5G/NR - NAS                                           Home : www.sharetechnote.com

 

 

 

 

 

 

Service Setup

 

PDU Session Establishement is equivalent to PDN Establishment in LTE. Main purpose of this process is to assign UE IP and inform the UE of various the IP address of various corenetwork components (application layer component)

 

 

 

 

Signaling Sequence

 

According to 24.501 - 5.6.1.1 Service Setup procedure initiation goes as follows.

 

 

< Case A > Normal Service Setup

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

SERVICE ACCEPT

T3517 Stop

 

 

 

< Case B > No Service Accept

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

No SERVICE ACCEPT

T3517 Expire

 

 

 

< Case C > Service Reject

 

Direction

Message

UE Timer

NW Timer

UE -> NW(AMF)

SERVICE REQUEST

T3517 Start

 

UE <- NW(AMF)

SERVICE REJECT

T3517 Stop

 

 

Following is a table listing various reject cause and the expected UE behavior based on 24.501-5.6.1.5 and 24.501-AnnexA. I put only high level and most critical (most critical to me) in the 'Expected UE behavior' column. There are much more futher details specified in the specification.

 

Reject Cause

Expected UE Behavior

#3 (Illegal UE); or

#6 (Illegal ME).

  • The UE shall consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed

#7 (5GS services not allowed)

  • The UE shall consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed

#9 (UE identity cannot be derived by the network)

  • The UE shall set the 5GS update status to 5U2 NOT UPDATED (and shall store it) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall enter the state 5GMM-DEREGISTERED.
  • If the service request was initiated for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 23.167. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures.
  • If the service request was initiated for any reason other than emergency services fallback or initiating an emergency PDU session, the UE shall perform a new initial registration procedure

#10 (Implicitly de-registered)

  • The UE shall enter the state 5GMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped 5G NAS security context or partial native 5G NAS security context.
  • If the rejected request was not for initiating an emergency PDU session, the UE shall perform a new initial registration procedure.

#11 (PLMN not allowed)

  • The UE shall delete the list of equivalent PLMNs and store the PLMN identity in the "forbidden PLMN list". The UE shall enter the state 5GMM-DEREGISTERED and perform a PLMN selection

#12 (Tracking area not allowed)

  • The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

#13 (Roaming not allowed in this tracking area)

  • The UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present.
  • The UE shall perform a PLMN selection.

#15 (No suitable cells in tracking area)

  • The UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.
  • The UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present.
  • If the service request was not initiated for emergency services fallback, the UE shall search for a suitable cell in another tracking area.

#22 (Congestion)

  • If the T3346 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below
  • If the rejected request was not for initiating an emergency PDU session, the UE shall abort the service request procedure and enter state 5GMM-REGISTERED, and stop timer T3517 if still running.

#27 (N1 mode not allowed)

  • The UE shall disable the N1 mode capability for both 3GPP access and non-3GPP access

#28 (Restricted service area)

  • UE shall perform the registration procedure for mobility and periodic registration update unless the service type IE in the SERVICE REQUEST message was set to "elevated signalling" .
  • If the service type IE in the SERVICE REQUEST message was set to "elevated signalling", the UE shall not reinitiate service request procedure until the UE enters an allowed area or leaves a non-allowed area, except for emergency services, high priority access or responding to paging or notification.

#72 (Non-3GPP access to 5GCN not allowed)

  • UE shall delete 5GGUTI,last visited registered TAI, TAI list and ngKSI for non-3GPP access. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED for non-3GPP access.
  • The UE shall disable the N1 mode capability for non-3GPP access

#73 (Serving network not authorized)

  • The UE shall set the 5GS update status to 5U2 NOT UPDATED, store the PLMN identity in the "forbidden PLMN list" and enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection

 

 

 

Message Structure

 

 

 

Service Request

 

    Service Request (24.501-8.2.16.1)

      Service request message identity (24.501-9.7)

      ngKSI(24.501-9.11.3.32)

      Service type(24.501-9.11.3.50)

      5G-S-TMSI(24.501-9.11.33.4)

      Uplink data status(24.501-9.11.3.57)

      PDU session status(24.501-9.11.3.44)

      Allowed PDU session status(24.501-9.11.3.13)

      NAS message container(24.501-9.11.3.33)

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

    Message: Service request

    Data:

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x1 (Integrity protected)
    Auth code = 0x749766c9
    Sequence number = 0x03
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x4c (Service request)
    ngKSI:
      TSC = 0
      NAS key set identifier = 0
    Service type = 0x01 (data)
    5G-S-TMSI:
      5G-S-TMSI
        AMF Set ID = 4
        AMF Pointer = 1
        5G-TMSI = 0x82fbff80
    NAS message container:
      Protocol discriminator = 0x7e (5GS Mobility Management)
      Security header = 0x0 (Plain 5GS NAS message, not security protected)
      Message type = 0x4c (Service request)
      ngKSI:
        TSC = 0
        NAS key set identifier = 0
      Service type = 0x01 (data)
      5G-S-TMSI:
        5G-S-TMSI
          AMF Set ID = 4
          AMF Pointer = 1
          5G-TMSI = 0x82fbff80
      Uplink data status:
        0x20 (PSI(7)=0,PSI(6)=0,PSI(5)=1,PSI(4)=0,PSI(3)=0,PSI(2)=0,PSI(1)=0)
        0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)
      PDU session status:
        0x20 (PSI(7)=0,PSI(6)=0,PSI(5)=1,PSI(4)=0,PSI(3)=0,PSI(2)=0,PSI(1)=0)
        0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)

     

 

 

 

Service Accept

 

This is a sample message from the log provided by Amarisoft.

 

    Service Accept (24.501-8.2.17.1)

      Service accept message identity (24.501-9.7)

      PDU session status(24.501-9.11.3.44)

      PDU session reactivation result(24.501-9.11.3.42)

      PDU session reactivation error cause(24.501-9.11.3.43)

      EAP message(24.501-9.11.2.2)

 

 

 

Example 01 >

 

    Message: Service accept
     

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x2 (Integrity protected and ciphered)
    Auth code = 0x91871bda
    Sequence number = 0x04
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x4e (Service accept)
    PDU session status:
      0x20 (PSI(7)=0, PSI(6)=0, PSI(5)=1, PSI(4)=0, PSI(3)=0, PSI(2)=0, PSI(1)=0)
      0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)
    PDU session reactivation result:
      0x00 (PSI(7)=0, PSI(6)=0, PSI(5)=0, PSI(4)=0, PSI(3)=0, PSI(2)=0, PSI(1)=0)
      0x00 (PSI(15)=0,PSI(14)=0,PSI(13)=0,PSI(12)=0,PSI(11)=0,PSI(10)=0,PSI(9)=0,PSI(8)=0)

 

 

 

Service Type (24.501-9.11.3.50)

 

    Service type value

      signalling

      data

      mobile terminated services

      emergency services

      emergency services fallback

      high priority access

      elevated signalling

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "signalling", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

      unused; shall be interpreted as "data", if received by the network

    Service Type IEI

 

 

 

Reference

 

[1] 3GPP SA2 architecture and functions for 5G mobile communication system

[2] 5G beyond radio access: a flatter sliced network

[3] End to End Network Slicing