5G/NR  - NAS

  

 

 

 

Registration in a Nutshell

 

 

  • Registration messages are a set of NAS message involved in Registration to 5G Core Network
  • Mainly three NAS messages are involved : RegistrationRequest, RegistrationAccept, RegistrationComplete
  • Important Information of RegistrationRequest are :
    • UE ID (SUCI)
    • Requested Network Slice List
    • UE NAS Capability (5GMM Capability)
  • Important Information of RegistrationAccept are :
    • UE ID (GUTI)
    • Registraion Result
    • Allowed Network Slice List

 

 

 

Registration in Detail

 

Registration process in 5G/NR is similar to the Attach Process in LTE except many of the new Information elements added or renamed in various NAS message mainly due to core network structure changes in 5G/NR.

 

NOTE : 'Registration' in this note refer to specific NAS messages, not about the full attach sequence. For the details of full registration, check out this note.

 

 

 

 

Signaling(message) Sequence

 

According to 24.501 - 5.5.1.2, Registration sequence for initial attach goes as follows. It can go through a little bit different path depending on how NW respond to UE after it get Registration Request.

 

 

< Case A >  Normal Registration

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3510 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

Registration Accept

T3510 Stop

T3550 Start

UE -> NW(AMF)

Registration Complete

 

T3550 Stop

 

 

< Case B >  No Registration Accept

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3510 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

No Registration Accept

T3510 Expire

  

 

 

< Case C >  Registration Reject

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

Registration Request

T3510 Start

 

UE -> NW

< Authentication >

 

 

UE -> NW

< Security >

 

 

UE <- NW(AMF)

Registration Reject

T3510 Expire

  

 

Following is a table listing various reject cause and the expected UE behavior based on 24.501-5.5.1.2.5. I put only high level and most critical (most critical to me) in the 'Expected UE behavior' column. There are much more futher details specified in the specification.

 

Reject Cause

Expected UE Behavior

#3 (Illegal UE); or

#6 (Illegal ME).
  • consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed
  • delete the list of equivalent PLMNs and enter the state 5GMM-DEREGISTERED.

#7 (5GS services not allowed)
  • consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed
  • delete the list of equivalent PLMNs and enter the state 5GMM-DEREGISTERED.

#11 (PLMN not allowed)
  • delete the list of equivalent PLMNs and reset the registration attempt counter and store the PLMN identity in the "forbidden PLMN list".
  • enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection

#12 (Tracking area not allowed)
  • shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • reset the registration attempt counter
  • store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

#13 (Roaming not allowed in this tracking area).
  • delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall delete the list of equivalent PLMNs
  • reset the registration attempt counter.
  • store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH

#15 (No suitable cells in tracking area)
  • store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.
  • search for a suitable cell in another tracking area

#22 (Congestion)

If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated,

  • abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.
  • stop timer T3346 if it is running
  • stays in the current serving cell and applies the normal cell reselection process. The initial registration procedure is started if still needed when timer T3346 expires or is stopped.

Else

  • consider it as abnorma case

#27 (N1 mode not allowed)
  • delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • reset the registration attempt counter and shall enter the state 5GMM-NULL.
  • disable the N1 mode capability for both 3GPP access and non-3GPP access.

#72 (Non-3GPP access to 5GCN not allowed)
  • delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI
  • reset the registration attempt counter and enter the state 5GMM-DEREGISTERED.

#73 (Serving network not authorized)
  • reset the registration attempt counter
  • store the PLMN identity in the "forbidden PLMN list"
  • enter state 5GMM-DEREGISTERED.PLMN-SEARCH

 

 

 

Message Structure

 

There are several important NAS signaling messages related to 5G registration. In this section, I will summarize about a few most important messages and look into its structure.

 

 

Registration Request

 

The "Registration Request" message is used by the mobile device to initiate the registration process with the 5G core network.

The Registration Request message contains important information about the mobile device, and is sent to the 5G core network via the Radio Access Network (RAN) and conveyed to AMF. The message also contains other information such as the device's capabilities and supported network features.

 

Followings are information that are included in RegistrationRequest message. Click on the link to get the details of each components (Information Elements).

    Registration Request (24.501 - 8.2.6.1)

      Registration Request Type

        followOnRequest

        registration Type (24.501 - 9.11.3.7)

      ngKSI (24.501 - 9.11.3.32)

      5GS MobileIdentity (24.501 - 9.11.3.4)

      non-Current Native NAS key set identifier (24.501 - 9.11.3.32)

      5GMM Capability  (24.501 - 9.11.3.1)

      ue Security Capability  (24.501 - 9.11.3.54)

      Requested NSSAI  (24.501 - 9.11.3.37)

      last Visited Registered TAI (24.501 - 9.11.3.8)

      s1 Ue Network Capability (24.501 - 9.11.3.48)

      uplink Data Status (24.501 - 9.11.3.57)

      pdu Session Status (24.501 - 9.11.3.44)

      MICOIndication (24.501 - 9.11.3.31)

      ue Status (24.501 - 9.11.3.56)

      additional GUTI (24.501 - 9.11.3.4)

      allowed Pdu Session Status (24.501 - 9.11.3.13)

      ue Usage Setting (24.501 - 9.11.3.55)

      requested Drx Parameters (24.501 - 9.11.3.2A)

      EPS Nas Message Container (24.501 - 9.11.3.24)

      LADN Indication (24.501 - 9.11.3.29)

      payload Container Type (24.501 - 9.11.3.40)

      payload Container (24.501 - 9.11.3.39)

      Network Slicing Indication  (24.501 - 9.11.3.36)

      5GS Update Type  (24.501 - 9.11.3.9A)

      NAS Message Container (24.501 - 9.11.3.33)

      EPS Bearer Context Status  (24.501 - 9.11.3.23A)

       

 

 

Example 01 > UEIC=SUCI, No Requested NASSI

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x41 (Registration request)
5GS registration type:
  Follow-on request bit = 1
  Value = 1 (initial registration)
ngKSI:
  TSC = 0
  NAS key set identifier = 7
5GS mobile identity:
  SUCI
    SUPI format = 0 (IMSI)
    MCC = 001
    MNC = 01 
    Routing indicator = 0000
    Protection sheme id = 0 (Null scheme)
    Home network public key identifier = 0
    MSIN = 0123456789
5GMM capability:
  0x03 (LPP=0, HO attach=1, S1 mode=1)
UE security capability:
  0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 
        5G-EA6=0, 5G-EA7=0)
  0xf0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 
        5G-IA6=0, 5G-IA7=0)
S1 UE network capability:
  0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
  0xf0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
  0xc0 (UEA0=1, UEA1=1, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
  0xc0 (UCS2=1, UIA1=1, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
  0x01 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=1)
  0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, 
        ProSe-relay=0, ProSe-dc=0)
  0x30 (15 bearers=0, SGC=0, N1mode=1, DCNR=1, CP backoff=0, RestrictEC=0, 
        V2X PC5=0, multipleDRB=0)

 

Example 02 >  UEIC=GUTI, Requested NASSI

 

This is a sample message from the log from Amarisoft callbox.

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x1 (Integrity protected)

    Auth code = 0xc2653407

    Sequence number = 0x09

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x0 (Plain 5GS NAS message, not security protected)

    Message type = 0x41 (Registration request)

    5GS registration type:

      Follow-on request bit = 1

      Value = 1 (initial registration)

    ngKSI:

      TSC = 0

      NAS key set identifier = 2

    5GS mobile identity:

      5G-GUTI

        MCC = 001

        MNC = 01

        AMF Region ID = 128

        AMF Set ID = 4

        AMF Pointer = 1

        5G-TMSI = 0x2fedc8c7

    UE security capability:

      0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0,

            5G-EA6=0, 5G-EA7=0)

      0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0,

            5G-IA6=0, 5G-IA7=0)

      0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

      0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

    NAS message container:

      Protocol discriminator = 0x7e (5GS Mobility Management)

      Security header = 0x0 (Plain 5GS NAS message, not security protected)

      Message type = 0x41 (Registration request)

      5GS registration type:

        Follow-on request bit = 1

        Value = 1 (initial registration)

      ngKSI:

        TSC = 0

        NAS key set identifier = 2

      5GS mobile identity:

        5G-GUTI

          MCC = 001

          MNC = 01

          AMF Region ID = 128

          AMF Set ID = 4

          AMF Pointer = 1

          5G-TMSI = 0x2fedc8c7

      5GMM capability:

        0x03 (SGC=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0, RestrictEC=0, LPP=0,

              HO attach=1, S1 mode=1)

      UE security capability:

        0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0,

              5G-EA6=0, 5G-EA7=0)

        0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0,

              5G-IA6=0, 5G-IA7=0)

        0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

        0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

      Requested NSSAI:

        S-NSSAI

          Length of S-NSSAI contents = 1 (SST)

          SST = 0x01

      Last visited registered TAI:

        MCC = 001

        MNC = 01

        TAC = 0x000064

      S1 UE network capability:

        0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

        0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

        0xc0 (UEA0=1, UEA1=1, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)

        0x40 (UCS2=0, UIA1=1, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)

        0x19 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=1, LPP=1, LCS=0, 1xSRVCC=0, NF=1)

        0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0,

              ProSe-relay=0, ProSe-dc=0)

        0xb0 (15 bearers=1, SGC=0, N1mode=1, DCNR=1, CP backoff=0, RestrictEC=0, V2X PC5=0,

              multipleDRB=0)

      UE's usage setting = 0x01 (Data centric)

      LADN indication:

        Length = 0

        Data =

      Network slicing indication = 0x00 (DCNI=0, NSSCI=0)

      5GS update type = 0x01 (EPS-PNB-CIoT=no additional information,

                        5GS-PNB-CIoT=no additional information, NG-RAN-RCU=0, SMS requested=1)

 

Example 03 >  UEIC=SUCI, Multiple Requested NASSI

 

This is a sample message from the log from Amarisoft callbox.

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x4 (Integrity protected and ciphered with new 5G NAS security context)

    Auth code = 0x291dbc03

    Sequence number = 0x00

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x0 (Plain 5GS NAS message, not security protected)

    Message type = 0x5e (Security mode complete)

    IMEISV:

      IMEISV = 0123456700000101

    NAS message container:

      Protocol discriminator = 0x7e (5GS Mobility Management)

      Security header = 0x0 (Plain 5GS NAS message, not security protected)

      Message type = 0x41 (Registration request)

      5GS registration type:

        Follow-on request bit = 1

        Value = 1 (initial registration)

      ngKSI:

        TSC = 0

        NAS key set identifier = 7

      5GS mobile identity:

        SUCI

          SUPI format = 0 (IMSI)

          MCC = 001

          MNC = 01

          Routing indicator = 0

          Protection sheme id = 0 (Null scheme)

          Home network public key identifier = 0

          MSIN = 0123456789

      5GMM capability:

        0x00 (SGC=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0, RestrictEC=0, LPP=0,

                HO attach=0, S1 mode=0)

      UE security capability:

        0xe0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=0, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

        0xe0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=0, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

      Requested NSSAI:

        S-NSSAI

          Length of S-NSSAI contents = 4 (SST and SD)

          SST = 0x01

          SD = 0x000001

        S-NSSAI

          Length of S-NSSAI contents = 4 (SST and SD)

          SST = 0x03

          SD = 0x000032

      UE's usage setting = 0x01 (Data centric)

      Network slicing indication = 0x02 (DCNI=1, NSSCI=0)

      5GS update type = 0x01 (EPS-PNB-CIoT=no additional information, 5GS-PNB-CIoT=no additional information,

                                        NG-RAN-RCU=0, SMS requested=1)

 

 

 

Registration Accept

 

5G Core would send Registration Accept message if all the information from RegistrationRequest message is acceptable and all the authentication and security processes are completed.

 

 

 

Example 01 > UE ID = GUTI, Allowed NSSAI

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0xb5719578
Sequence number = 0x01
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x42 (Registration accept)
5GS registration result = 0x09 (SMS allowed=1, 3GPP access)
5G-GUTI:
  5G-GUTI
    MCC = 001
    MNC = 01 
    AMF Region ID = 128
    AMF Set ID = 4
    AMF Pointer = 1
    5G-TMSI = 0x82fbff80
TAI list:
  Length = 7
  Data = 00 00 f1 10 00 00 64
Allowed NSSAI:
  S-NSSAI
    Length of S-NSSAI contents = 1 (SST)
    SST = 0x00
5GS network feature support:
  0x01 (MPSI=0, IWK N26=0, EMF=not supported, EMC=not supported, 
        IMS-VoPS-N3GPP=0, IMS-VoPS-3GPP=1)
  0x00 (MCSI=0, EMCN3=0)
T3512 value:
  Value = 30
  Unit = 5 (1 minute)
Emergency number list:
  Length = 8
  Data = 03 1f 19 f1 03 1f 11 f2

 

Example 02 > UE ID = GUTI, Multiple Allowed NSSAI

 

This is a sample message from the log provided by Amarisoft.

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x2 (Integrity protected and ciphered)

    Auth code = 0x091863db

    Sequence number = 0x01

    Protocol discriminator = 0x7e (5GS Mobility Management)

    Security header = 0x0 (Plain 5GS NAS message, not security protected)

    Message type = 0x42 (Registration accept)

    5GS registration result = 0x09 (Emergency registered=0, NSSAA to be performed=0, SMS allowed=1, 3GPP access)

    5G-GUTI:

      5G-GUTI

        MCC = 001

        MNC = 01

        AMF Region ID = 128

        AMF Set ID = 4

        AMF Pointer = 1

        5G-TMSI = 0xc69f2cdc

    TAI list:

      Length = 7

      Data = 00 00 f1 10 00 00 64

    Allowed NSSAI:

      S-NSSAI

        Length of S-NSSAI contents = 4 (SST and SD)

        SST = 0x01

        SD = 0x000001

      S-NSSAI

        Length of S-NSSAI contents = 4 (SST and SD)

        SST = 0x03

        SD = 0x000032

    5GS network feature support:

      0x03 (MPSI=0, IWK N26=0, EMF=not supported, EMC=not supported, IMS-VoPS-N3GPP=1, IMS-VoPS-3GPP=1)

      0x00 (5G-UP CIoT=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0,

               RestrictEC=both CE mode A and CE mode B are not restricted, MCSI=0, EMCN3=0)

    T3512 value:

      Value = 30

      Unit = 5 (1 minute)

    Emergency number list:

      Length = 8

      Data = 03 1f 19 f1 03 1f 11 f2

     

 

 

Registration Complete

 

    Registration complete (24.501 - 8.2.8.1)

      5GS registration result (24.501 - 9.11.3.51)

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x6f97640e
Sequence number = 0x01
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x43 (Registration complete)

 

 

 

Information Element Structure

 

In this section, I want to highlight and summarize some of the important Information Elements used in Registration related NAS message.

 

 

5GS registration type

 

The 5GS registration type parameter in the Registration Request message enables the 5G core network to identify the type of registration that the mobile device is requesting, and to initiate the appropriate registration procedure.

    5GS registration type value (3bits)

      1=initial registration

      2=mobility registration updating

      3=periodic registration updating

      4=emergency registration

      6=reserved

     

    Follow-on request (1 bit)

      0=No follow-on request pending  // the AMF initiates the release of the UE context

                                                  // after registration complete message

      1=Follow-on request pending

The Follow-on request is used to indicate that the mobile device is requesting a follow-on procedure, which is a specific type of mobility registration.

 

The Follow-on procedure is used when the mobile device has moved to a new location within the same 5G core network, but has not lost the radio connection with the previous location. This can occur when the mobile device moves from one cell to another within the same location area or tracking area, or when the mobile device is handed over between different radio access technologies (RATs) that are served by the same core network.

 

When the mobile device requests a Follow-on procedure using the "Follow-on request" parameter, the 5G core network can use the previous registration context to quickly re-establish the connection with the mobile device in the new location, without requiring a full authentication and authorization process. This helps to reduce the delay and signaling overhead involved in the registration process, and enables the mobile device to maintain continuity of service during the mobility transition.

 

 

 

5GS Mobile Identity

 

5G Registration Request message is used by a device to identify itself to the 5G network when initiating registration. It contains the mobile device's International Mobile Subscriber Identity (IMSI) or other unique identifier, such as a Temporary Mobile Subscriber Identity (TMSI) or a 5G Globally Unique Temporary Identity (5G-GUTI).

    No identity

    SUCI

      SUCI (SUPI Format = IMSI)

        mcc

        mnc

        Routing Indicator (16 bit, 4 digit)

        Protection scheme Id (4 bit)

        Home network public key identifier (8 bit)

        Scheme output (n Bytes)

      SUCI (SUPI Format = Network specific identifier)

        Type of identity (3 bit)

        SUCI NAI (n bytes)

    5G-GUTI

      mcc

      mnc

      AMF Region ID (8 bit)

      AMF Set ID (10 bit)

      AMF Pointer (6 bit)

      5G TMSI (32 bit)

    IMEI

    5G-S-TMSI

      AMF Set ID (8 bit)

      AMF Pointer (8 bit)

      5G - TMSI(32 bit)

    IMEISV

 

 

 

5GMM capability information

 

    EPC NAS supported (S1 mode)

      S1 mode not supported

      S1 mode supported

    ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message for handover support (HO attach)

      ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message with request type set to "handover" or "handover of emergency bearer services" to transfer PDU session from N1 mode to S1 mode not supported

      ATTACH REQUEST message containing PDN CONNECTIVITY REQUEST message with request type set to "handover" or "handover of emergency bearer services" to transfer PDU session from N1 mode to S1

      mode supported

    LTE Positioning Protocol (LPP) capability

      LPP in N1 mode not supported

      LPP in N1 mode supported

 

 

 

5GS registration result

 

This field is present in the NAS (Non-Access Stratum) message of the 5G Attach Accept message and it indicates the status of the attach procedure for the UE.

 

< 24.501 - Figure 9.11.3.6.1: 5GS registration result information element >

    5GS registration result value (3bit)

      3GPP access

      Non-3GPP access

      3GPP access and non-3GPP access

      reserved

    SMS over NAS transport allowed (SMS allowed) (1bit)

      SMS over NAS not allowed

      SMS over NAS allowed

    NSSAA to be performed : Network slice-specific authentication and authorization is to be performed

      Network slice-specific authentication and authorization is not to be performed

      Network slice-specific authentication and authorization is to be performed

    Emergency registered

      Not registered for emergency services

      Registered for emergency services

 

 

 

5GS network feature support

 

    IMS voice over PS session over 3GPP access indicator (IMS-VoPS-3GPP)

      IMS voice over PS session not supported over 3GPP access

      IMS voice over PS session supported over 3GPP access

    IMS voice over PS session over non-3GPP access indicator (IMS-VoPS-N3GPP)

      IMS voice over PS session not supported over non-3GPP access

      IMS voice over PS session supported over non-3GPP access

    Emergency service support indicator for 3GPP access (EMC)

      Emergency services not supported

      Emergency services supported in NR connected to 5GCN only

      Emergency services supported in E-UTRA connected to 5GCN only

      Emergency services supported in NR connected to 5GCN and E-UTRA

    Emergency service fallback indicator for 3GPP access (EMF)

      Emergency services fallback not supported

      Emergency services fallback supported in NR connected to 5GCN only

      Emergency services fallback supported in E-UTRA connected to 5GCN only

      Emergency services fallback supported in NR connected to 5GCN and E-UTRA connected to 5GCN

    Interworking without N26 interface indicator (IWK N26)

      Interworking without N26 interface not supported

      Interworking without N26 interface supported

    MPS indicator (MPSI)

      Access identity 1 not valid in RPLMN or equivalent PLMN

      Access identity 1 valid in RPLMN or equivalent PLMN

    Emergency service support for non-3GPP access indicator (EMCN3)

      Emergency services not supported over non-3GPP access

      Emergency services supported over non-3GPP access

    MCS indicator (MCSI)

      Access identity 2 not valid in RPLMN or equivalent PLMN

      Access identity 2 valid in RPLMN or equivalent PLMN

 

 

 

5GS update type

 

    SMS over NAS transport requested (SMS requested)

      0 SMS over NAS not supported

      1 SMS over NAS supported

    NG-RAN Radio Capability Update (NG-RAN-RCU)

      0 NG-RAN radio capability update not needed

      1 NG-RAN radio capability update needed

 

 

 

Allowed NSSAI

 

The Allowed NSSAI indicates the network slice(s) that the mobile device is allowed to use based on the network's policy and available resources. To understand the role of this IE in the context of real 5G operation, you need to have a good understandings on Network Slicing. I would recommend you to check out the note on Network Slicing for further details.

 

< 24.501 - Figure 9.11.3.37.1: NSSAI information element >

 

< 24.501 - Figure 9.11.2.8.1: S-NSSAI information element >

 

 

 

 

Allowed PDU session status

    All 0 : indicates that the user-plane resources of corresponding PDU session is not allowed to be

            re-established over 3GPP access.

    All 1 : indicates that the user-plane resources of corresponding PDU session can be re-established

            over 3GPP access.

 

 

 

Configured NSSAI

 

24.501-8.2.7.7 states :

    The network may include this IE if the network needs to provide the UE with a new configured NSSAI for the current PLMN or SNPN.

 

To understand the role of this IE in the context of real 5G operation, you need to have a good understandings on Network Slicing. I would recommend you to check out the note on Network Slicing for further details.

 

< 24.501 - Figure 9.11.3.37.1: NSSAI information element >

 

< 24.501 - Figure 9.11.2.8.1: S-NSSAI information element >

 

 

 

LADN(Local Area Data Network) Indication

 

    LADN DNN value 1

    LADN DNN value 2

    ...

    LADN DNN value n

 

 

 

LADN information

 

    LADN 1

      DNN Value (24.501 - 9.11.2.1A)

      5GS tracking area identity list

    LADN 2

      DNN Value

      5GS tracking area identity list

    ....

    LADN n

      DNN Value

      5GS tracking area identity list

 

 

 

MICO(Mobile Initiated Connection Only) indication

 

    0 : all PLMN registration area not allocated

    1 : all PLMN registration area allocated

 

 

 

Network slicing indication

 

24.501-9.11.3.36 states as follows :

The purpose of the Network slicing indication information element is to indicate additional information associated with network slicing in the generic UE configuration update procedure and the registration procedure, other than the user's configured NSSAI, allowed NSSAI, pending NSSAI and rejected NSSAI information.

 

< 24.501-Figure 9.11.3.36.1: Network slicing indication >

     

    Network slicing subscription change indication (NSSCI) - octat 1, bit 1

      0 Network slicing subscription not changed

      1 Network slicing subscription changed

    Default configured NSSAI indication (DCNI) - octat 1, bit 2

      0 Requested NSSAI not created from default configured NSSAI

      1 Requested NSSAI created from default configured NSSAI

       

    In the UE to network direction bit 1 is spare. The UE shall set this bit to zero.

    In the network to UE direction bit 2 is spare. The network shall set this bit to zero.

    Bits 3 and 4 are spare and shall be coded as zero.

    NOTE :  NSSAI stands for Network Slice Selection Assistance Information)

 

 

NSSAI (Network Slice Selection Assistance Information)

 

24.501-9.11.3.37 states as follows :

The purpose of the NSSAI information element is to identify a collection of S-NSSAIs

 

< 24.501 - Figure 9.11.3.37.1: NSSAI information element >

     

    The NSSAI is a type 4 information element with a minimum length of 4 octets and a maximum length of 146 octets.

     

    S-NSSAI value 1

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

    S-NSSAI value 2

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

    ....

    S-NSSAI value N

      SST (Slice/Service Type)

      SD (Slide Differentiator)

      Mapped HPLMN SST

      Mapped HPLMN SD

     

    NOTE 1: The total number of S-NSSAI values in a requested NSSAI cannot exceed eight.

    NOTE 2: The number of S-NSSAI values in an allowed NSSAI cannot exceed eight.

    NOTE 3: The number of S-NSSAI values in a configured NSSAI or pending NSSAI cannot exceed sixteen.

    NOTE 4: More than one S-NSSAIs in an NSSAI can have the same SST values, and optionally same SD values, which are are associated with different mapped HPLMN SST values and optionally mapped HPLMN SD values.

 

 

 

NSSAI(Network Slice Selection Assistance Information) inclusion mode

 

24.501-9.11.3.37A States as follows :

The purpose of the NSSAI inclusion mode information element is to indicate the NSSAI inclusion mode in which the UE shall operate.

 

< 24.501 - Figure 9.11.3.37A.1: NSSAI inclusion mode information element >

 

    [bit(2),bit(1)] = [0,0] : NSSAI inclusion mode A

    [bit(2),bit(1)] = [0,1] : NSSAI inclusion mode B

    [bit(2),bit(1)] = [1,0] : NSSAI inclusion mode C

    [bit(2),bit(1)] = [1,1] : NSSAI inclusion mode D

 

 

 

Operator-defined access category definitions

    Operator-defined access category definition 1

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

    Operator-defined access category definition 2

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

    ....

    Operator-defined access category definition n

      Precedence value

      Operator-defined access category number

      PSAC

        Standardized access category field is not included

        Standardized access category field is included

      Length of criteria

      Criteria

        DNN type

        OS id + OS App Id type

        S-NSSAI type

      Standardized access category

 

 

 

PDU session status

 

The purpose of the PDU session status information element is to indicate the state of each PDU session that can be identified by a PDU session identity(PSI).

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates that the 5GSM state of the corresponding PDU session is PDU SESSION INACTIVE.

    1 : indicates that the 5GSM state of the corresponding PDU session is not PDU SESSION INACTIVE

NOTE : PSI stands for PDU Session Identity

 

 

 

PDU session reactivation result

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates establishment of user-plane resources of the PDU session was not requested in the Uplink data status IE or establishment of user-plane resources of the PDU session was not allowed in the Allowed PDU session status IE or establishment of user-plane resource of the PDU session is successful.

    1 : indicates either establishment of user-plane resources of the PDU session was requested in the Uplink data status IE but establishment of user-plane resource of the PDU session is not successful or indicates establishment of user-plane resources of the PDU session was allowed in the Allowed PDU session status IE butestablishment of user-plane resource of the PDU session is either not performed or not successful.

NOTE : PSI stands for PDU Session Identity

 

 

 

PDU session reactivation result error cause

    PDU session ID 1

      cause value 1 (8 bit)

    PDU session ID 2

      cause value 2

    ...

    PDU session ID N

      cause value N

 

 

 

Requested NSSAI

 

The Requested NSSAI is used to inform the 5G core network about the network slice(s) that the mobile device is requesting to use. To understand the role of this IE in the context of real 5G operation, you need to have a good understandings on Network Slicing. I would recommend you to check out the note on Network Slicing for further details.

 

< 24.501 - Figure 9.11.3.37.1: NSSAI information element >

 

< 24.501 - Figure 9.11.2.8.1: S-NSSAI information element >

 

 

 

Service type

 

    Service type value (4 bit)

      signalling

      data

      mobile terminated services

      emergency services

      emergency services fallback

      high priority access

      elevated signalling

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

 

 

 

UE status

 

    EMM registration status (S1 mode reg)

      0 UE is not in EMM-REGISTERED state

      1 UE is in EMM-REGISTERED state

    5GMM registration status (N1 mode reg)

      0 UE is not in 5GMM-REGISTERED state

      1 UE is in 5GMM-REGISTERED state

 

 

 

Uplink Data Status

 

This IE carriies a bitmap of 16 bits as labeled below.

    PSI(7),PSI(6),PSI(5),PSI(4),PSI(3),PSI(2),PSI(1),PSI(0)

    PSI(15),PSI(14),PSI(13),PSI(12),PSI(11),PSI(10),PSI(9),PSI(8)

0 or 1 for each bit indicates followings.

    0 : indicates that no uplink data are pending for the corresponding PDU session identity.

    1 : indicates that uplink data are pending for the corresponding PDU session identity.

 

 

 

Reference

 

[1] 5G Standalone Access Registration Signaling Messages

[2] 5G Standalone Access: Registration Procedure