MME

Overview

The MME — Mobility Management Entity — is the control plane anchor of the 4G Evolved Packet Core. It is the first core network node a UE contacts when attaching to an LTE network and the function responsible for managing that UE's registration state, security context, and session establishment for the entirety of the connection. Every attach, detach, tracking area update, paging, and handover flows through the MME.

The MME does not carry user plane traffic. Its role is purely signalling: it coordinates with the HSS to authenticate the subscriber, establishes NAS security with the UE (ciphering and integrity), instructs the SGW to create bearers, and orchestrates handovers between eNBs and between LTE and 3G networks. This separation of control and user planes — MME for control, SGW/PGW for data — was a design principle of the EPC architecture that 5G SA carried forward and formalised with the CUPS framework.

The MME communicates with the eNB via S1AP (the S1-MME interface), with the HSS via Diameter on S6a, with the SGW via GTPv2-C on S11, and with peer MMEs via GTPv2-C on S10 for handovers. For subscribers with 2G/3G fallback, it interfaces with the SGSN on S3 (GTPv2-C) and communicates with the MSC via the SGs interface for SMS and circuit-switched fallback (CSFB).

In production deployments, MMEs are grouped into MME pools. eNBs connect to multiple MMEs in the pool, and UE contexts are distributed across instances. The pool model provides redundancy and horizontal scaling without requiring per-UE configuration — the eNB selects an MME from the pool based on load indicators in SCTP connections. This was the direct predecessor to the AMF pool model in 5G.

---

How it works

LTE Attach procedure

The LTE attach is the foundational procedure — the UE has just powered on or entered LTE coverage for the first time.

1. The UE sends an Attach Request NAS message to the eNB. If the UE has no previous GUTI, it includes its IMSI. The eNB selects an MME from the pool and forwards the NAS PDU in an S1AP Initial UE Message.
2. The MME identifies the subscriber's HSS using the IMSI's MCC/MNC prefix and sends a Diameter Authentication Information Request (AIR) to the HSS on S6a, requesting EPS authentication vectors.
3. The HSS responds with an Authentication Information Answer (AIA) containing one or more EPS Authentication Vectors — each consisting of RAND, AUTN, XRES, and KASME.
4. The MME sends a NAS Authentication Request (RAND + AUTN) to the UE. The UE's USIM verifies AUTN, then computes RES and the KASME anchor key.
5. The UE returns a NAS Authentication Response carrying RES. The MME compares RES with XRES from the HSS. If they match, authentication succeeds.
6. The MME activates NAS security: it selects ciphering and integrity algorithms and sends a Security Mode Command to the UE. The UE responds with Security Mode Complete — NAS is now encrypted and integrity-protected.
7. The MME sends a Diameter Update Location Request (ULR) to the HSS on S6a. The HSS cancels the UE's registration in the previous MME (if any) and responds with an Update Location Answer (ULA) containing the full subscription profile: APNs, default QoS, roaming restrictions, AMBR.
8. The MME allocates a GUTI and instructs the SGW to create a bearer via a Create Session Request on S11 (GTPv2-C). The SGW forwards the request to the PGW on S5/S8.
9. On bearer creation success, the MME returns the Attach Accept NAS message to the UE via the eNB, including the GUTI, PDN addresses, and bearer QoS.

Tracking Area Update (TAU)

As a UE moves between eNBs, it reports its position to the MME via Tracking Area Update (TAU) requests. The Tracking Area (TA) is a group of cells; the UE only signals when it crosses a TA boundary, not every cell change.

1. The UE sends a NAS TAU Request including its GUTI and the visited TAI.
2. The MME validates the GUTI, checks whether the subscriber has roamed to a new MME's coverage area, and if so performs an inter-MME context fetch via S10 from the old MME.
3. The MME updates the SGW about the UE's new serving eNB (Modify Bearer Request on S11) if the UE is active, or records the new TA for paging if the UE is idle.
4. The MME returns TAU Accept, optionally with a new GUTI.

CS Fallback (CSFB) and SMS via SGs

For operators running 2G/3G voice alongside LTE data, the MME maintains an SGs interface to the MSC. When the UE registers on LTE, it also registers a combined EPS/IMSI attach with the MSC via the MME's SGs interface, enabling:

• SMS delivery: The MSC delivers SMS to the MME over SGs as a NAS SMS message, forwarded to the UE.
• CS Fallback: For voice calls, the MME redirects the UE to a 2G/3G cell via an Extended Service Request, where the call is handled by the circuit- switched MSC.

---

Architecture role

The MME is the control plane hub of the EPC. Every other signalling function — HSS, SGW, eNB, MSC — has a direct interface to it. It is the only EPC node with both a radio access interface (S1-MME to eNB) and interfaces to both the HSS (authentication) and the SGW (bearer management).

In 4G EPC: The MME manages NAS for every LTE UE. The HSS authenticates; the SGW and PGW carry the data; the PCRF enforces policy — but all coordination flows through or is initiated by the MME.

In 5G SA: The AMF replaces the MME with a narrower scope. Session management was extracted into the SMF, and the Diameter S6a interface to the HSS was replaced by the SBI N8 interface to the UDM.

For operators running 4G/5G NSA (Option 3x), the MME remains the control plane anchor. The 5G NR leg carries user plane only. The MME is not retired until the operator completes a full 5G SA migration.

---

Key interfaces

---

Security posture

The MME inherits the fundamental security risk of being the control plane entry point for every LTE subscriber. Its Diameter S6a interface to the HSS is a high- value target because it carries authentication vectors — the same vectors that, if extracted, allow an attacker to impersonate the network to the UE or decrypt NAS traffic. The S1-MME interface is protected by IPsec in properly deployed networks, but many operators, particularly in MNO to MVNO scenarios, have relaxed this requirement.

4G NAS security is a substantial improvement over 3G: integrity protection is mandatory for all NAS messages (unlike 3G where it was optional), and the KASME anchor key prevents the visited network from learning the UE's long-term key. However, the architecture retains the 4G vulnerability where the visited network — the MME — receives the full authentication vector including XRES from the HSS. In roaming scenarios, this means the visited MME has the expected response value, which is cryptographically equivalent to having the network authentication key for that session. 5G-AKA closed this by adding the home network confirmation step.

The MME's downgrade attack surface — forcing a UE from LTE to 3G or 2G — is a real operational risk in markets where 2G/3G coverage remains dense. A rogue base station that prevents a UE from seeing LTE signals forces it into the 2G/3G attach path through the SGSN, exposing it to SS7 and MAP attack surfaces.

---

Attack surface

S6a Diameter interface manipulation

The S6a interface between MME and HSS carries authentication vectors and subscription data over Diameter. In roaming scenarios, this interface traverses the IPX (via the Diameter Routing Agent / DRA), meaning authentication vectors flow through third-party infrastructure. An attacker with access to the IPX signalling path can intercept XRES values from the AIR/AIA exchange and use them to mount offline attacks against the subscriber's credentials.

Impact: Authentication vector exposure; ability to replay XRES for session impersonation in scenarios where the XRES is reusable.
Difficulty: Medium in domestic deployments; Low in roaming via IPX if Diameter edge protection (GSMA FS.19) is not deployed.

Rogue eNB via S1AP

The S1-MME interface uses S1AP over SCTP. When IPsec is not enforced — which is common in neutral-host, shared RAN, and indoor coverage scenarios — a device on the MME's S1 network that can send SCTP packets to the MME's S1 IP can impersonate an eNB. A rogue eNB can register phantom UEs, inject false handover required messages disrupting active sessions, or trigger paging storms.

Impact: Phantom UE registration consuming MME resources; handover disruption; paging denial-of-service.
Difficulty: Medium. Requires network access to the MME's S1 IP and knowledge of S1AP message formats. IPsec enforcement removes this attack class entirely.

NAS generation downgrade

If the MME accepts combined EPS/IMSI attach requests and the operator's 2G/3G network is reachable, a rogue base station can prevent a UE from connecting to LTE and force it through the 2G/3G attach path. The UE ends up in the SGSN/MSC domain, where SS7 MAP attacks apply. The MME itself is not attacked, but its failure to enforce LTE-only operation enables the downgrade.

Impact: Subscriber falls to 2G/3G, exposing them to location tracking, SMS interception, and denial-of-service via MAP.
Difficulty: Medium. Requires a software-defined radio to emit LTE-like signals that prevent UE from detecting genuine eNBs.

GTPv2-C S11 bearer injection

The S11 interface carries GTPv2-C messages between MME and SGW. If this interface is not secured and a rogue node can reach the S11 IP of the MME or SGW, it can send crafted Create Bearer Request or Modify Bearer Request messages — creating ghost bearers that consume SGW resources or modifying existing bearer tunnels to redirect user plane traffic.

Impact: Ghost bearer resource exhaustion; user plane traffic redirection for targeted subscribers.
Difficulty: High. Requires network access to the S11 segment and knowledge of active GTPv2-C session states (TEID values).

---

Mitigations

• IPsec on S1-MME: Enforce IKEv2 mutual certificate authentication on all S1 connections. This is mandatory in 3GPP security architecture (TS 33.401) but is frequently relaxed in practice. Non-IPsec S1 is the single largest fixable attack surface on the MME.

• Diameter edge protection on S6a: For roaming scenarios, deploy a Diameter Signalling Controller (DSC) or Diameter Edge Agent (DEA) on the S6a roaming path. Apply GSMA FS.19 filtering to reject or inspect Diameter messages from roaming partners that should not be initiating authentication procedures.

• S11/S10 interface segmentation: Place the S11 (MME-SGW) and S10 (MME-MME) interfaces on isolated VLANs reachable only from registered SGW and MME addresses. GTPv2-C has no authentication — network isolation is the only reliable defence.

• LTE-only NAS enforcement: Disable combined EPS/IMSI attach and CS Fallback for subscribers on VoLTE-capable devices. Subscribers with VoLTE do not need CSFB, and disabling it removes the SGs interface exposure and the 2G/3G fallback downgrade path.

• GUTI refresh: Refresh the GUTI at every periodic TAU. Static GUTIs enable passive UE tracking without active signalling — the same concern as 5G-GUTI tracking. Some MME implementations default to lazy refresh.

---

Spec references

• 3GPP TS 23.401 — The normative EPC architecture and procedure specification. Section 4 defines the EPC architecture and the MME's role; Section 5 defines all attach, TAU, handover, and bearer management procedures.

• 3GPP TS 29.272 — The normative Diameter S6a/S6d interface specification. Defines all command codes (AIR/AIA, ULR/ULA, ISD, PUR) and AVPs used between MME and HSS.

• 3GPP TS 36.413 — S1 Application Protocol (S1AP). Defines all procedures on the S1-MME interface between MME and eNB, including initial context setup, handover, paging, and error indication.

• 3GPP TS 33.401 — SAE security architecture. Section 6 defines EPS-AKA; Section 7 covers NAS security activation; Section 8 defines S1AP security (IPsec requirements).

---

Related topics

The MME is the direct predecessor to the AMF in 5G SA. The AMF took the mobility and registration functions; session management was separated into the SMF. The Diameter S6a to the HSS became the SBI N8 to the UDM.

The HSS is the MME's most critical peer — it provides authentication vectors via S6a and holds the subscription profile. The SGW handles bearer forwarding under the MME's direction via S11. The PCRF is not directly connected to the MME — policy is applied at the PGW/PCEF level — but the MME's bearer decisions determine what the PCRF can enforce.

Diameter is the transport protocol for S6a. All MME-HSS interactions — authentication, location update, subscription retrieval — are Diameter CCR/CCA and ULR/ULA exchanges.

For the full 4G architecture context, see 4G EPC.