EPS Network Elements (MME/S-GW/P-GW/HSS/PCRF) in LTE 4G

Introduction

The Evolved Packet System (EPS) is the end-to-end LTE system: a single radio access network (E-UTRAN, built entirely from eNBs) plus a packet-only core (EPC). There is no circuit-switched domain — voice, video and web all ride the same IP bearers. Every network element on this page is one of those two halves, and every element lives on the control plane, the user plane, or (only the eNB) both.

You meet these nodes at every stage of the UE lifecycle. At Attach the eNB carries your RRC signalling to the MME, which authenticates you with the HSS and builds a data path through the S-GW and P-GW. In RRC_IDLE the MME tracks you by Tracking Area and pages you through the eNB when data arrives. During mobility the eNBs hand you between cells over X2 while the S-GW keeps the anchor still. Learn the roles once and every later procedure becomes a matter of "which box, which interface, which plane."

Why it matters: almost every outage post-mortem, log trace and interview question resolves faster when you can instantly place a node on a plane and name the interface it terminates. Signalling problems point at control-plane nodes; throughput and IP problems point at user-plane nodes; the eNB is the one place the two meet.

Why network elements are split this way

The concrete purpose of the split is independent scaling and placement. Signalling load (attaches, pages, TAUs) grows differently from traffic load (video, downloads), so operators want to add MME capacity without touching gateways, and vice versa. Separating planes also lets operators push user-plane gateways deep toward the internet edge for low latency while keeping control-plane MMEs centralised for simpler mobility. Compared to 3G, LTE also removed the RNC: the eNB absorbed radio-controller functions and makes its own real-time scheduling and handover decisions, cutting a whole hop out of the latency budget.

The Big Picture — EPS = E-UTRAN + EPC

The full system is the Evolved Packet System (EPS). It has exactly one radio node — the eNB — and a small handful of core nodes: MME, S-GW, P-GW, HSS and PCRF. The single most useful habit when you first meet the architecture is to sort every node onto a plane. The control plane carries signalling — attach, authentication, paging, bearer setup — and the user plane carries the tunnelled IP packets your apps actually send and receive. Almost every exam question, log trace and outage post-mortem becomes easier once you reflexively ask "is this a control-plane node or a user-plane node?"

eNB — the Radio Node

The eNB (evolved Node B) owns everything about the air interface. Unlike 3G, there is no central controller above it, so the eNB makes its own real-time radio decisions and coordinates with its neighbours directly over the X2 interface rather than through a controller.

Its responsibilities cover the whole radio protocol stack. It performs Radio Resource Management (RRM): admission control, radio bearer control, connection mobility control, and dynamic resource allocation. It does scheduling — deciding, slot by slot, which UE gets which uplink and downlink resource blocks based on channel quality (CQI), buffer status and QoS. It runs Radio Resource Control (RRC) — the signalling protocol that configures, reconfigures and releases the UE's connection and moves it between RRC_IDLE and RRC_CONNECTED. In the PDCP layer it performs header compression (ROHC) so the air interface is efficient, and ciphering and integrity protection of the radio link so it is secure. It makes the handover decision — reading the UE's measurement reports and deciding when to move it to a better cell, then executing an X2 or S1 handover. Finally, on the network side it terminates S1-MME to the MME (control) and S1-U to the S-GW (user data), and X2 to peer eNBs.

The eNB is also where the radio identifiers live. Each connected UE is addressed in the cell by a 16-bit C-RNTI that the eNB's MAC assigns and XORs into the CRC of every PDCCH grant; the cell itself carries a PCI (1 of 504, from PSS/SSS) for blind detection and a globally unique ECGI (PLMN ID + ECI, where the ECI embeds the 20-bit macro eNB ID + 8-bit cell ID) broadcast in SIB1. On the network side the eNB also holds one end of the S1-U GTP-U tunnel (a 32-bit TEID per bearer) and the eNB UE S1AP ID that names each UE's control association toward the MME.

MME — the Control-Plane Brain

The MME (Mobility Management Entity) is the top of the control plane. It never touches user data — not a single IP packet of your traffic passes through it. Instead it runs all the signalling that keeps a UE registered, reachable and authorised.

Its main jobs are worth learning individually. It terminates NAS signalling (the direct UE-to-core dialogue that tunnels transparently through the eNB) and handles NAS security — integrity protection and ciphering of NAS messages, and derivation of the key hierarchy. It runs authentication together with the HSS using EPS-AKA. It performs EPS mobility management: idle-mode UE tracking by Tracking Area, paging when downlink data arrives for an idle UE, and processing of Tracking Area Updates (TAU). It controls bearer activation, modification and deactivation — the control-plane side of building the data path, including the default bearer at Attach and any dedicated bearers. It does the selection work: S-GW and P-GW selection when a UE attaches, and MME selection at handover. It supports MME pooling for resilience and load sharing (see below), and it handles roaming by fetching subscription data and authentication vectors from the home HSS over the S6a Diameter interface. It also talks to the S-GW/P-GW over S11/GTP-C to set up bearers, and to peer MMEs over S10 for mobility.

The MME is also the owner of the UE's temporary identities. It assigns the GUTI — structured as GUMMEI + M-TMSI, where the GUMMEI (PLMN ID + MMEGI + 8-bit MMEC) names exactly this MME worldwide — to shield the permanent IMSI. Paging and Service Request then use the compact 40-bit S-TMSI (MMEC + M-TMSI), a slice of the GUTI. On the S1-MME interface the MME allocates the 32-bit MME UE S1AP ID, which together with the eNB UE S1AP ID uniquely names the UE's control-plane context.

S-GW and P-GW — the User-Plane Path

Your actual packets ride a chain of GTP-U tunnels: eNB → S-GW → P-GW → the internet. These two gateways are where the user plane lives, and each is an anchor of a different scope.

The P-GW (PDN Gateway) sits at the edge, facing the external Packet Data Network over the SGi interface. It is the node that makes the UE part of the internet. It performs UE IP address allocation (IPv4, IPv6 or both), acts as the IP anchor to external PDNs, and enforces policy: it hosts the PCEF (Policy and Charging Enforcement Function), taking dynamic PCC rules from the PCRF over the Gx interface. It performs per-flow QoS enforcement, applies DPI and service-data-flow gating (blocking or allowing flows), does per-flow charging (online and offline), enforces the downlink APN-AMBR, and serves as the anchor between 3GPP and non-3GPP access. It connects to the S-GW over S5 (non-roaming, same operator) or S8 (roaming, home P-GW reached from a visited S-GW). In many deployments the S-GW and P-GW are collocated in a single physical box, which turns the S5/S8 interface into an internal reference point.

Both gateways are also full of tunnel identifiers. Each GTP-U tunnel end is named by a 32-bit TEID, and there is a separate TEID per direction and per hop — one pair on S1-U (eNB↔S-GW) and another on S5/S8 (S-GW↔P-GW) — so a downlink packet is routed to the correct EPS Bearer (EBI 5–15) hop by hop. The control-plane setup of these tunnels rides GTP-C on S11 and S5/S8.

HSS and PCRF — Subscribers and Policy

Two support nodes feed the rest of the network with the data they need to make decisions. Neither carries user traffic; both are pure control plane.

The HSS (Home Subscriber Server) is the master subscriber database. It holds every subscriber's permanent identity (IMSI), their subscription and QoS profile — which APNs they may use, their AMBR ceilings, their default bearer QoS, roaming permissions — and the long-term secret key. From that key it generates the authentication vectors used in EPS-AKA. When the MME authenticates a UE, or needs its subscription profile during Attach, or must register the UE's current serving MME, it exchanges these over the S6a Diameter interface. The HSS also stores which MME is currently serving each subscriber, so the network can locate a subscriber for mobile-terminated services.

The PCRF (Policy and Charging Rules Function) is the policy decision point. It decides the QoS and charging treatment for each service data flow and installs the resulting PCC rules into the P-GW's PCEF over Gx. Policy can be static (pre-provisioned rules the PCEF applies without asking) or dynamic (the PCRF pushes rules in real time based on the service). The PCRF also talks to the IMS core over the Rx interface: when you place a VoLTE call, the IMS Application Function (AF) tells the PCRF what the media session needs, and the PCRF tells the P-GW to build a dedicated bearer with the right QCI and bit rate. It may also pull subscriber policy from a Subscription Profile Repository (SPR) over Sp.

The Supporting Cast — ePDG, ANDSF, EIR and Legacy Interworking

Beyond the six core nodes, a real EPC leans on several more elements for Wi-Fi offload, access-network steering, device screening and coexistence with older 3GPP networks. You will meet all of these in deployment diagrams even if they are quieter in the textbook flow.

The ePDG (evolved Packet Data Gateway) is the secure gateway for untrusted non-3GPP access — typically public Wi-Fi. The UE builds an IPsec tunnel (IKEv2) to the ePDG, which then connects on to the P-GW over the S2b interface, so a Wi-Fi session lands on the same P-GW and keeps the same IP anchor as cellular. This is what makes seamless Wi-Fi Calling and ePDG-based offload work.

The ANDSF (Access Network Discovery and Selection Function) is a policy server that helps the UE decide which access to use and when to move traffic between 3GPP and Wi-Fi. It delivers discovery information, inter-system mobility policy and routing rules (over the S14 reference point) so the operator, not just the handset, influences offload behaviour.

The EIR (Equipment Identity Register) is a database of device identities (IMEI) used to screen equipment — allowing, watching or blocking stolen or non-compliant devices. The MME queries it over the S13 interface during Attach or TAU to check the UE's IMEI/IMEISV.

For coexistence with 2G/3G, the EPC interworks with the legacy packet core through the SGSN. The MME exchanges mobility context with the SGSN over S3 (so a UE can move between LTE and UMTS/GPRS while keeping its session), and the SGSN connects to the S-GW over S4 for the user plane. This is how a call survives a drop from LTE to 3G.

Pooling — MME Pool Areas and S-GW Service Areas

In production networks the core nodes are not deployed one-per-region; they are grouped into pools for resilience, load balancing and reduced signalling. Understanding pooling explains why an eNB connects to several MMEs at once.

An MME Pool Area is a region served by a group of MMEs, any of which can serve any UE in that area. Each eNB in the pool area has an S1-MME connection to every MME in the pool. When a UE attaches, the eNB uses the NAS Node Selection Function (NNSF) to pick an MME — usually from a routing hint in the UE's temporary identity (the GUTI, which carries an MMEC). The benefits are direct: if one MME fails, the others absorb its load; adding capacity means adding an MME to the pool rather than re-planning; and because a large area is covered by one pool, a moving UE crosses fewer MME boundaries, cutting inter-MME TAU signalling.

The equivalent concept on the user plane is the S-GW Service Area — the set of Tracking Areas one S-GW can serve. Overlapping service areas let the MME keep a UE on the same S-GW as it moves, avoiding S-GW relocation and its associated signalling and brief user-plane interruption. Well-designed pool and service areas are a major lever for both reliability and signalling efficiency.

Every Node at a Glance — Roles and Interfaces

The comprehensive map — each node, what it does, and the interfaces it terminates:

And the plane classification, which is the fastest way to reason about any flow:

Summary

LTE is the EPS: one radio node type (eNB) plus a lean packet core (EPC). Sort every node onto a plane and the whole architecture unlocks. The eNB owns the air — scheduling, RRC, PDCP ciphering, handover decisions — and is the only node on both planes. The MME is the control-plane brain: NAS, authentication with the HSS over S6a, mobility, paging, and the owner of the GUTI/S-TMSI. Your bytes never touch it — they ride GTP-U tunnels through the S-GW (local anchor) and P-GW (global IP anchor and single policy-enforcement point).

Around the six core nodes, the HSS stores subscriptions, the PCRF decides policy that the P-GW's PCEF enforces, and the ePDG, ANDSF, EIR and SGSN handle Wi-Fi offload, access steering, device screening and 2G/3G interworking. Pooling ties it together: an eNB links to a whole MME pool for resilience, choosing per-UE via the NNSF. Keep the verbs straight — stores vs uses, decides vs enforces, local vs global anchor — and every LTE call flow reads like a map you already know.