Chapter One

The Evolution Story

Every decade, the mobile network is reborn. Not just upgraded — fundamentally reimagined. In 2009, 4G LTE gave us the mobile internet. In 2018, 5G NR brought machine communication and network slicing. By 2030, 6G will merge communication, sensing, computing, and AI into a single intelligent fabric. This article tells the complete technical story — every core network function, every RAN innovation, every 3GPP specification — across all three generations.

4G
EPC + E-UTRAN
5G
5GC + NR
6G
6G CN + 6G RAN
16
3GPP Releases
50+
Key Specs
Think of it like this

4G is a highway with fast lanes (good for cars/phones). 5G is a smart city with highways, railways, drone routes, and a control tower (good for everything). 6G is that city coming alive — the roads can sense traffic, the buildings think, the control tower is an AI, and the whole system extends to the sky via satellites.

The Evolution — 4G (2009) → 5G (2018) → 6G (2030) — Architecture complexity and capability growth
• • •
Chapter Two

4G Core: EPC Architecture (TS 23.401)

The Evolved Packet Core (EPC) was the first all-IP mobile core network. Defined in 3GPP TS 23.401 (Release 8, 2008), it replaced the circuit-switched core of 3G with a flat, packet-based architecture. Every byte of data — voice, video, web — travels as IP packets.

Think of it like this

The EPC is like a toll highway system. The MME is the toll booth operator (checks your identity, lets you in). The S-GW is the highway interchange (routes your car between roads). The P-GW is the exit ramp to the internet. The HSS is the driver’s license database. The PCRF is the traffic cop enforcing speed limits.

The 5 Core Network Functions of EPC

MME — Mobility Management Entity
The brain of 4G. Handles authentication, security, tracking area updates, paging, bearer management, and handover signalling. Does NOT touch user data — control plane only. Communicates via S1-MME interface with eNodeB.
S-GW — Serving Gateway
Local mobility anchor for the user plane. Routes and forwards user data packets. Acts as the handover anchor between eNodeBs. Connected to eNodeB via S1-U (GTP-U tunnel).
P-GW — PDN Gateway
The exit point to the internet (PDN). Assigns IP addresses, enforces QoS policies, performs deep packet inspection, and handles charging. Connected to external data networks via SGi interface.
HSS — Home Subscriber Server
The master database of all subscribers. Stores IMSI, authentication keys (Ki), subscription profiles, QoS settings, and APN configurations. Accessed via Diameter protocol (S6a interface).
PCRF — Policy & Charging Rules Function
The policy engine. Decides which QoS to apply (QCI values), how to charge for services, and what traffic rules to enforce. Communicates with P-GW via Gx interface (Diameter).

Key 4G Core Specs: TS 23.401 (EPC architecture), TS 23.402 (non-3GPP access), TS 29.274 (GTPv2-C), TS 29.272 (S6a Diameter). Protocols: GTP-C/GTP-U (tunnelling), Diameter (signalling), PMIP (mobility).

Key Interfaces (EPC)

InterfaceBetween & Protocol
S1-MMEeNodeB ↔ MME (SCTP/S1AP) — Control plane
S1-UeNodeB ↔ S-GW (GTP-U) — User plane
S5/S8S-GW ↔ P-GW (GTP/PMIP) — User plane + control
S6aMME ↔ HSS (Diameter) — Authentication & subscription
S11MME ↔ S-GW (GTPv2-C) — Bearer management
GxPCRF ↔ P-GW (Diameter) — Policy & charging rules
SGiP-GW ↔ External PDN (IP) — Internet access
X2eNodeB ↔ eNodeB (X2AP/GTP-U) — Handover
• • •
Chapter Three

4G RAN: E-UTRAN (TS 36.300)

The 4G RAN — called E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) — was revolutionary: a flat, one-node architecture with just the eNodeB. No more RNC (Radio Network Controller) from 3G. Every base station is autonomous.

Physical Layer Fundamentals

Parameter4G LTE Value
DL WaveformOFDMA (Orthogonal Frequency Division Multiple Access)
UL WaveformSC-FDMA (Single Carrier FDMA) — lower PAPR
Bandwidth1.4, 3, 5, 10, 15, 20 MHz (up to 100 MHz with CA)
Subcarrier Spacing15 kHz (fixed)
Frame10 ms frame, 1 ms subframe (TTI), 0.5 ms slot
MIMOUp to 8×8 (Rel-10), typically 2×2 or 4×4
ModulationQPSK, 16QAM, 64QAM (256QAM in Rel-12)
Frequency700 MHz – 3.5 GHz (all sub-6 GHz)
Peak DL Rate300 Mbps (Cat 5) to 3 Gbps (Cat 20 with CA)
Latency~10 ms (user plane)

Key 4G RAN Specs: TS 36.300 (E-UTRAN architecture), TS 36.211 (physical channels & modulation), TS 36.212 (multiplexing & coding), TS 36.213 (physical layer procedures), TS 36.214 (measurements), TS 36.331 (RRC).

• • •
Chapter Four

5G Core: 5GC Architecture (TS 23.501)

The 5G Core was the biggest architectural revolution since the birth of cellular. TS 23.501 (Release 15, 2018) introduced the Service-Based Architecture (SBA) — replacing 4G’s fixed point-to-point interfaces with a flexible bus where any Network Function can discover and consume services from any other.

Think of it like this

4G EPC is a factory with fixed conveyor belts between machines. Moving one machine means rebuilding the belt. 5G Core is a modern warehouse with autonomous robots (NFs) that find each other, communicate over WiFi (APIs), and self-organize. Add a new robot? It just joins the network.

The 10 Core Network Functions

AMF — Access & Mobility Management Function
Evolved from MME. Handles registration, connection management, mobility, access authentication. Communicates with gNB via N2 interface (NGAP). Stateless design — state stored in UDM/UDR.
SMF — Session Management Function
Manages PDU sessions (replaces bearers). UPF selection, IP allocation, QoS enforcement via N4 (PFCP) to UPF. Decoupled from AMF — sessions and mobility are independent.
UPF — User Plane Function
Evolved from S-GW + P-GW user plane. Packet routing, forwarding, QoS handling, DPI. Connected to gNB via N3 (GTP-U). Can be deployed at edge for low latency (MEC).
NRF — NF Repository Function
NEW in 5G. The service registry. Every NF registers its capabilities and discovers others via NRF. This is what enables SBA — no hardcoded interfaces. Uses HTTP/2 REST APIs.
AUSF — Authentication Server Function
Handles 5G-AKA and EAP-AKA' authentication. Works with UDM for credential verification. Generates SUCI (concealed subscriber ID) to prevent IMSI catching.
UDM — Unified Data Management
Evolved from HSS. Stores subscription data, generates auth vectors, manages registrations. Backed by UDR (Unified Data Repository) for data storage.
PCF — Policy Control Function
Evolved from PCRF. Provides access and mobility policy, session management policy, and UE policy via SBA APIs (not Diameter). Integrated with network slicing.
NSSF — Network Slice Selection Function
NEW in 5G. Selects the right network slice for each UE based on S-NSSAI. Enables multiple virtual networks on shared infrastructure.
NEF — Network Exposure Function
NEW in 5G. Exposes network capabilities to external applications (AFs) securely. The API gateway for third-party access.
NWDAF — Network Data Analytics Function
NEW in Rel-16. Collects network data, runs analytics, provides insights. The first AI/ML function in 3GPP — but only as an observer, not a controller.

Key 5G Core Specs: TS 23.501 (architecture), TS 23.502 (procedures), TS 23.503 (policy), TS 29.500 (HTTP/2 framework), TS 29.510 (NRF), TS 33.501 (security). Protocol: HTTP/2 + JSON (SBI), NGAP, PFCP, GTP-U.

• • •
Chapter Five

5G RAN: NR (TS 38.300)

5G New Radio (NR) is defined in the TS 38 series. The gNB (next-generation NodeB) can be split into CU (Central Unit) and DU (Distributed Unit), with further separation into CU-CP and CU-UP.

Physical Layer: 4G LTE vs 5G NR

Parameter4G LTE5G NR
WaveformOFDMA (DL) / SC-FDMA (UL)CP-OFDM (DL+UL) + DFT-s-OFDM (UL)
Subcarrier Spacing15 kHz (fixed)15/30/60/120/240 kHz (flexible numerology)
BandwidthUp to 20 MHz (100 with CA)Up to 100 MHz (FR1) / 400 MHz (FR2)
FrequencySub-6 GHz onlyFR1 (410 MHz–7.125 GHz) + FR2 (24.25–52.6 GHz)
MIMOUp to 8×8Massive MIMO: 64T64R (256 elements)
BeamformingBasic (Rel-10+)Advanced analog/digital/hybrid beamforming
ModulationUp to 256QAMUp to 256QAM (1024QAM in Rel-17)
Latency~10 ms1 ms (URLLC) / 4 ms (eMBB)
Peak DL Rate~3 Gbps (theoretical)20 Gbps (theoretical)
Slot Duration1 ms (fixed TTI)0.0625–1 ms (mini-slot support)
DuplexFDD / TDDFDD / TDD + dynamic TDD + SUL

Key 5G RAN Specs: TS 38.300 (NR/NG-RAN architecture), TS 38.211 (physical channels & modulation), TS 38.212 (multiplexing & coding), TS 38.213 (control procedures), TS 38.214 (data procedures), TS 38.215 (measurements), TS 38.331 (RRC), TS 38.401 (NG-RAN architecture).

• • •
Chapter Six

6G Core: Intent-Based Architecture (TR 23.801)

The 6G Core is being designed in TR 23.801 V0.4.0 (Release 20, February 2026). It defines 24 key issues across 8 work tasks. The SBA foundation from 5G is retained, but with transformative additions.

What’s NEW in 6G Core (No 5G Equivalent)

KI#18: AI Agents & Intent-Based Operation
AI agents autonomously process intents (“ensure 99.999% reliability”) and compose network procedures dynamically. Operator-configurable autonomy levels. Closed-loop RL.
KI#19: AI-as-a-Service (AIaaS)
The network offers AI inferencing and training to UEs and applications. UE AI agents can discover and communicate with other AI agents via 6G.
KI#20: Integrated Sensing (ISAC)
Core architecture for sensing services: authorization, entity discovery, data collection, result exposure. Radio signals as radar.
KI#22: Integrated Computing
Computing Sites as first-class 3GPP entities. Compute resource discovery, communication-compute coordination, service continuity on compute migration.
KI#21: Data Framework
Unified data discovery, collection, labelling, processing, storage, and exposure. Privacy and governance built-in.

Key 6G Core Specs: TR 23.801 (6G system architecture study, 24 KIs), TR 22.870 (6G use cases & requirements). References: TS 23.501 (5GC as starting point), TS 22.261 (service requirements).

• • •
Chapter Seven

6G RAN: Cell-Free & ISAC (TR 38.914)

The 6G RAN is defined in TR 38.914 V0.4.0 (Release 20, March 2026). It specifies 14 deployment scenarios, 19 KPI requirements, and revolutionary technologies.

5G NR vs 6G RAN

Parameter5G NR6G RAN (TR 38.914)
ArchitectureCell-based (gNB cells)Cell-free distributed access points
Antenna64T64R (256 elements)Up to 4,096 elements (holographic MIMO)
SpectrumFR1 + FR2 (up to 52.6 GHz)+ FR3 (7–24 GHz) + sub-THz (100–300 GHz)
Peak SE (DL)30 b/s/Hz60 b/s/Hz
Peak DL Rate20 Gbps36 Gbps (min); up to 1 Tbps aspirational
Mobility500 km/h1,200 km/h (air-to-ground)
WaveformCP-OFDMOTFS / AFDM (delay-Doppler domain)
SensingNot supportedISAC: 95% detection, 2m indoor localization NEW
RISNot supportedReconfigurable Intelligent Surfaces NEW
Scenarios3 (eMBB, URLLC, mMTC)6 usage scenarios + 14 deployment scenarios

Key 6G RAN Specs: TR 38.914 (6G scenarios & requirements, 19 KPIs, 14 deployment scenarios), RP-252912 (6G Radio SID). ITU: M.2160-0 (IMT-2030 framework).

• • •
Chapter Eight

The Mega Comparison: 4G vs 5G vs 6G

Here it is — the complete side-by-side across all three generations.

Core Network Evolution

MMEMobility Mgmt
AMFAccess & Mobility
AI-AMFPredictive mobility
S-GW + P-GWUser Plane
UPFUser Plane Fn
UPF + ComputeUser+Edge
HSSSubscriber DB
UDM/UDRUnified Data
UDM + Data FwkKI#21
PCRFPolicy (Diameter)
PCFPolicy (SBA)
Intent EngineAI-driven
N/A
NWDAFAnalytics add-on
AI AgentsKI#18 core brain
N/A
N/A
Sensing NFISAC KI#20
N/A
MEC (separate)
Compute NFKI#22

Architecture Comparison Table

Aspect4G (EPC)5G (5GC)6G (TR 23.801)
ArchitecturePoint-to-pointService-Based (SBA)SBA + AI + Intent
ProtocolGTP-C + DiameterHTTP/2 + JSON (REST)Enhanced SBA APIs
Core SpecTS 23.401TS 23.501TR 23.801
RAN SpecTS 36.300TS 38.300TR 38.914
First ReleaseRel-8 (2008)Rel-15 (2018)Rel-21 (~2027)
AI/MLNoneNWDAF (observer)AI agents (controller) NEW
SlicingAPN-basedNSSAI-based slicingEnhanced + simplified
SensingNoneNoneISAC native NEW
ComputingNoneMEC (external)Integrated NEW
SatelliteNoneNTN (Rel-17 add-on)Native from Day 1
VoiceVoLTE (IMS)VoNR (IMS)Vo6G (IMS evolved)
Peak DL Rate~3 Gbps20 Gbps36 Gbps (min) / 1 Tbps
Latency~10 ms1–4 ms~1 ms (target 10 μs)
FrequencySub-6 GHz+ mmWave (52.6 GHz)+ FR3 + sub-THz (300 GHz)
MIMOUp to 8×864T64R massive4,096 elements holographic
• • •
Chapter Nine

3GPP Release Timeline (Rel-8 to Rel-21)

Rel-82008
LTE & EPC — The 4G Foundation
First LTE spec. EPC core (MME, S-GW, P-GW). OFDMA DL, SC-FDMA UL. Up to 300 Mbps. 20 MHz BW. TS 23.401, TS 36.211-214.
Rel-92009
eMBMS & Location
Multimedia broadcast, enhanced positioning (E-CID, OTDOA), HeNB (femtocells).
Rel-102011
LTE-Advanced (IMT-Advanced)
Carrier Aggregation (up to 100 MHz), 8×8 MIMO, eICIC, relay nodes. Peak 3 Gbps theoretical.
Rel-11/122012–14
CoMP, 256QAM, D2D
Coordinated Multi-Point, enhanced CA (3CC+), 256QAM DL, Device-to-Device (ProSe), small cells.
Rel-13/142015–17
LTE-Advanced Pro
NB-IoT, LTE-M (CIoT), Licensed Assisted Access (LAA), 32 CA, V2X, massive CA. Bridge to 5G.
Rel-152018
5G NR & 5GC — Phase 1
First 5G spec. NSA (Option 3x) + SA. 5GC SBA (TS 23.501). NR (TS 38.211-215). FR1+FR2. Massive MIMO. Network slicing. eMBB focus.
Rel-162020
5G NR Phase 2
URLLC enhancements, NR V2X, NR-U (unlicensed), NWDAF (AI analytics), IIoT, NR positioning, power saving. Integrated Access Backhaul (IAB).
Rel-172022
NTN, RedCap, XR
Non-Terrestrial Networks (satellite), RedCap (reduced capability IoT), NR sidelink, XR support, multi-SIM, 52.6–71 GHz (FR2-2), AI/ML data collection.
Rel-182024
5G-Advanced Phase 1
AI/ML for NR air interface, NR MIMO evolution, network energy saving, XR enhancements, NTN enhancements, ambient IoT study, duplex evolution.
Rel-192025
5G-Advanced Phase 2
AI/ML for mobility, MIMO enhancements, NTN evolution, ambient IoT normative, sub-band non-contiguous CA, enhanced sidelink, NR positioning.
Rel-202025–27
5G-Adv Final + 6G Study
Dual track: 126 WIs for 5G-Advanced + dedicated 6G study. TR 23.801 (6G Core), TR 38.914 (6G RAN scenarios). No normative 6G yet — only Technical Reports.
Rel-21~2027–29
First Normative 6G
First normative 6G specifications. New air interface, 6G CN architecture, AI-native, ISAC, computing. ASN.1 freeze ~March 2029. IMT-2030 submission to ITU.
• • •
Chapter Ten

The Complete 3GPP Specs Library

Every key specification for all three generations, organized by domain:

Core Network Specs

TS 23.401
EPC Architecture
4G EPC: MME, S-GW, P-GW, HSS, PCRF. GTP interfaces. Bearer model.
TS 23.402
Non-3GPP Access
WiFi integration: ePDG, TWAN, trusted/untrusted access to EPC.
TS 23.501
5GC Architecture
5G Core: SBA, AMF, SMF, UPF, NRF, slicing, CUPS. The 5G bible.
TS 23.502
5GC Procedures
Registration, PDU session, handover, service request, paging flows.
TS 23.503
Policy & Charging
PCF architecture, PCC rules, AM/SM/UE policy, charging control.
TR 23.801
6G System Architecture
6G Core study: 24 Key Issues, 8 WTs. AI, ISAC, compute, NTN, intent.

RAN / Physical Layer Specs

TS 36.300
E-UTRAN Architecture
4G RAN: eNodeB, X2, S1 interfaces. Flat architecture. No RNC.
TS 36.211
LTE Physical Channels
OFDMA/SC-FDMA, resource grid, reference signals, PDSCH/PUSCH.
TS 36.213
LTE PHY Procedures
Cell search, RACH, power control, CSI reporting, HARQ.
TS 38.300
NR/NG-RAN Architecture
5G RAN: gNB, CU/DU split, Xn, F1, NG interfaces.
TS 38.211
NR Physical Channels
CP-OFDM, flexible numerology, SSB, CORESET, BWP, beam management.
TS 38.214
NR Data Procedures
MCS/TBS, CSI, codebooks, scheduling, PDSCH/PUSCH resource allocation.
TR 38.914
6G Scenarios & Requirements
19 KPIs, 14 deployment scenarios, 4096 antennas, 1200 km/h, ISAC.

Security Specs

TS 33.401
EPS Security
EPS-AKA, NAS/AS ciphering, key hierarchy, IMSI exposed on air.
TS 33.501
5G Security
5G-AKA, SUCI/SUPI (IMSI concealed), SEPP, 256-bit keys, PRINS.
6G Security
Post-Quantum + Zero-Trust
PQC (ML-KEM/Kyber), zero-trust per-transaction auth, AI threat detection.

“Understanding 4G is the foundation. Mastering 5G is the present. Preparing for 6G is the future. All three are connected by one thread: 3GPP.”

— This article’s conclusion

Master All Three Generations

CafeTele offers courses, books, and interactive labs covering 4G, 5G, and the path to 6G.