Introduction
Welcome to the third module of our course. In the previous lessons, we focused on the Radio Access Network (RAN), exploring how a phone finds and decodes broadcast information from a cell tower (eNodeB). You learned to interpret this information from a security perspective, identifying potential downgrade vectors and information leakage.
Now, we're going to move from the airwaves into the heart of the mobile network. The eNodeB is just the front door; what happens once your connection request goes inside? This lesson addresses the learning outcome: Identify and describe the components of the LTE Evolved Packet Core (MME, SGW, PGW, HSS).
The Evolved Packet Core (EPC) is the "brain" of the 4G network. It handles everything from authenticating your identity to routing your data to the internet. Understanding its components is the essential foundation for learning about the protocol-level attacks that target the core network itself.
1. The Big Picture: Control Plane vs. User Plane
Before we look at individual components, it's crucial to understand a core design principle of modern networks that should be familiar from your IP networking background: the separation of the control plane and the user plane.
- Control Plane: This is for signaling and management traffic. Think of it as the conversation about the data. It handles tasks like setting up connections, authentication, deciding where to route traffic, and managing your mobility as you move between cell towers.
- User Plane: This is for the actual user data. It's the "payload"—your web browsing, video streaming, and app data.
This separation is fundamental to how the EPC is designed. Different components specialize in handling one or both of these "planes."
To see this in action, let's watch a short video that introduces the LTE architecture and this key concept.
Learn 4G LTE Network Architecture
The video 'Learn 4G LTE Network Architecture' by Mobile Packet Core provides a concise explanation of the control and user planes before introducing the main network components.
Please watch the video from the beginning until 01:31. Pay close attention to how the narrator distinguishes between signaling messages (control plane) and user data (user plane). Also, note the two main parts of the network identified: the E-UTRAN (access network) and the EPC (core network).
This diagram illustrates the concept clearly. The blue lines represent the control plane signaling path, while the orange lines show the more direct path your user data takes.
2. The Core Components of the EPC
The EPC consists of four main logical nodes that work together to provide connectivity. We'll examine each one, focusing on its specific role. For a quick, security-oriented overview, the article from P1 Security is an excellent starting point.
4G LTE Architecture and Security Explained
The article '4G LTE Architecture and Security Explained' provides a brief but effective description of each EPC component, and importantly for us, frames them in the context of their attack surface.
Read the section 'Inside the 4G LTE Core: EPC Breakdown'. This will give you a quick reference for the function and security relevance of the MME, SGW, PGW, and HSS.
Now, let's dive deeper into each component.
MME: Mobility Management Entity
The MME is the primary control node in the EPC. It operates exclusively in the control plane. You can think of it as the network's traffic director and security guard for subscribers.
- Primary Functions:
- Authentication: It orchestrates the authentication process by communicating with the HSS to verify the subscriber's identity.
- Mobility Management: It tracks the location of the phone (UE) at a high level (which group of towers, or "tracking area," it's in). This is how the network knows where to send incoming calls or data.
- Session Management: It's responsible for establishing, maintaining, and tearing down the data "bearers" (the logical pipes that carry user data).
Given your background, an analogy would be a combination of a RADIUS server (handling authentication requests), a DHCP server (managing session context), and a dynamic routing protocol manager for user sessions.
For a more detailed technical description, the YateBTS documentation is quite thorough.
Full LTE architecture and components - YateBTS
The 'Full LTE architecture and components' article from YateBTS offers a more in-depth look at the MME's functions.
From the article, read the subsection titled 'The MME'. Focus on the list of functions provided, such as Authentication, Mobility management, Location update, and Bearer establishment.
HSS: Home Subscriber Server
The HSS is the master database for the entire network. It's a critical, centralized component that holds all subscriber and security information.
- Primary Functions:
- Subscriber Profile Storage: It contains the user's IMSI, service subscriptions (e.g., are they allowed to use VoLTE? What's their data plan?), and roaming rights.
- Authentication Center (AuC): It stores the secret keys for each subscriber (the Ki) and generates the authentication vectors used by the MME to challenge the UE during the authentication procedure.
- Location Information: It keeps track of which MME is currently serving the subscriber.
This is the authoritative source of truth for user identity in the network. In an enterprise IT context, it serves a role similar to an Active Directory domain controller, holding all user accounts, permissions, and credentials.
Full LTE architecture and components - YateBTS
Let's return to the YateBTS article for a detailed look at the HSS.
Read the subsection 'The HSS'. Note its description as a 'central database' and its role in mobility management, authentication, and authorization.
SGW: Serving Gateway
The SGW is a user plane node that acts as a mobility anchor. Its primary job is to route and forward user data packets within the operator's network.
- Primary Functions:
- Local Mobility Anchor: When you move between eNodeBs, the SGW ensures your data session continues uninterrupted. Your connection to the SGW remains stable while your connection to the eNodeB changes.
- Packet Routing: It routes data packets between the eNodeB and the PGW.
- Paging: For an idle phone, the SGW buffers any incoming data and triggers the MME to page the device to wake it up.
Think of the SGW as a local or regional router. It handles traffic for a specific geographical area and manages mobility within that area. All user traffic from the cell towers flows through it.
Full LTE architecture and components - YateBTS
The YateBTS documentation explains the role of the SGW as an anchor point.
Read the subsection 'The S-GW'. Focus on its role as an 'anchor for handover' and its function of routing user data packets.
PGW: Packet Data Network Gateway
The PGW is the final piece of the puzzle. It's the gateway that connects the mobile operator's EPC to external packet data networks (PDNs), most commonly the public internet. It is also primarily a user plane node but has control plane functions for policy and IP address allocation.
- Primary Functions:
- IP Address Allocation: It is responsible for assigning an IP address to the phone. This is the IP address you see when you check "what's my IP" on your device.
- Policy Enforcement (PCEF): It enforces rules from the network, such as applying data rate limits or blocking certain types of traffic.
- Gateway to the Internet: It acts as the final entry and exit point for all user traffic.
The PGW is analogous to the main internet gateway, firewall, and NAT device for an entire corporate network. It's the border between the trusted mobile core and the untrusted public internet.
Full LTE architecture and components - YateBTS
Finally, read the description of the PGW in the YateBTS article.
Read the subsection 'The P-GW'. Note its role in providing connectivity to external networks, policy enforcement, and IP address allocation.
3. Visualizing the Connections
Now that you know the four main players, let's look at a diagram that shows how they connect to each other. These connections are called interfaces, and each has a specific name (e.g., S1, S6a, S11). You don't need to memorize them now, but it's useful to see the overall topology.
This diagram puts everything we've discussed together. You can trace the control plane path from the eNodeB to the MME (S1-MME), from the MME to the HSS (S6a), and from the MME to the gateways (S11). You can also trace the user plane path from the eNodeB, through the SGW, to the PGW, and out to the internet (SGi). As someone interested in network attacks, these interfaces are precisely where you would use a tool like Wireshark to analyze protocol traffic.
Conclusion
In this lesson, you have mapped out the core of the 4G LTE network. By moving past the radio tower, you've now identified the key servers that manage and route all cellular traffic.
Key Takeaways:
- EPC Architecture: The 4G core, or EPC, is built on the principle of separating the Control Plane (signaling) from the User Plane (data).
- MME (Mobility Management Entity): The control plane "brain" that handles authentication, mobility tracking, and session management.
- HSS (Home Subscriber Server): The master database holding subscriber profiles and security keys, acting as the authoritative source for identity.
- SGW (Serving Gateway): The user plane "mobility anchor" that routes data packets locally and ensures seamless handovers between cell towers.
- PGW (Packet Data Network Gateway): The user plane "gateway" that connects the mobile network to the internet, allocating IP addresses and enforcing policies.
Preview of the Next Lesson:
Now that you know the key components of the EPC, the next logical step is to see how they interact. Our next lesson, "Describe the LTE attach procedure, from initial access to bearer setup," will walk you through the sequence of events and messages exchanged between your phone and these core network components to get you connected. You'll see the theory you learned today put into practice in a step-by-step process.