LTE-NB : CIoT EPS Optimization
If you have looked into Physical layer of LTE-NB, you might have felt that LTE-NB looks a pretty much new design. It is true. There are huge difference between legacy LTE and LTE-NB in Physical layer even though you still see the same terminology being used in both technology (e.g, Resource Elemenent, Sub Carrier Spacing, Radio Frame, Sub Frame etc). However, the difference does not stay in physical layer only. There are pretty big modification on core network side as well.
Overall network architecture of LTE-NB can be illustrated as below. You would notice that the network components of LTE-NB are almost same as in legacy LTE. It is understandable. No Network Operator would like to deploy a completely new core network for LTE-NB. You may notice only one new component labeled SCEF. I see this from Rel 13 of 23.682 and 23.401. Since this is pretty new components as of now(May 2017), I am not sure how soon we will see this deployed in real network.
In short, just looking at the following illustration, the biggest difference you would see would be that there are not a single path for the user data, there are multiple options for it. It can take the solid BLUE path and this is same as legacy LTE data path. This operation mode that is using this path is called 'UP-Mode'. The RED paths are the new path designed for LTE-NB. The operation mode that are using these path is called 'CP-Mode'.
As you see in the illustration shown above, there are three different options for the user data in LTE NB. It can take the solid BLUE path and this is same as legacy LTE data path. This operation mode that is using this path is called 'UP-Mode'. The RED paths are the new path designed for LTE-NB. The operation mode that are using these path is called 'CP-Mode'.
The 'CP-Mode' is the new path defined in LTE-NB. As you see in the diagram, the most critical difference between UP and CP mode is that the user data go through MME in CP mode.
As you know, the main role of MME in LTE is to process the signaling message (RRC / NAS message). Does it imply that in CP-Mode, the user data is carried by signaling messages ? Good guess ! Yes, the user data is carried by some signaling messages in CP-mode. More specifically, the user data is carried by NAS message. Even more specifically, the data is carried by NAS message which has 'DedicatedNasInfo' IE.
< 23.401-Figure 5.3.4B.2-1: MO Data transport in NAS PDU >
< 23.401-Figure 5.3.4B.3-1: MT Data transport in NAS PDUs >
UE Capabability for CIoT Optimization
Network Capability for CIoT Optimization
 3GPP 23.401 - LTE;General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access
5.3.4B Data Transport in Control Plane CIoT EPS optimisation
 3GPP 23.682 - Architecture enhancements to facilitat communications with packet data networks and applications
 3GPP SCEF PRIMER