1128  NB-IoT Architecture

Cellular IoT Network Architecture and Components

Prerequisites: NB-IoT Technical Specifications | Cellular IoT Fundamentals

This enables: NB-IoT Power Optimization | NB-IoT Applications

1128.1 Learning Objectives

By the end of this chapter, you will be able to:

  • Describe the CIoT architecture: Explain the components and their roles in NB-IoT networks
  • Understand data paths: Compare Control Plane and User Plane optimization for small data
  • Identify key components: Describe the functions of eNodeB, MME, SCEF, S-GW, and P-GW
  • Explain the attach procedure: Understand how NB-IoT devices connect to the network

1128.2 Cellular IoT Architecture Overview

The Cellular IoT (CIoT) architecture extends the traditional LTE Evolved Packet Core (EPC) with optimizations specifically designed for IoT applications. NB-IoT introduces new components and procedures that dramatically reduce power consumption and signaling overhead for devices that send small, infrequent data.

Graph diagram

Graph diagram
Figure 1128.1

Comprehensive NB-IoT network architecture diagram showing the complete signal path from IoT devices (sensors, meters, trackers) through the radio access network (eNodeB base stations), evolved packet core (MME, SGW, PGW), to application servers and cloud platforms, illustrating how NB-IoT integrates with existing LTE infrastructure.

NB-IoT Architecture

Sequence diagram of NB-IoT device attach procedure showing the signaling exchange between UE (device), eNodeB, MME, and HSS including RRC connection establishment, authentication, security mode command, and bearer setup to complete network attachment.

NB-IoT Attach Procedure
Figure 1128.2: NB-IoT network architecture and device attachment procedure

1128.3 Key Architecture Components

1128.3.1 1. Radio Access Network (RAN)

eNodeB (Evolved Node B):

The eNodeB is the LTE base station that handles radio communication with NB-IoT devices.

Functions:

  • Manages radio resource scheduling for NB-IoT and LTE traffic
  • Handles NB-IoT physical layer (NPSS, NSSS, NPBCH, NPDCCH, NPDSCH, NPUSCH)
  • Performs Coverage Enhancement (CE) mode selection
  • Manages RRC (Radio Resource Control) connection states

NB-IoT Physical Channels:

Channel Direction Purpose
NPSS DL Narrowband Primary Synchronization Signal
NSSS DL Narrowband Secondary Synchronization Signal
NPBCH DL Narrowband Physical Broadcast Channel
NPDCCH DL Narrowband Physical Downlink Control Channel
NPDSCH DL Narrowband Physical Downlink Shared Channel
NPRACH UL Narrowband Physical Random Access Channel
NPUSCH UL Narrowband Physical Uplink Shared Channel

1128.3.2 2. Mobility Management Entity (MME)

The MME is the control plane component that manages device registration, authentication, and mobility.

Functions:

  • Authentication and security: EPS-AKA (Authentication and Key Agreement) with SIM/USIM
  • Mobility management: Tracking Area Updates (TAU), handover coordination
  • Session management: EPS bearer context establishment and modification
  • Control plane signaling: NAS (Non-Access Stratum) message handling
  • PSM/eDRX timer negotiation: Configures power-saving parameters with devices

1128.3.3 3. Service Capability Exposure Function (SCEF)

The SCEF is a new component introduced specifically for IoT in 3GPP Release 13. It provides APIs for IoT applications and enables efficient small data delivery.

Functions:

  • APIs for IoT applications: RESTful interfaces for device management
  • Non-IP data delivery: Optimized path for small payloads without IP overhead
  • Event monitoring: Connectivity status, location, reachability reporting
  • Device triggering: Wake up devices in PSM mode
  • Group messaging: Multicast/broadcast to device groups
NoteWhy SCEF Matters

For small IoT payloads (10-100 bytes), traditional IP overhead (40+ bytes for headers) represents 40-400% overhead. SCEF enables Non-IP Data Delivery (NIDD) where raw application data travels through the control plane without IP encapsulation, dramatically improving efficiency for sensor readings and status updates.

1128.3.4 4. Serving Gateway (S-GW) / Packet Gateway (P-GW)

S-GW Functions:

  • User plane traffic routing within the EPC
  • Mobility anchor for handover between eNodeBs
  • Downlink data buffering when device is in idle mode

P-GW Functions:

  • IP address assignment (IPv4 or IPv6)
  • Connection to external networks (internet, private networks)
  • Policy enforcement (QoS, charging)
  • Deep packet inspection (optional)

1128.3.5 5. Home Subscriber Server (HSS)

The HSS is the central database for subscriber information and authentication.

Functions:

  • Subscriber database: IMSI, service profiles, QoS parameters
  • Authentication data: Keys for EPS-AKA authentication
  • Location information: Current MME serving the device
  • Subscription management: Data limits, roaming permissions

1128.4 Control Plane vs User Plane Optimization

NB-IoT introduces Control Plane CIoT EPS Optimization for efficient small data transmission. This is one of the most important architectural innovations for IoT.

Mermaid diagram

Mermaid diagram
Figure 1128.3

1128.4.1 Control Plane CIoT Optimization (DoNAS)

Data over NAS (DoNAS) sends user data piggy-backed on NAS signaling messages through the control plane.

Benefits:

  • Reduced signaling overhead: No user plane bearer establishment needed
  • Lower latency for small messages: Data travels with attach/TAU messages
  • Lower power consumption: Fewer radio transmissions required
  • Optimized for small payloads: Best for < 1600 bytes

Data Path:

Device -> eNodeB -> MME -> SCEF -> Application Server
                    (NAS)   (T6a)    (API)

1128.4.2 User Plane Optimization

Traditional data path through the user plane, suitable for larger data transfers.

Benefits:

  • Higher throughput: Better for bulk data (firmware updates)
  • Established protocols: Standard IP networking
  • Multiple bearer support: Different QoS classes

Data Path:

Device -> eNodeB -> S-GW -> P-GW -> Internet -> Application Server
           (RRC)    (GTP)   (GTP)    (IP)

1128.4.3 When to Use Each Path

Scenario Recommended Path Reason
Sensor reading (< 100 bytes) Control Plane Minimal overhead
Status update (100-500 bytes) Control Plane Fast delivery
Firmware update (> 10 KB) User Plane Higher throughput
Frequent small messages Control Plane Power efficiency
Bidirectional session User Plane Session state

1128.5 NB-IoT Attach Procedure

Understanding the attach procedure helps explain the power consumption and latency characteristics of NB-IoT devices.

1128.5.1 Attach Procedure Steps

Step 1: Cell Search and Selection

  1. Device scans for NB-IoT cells using synchronization signals (NPSS/NSSS)
  2. Reads Master Information Block (MIB-NB) for system parameters
  3. Reads System Information Blocks (SIB1-NB, SIB2-NB) for access configuration
  4. Evaluates cell suitability based on signal quality (RSRP, RSRQ)
  5. Selects Coverage Enhancement (CE) level based on path loss

Step 2: Random Access (NPRACH)

  1. Device transmits preamble on NPRACH (Narrowband Physical Random Access Channel)
  2. Number of repetitions determined by CE level
  3. eNodeB responds with Random Access Response (RAR)
  4. Device sends RRC Connection Request (Msg3)
  5. eNodeB sends RRC Connection Setup (Msg4)

Step 3: Authentication (EPS-AKA)

  1. MME retrieves authentication vectors from HSS
  2. Authentication Request sent to device (RAND, AUTN)
  3. Device verifies network authenticity using USIM
  4. Device calculates and sends RES (Response)
  5. Keys derived: K_ASME, K_NASenc, K_NASint

Step 4: Security Mode Establishment

  1. MME sends NAS Security Mode Command (selected algorithms)
  2. Device activates NAS security (encryption + integrity)
  3. Device sends NAS Security Mode Complete

Step 5: Attach Accept

  1. MME sends Attach Accept with:
    • T3412 value (TAU timer - extended periodic tracking area update)
    • T3324 value (Active timer - time before entering PSM)
    • eDRX parameters (if requested and supported)
    • PDN connection parameters
  2. Device sends Attach Complete
  3. Device is now EMM-REGISTERED

1128.5.2 Timing Considerations

Procedure Phase Typical Duration Notes
Cell search 1-5 seconds Depends on signal strength
Random access 0.5-2 seconds Longer with CE repetitions
Authentication 1-2 seconds Network latency dependent
Security mode 0.5-1 second
Attach complete 0.5-1 second
Total 3-10 seconds First attach; subsequent faster

1128.6 Architecture for Smart Metering Example

To illustrate the architecture in practice, consider a smart water meter deployment:

Smart Water Meter
       |
       | (NB-IoT Radio - 180 kHz)
       v
   eNodeB (City Cell Tower)
       |
       | (S1 Interface)
       v
   MME (Carrier Core Network)
       |
       +---> HSS (Subscriber Database)
       |
       +---> SCEF (IoT API Gateway)
                  |
                  | (T6a Interface)
                  v
          Utility Company Cloud
          - Billing System
          - Leak Detection AI
          - Customer Portal

Data Flow for Daily Meter Reading:

  1. Meter wakes from PSM at scheduled time
  2. Resumes RRC connection (faster than full attach)
  3. Sends reading via Control Plane (NAS message)
  4. MME forwards to SCEF via T6a interface
  5. SCEF delivers to utility company via REST API
  6. Meter receives ACK, restarts T3324 timer
  7. After T3324 expires, enters PSM again

Key Architectural Benefits:

  • No IP overhead: Meter reading travels as raw bytes through SCEF
  • Carrier SLA: Guaranteed delivery to utility company
  • Centralized management: SCEF provides fleet management APIs
  • Security: End-to-end encryption via 3GPP security

1128.7 Knowledge Check

Question: Which NB-IoT network component provides APIs for IoT applications and enables efficient small data delivery without IP overhead?

Explanation: The SCEF (Service Capability Exposure Function) is a new component introduced in 3GPP Release 13 specifically for IoT. It provides:

  • RESTful APIs for IoT application integration
  • Non-IP Data Delivery (NIDD) for efficient small payloads
  • Device triggering to wake devices from PSM
  • Event monitoring (connectivity, location, reachability)

The SCEF enables Control Plane CIoT Optimization where small sensor data travels through the control plane without IP encapsulation, reducing overhead from 40+ bytes (IP headers) to just a few bytes.

Question: For an NB-IoT smart meter sending 50-byte daily readings, which data path provides the most power-efficient transmission?

Explanation: Control Plane (DoNAS) is optimal for small payloads like 50-byte meter readings because:

  1. No bearer establishment: Data piggy-backs on NAS signaling
  2. No IP overhead: Raw data through SCEF (vs 40+ byte IP headers)
  3. Fewer radio transmissions: Less time in active mode
  4. Power savings: Estimated 30-50% reduction vs User Plane

User Plane is better for larger transfers (firmware updates) where the overhead becomes proportionally smaller.

1128.8 Summary

  • CIoT architecture extends LTE EPC with IoT-specific components (SCEF) and optimizations
  • Key components: eNodeB (radio), MME (control), SCEF (IoT APIs), S-GW/P-GW (user plane), HSS (subscriber database)
  • Control Plane optimization (DoNAS) sends small data through signaling path for maximum efficiency
  • User Plane optimization provides higher throughput for larger data transfers
  • SCEF enables Non-IP Data Delivery, device triggering, and event monitoring APIs
  • Attach procedure takes 3-10 seconds for initial connection; subsequent wakeups are faster

1128.9 What’s Next

Continue your NB-IoT learning journey with these related topics: