6.1 5GC-MT-LR Procedure

23.2733GPP5G System (5GS) Location Services (LCS)Release 18Stage 2TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

6.1.1 5GC-MT-LR procedure for the regulatory location service

Figure 6.1.1-1 illustrates the general network positioning for the LCS clients external to the PLMN for the regulatory location service for non-roaming scenario. In this scenario, it is assumed that the target UE is identified using an SUPI or GPSI.

This procedure is applicable to a request from an LCS client for a current location of the target UE, and it is assumed that the LCS client is authorised to use the location service and no privacy verification is required.

Figure 6.1.1-1: 5GC-MT-LR procedure for the regulatory location service

1. The external location services client sends a request to the GMLC for a location for the target UE identified by an GPSI or an SUPI. The request may include the required QoS, UE unaware indication and Supported GAD shapes. If location is required for more than one UE, the steps following below may be repeated and in that case the GMLC shall verify whether the number of Target UEs in the LCS request is equal to or less than the Maximum Target UE Number of the LCS client. If Maximum Target UE Number is exceeded, the GMLC shall reject the LCS request, the step 2-10 are skipped, and then GMLC respond to the client with proper error cause in the step 11.

2. The GMLC invokes a Nudm_UECM_Get service operation towards the home UDM of the target UE to be located with the GPSI or SUPI of this UE.

3. The UDM returns the network addresses of the current serving AMF.

NOTE: For backward compatibility, the GMLC can use a Nudm_SDM_Get service operation to retrieve the SUPI of the target UE from a Rel-15 UDM as defined in clause 5.2.3.3.2 of TS 23.502 [19].

4. The GMLC invokes the Namf_Location_ProvidePositioningInfo service operation towards the AMF to request the current location of the UE. The service operation includes the SUPI, and client type and may include the required QoS, UE unaware indication and Supported GAD shapes.

5. If the UE is in CM IDLE state, the AMF initiates a network triggered Service Request procedure as defined in clause 4.2.3.3 of TS 23.502 [19] to establish a signalling connection with the UE.

If UE unaware indication is received by AMF, and the UE is in CM_IDLE state or in RRC_INACTIVE state (if known by AMF by requesting the NG-RAN to report RRC state information), the steps 5 – 9 are skipped.

6. The AMF selects an LMF based on the available information as defined in clause 5.1 or based on AMF local configuration. The LMF selection takes the 5G-AN currently serving the UE into account. The selection may use a NRF query.

7. The AMF invokes the Nlmf_Location_DetermineLocation service operation towards the LMF to request the current location of the UE. The service operation includes a LCS Correlation identifier, the serving cell identity of the Primary Cell in the Master RAN node and the Primary Cell in the Secondary RAN node when available based on Dual Connectivity scenarios, and the client type and may include an indication if UE supports LPP, the required QoS, UE Positioning Capability if available, UE unaware indication and Supported GAD shapes. If any of the procedures in clause 6.11.1 or clause 6.11.2 are used the service operation includes the AMF identity.

8. The LMF performs one or more of the positioning procedures described in clauses 6.11.1, 6.11.2 and 6.11.3. During this step the LMF may use the Namf_Communication_N1N2MessageTransfer service operation to request the transfer of a Positioning related N1 message to the UE or the transfer of a Network Positioning message to the serving NG-RAN node (gNB or NG-eNB) for the UE. The LMF shall determine a geographical location and optionally a location in local coordinates.

If UE unaware indication is received from AMF in step 7, the LMF selects Uplink Positioning method to obtain UE location and performs the positioning procedure described in clause 6.11.2.

9. The LMF returns the Nlmf_Location_DetermineLocation Response towards the AMF to return the current location of the UE and UE Positioning Capability if the UE Positioning Capability is received in step 8 including an indication that the capabilities are non-variable and not received from AMF in step 7. The service operation includes the LCS Correlation identifier, the location estimate, its age and accuracy and may include information about the positioning method and the timestamp of the location estimate.

If UE unaware indication is received from AMF in step 7 and the NG-RAN rejects the Network Positioning message as described in clause 6.11.2 with appropriate rejection cause (e.g. UE cannot be paged) in step 8, the LMF rejects the Nlmf_Location_DetermineLocation Request with appropriate rejection cause (e.g. UE cannot be paged).

10. The AMF returns the Namf_Location_ProvidePositioningInfo Response towards the GMLC/LRF to return the current location of the UE. The service operation includes the location estimate, its age and accuracy and may include information about the positioning method and the timestamp of the location estimate. The AMF stores the UE Positioning Capability in UE context when received from LMF.

If the AMF decides to skip steps 5 – 9 in step 5 based on the UE unaware indication and the UE state or the LMF rejects the Nlmf_Location_DetermineLocation Request with appropriate rejection cause (e.g. UE cannot be paged), the AMF may convert any last known location in the form of a cell ID or TAI into geographical information based on TS 23.032 [8] and as defined in clause 6.2.6.2.5 of TS 29.518 [16] and clauses 5.4.4.7, 5.4.4.8 and 5.4.4.9 of TS 29.571 [33] and answer to the GMLC with the geographical information together with the age of this location.

11. The GMLC sends the location service response to the external location services client.

6.1.2 5GC-MT-LR Procedure for the commercial location service

Figure 6.1.2-1 illustrates the general network positioning requested by the LCS clients or the AF. In this scenario, it is assumed that the target UE may be identified using an SUPI or GPSI. This procedure is applicable to a request from an LCS client or AF for a current location of the target UE, and it is assumed that

– Privacy verification may be required for the location service request;

– The LCS client or the AF needs to be authorised to use the location service.

Figure 6.1.2-1: 5GC-MT-LR Procedure for the commercial location services

1. The LCS Client or the AF (via NEF) sends a request to the (H)GMLC for a location and optionally a velocity for the target UE which may be identified by an GPSI or an SUPI. The request may include the required QoS, supported GAD shapes and other attributes. (H)GMLC (for 1a) or NEF (for 1b) authorizes the LCS Client or the AF for the usage of the LCS service. If the authorization fails, step 2-23 are skipped and (H)GMLC (for 1a) or NEF (for 1b) responds to the LCS Client or the AF the failure of the service authorization in step 24. In some cases, the (H)GMLC derives the GPSI or SUPI of the target UE and possibly the QoS from either subscription data or other data supplied by the LCS Client or AF.

The LCS request may carry also the Service Identity (see TS 22.071 [2]) and the Codeword and the service coverage information. The (H)GMLC may verify that the Service Identity received in the LCS request matches one of the service identities allowed for the LCS client or AF. If the service identity does not match one of the service identities for the LCS client or AF, the (H)GMLC shall reject the LCS request. Otherwise, the (H)GMLC can map the received service identity in a corresponding service type.

The LCS service request may include a scheduled location time if a current location of the UE is required at a specific time in the future.

The LCS service request may include integrity requirements.

NOTE 1: In this release of specification, integrity requirements are only for GNSS integrity.

If the LCS service request contains the pseudonym of the target UE and the (H)GMLC cannot resolve the PMD address from the pseudonym, the (H)GMLC itself determines the verinym (GPSI or SUPI) of the target UE. If the (H)GMLC can resolve the address of PMD from the pseudonym, the HGMLC requests the verinym from its associated PMD. If (H)GMLC is not able to obtain the verinym of the target UE, the (H)GMLC shall cancel the location request.

If a scheduled location time is not included and the requested type of location is "current or last known location" and the requested maximum age of location information is available, the (H)GMLC verifies whether it stores the previously obtained location estimate of the target UE. If the HGMLC stores the location estimate and timestamp of the location estimate (if available) and the location estimate satisfies the requested accuracy and the requested maximum age of location, the (H)GMLC checks the result of the privacy check at step 2. If the result of the privacy check for call/session unrelated class is "Location allowed without notification" then steps 3-23 may be skipped.

1b-1 AF sends the Nnef_EventExposure_Subscribe to the NEF.

1b-2 The NEF identifies based on the QoS attribute received from the location request that higher than cell-ID level location accuracy is required and invokes the Ngmlc_Location_ProvideLocation_Request service operation to the (H)GMLC, which contains the attributes received from the AF request. The NEF may also invoke the Ngmlc_Location_ProvideLocation_Request service operation to the (H)GMLC for lower than cell-ID location accuracy as an implementation option or if a scheduled location time is included.

If location is required for more than one UE, the steps following below may be repeated and in that case the NEF or HGMLC receiving location request, shall verify whether the number of Target UEs in the Nnef_EventExposure_Subscribe or LCS request is equal to or less than the Maximum Target UE Number of the LCS client. If Maximum Target UE Number is exceeded, the NEF or HGMLC shall reject the Nnef_EventExposure_Subscribe or LCS request, the steps 2-23 are skipped, and then GMLC respond to the client with proper error cause in the step 24.

NOTE 2: If cell-ID level or lower than cell-ID level location accuracy is required in the location request, the NEF may invoke an Namf_EventExposure_Subscribe service operation to subscribe location event reporting from the AMF for the target UE as further described in clause 6.5.

2. The (H)GMLC invokes a Nudm_SDM_Get service operation towards the UDM of the target UE to get the privacy settings of the UE identified by its GPSI or SUPI. The UDM returns the target UE Privacy setting of the UE. The (H)GMLC checks the UE LCS privacy profile. If the target UE is not allowed to be located, steps 3-23 are skipped.

3. The (H)GMLC invokes a Nudm_UECM_Get service operation towards the UDM of the target UE with GPSI or SUPI of this UE. The UDM returns the network addresses of the current serving AMF and additionally the address of a VGMLC (for roaming case). If the location request is an immediate location request, the (H)GMLC checks the country codes of the serving node addresses. If the (H)GMLC finds the current AMF is out of the service coverage of the (H)GMLC, the (H)GMLC returns an appropriate error message to the LCS client or AF (via NEF).

NOTE 3: The UDM is aware of the serving AMF address at UE registration on an AMF as defined in clause 4.2.2.2.2 of TS 23.502 [19]. The UDM is aware of a serving VGMLC address at UE registration on an AMF as defined in clause 4.2.2.2.2 of TS 23.502 [19].

NOTE 4: The HGMLC can also query the HSS of the target UE for a serving MME address as described in clause 9.1.1 of TS 23.271 [4]. The EPC-MT-LR procedure described in clause 9.1.15 of TS 23.271 [4], excluding the UE availability event, may then be performed instead of steps 4-23, e.g. if the HSS returns an MME address but the UDM does not return an AMF address.

4. For a non-roaming case, this step is skipped. In the case of roaming, the HGMLC may receive an address of a VGMLC (together with the network address of the current serving AMF) from the UDM in step 3, otherwise, the HGMLC may use the NRF service in the HPLMN to select an available VGMLC in the VPLMN, based on the VPLMN identification contained in the AMF address received in step 3. The HGMLC then sends the location request to the VGMLC by invoking the Ngmlc_Location_ProvideLocation service operation towards the VGMLC. In the cases when the HGMLC did not receive the address of the VGMLC, or when the VGMLC address is the same as the HGMLC address, or when both PLMN operators agree, the HGMLC sends the location service request message to the serving AMF. In this case, step 4 is skipped. If the result of privacy check indicates that the verification based on current location is needed, the HGMLC shall send a location request to the VGMLC (in the case of roaming) or to the AMF (in the case of non-roaming) indicating "positioning allowed without notification" and VGMLC shall invoke an Namf_Location_ProvidePositioningInfo Request service operation towards the AMF at step 5. H-GMLC also provides the LCS client type of AF, if received in step 41b‑2, or LCS client type of LCS client and other attributes to be sent to AMF in step 5.

5. In the case of roaming, the VGMLC first authorizes that the location request is allowed from this HGMLC, PLMN or from this country. If not, an error response is returned. The (H)GMLC or VGMLC invokes the Namf_Location_ProvidePositioningInfo service operation towards the AMF to request the current location of the UE. The service operation includes the SUPI, the client type and may include the required LCS QoS, supported GAD shapes, scheduled location time, service type and other attributes as received or determined in step 1.

NOTE 5: The location request forwarded at step 4 and step 5 may also carry the result of the privacy check in step 2 which may include a codeword provided by the LCS Client or AF and an indication of a privacy related action as described in clause 5.4.

6. If the UE is in CM IDLE state, the AMF initiates a network triggered Service Request procedure as defined in clause 4.2.3.3 of TS 23.502 [19] to establish a signalling connection with the UE.

If signalling connection establishment fails, step 7-13 are skipped and the AMF answers to the GMLC in step 14 with the last known location of the UE (i.e. Cell ID) together with the age of this location.

7. If the indicator of privacy check related action indicates that the UE must either be notified or notified with privacy verification and if the UE supports LCS notification (according to the UE capability information), a notification invoke message is sent to the target UE, indicating the identity of the LCS client and the , service type (if that is both supported and available) and whether privacy verification is required.

8. The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the user to grant or withhold permission. The UE then returns a notification result to the AMF indicating, if privacy verification was requested, whether permission is granted or denied for the current LCS request. If the UE user does not respond after a predetermined time period, the AMF shall infer a "no response" condition. The AMF shall return an error response in step 14 and if roaming VGMLC in step 15 to the HGMLC if privacy verification was requested and either the UE user denies permission or there is no response with the indication received from the (H)GMLC indicating barring of the location request and steps 10~13 are skipped.

The notification result may also indicate the Location Privacy Indication setting for subsequent LCS requests; i.e whether subsequent LCS requests, if generated, will be allowed or disallowed by the UE. The Location Privacy Indication may also indicate a time for disallowing the subsequent LCS requests.

9. The AMF invokes the Nudm_ParameterProvision_Update (LCS privacy) service operation to store in the UDM the Location Privacy Indication information received from the UE. The UDM may then store the updated UE privacy setting information into the UDR as the "LCS privacy" Data Subset of the Subscription Data.

10-13. Step 10-13 are the same as steps 6-9 defined in clause 6.1.1 with the addition that service type may be indicated towards the LMF and the exception that the LMF may determine the UE location in local coordinates or geographical co-ordinates or both. If the supported GAD shapes is not received in step 11 or Local Co-ordinates is not included in the supported GAD shapes, the LMF shall determine a geographical location. If a scheduled location time is provided at step 5, steps 11 and 12 include the following additional differences.

11. The AMF includes the scheduled location time in the Nlmf_Location_DetermineLocation service operation sent towards the LMF.

12. When sending a location request to the UE, the LMF may include the scheduled location time.

NOTE 6: If integrity requirements are received in step 11, LMF may determine to use GNSS positioning method.

NOTE 7: LMF does not deliver the scheduled location time to NG-RAN as part of step 12.

NOTE 8: The LMF may send a location request to the UE at step 12 containing the scheduled location time sometime before the scheduled location time to allow the UE to enter CM Connected state shortly before the scheduled location time.

14. The AMF returns the Namf_Location_ProvidePositioningInfo Response towards the (V)GMLC (or HGMLC for roaming when the NL3 reference point is not supported) to return the current location of the UE. The service operation includes the location estimate, its age and accuracy and may include information about the positioning method and the timestamp of the location estimate.

15. In the case of roaming, the VGMLC forwards the location estimation of the target UE, its age, its accuracy and optionally the information about the positioning method received at step 14 to the HGMLC. For non-roaming scenario, this step is skipped.

16. If the privacy check in step 2 indicates that further privacy checks are needed, the (H)GMLC shall perform an additional privacy check in order to decide whether the (H)GMLC can forward the location information to the LCS client or AF or send a notification if the result of the privacy check requires the notification and verification based on current location. One example when this additional privacy check is needed is when the target UE user has defined different privacy settings for different geographical locations. When an additional privacy check is not needed, the (H)GMLC skips steps 17-23.

17. If the result of privacy checks in step 16 indicates that the notification (and verification) based on current location is needed, and in the case of roaming, the (H)GMLC shall send a location request to the VGMLC with location type indicating "notification only".

18. The (H)GMLC or VGMLC invokes the Namf_Location_ProvidePositioningInfo service operation towards the AMF to request notification (and verification) based on current location.

19. If the UE is in CM IDLE state, the AMF initiates a network triggered Service Request procedure as defined in clause 4.2.3.3 of TS 23.502 [19] to establish a signalling connection with the UE.

20. If the indicator of privacy check related action indicates that the UE must either be notified or notified with privacy verification and if the UE supports LCS notification, the AMF sends a notification invoke message to the target UE, indicating the identity of the LCS client and the service type (if that is both supported and available) and whether privacy verification is required.

21. Step 21 is the same as step 8.

22. The AMF returns the Namf_Location_ProvidePositioningInfo Response towards the (V)GMLC (or HGMLC for roaming when the NL3 reference point is not supported) with an indication of the result of notification and verification procedure performed in steps 20-21.

23. In the case of roaming, the VGMLC forwards an indication of the result of notification and verification procedure to the HGMLC. For non-roaming scenario, this step is skipped.

24. The (H)GMLC sends the location service response to the LCS Client or AF (via the NEF) if the target UE is allowed to be located by the LCS Client or AF. Accordingly, NEF invokes Nnef_EventExposure_Notify or sends Nnef_EventExposure_Subscribe Response to the AF. If the location request from the LCS Client contained the pseudonym and the (H)GMLC resolved the verinym from the pseudonym in step 1, the (H)GMLC shall use the pseudonym of the target UE in the location response to the external LCS client. If the external LCS client or AF requires it, the (H)GMLC may first transform the universal location co-ordinates provided by the AMF into some local geographic reference system. The (H)GMLC may record charging information both for the LCS Client or AF and inter-network revenue charges from the AMF’s network. The location service response from the (H)GMLC to the LCS Client or AF may contain the information about the positioning method used and the indication whether the obtained location estimate satisfies the requested accuracy or not. If in step 2, step 15, step 16 or step 23 the (H)GMLC identifies that the target UE is not allowed to be located by the LCS Client or AF, it rejects the LCS service request, and optionally indicate in the response the reason of the rejection, i.e. the target UE is not allowed to be located. If the LCS QoS Class is Assured and (H)GMLC detects that requested accuracy is not achieved, the (H)GMLC sends error response including failure cause.

6.1.3 5GC-MT-LR multiple location procedure for the regulatory location service

Figure 6.1.3-1 illustrates an extension procedure of 5GC-MT-LR procedure for the regulatory location service defined in clause 6.1.1.

This procedure is applicable for providing multiple location estimates of the target UE to LCS client.

Figure 6.1.3-1: 5GC-MT-LR multiple location procedure for the regulatory location service

1. Steps 1-7 for 5GC-MT-LR procedure for the regulatory location service clause 6.1.1 are performed with the following differences:

– At step 1 in clause 6.1.1 the request from external location services client may include acceptance of INTERMEDIATE response and maximum response time.

– At step 4 in clause 6.1.1 Namf_Location_ProvidePositioningInfo service operation invoked by GMLC may include the acceptance of INTERMEDIATE response and maximum response time, GMLC contact address and LIR reference number. The LIR reference number is allocated by GMLC based on predefined rule.

– At step 7 in clause 6.1.1 Nlmf_Location_DetermineLocation service operation invoked by AMF may include additionally include acceptance of INTERMEDIATE response and maximum response time, GMLC contact address, LIR reference number for the INTERMEDIATE response. AMF can overwrite maximum response time to avoid timeout.

2. LMF performs positioning procedures and determines multiple location estimates during the session.

2.1. This step is executed if the INTERMEDIATE result is available. The LMF invokes an Nlmf_Location_EventNotify service operation towards GMLC and provides the INTERMEDIATE location of the UE during the session and timestamp of the location estimate, and LIR reference number, and INTERMEDIATE event type.

2.2. This step is executed if step 2.1 was executed. The GMLC sends the INTERMEDIATE location of the UE and timestamp of the location estimate to external location services client.

3. Based on step 9 in clause 6.1.1 the LMF returns the Nlmf_Location_DetermineLocation Response towards the AMF to return the FINAL location of the UE. LMF ensures that FINAL location will be transferred towards AMF within the maximum response time.

4. Steps 10-11 for 5GC-MT-LR procedure for the regulatory location service clause 6.1.1 are performed with the following differences:

– At step 11 the FINAL location is sent from GMLC to LCS client.