5G/NR - NAS                                           Home : www.sharetechnote.com

 

 

 

 

 

Registration

 

Registration process in 5G/NR is similar to the Attach Process in LTE except many of the new Information elements added or renamed in various NAS message mainly due to core network structure changes in 5G/NR.

 

 

 

 

Signaling(message) Sequence

 

According to 24.501 - 5.5.1.2, Registration sequence for initial attach goes as follows. It can go through a little bit different path depending on how NW respond to UE after it get Registration Request.

 

 

< Case A >  Normal Registration

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3512 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

Registration Accept

T3512 Stop

T3550 Start

UE -> NW(AMF)

Registration Complete

 

T3550 Stop

 

 

< Case B >  No Registration Accept

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3512 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

No Registration Accept

T3512 Expire

 

 

 

< Case C >  Registration Reject

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3512 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

Registration Reject

T3512 Expire

 

 

Following is a table listing various reject cause and the expected UE behavior based on 24.501-5.5.1.2.5. I put only high level and most critical (most critical to me) in the 'Expected UE behavior' column. There are much more futher details specified in the specification.

 

Reject Cause

Expected UE Behavior

#3 (Illegal UE); or

#6 (Illegal ME).

  • consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed
  • delete the list of equivalent PLMNs and enter the state 5GMM-DEREGISTERED.

#7 (5GS services not allowed)

  • consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed
  • delete the list of equivalent PLMNs and enter the state 5GMM-DEREGISTERED.

#11 (PLMN not allowed)

  • delete the list of equivalent PLMNs and reset the registration attempt counter and store the PLMN identity in the "forbidden PLMN list".
  • enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection

#12 (Tracking area not allowed)

  • shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • reset the registration attempt counter
  • store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

#13 (Roaming not allowed in this tracking area).

  • delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall delete the list of equivalent PLMNs
  • reset the registration attempt counter.
  • store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH

#15 (No suitable cells in tracking area)

  • store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.
  • search for a suitable cell in another tracking area

#22 (Congestion)

If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated,

  • abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.
  • stop timer T3346 if it is running
  • stays in the current serving cell and applies the normal cell reselection process. The initial registration procedure is started if still needed when timer T3346 expires or is stopped.

Else

  • consider it as abnorma case

#27 (N1 mode not allowed)

  • delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • reset the registration attempt counter and shall enter the state 5GMM-NULL.
  • disable the N1 mode capability for both 3GPP access and non-3GPP access.

#72 (Non-3GPP access to 5GCN not allowed)

  • delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI
  • reset the registration attempt counter and enter the state 5GMM-DEREGISTERED.

#73 (Serving network not authorized)

  • reset the registration attempt counter
  • store the PLMN identity in the "forbidden PLMN list"
  • enter state 5GMM-DEREGISTERED.PLMN-SEARCH

 

 

 

Message Structure

 

 

 

Registration Request

 

    Registration Request (24.501 - 8.2.6.1)

      Registration Request Type

        followOnRequest

        registration Type (24.501 - 9.11.3.7)

      ngKSI (24.501 - 9.11.3.32)

      5GS MobileIdentity (24.501 - 9.11.3.4)

      non-Current Native NAS key set identifier (24.501 - 9.11.3.32)

      5GMM Capability  (24.501 - 9.11.3.1)

      ue Security Capability  (24.501 - 9.11.3.54)

      Requested NSSAI  (24.501 - 9.11.3.37)

      last Visited Registered TAI (24.501 - 9.11.3.8)

      s1 Ue Network Capability (24.501 - 9.11.3.48)

      uplink Data Status (24.501 - 9.11.3.57)

      pdu Session Status (24.501 - 9.11.3.44)

      MICOIndication (24.501 - 9.11.3.31)

      ue Status (24.501 - 9.11.3.56)

      additional GUTI (24.501 - 9.11.3.4)

      allowed Pdu Session Status (24.501 - 9.11.3.13)

      ue Usage Setting (24.501 - 9.11.3.55)

      requested Drx Parameters (24.501 - 9.11.3.2A)

      EPS Nas Message Container (24.501 - 9.11.3.24)

      LADN Indication (24.501 - 9.11.3.29)

      payload Container Type (24.501 - 9.11.3.40)

      payload Container (24.501 - 9.11.3.39)

      Network Slicing Indication  (24.501 - 9.11.3.36)

      5GS Update Type  (24.501 - 9.11.3.9A)

      NAS Message Container (24.501 - 9.11.3.33)

      EPS Bearer Context Status  (24.501 - 9.11.3.23A)

       

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x41 (Registration request)
    5GS registration type:
      Follow-on request bit = 1
      Value = 1 (initial registration)
    ngKSI:
      TSC = 0
      NAS key set identifier = 7
    5GS mobile identity:
      SUCI
        SUPI format = 0 (IMSI)
        MCC = 001
        MNC = 01 
        Routing indicator = 0000
        Protection sheme id = 0 (Null scheme)
        Home network public key identifier = 0
        MSIN = 0123456789
    5GMM capability:
      0x03 (LPP=0, HO attach=1, S1 mode=1)
    UE security capability:
      0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 
            5G-EA6=0, 5G-EA7=0)
      0xf0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 
            5G-IA6=0, 5G-IA7=0)
    S1 UE network capability:
      0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
      0xf0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
      0xc0 (UEA0=1, UEA1=1, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
      0xc0 (UCS2=1, UIA1=1, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
      0x01 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=1)
      0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, 
            ProSe-relay=0, ProSe-dc=0)
      0x30 (15 bearers=0, SGC=0, N1mode=1, DCNR=1, CP backoff=0, RestrictEC=0, 
            V2X PC5=0, multipleDRB=0)

 

 

 

 

Registration Accept

 

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x2 (Integrity protected and ciphered)
    Auth code = 0xb5719578
    Sequence number = 0x01
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x42 (Registration accept)
    5GS registration result = 0x09 (SMS allowed=1, 3GPP access)
    5G-GUTI:
      5G-GUTI
        MCC = 001
        MNC = 01 
        AMF Region ID = 128
        AMF Set ID = 4
        AMF Pointer = 1
        5G-TMSI = 0x82fbff80
    TAI list:
      Length = 7
      Data = 00 00 f1 10 00 00 64
    Allowed NSSAI:
      S-NSSAI
        Length of S-NSSAI contents = 1 (SST)
        SST = 0x00
    5GS network feature support:
      0x01 (MPSI=0, IWK N26=0, EMF=not supported, EMC=not supported, 
            IMS-VoPS-N3GPP=0, IMS-VoPS-3GPP=1)
      0x00 (MCSI=0, EMCN3=0)
    T3512 value:
      Value = 30
      Unit = 5 (1 minute)
    Emergency number list:
      Length = 8
      Data = 03 1f 19 f1 03 1f 11 f2

 

 

 

Registration Complete

 

    Registration complete (24.501 - 8.2.8.1)

      5GS registration result (24.501 - 9.11.3.51)

       

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x2 (Integrity protected and ciphered)
    Auth code = 0x6f97640e
    Sequence number = 0x01
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x43 (Registration complete)

 

 

 

Information Element Structure

 

 

5GS registration type

 

    5GS registration type value (3bits)

      initial registration

      mobility registration updating

      periodic registration updating

      emergency registration

      reserved

     

    Follow-on request (1 bit)

      No follow-on request pending

      Follow-on request pending

 

 

 

5GS Mobile Identity

 

    No identity

    SUCI

      SUCI (SUPI Format = IMSI)

        mcc

        mnc

        Routing Indicator (16 bit, 4 digit)

        Protection scheme Id (4 bit)

        Home network public key identifier (8 bit)

        Scheme output (n Bytes)

      SUCI (SUPI Format = Network specific identifier)

        Type of identity (3 bit)

        SUCI NAI (n bytes)

    5G-GUTI

      mcc

      mnc

      AMF Region ID (8 bit)

      AMF Set ID (10 bit)

      AMF Pointer (6 bit)

      5G TMSI (32 bit)

    IMEI

    5G-S-TMSI

      AMF Set ID (8 bit)

      AMF Pointer (8 bit)

      5G - TMSI(32 bit)

    IMEISV

  

 

 

5GMM capability information

 

    EPC NAS supported (S1 mode)

      S1 mode not supported

      S1 mode supported

    ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message for handover support (HO attach)

      ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message with request type set to "handover" or "handover of emergency bearer services" to transfer PDU session from N1 mode to S1 mode not supported

      ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message with request type set to "handover" or "handover of emergency bearer services" to transfer PDU session from N1 mode to S1

      mode supported

    LTE Positioning Protocol (LPP) capability

      LPP in N1 mode not supported

      LPP in N1 mode supported

 

 

 

5GS registration result

 

    5GS registration result value (3bit)

      3GPP access

      Non-3GPP access

      3GPP access and non-3GPP access

      reserved

     

    SMS over NAS transport allowed (SMS allowed) (1bit)

      SMS over NAS not allowed

      SMS over NAS allowed

 

 

 

5GS network feature support

 

    IMS voice over PS session over 3GPP access indicator (IMS-VoPS-3GPP)

      IMS voice over PS session not supported over 3GPP access

      IMS voice over PS session supported over 3GPP access

    IMS voice over PS session over non-3GPP access indicator (IMS-VoPS-N3GPP)

      IMS voice over PS session not supported over non-3GPP access

      IMS voice over PS session supported over non-3GPP access

    Emergency service support indicator for 3GPP access (EMC)

      Emergency services not supported

      Emergency services supported in NR connected to 5GCN only

      Emergency services supported in E-UTRA connected to 5GCN only

      Emergency services supported in NR connected to 5GCN and E-UTRA

    Emergency service fallback indicator for 3GPP access (EMF)

      Emergency services fallback not supported

      Emergency services fallback supported in NR connected to 5GCN only

      Emergency services fallback supported in E-UTRA connected to 5GCN only

      Emergency services fallback supported in NR connected to 5GCN and E-UTRA connected to 5GCN

    Interworking without N26 interface indicator (IWK N26)

      Interworking without N26 interface not supported

      Interworking without N26 interface supported

    MPS indicator (MPSI)

      Access identity 1 not valid in RPLMN or equivalent PLMN

      Access identity 1 valid in RPLMN or equivalent PLMN

    Emergency service support for non-3GPP access indicator (EMCN3)

      Emergency services not supported over non-3GPP access

      Emergency services supported over non-3GPP access

    MCS indicator (MCSI)

      Access identity 2 not valid in RPLMN or equivalent PLMN

      Access identity 2 valid in RPLMN or equivalent PLMN

 

 

 

5GS update type

 

    SMS over NAS transport requested (SMS requested)

      0 SMS over NAS not supported

      1 SMS over NAS supported

    NG-RAN Radio Capability Update (NG-RAN-RCU)

      0 NG-RAN radio capability update not needed

      1 NG-RAN radio capability update needed

 

 

 

Allowed PDU session status

    All 0 : indicates that the user-plane resources of corresponding PDU session is not allowed to be re-established

    over 3GPP access.

    All 1 : indicates that the user-plane resources of corresponding PDU session can be re-established over 3GPP

    access.

 

 

 

LADN(Local Area Data Network) Indication

 

    LADN DNN value 1

    LADN DNN value 2

    ...

    LADN DNN value n

 

 

 

LADN information

 

    LADN 1

      DNN Value (24.501 - 9.11.2.1A)

      5GS tracking area identity list

    LADN 2

      DNN Value

      5GS tracking area identity list

    ....

    LADN n

      DNN Value

      5GS tracking area identity list

 

 

 

MICO(Mobile Initiated Connection Only) indication

 

    0 : all PLMN registration area not allocated

    1 : all PLMN registration area allocated

 

 

 

Network slicing indication

 

    Network slicing subscription change indication (NSSCI)

      0 Network slicing subscription not changed

      1 Network slicing subscription changed

    Default configured NSSAI indication (DCNI)

      0 Requested NSSAI not created from default configured NSSAI

      1 Requested NSSAI created from default configured NSSAI

      NOTE :  NSSAI stands for Network Slice Selection Assistance Information)

 

 

 

NSSAI (Network Slice Selection Assistance Information)

 

    NSSAI IEl

    Length of NSSAI contents

    S-NSSAI value 1

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

    S-NSSAI value 2

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

    ....

    S-NSSAI value N

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

     

 

 

 

NSSAI(Network Slice Selection Assistance Information) inclusion mode

    NSSAI inclusion mode A

    NSSAI inclusion mode B

    NSSAI inclusion mode C

    NSSAI inclusion mode D

 

 

 

Operator-defined access category definitions

    Operator-defined access category definition 1

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

    Operator-defined access category definition 2

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

    ....

    Operator-defined access category definition n

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

 

 

 

PDU session status

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates that the 5GSM state of the corresponding PDU session is PDU SESSION INACTIVE.

    1 : indicates that the 5GSM state of the corresponding PDU session is not PDU SESSION INACTIVE

 

 

 

PDU session reactivation result

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates establishment of user-plane resources of the PDU session was not requested in the Uplink data status IE or establishment of user-plane resources of the PDU session was not allowed in the Allowed PDU session status IE or establishment of user-plane resource of the PDU session is successful.

    1 : indicates either establishment of user-plane resources of the PDU session was requested in the Uplink data status IE but establishment of user-plane resource of the PDU session is not successful or indicates establishment of user-plane resources of the PDU session was allowed in the Allowed PDU session status IE butestablishment of user-plane resource of the PDU session is either not performed or not successful.

 

 

 

PDU session reactivation result error cause

    PDU session ID 1

      cause value 1 (8 bit)

    PDU session ID 2

      cause value 2

    ...

    PDU session ID N

      cause value N

 

 

 

Service type

 

    Service type value (4 bit)

      signalling

      data

      mobile terminated services

      emergency services

      emergency services fallback

      high priority access

      elevated signalling

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

 

 

 

UE status

 

    EMM registration status (S1 mode reg)

      0 UE is not in EMM-REGISTERED state

      1 UE is in EMM-REGISTERED state

    5GMM registration status (N1 mode reg)

      0 UE is not in 5GMM-REGISTERED state

      1 UE is in 5GMM-REGISTERED state

 

 

 

Uplink Data Status

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates that no uplink data are pending for the corresponding PDU session identity.

    1 : indicates that uplink data are pending for the corresponding PDU session identity.

 

 

 

Reference

 

[1] 5G Standalone Access Registration Signaling Messages

[2] 5G Standalone Access: Registration Procedure