5G Signaling Radio Bearers (SRBs) Explained: NR Control Deep Dive (SRB0-SRB3)

Welcome to the world of 5G/NR! As networks get faster and more complex, understanding how devices talk to the network becomes crucial. A fundamental part of this communication happens over Signaling Radio Bearers (SRBs). These aren’t for your data (like browsing or streaming) but are special pathways dedicated solely to the control conversations that make your 5G connection work.

This guide provides a deep dive into 5G Signaling Radio Bearers (SRBs). We’ll explore what SRBs are, the different types (5G SRB 0 through 3), how they are set up according to 3GPP Specifications, how they handle critical signaling like RRC and NAS messages, and why they are essential for everything from connecting to the network to handling handovers.

What is a Signaling Radio Bearer (SRB)?

In simple terms, a Signaling Radio Bearer (SRB) is a dedicated channel or pipe established over the 5G air interface between your device (User Equipment or UE) and the 5G base station (gNB). Its sole purpose is to carry control plane messages.

Role in Control Plane Signaling

The control plane handles all the management and coordination messages needed to establish, maintain, and modify your connection. SRBs transport two main types of control messages:

Table of Contents

Radio Resource Control (RRC) Messages: These manage the radio link itself between the UE and the gNB. Think of commands for connection setup, handover instructions, measurement reports, security activation, and configuring other radio bearers (like those for data).
Non-Access Stratum (NAS) Messages: These handle communication between the UE and the 5G Core network (specifically functions like the AMF and SMF). NAS messages cover things like network registration, authentication, setting up data sessions (PDU Sessions), and mobility tracking at the core network level.

Important Note: NAS messages don’t travel directly over the air to the core network. They are cleverly encapsulated (wrapped inside) RRC messages (like ULInformationTransfer or DLInformationTransfer) and sent over the appropriate SRB. The gNB then extracts the NAS message and forwards it to the 5G Core (AMF) via the N2 interface.

Why are SRBs Necessary?

Separating control signaling (on SRBs) from your actual user data (on Data Radio Bearers or DRBs) is vital. SRBs ensure that essential network commands and responses can be transmitted reliably and often with higher priority than user data. This allows the network to:

Quickly set up and modify connections.
Manage mobility (handovers) efficiently.
Activate security procedures promptly.
Transfer UE capabilities.
Relay critical NAS messages for core network functions.

Without working SRBs, your 5G UE simply cannot connect to the network, access services, or move between cells reliably. They are the foundation of 5G/NR communication.

The Different Types of 5G SRBs (SRB0, SRB1, SRB2, SRB3)

3GPP Specifications define four distinct types of Signaling Radio Bearers in 5G/NR, each with a specific role and configuration:

SRB0: The Initial Handshake (CCCH, RLC TM)

Purpose: Used only during the very initial phase of establishing an RRC connection (or re-establishing after a failure).
Logical Channel: Uses the Common Control Channel (CCCH). This channel is used when there’s no dedicated connection yet.
RLC Mode: Uses Radio Link Control Transparent Mode (TM). This mode has minimal overhead (no extra headers, no segmentation, no guaranteed delivery mechanism within RLC itself). Reliability relies on lower layers (like HARQ in MAC) and RRC timers.
Key Messages: RRCSetupRequest (UE->gNB), RRCSetup (gNB->UE), RRCReject, RRCReestablishmentRequest.
Security: None. SRB0 operates before security is activated.

Think of SRB0 as the quick, basic message exchange needed just to agree on setting up a more robust connection.

SRB1: The Primary Workhorse (DCCH, RLC AM)

Purpose: Becomes the main signaling channel after the initial SRB0 exchange. Carries most RRC messages and the initial NAS messages needed for security and registration.
Logical Channel: Uses the Dedicated Control Channel (DCCH), a point-to-point channel specific to the UE.
RLC Mode: Uses Radio Link Control Acknowledged Mode (AM). RLC AM provides reliable delivery through segmentation, sequence numbering, and automatic repeat request (ARQ) for retransmitting lost packets.
Key Messages: RRCSetupComplete (often carrying the first NAS message), RRCReconfiguration, SecurityModeCommand, SecurityModeComplete, MeasurementReport, UECapabilityInformation, UL/DLInformationTransfer (for initial NAS).
Security: Yes. Security (integrity protection and ciphering) is activated on SRB1 during the connection setup.
Priority: High (typically priority 1).

SRB1 is established by the RRCSetup message and provides a reliable path for the critical steps following initial access, including security activation and subsequent connection management.

Also Read: 5G vs 5G Ultra Wideband

SRB2: Dedicated NAS Channel (DCCH, RLC AM, Post-Security)

Purpose: Carries NAS messages after security has been activated. Separates ongoing NAS communication from RRC messages.
Logical Channel: Uses the Dedicated Control Channel (DCCH).
RLC Mode: Uses Radio Link Control Acknowledged Mode (AM) for reliability.
Key Messages: UL/DLInformationTransfer (carrying NAS messages like PDU Session commands, subsequent Registration updates, etc.).
Security: Yes. SRB2 is only established after Access Stratum (AS) security is active, so it’s always protected.
Priority: Lower than SRB1 (typically priority 3).

Establishing SRB2 ensures ongoing NAS dialogues happen over a secure channel and allows the network to prioritize time-critical RRC messages on SRB1 over potentially less urgent NAS messages on SRB2.

SRB3: The Dual Connectivity Specialist (DCCH, RLC AM)

Purpose: A specialized 5G SRB used only in Dual Connectivity (DC) scenarios (like EN-DC where LTE and 5G work together, or NR-DC). It provides a direct signaling path between the UE and the Secondary Node (SN – the gNB in EN-DC or a secondary gNB in NR-DC).
Logical Channel: Uses the Dedicated Control Channel (DCCH).
RLC Mode: Uses Radio Link Control Acknowledged Mode (AM) for reliability.
Key Messages: SN-specific RRCReconfiguration messages, MeasurementReport messages related to the secondary cell group (SCG).
Security: Yes. Established after initial security is active, using keys relevant to the DC context.
Priority: High (typically priority 1, same as SRB1).

SRB3 is optional. If not configured, SN-related RRC messages are usually tunneled via the Master Node (MN) over SRB1. SRB3’s direct path reduces signaling latency for controlling the secondary connection, crucial for optimizing DC performance.

Quick Comparison Table: 5G SRBs

Feature	SRB0	SRB1	SRB2	SRB3 (DC Only)
Purpose	Initial RRC Establish	Primary RRC & Initial NAS	Dedicated NAS (Post-Security)	Dedicated RRC for SN (DC)
Log. Channel	CCCH	DCCH	DCCH	DCCH
RLC Mode	TM (Transparent)	AM (Acknowledged)	AM (Acknowledged)	AM (Acknowledged)
Security	None	Activated during Setup	Always Active	Always Active
Typical Pri.	N/A (Implicit High)	1 (Highest)	3 (Lower)	1 (Highest)
Key Use	`RRCSetupRequest`/`Setup`	`RRCReconfig`, Security, Init NAS	Subsequent NAS messages	SN `RRCReconfig`, SN Measurements

How are 5G Signaling Radio Bearers Established?

The setup of each SRB is woven into key RRC procedures:

Initial Connection: Setting up SRB0 and SRB1

UE Request (RRCSetupRequest on SRB0): The UE initiates connection via the Random Access procedure, sending the request on the CCCH using SRB0’s simple RLC TM mode.
Network Response (RRCSetup on SRB0): The gNB responds on the CCCH (SRB0). This message contains the configuration parameters needed to set up SRB1.
SRB1 Established: The UE processes the RRCSetup message, configures its RLC AM and PDCP layers for SRB1 on the DCCH, and transitions to RRC_CONNECTED state.
Confirmation (RRCSetupComplete on SRB1): The UE confirms success by sending this message using the newly established SRB1. This message often carries the first crucial uplink NAS message (like Registration Request).

Activating Security & Establishing SRB2

Security Commands (on SRB1): After SRB1 is up, the network initiates security activation using SecurityModeCommand messages (first NAS, then AS) sent over SRB1.
Security Complete (on SRB1): The UE responds with SecurityModeComplete messages over SRB1. After the AS SecurityModeComplete, SRB1 traffic becomes encrypted and integrity protected.
SRB2 Configuration (via RRCReconfiguration on SRB1): Only after AS security is confirmed active, the gNB can choose to establish SRB2 by sending an RRCReconfiguration message over the now-secure SRB1. This message includes the configuration for SRB2 (RLC AM, DCCH).
SRB2 Confirmation (via RRCReconfigurationComplete on SRB1): The UE sets up SRB2 and confirms. Subsequent NAS messages typically flow over SRB2.

Setting up SRB3 in Dual Connectivity

SN Decision: The Secondary Node (SN) decides if SRB3 is needed.
Configuration Transfer (SN->MN): The SN sends the desired SRB3 configuration to the Master Node (MN) over the Xn (NR-DC) or X2 (EN-DC) interface.
Signaling to UE (via MN on SRB1): The MN relays the configuration (including SRB3 parameters) to the UE within an RRCReconfiguration (NR) or RRCConnectionReconfiguration (LTE for EN-DC) message, sent over the MN’s reliable SRB1 link.
UE Establishment & Confirmation (on SRB1): The UE receives the config on SRB1, sets up SRB3, and sends the confirmation message back to the MN over SRB1.

SRBs in the 5G Protocol Stack

Signaling data travels through several layers:

Mapping SRBs to Logical Channels (CCCH/DCCH)

SRB0 maps exclusively to the Common Control Channel (CCCH).
SRB1, SRB2, SRB3 all map to the Dedicated Control Channel (DCCH).
To distinguish them on the DCCH, they use unique Logical Channel IDs (LCIDs) in the MAC header (Default: SRB1=LCID 1, SRB2=LCID 2, SRB3=LCID 3).

Mapping Logical Channels to Transport Channels (UL-SCH/DL-SCH)

Both CCCH (carrying SRB0) and DCCH (carrying SRB1/2/3) are mapped by the MAC layer onto the main shared transport channels:
- Uplink Shared Channel (UL-SCH) for transmissions from UE to gNB.
- Downlink Shared Channel (DL-SCH) for transmissions from gNB to UE.
This means SRB signaling shares the same transport channels as user data (DRBs), making MAC layer prioritization crucial.

The Journey Through PDCP, RLC, and MAC Layers

PDCP (Packet Data Convergence Protocol): For SRB1, SRB2, SRB3 (SRB0 bypasses PDCP):
- Adds Sequence Numbers.
- Performs Ciphering (encryption) after security activation.
- Performs Integrity Protection (adding a MAC-I code) after security activation.
- Adds PDCP header.
RLC (Radio Link Control):
- Operates in TM (SRB0) or AM (SRB1/2/3).
- Segments messages if too large (AM only).
- Handles ARQ retransmissions for reliable delivery (AM only).
- Adds RLC header (AM only).
MAC (Medium Access Control):
- Performs Logical Channel Prioritization (giving SRB1/SRB3 highest priority).
- Multiplexes data from different SRBs/DRBs into Transport Blocks.
- Adds MAC header (including LCIDs).
- Handles HARQ (fast physical layer retransmissions).
- Interacts with the scheduler for resource allocation.

Securing Signaling: How SRBs are Protected

Security is critical for control messages. 5G/NR uses strong security applied at the PDCP layer for SRB1, SRB2, and SRB3.

Integrity Protection

Purpose: Prevents message tampering and verifies the sender’s identity.
How: A Message Authentication Code (MAC-I) is calculated using a shared secret key (KRRCint) and integrity algorithm (NIA), then appended to the message. The receiver recalculates and compares the MAC-I.
Applies to: SRB1 (after security activation), SRB2, SRB3.
SRB0: Not integrity protected.

Ciphering

Purpose: Ensures message confidentiality (prevents eavesdropping).
How: The message payload is encrypted using a shared secret key (KRRCenc) and ciphering algorithm (NEA).
Applies to: SRB1 (after security activation), SRB2, SRB3.
SRB0: Not ciphered.

Activation Timing

Security isn’t active from the very start:

SRB0: Always unprotected.
SRB1: Starts unprotected, carries security activation commands, then becomes protected.
SRB2 & SRB3: Established only after security is active, so they are always protected.

The specific algorithms (NIA1/2/3, NEA1/2/3 based on SNOW 3G, AES, ZUC) are negotiated during the security setup, based on UE and network capabilities (3GPP Spec TS 33.501).

Configuring Signaling Radio Bearers

Network operators can fine-tune SRB behavior via RRC configuration messages, impacting reliability and performance. Key parameters include:

RLC Settings: Mode (TM/AM), Sequence Number length (NR defaults to 12-bit for SRBs, supports 18-bit), various timers (t-PollRetransmit, t-Reassembly), polling triggers, retransmission limits (maxRetxThreshold).
PDCP Settings: Sequence Number length (12/18 bit), reordering timer (t-Reordering).
Logical Channel Config (MAC): priority (critical – lower number = higher priority, SRB1/3 usually 1, SRB2 usually 3), prioritisedBitRate (PBR – usually infinity for SRBs), logicalChannelGroup (for buffer reporting).

Optimizing these requires balancing reliability needs (e.g., for handover commands on SRB1) against latency and overhead.

SRBs in Action: Role in Key 5G Procedures

SRBs are constantly active during essential operations:

Connection Management: SRB0 for initial setup, SRB1 for configuration changes (RRCReconfiguration), release (RRCRelease), and re-establishment.
Mobility / Handovers: SRB1 (or SRB3 for SN measurements) carries MeasurementReport messages. SRB1 delivers the crucial RRCReconfiguration message containing the handover command.
Measurement Reporting: UE sends reports via SRB1 (to MN) or SRB3 (directly to SN in DC).
Security Control: SRB1 carries the SecurityModeCommand and SecurityModeComplete exchange.

5G SRBs vs. 4G LTE SRBs: What’s New?

5G SRBs build upon the LTE foundation:

Similarities: SRB0, SRB1, and SRB2 have very similar roles and basic configurations (CCCH/TM for SRB0, DCCH/AM for SRB1/SRB2).
The Big Difference: SRB3: 5G NR introduces SRB3 specifically for optimizing Dual Connectivity signaling latency by providing a direct UE-SN link, which LTE lacked by default.
Other Enhancements: NR typically uses longer default Sequence Number lengths (e.g., 12-bit or 18-bit for RLC/PDCP) compared to LTE (often 5/7/10/12 bit) to better handle higher data rates and latencies. The potential for SRB1/SRB2 splitting/duplication in DC might also be an enhancement for reliability in NR.

Conclusion

Signaling Radio Bearers (SRBs) are the unsung heroes of the 5G/NR control plane. From the initial handshake on SRB0 to the reliable RRC/NAS transport on SRB1 and SRB2, and the specialized DC handling via SRB3, these bearers are essential for a functional and efficient network. They enable connection setup, secure communication, seamless mobility, and the configuration of advanced 5G features. Understanding the different 5G SRB types, their establishment, security, configuration, and operational roles, as defined in 3GPP Specifications, is fundamental to grasping how 5G networks manage the complex dance of control signaling that underpins the entire user experience.

Axee Davies

Is a freelance tech writer based in the East Continent, is quite fascinated by modern-day gadgets, smartphones, and all the hype and buzz about modern technology on the Internet. Besides this a part-time photographer and love to travel and explore. Follow me on. Twitter, Facebook Or Simply Contact Here. Or Email: [email protected]

axeetech.com