |
|==Implicit Detach (internal to MME, NO NAS message sent to UE)==|
|--Delete Session Req ------->| | |
| |--Delete Session Req ----------->|
| | |--CCR-Terminate->|
| | |<-CCA-Terminate--|
| |<-Delete Session Rsp -------------|
|<-Delete Session Rsp --------| | |
| | | |
| MME releases S1 context (if still present) via UE Context |
| Release, Cause = "detach" or timer-based |
| | | |
Notes relevant to S6a security analysis
- Detach normally carries no S6a exchange. CLR/CLA only fires when the HSS actively withdraws the subscription or when the subscriber re-attaches at a different MME (update-procedure cancel). This mirrors the ULR/ULA gap already identified in the attach flow: Attach has an explicit S6a checkpoint, but most of the detach path only touches GTPv2-C (S11) + Gx — there is no real-time reconciliation between HSS and MME/SGW/PGW during teardown.
- Reinforces the “no downstream reject mechanism” finding: if ULA is tampered at attach (e.g. forged AMBR), the resulting session persists through its entire lifetime with no intermediate S6a checkpoint to catch it — Update Location only re-runs on TAU with MME change or periodic update.
- Implicit Detach [2.C] is a blind spot for LI/mediation: there is no NAS signaling at all, so if building a mediation-function pipeline for HI3, this termination event is only observable via the GTPv2-C Delete Session exchange, never via S1AP/NAS.
LTE Attach Flow — No old-MME/SGSN
UE eNodeB MME SGW PGW HSS PCRF
│ │ │ │ │ │ │
│──Attach Req→│ │ │ │ │ │
│ IMSI/GUTI │ │ │ │ │ │
│ Attach Type│ │ │ │ │ │
│ UE NetCap │ │ │ │ │ │
│ │─Initial UE Message─────────>│ │ │ │
│ │ │ │ │ │ │
│ │ │ [1] EPS AKA Authentication │ │
│ │ │── AIR ───────────────────────────────────────>│ │
│ │ │ User-Name = IMSI │ │
│ │ │<─ AIA ───────────────────────────────────────│ │
│ │ │ RAND / AUTN / XRES / KASME │ │
│<────────────│<────────────│ Authentication Request │ │
│ │ │ RAND / AUTN / KSI │ │
│────────────>│────────────>│ Authentication Response │ │
│ │ │ RES │ │
│ │ │ verify RES == XRES │ │
│ │ │ │ │ │ │
│ │ │ [2] NAS Security Mode │ │
│<────────────│<────────────│ Security Mode Command │ │
│────────────>│────────────>│ Security Mode Complete │ │
│ │ │ │ │ │ │
│ │ │ [3] Update Location │ │
│ │ │── ULR ───────────────────────────────────────>│ │
│ │ │ IMSI / MME Identity / RAT-Type / Flags │ │
│ │ │<─ ULA ───────────────────────────────────────│ │
│ │ │ Subscription-Data │ │
│ │ │ APN / AMBR / QoS / restrictions │ │
│ │ │ │ │ │ │
│ │ │ [4] Create PDN Session │ │
│ │ │──Create Session Request──────>│ │ │
│ │ │ S11 / GTPv2-C │ │ │
│ │ │ │──Create Session Request──────>│ │
│ │ │ │ S5/S8 / GTPv2-C │ │
│ │ │ │ │──CCR-Initial──>│ │
│ │ │ │ │ Gx │ │
│ │ │ │ │<─CCA-Initial───│ │
│ │ │ │ │ Policy/QoS │ │
│ │ │ │<─Create Session Response───────│ │
│ │ │ │ UE IP / Bearer / PGW TEID │ │
│ │ │<─Create Session Response─────│ │ │
│ │ │ UE IP / EBI / SGW S1-U TEID │ │
│ │ │ │ │ │ │
│ │ │ [5] Initial Context + Attach Accept │ │
│ │<─Initial Context Setup Request─────────────│ │ │
│ │ E-RAB Setup + NAS Attach Accept │ │ │
│<────────────│ │ │ │ │ │
│ RRC Reconfiguration + NAS Attach Accept │ │ │ │
│────────────>│ │ │ │ │ │
│ RRC Reconfiguration Complete │ │ │ │
│ │─Initial Context Setup Response─────────────>│ │ │
│ │ │ │ │ │ │
│──Attach Complete─────────>│ │ │ │ │
│ Activate Default EPS │ │ │ │ │
│ Bearer Context Accept │ │ │ │ │
│ │─Uplink NAS Transport──────>│ │ │ │
│ │ │──Modify Bearer Request──────>│ │ │
│ │ │ eNB S1-U F-TEID │ │ │
│ │ │ │──Modify Bearer Request───────>│ │
│ │ │ │<─Modify Bearer Response───────│ │
│ │ │<─Modify Bearer Response──────│ │ │
│ │ │ │ │ │ │
│<══════════════════════════════ GTP-U USER PLANE ═══════════════════════════════════════════>│
Reference
- 3GPP TS 23.401 §5.3.2 — Attach Procedure
- 3GPP TS 23.401 §5.3.8 — Detach Procedure
- 3GPP TS 29.272 — MME/HSS Diameter S6a/S6d interface (ULR/ULA, CLR/CLA, AIR/AIA)
- 3GPP TS 29.274 — GTPv2-C (S11: Create/Modify/Delete Session)
- 3GPP TS 29.212 — Gx interface (CCR/CCA)