LTE Attach in Bullet Points

UE switched ON - Cell selection

UE > eNB - RRC connection request

eNB > UE - RRC connection set-up

UE > eNB - RRC Connection complete+ Attach request + PDN conn request

eNB > MME - Initial UE message + NAS-PDU ( Attach request + PDN conn request )

MME > HSS - Authentication request ( Acquisition of Authentication vector )

HSS > MME - Authentication information Answer ( RAND, AUTN, XRES, Kasme )

MME > UE -  Authentication request ( RAND, AUTN )

UE - UE generates Auth response from the information received and uses the same algorithm HSS used to generate AV

UE > MME - Authentication response ( RES )

MME - Authenticates UE if RES = XRES (  UE authenticated )

MME - Generates Security keys 

MME > UE -  Security Mode  command

UE - Generates NAS keys

UE > MME - Security mode Complete. 

MME > HSS - Location update request

HSS - Registers UE IMSI , MME ID.

HSS > MME -  Update location answer  ( Subscriber profile + APN + P-GW + QoS )

MME - MME stores APN & subscriber profile 

MME - Assigns EPS bearer ID & P-GW selection by HSS or MME

MME > S-GW - Create session request 

S-GW > P-GW - Create session request

P-GW - Assigns IP address to UE 

P-GW > PCRF -  Notification of EPS session set-up

PCRF - Determines PCC ( Policy charging & control ) policies for the EPS session to established

PCRF > P-GW - Acknowledging EPS Session Establishment

P-GW - Policy Enforcement (Install Policy Rule)

P-GW > S-GW - Create session response

S-GW > MME - Create session Response

MME - Generates Various parameters ( UE AMBR  )

MME - eNB - Initial context set-up request ( Attach accept in NAS-PDU )

eNB - Receives S-GW address and generates keys 

eNB > UE -  Security mode command

UE - UE generates Kenb and AS keys

UE > eNB - Security mode complete

eNB > UE - RRC connection reconfiguration + Attach Accept

UE - DRB is created between UE and eNB

UE > MME - Attach complete ( via eNB )

eNB > MME - Initial context set-up response

MME > S-GW -  - Modify bearer request + eNB address + EPS bearer ID

S-GW > MME -  Modify bearer response

S1 bearer is established between eNB and S-GW. EPS default bearer is UP and user can exchange data.