5G/NR  - NAS

  

 

 

 

 

Service Setup

 

The Service Request procedure in 5G is used when a device wants to establish a connection to the AMF. There are two possible scenarios in which this can happen: Network Triggered and UE Triggered Request. In practice, I think UE triggered Request is more common.

In more formal expression as stated in 24.501-5.6.1.1, 'The purpose of the service request procedure is to change the 5GMM mode from 5GMM-IDLE to 5GMMCONNECTED mode.' as highlighted in the following statemachine.

 

< 24.501 Figure 5.1.3.2.1.1.1: 5GMM main states in the UE >

 

In this note, I will talk about the details of Service Request procedure as follows.

 

 

 

What triggers UE initiated Service Request ?

 

When UE is supposed to trigger Service Request ? The most common case is when there is some data to be sent by UE while it is in idle mode, UE initiate the service request.

 

More detailed case description for UE initiated Service Request is stated in 24.501-5.6.1.1 as follows : (NOTE : The first two cases would be the most common cases you would see in regular operations)

  • the UE has uplink signalling pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access
  • the UE has user data pending over 3GPP access and the UE is in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access;
  • the UE has user data pending over non-3GPP access and the UE is in 5GMM-CONNECTED mode over non-3GPP access;
  • the UE in 5GMM-IDLE mode over non-3GPP access, receives an indication from the lower layers of non-3GPP access, that the access stratum connection is established between UE and network, if T3346 is not running;
  • the UE in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access receives a request from the upper layers to perform emergency service fallback and performs emergency services fallback
  • the UE has to request resources for V2X communication over PC5.

 

 

 

What triggers Network initiated Service Request ?

 

When UE is supposed to trigger Service Request ? The most common case is when there is some data to be sent by Network while it is in idle mode, NW(Network) initiate the service request.

 

More detailed case description for NW initiated Service Request is stated in 24.501-5.6.1.1 as follows : (NOTE : The first two cases would be the most common cases you would see in regular operations)

  • the network has downlink signalling pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access;
  • the network has downlink user data pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access;
  • the network has downlink signalling pending over non-3GPP access, the UE is in 5GMM-IDLE mode over non- 3GPP access and in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access
  • the network has downlink user data pending over non-3GPP access, the UE is in 5GMM-IDLE mode over non-3GPP access and in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access

 

 

 

Signaling Sequence

 

According to 24.501 - 5.6.1.1 Service Setup procedure initiation goes as follows.

 

 

< Case A > Normal Service Setup

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

SERVICE ACCEPT

T3517 Stop

 

 

 

< Case B > No Service Accept

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

No SERVICE ACCEPT

T3517 Expire

 

 

 

< Case C > Service Reject

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

SERVICE REJECT

T3517 Stop

 

 

Following is a table listing various reject cause and the expected UE behavior based on 24.501-5.6.1.5 and 24.501-AnnexA. I put only high level and most critical (most critical to me) in the 'Expected UE behavior' column. There are much more futher details specified in the specification.

 

Reject Cause

Expected UE Behavior

#3 (Illegal UE); or

#6 (Illegal ME).
  • The UE shall consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed

#7 (5GS services not allowed)
  • The UE shall consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed

#9 (UE identity cannot be derived by the network)
  • The UE shall set the 5GS update status to 5U2 NOT UPDATED (and shall store it) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall enter the state 5GMM-DEREGISTERED.
  • If the service request was initiated for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 23.167. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures.
  • If the service request was initiated for any reason other than emergency services fallback or initiating an emergency PDU session, the UE shall perform a new initial registration procedure

#10 (Implicitly de-registered)
  • The UE shall enter the state 5GMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped 5G NAS security context or partial native 5G NAS security context.
  • If the rejected request was not for initiating an emergency PDU session, the UE shall perform a new initial registration procedure.

#11 (PLMN not allowed)
  • The UE shall delete the list of equivalent PLMNs and store the PLMN identity in the "forbidden PLMN list". The UE shall enter the state 5GMM-DEREGISTERED and perform a PLMN selection

#12 (Tracking area not allowed)
  • The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

#13 (Roaming not allowed in this tracking area)
  • The UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present.
  • The UE shall perform a PLMN selection.

#15 (No suitable cells in tracking area)
  • The UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present.
  • If the service request was not initiated for emergency services fallback, the UE shall search for a suitable cell in another tracking area.

#22 (Congestion)
  • If the T3346 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below
  • If the rejected request was not for initiating an emergency PDU session, the UE shall abort the service request procedure and enter state 5GMM-REGISTERED, and stop timer T3517 if still running.

#27 (N1 mode not allowed)
  • The UE shall disable the N1 mode capability for both 3GPP access and non-3GPP access

#28 (Restricted service area)
  • UE shall perform the registration procedure for mobility and periodic registration update unless the service type IE in the SERVICE REQUEST message was set to "elevated signalling" .
  • If the service type IE in the SERVICE REQUEST message was set to "elevated signalling", the UE shall not reinitiate service request procedure until the UE enters an allowed area or leaves a non-allowed area, except for emergency services, high priority access or responding to paging or notification.

#72 (Non-3GPP access to 5GCN not allowed)
  • UE shall delete 5GGUTI,last visited registered TAI, TAI list and ngKSI for non-3GPP access. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED for non-3GPP access.
  • The UE shall disable the N1 mode capability for non-3GPP access

#73 (Serving network not authorized)
  • The UE shall set the 5GS update status to 5U2 NOT UPDATED, store the PLMN identity in the "forbidden PLMN list" and enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection

 

 

 

Message Structure

 

The structure of messages and a specific IE(Information Elements) involved in Service Setup process listed below :

 

 

 

Service Request

 

    Service Request (24.501-8.2.16.1)

      Service request message identity (24.501-9.7)

      ngKSI(24.501-9.11.3.32)

      Service type(24.501-9.11.3.50)

      5G-S-TMSI(24.501-9.11.33.4)

      Uplink data status(24.501-9.11.3.57)
      PDU session status(24.501-9.11.3.44)

      Allowed PDU session status(24.501-9.11.3.13)

      NAS message container(24.501-9.11.3.33)

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.  Highlights of this message is as follows.

  • This message is triggered by the existence of pending data on UE (saying 'I have some data to send'). This is indicated by the IE 'Service Type'.
  • The PSI (PDU Session Identifier) for the pending data (data to be sent) is 5. This is indicated by the IE 'uplink data status'
  • The PSI (PDU Session Identifier) for the currently active PDU is 5. This is indicated by the IE 'PDU session status'.

    Message: Service request

    Data:

    Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x1 (Integrity protected)
Auth code = 0x749766c9
Sequence number = 0x03
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x4c (Service request)
ngKSI:
  TSC = 0
  NAS key set identifier = 0
Service type = 0x01 (data)
5G-S-TMSI:
  5G-S-TMSI
    AMF Set ID = 4
    AMF Pointer = 1
    5G-TMSI = 0x82fbff80
NAS message container:
  Protocol discriminator = 0x7e (5GS Mobility Management)
  Security header = 0x0 (Plain 5GS NAS message, not security protected)
  Message type = 0x4c (Service request)
  ngKSI:
    TSC = 0
    NAS key set identifier = 0
  Service type = 0x01 (data)
  5G-S-TMSI:
    5G-S-TMSI
      AMF Set ID = 4
      AMF Pointer = 1
      5G-TMSI = 0x82fbff80
  Uplink data status:
    0x20 (PSI(7)=0,PSI(6)=0,PSI(5)=1,PSI(4)=0,PSI(3)=0,PSI(2)=0,PSI(1)=0)
    0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)
  PDU session status:
    0x20 (PSI(7)=0,PSI(6)=0,PSI(5)=1,PSI(4)=0,PSI(3)=0,PSI(2)=0,PSI(1)=0)
    0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)

 

 

 

Service Accept

 

    Service Accept (24.501-8.2.17.1)

      Service accept message identity (24.501-9.7)

      PDU session status(24.501-9.11.3.44)

      PDU session reactivation result(24.501-9.11.3.42)

      PDU session reactivation error cause(24.501-9.11.3.43)

      EAP message(24.501-9.11.2.2)

 

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

    Message: Service accept
     

    Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x91871bda
Sequence number = 0x04
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x4e (Service accept)
PDU session status:  
  0x20 (PSI(7)=0, PSI(6)=0, PSI(5)=1, PSI(4)=0, PSI(3)=0, PSI(2)=0, PSI(1)=0)
  0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)
PDU session reactivation result:
  0x00 (PSI(7)=0, PSI(6)=0, PSI(5)=0, PSI(4)=0, PSI(3)=0, PSI(2)=0, PSI(1)=0)
  0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)

 

 

 

Service Type (24.501-9.11.3.50)

 

    Service type value

      signalling

      data

      mobile terminated services

      emergency services

      emergency services fallback

      high priority access

      elevated signalling

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

    Service Type IEI

 

 

 

Reference

 

[1] 3GPP SA2 architecture and functions for 5G mobile communication system

[2] 5G beyond radio access: a flatter sliced network

[3] End to End Network Slicing

 

 

 

Readings