5.3 General on elementary 5GMM procedures

24.5013GPPNon-Access-Stratum (NAS) protocol for 5G System (5GS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

5.3.1 5GMM modes and N1 NAS signalling connection

5.3.1.1 Establishment of the N1 NAS signalling connection

When the UE is in 5GMM-IDLE mode over 3GPP access and needs to transmit an initial NAS message, the UE shall request the lower layer to establish an RRC connection. Upon indication from the lower layers that the RRC connection has been established, the UE shall consider that the N1 NAS signalling connection over 3GPP access is established and enter 5GMM-CONNECTED mode over 3GPP access.

When the UE is in 5GMM-IDLE mode over non-3GPP access, and the UE receives an indication from the lower layers of non-3GPP access, that the access stratum connection is established between the UE and the network, the UE shall send an initial NAS message, consider the N1 NAS signalling connection is established and enter 5GMM-CONNECTED mode over non-3GPP access.

Initial NAS messages are:

a) REGISTRATION REQUEST message;

b) DEREGISTRATION REQUEST message;

c) SERVICE REQUEST message; and

d) CONTROL PLANE SERVICE REQUEST.

If the UE is capable of both N1 mode and S1 mode and lower layers provide an indication that the current E-UTRA cell is connected to both EPC and 5GCN, for the routing of the REGISTRATION REQUEST message during the initial registration procedure to the appropriate core network (EPC or 5GCN), the UE NAS provides the lower layers with the selected core network type information.

For the routing of the initial NAS message to the appropriate AMF, if the UE holds a 5G-GUTI or 4G-GUTI, the UE NAS provides the lower layers with the UE identity according to the following rules:

a) if the registration procedure for mobility and periodic registration update was triggered due to the last CONFIGURATION UPDATE COMMAND message containing the Configuration update indication IE with the Registration bit set to "registration requested" and including:

1) no other parameters;

2) one or both of the Allowed NSSAI IE and the Configured NSSAI IE; or

3) the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed";

the UE NAS shall not provide the lower layers with the 5G-S-TMSI or the registered GUAMI;

b) if the service request procedure was initiated over non-3GPP access, the UE NAS shall provide the lower layers with the registered GUAMI, but shall not provide the lower layers with the 5G-S-TMSI;

c) if the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over untrusted non-3GPP access, the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclause 5.5.1.2.2 and 5.5.1.3.2, but shall not provide the lower layers with the 5G-S-TMSI;

if the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over trusted non-3GPP access, the UE NAS shall provide the lower layers with the 5G-GUTI, if available, otherwise shall provide the lower layers with the SUCI;

if the UE is the 5G-RG and the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over wireline access, the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclause 5.5.1.2.2 and 5.5.1.3.2, if available, otherwise shall not provide the lower layers with any UE identity;

d) if the UE does not hold a 5G-GUTI that was previously assigned by the same PLMN with which the UE is performing the registration procedure and if:

1) the UE operating in the single-registration mode performs a registration procedure for mobility and periodic registration update indicating "mobility registration updating" following an inter-system change from S1 mode to N1 mode; or

2) the UE which was previously registered in S1 mode before entering state EMM-DEREGISTERED, performs an initial registration procedure, the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface not supported" from the network, and the UE holds a 4G-GUTI;

then the UE NAS provides the lower layers with a GUAMI part of the 5G-GUTI mapped from 4G-GUTI as specified in 3GPP TS 23.003 [4] with an indication that the GUAMI is mapped from EPS; or

e) otherwise:

1) if the tracking area of the current cell is in the registration area, the UE NAS shall provide the lower layers with the 5G-S-TMSI, but shall not provide the registered GUAMI to the lower layers; or

2) if the tracking area of the current cell is not in the registration area, the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclauses 5.5.1.2.2 and 5.5.1.3.2, but shall not provide the lower layers with the 5G-S-TMSI.

For 3GPP access and untrusted non-3GPP access, if the UE does not hold a 5G-GUTI and the UE does not hold a 4G-GUTI, the UE NAS does not provide the lower layers with the 5G-S-TMSI or the registered GUAMI. For trusted non-3GPP access, if the UE does not hold a 5G-GUTI and the UE does not hold a 4G-GUTI, the UE NAS provides the lower layers with the SUCI.

The UE NAS also provides the lower layers with the identity of the selected PLMN (see 3GPP TS 38.331 [30]) if the UE is not operating in SNPN access operation mode. If the UE is operating in SNPN access operation mode, the UE NAS provides the lower layers with the SNPN identity of the selected SNPN. In a shared network, the UE shall choose one of the PLMN identity(ies) or SNPN identity(ies) as specified in 3GPP TS 23.122 [5] and 3GPP TS 24.502 [18].

The UE NAS layer may provide the lower layers with an NSSAI as specified in subclause 4.6.2.3.

If the UE performs initial registration for onboarding services in SNPN or is registered for onboarding services in SNPN, the UE NAS layer shall provide the lower layers with an indication that the connection is for onboarding.

5.3.1.2 Re-establishment of the N1 NAS signalling connection

a) enter 5GMM-IDLE mode; and

b) initiate the registration procedure for mobility and periodic registration update and include the Uplink data status IE in the REGISTRATION REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.5.1.3 for further details).

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has pending uplink user data for PDU session(s) with user-plane resources already established but no pending NAS procedure, the UE shall:

a) enter 5GMM-IDLE mode; and

b) initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication (see subclause 5.6.1 for further details).

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending registration procedure, a service request procedure, or a de-registration procedure, the UE shall:

a) enter 5GMM-IDLE mode;

b) proceed with the pending procedure; and

c) if the pending procedure is a service request or registration procedure and the SERVICE REQUEST message, the CONTROL PLANE SERVICE REQUEST message or the REGISTRATION REQUEST message does not include UE request type IE with Request type value set to "NAS signalling connection release", the UE shall include the Uplink data status IE in the SERVICE REQUEST message, or in the REGISTRATION REQUEST message, indicating the PDU session(s) for which user-plane resources were not active prior to receiving a fallback indication from the lower layers and the UE has pending user data to be sent over 3GPP access, if any, and the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclauses 5.5.1.3 and 5.6.1 for further details).

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending NAS procedure other than a registration procedure, a service request procedure, or a de-registration procedure, the UE shall:

a) enter 5GMM-IDLE mode;

c) upon successful service request procedure completion, proceed with any pending procedure.

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has no pending NAS procedure and no pending uplink user data for PDU session(s) with user-plane resources already established, and the UE was using network resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5 (see 3GPP TS 23.304 [6E]), the UE shall:

a) enter 5GMM-IDLE mode; and

The cases above apply when the UE is in an allowed area or when the UE is not in a non-allowed area.

When the UE:

a) is in a non-allowed area or is not in an allowed area;

b) is in 5GMM-CONNECTED mode over 3GPP access;

c) receives a fallback indication from lower layers; and

d) does not have signalling pending,

the UE shall:

a) enter 5GMM-IDLE mode; and

b) initiate the registration procedure for mobility and periodic registration update. The UE shall not include the Uplink data status IE in the REGISTRATION REQUEST message except if the PDU session for which user-plane resources were active is an emergency PDU session, or if the UE is configured for high priority access in selected PLMN or SNPN.

In the above cases when the UE receives a fallback indication from lower layers, if the UE is in non-allowed area or not in allowed area, the UE shall behave as specified in subclause 5.3.5.

5.3.1.3 Release of the N1 NAS signalling connection

The signalling procedure for the release of the N1 NAS signalling connection is initiated by the network.

In N1 mode, upon indication from lower layers that the access stratum connection has been released, the UE shall enter 5GMM-IDLE mode and consider the N1 NAS signalling connection released.

If the UE in 3GPP access is configured for eCall only mode as specified in 3GPP TS 31.102 [22] then:

– if the N1 NAS signalling connection that was released had been established for eCall over IMS was released, the UE shall start timer T3444; and

– if the N1 NAS signalling connection that was released had been established for a call to an HPLMN designated non-emergency MSISDN or URI for test or terminal reconfiguration service was released, the UE shall start timer T3445.

The UE shall start the timer T3447 if not already running when the N1 NAS signalling connection is released as specified in subclause 5.3.17.

To allow the network to release the N1 NAS signalling connection, the UE:

a) shall start the timer T3540 if the UE receives any of the 5GMM cause values #7, #11, #12, #13, #15, #27, #31, #62, #72, #73, #74, #75, #76 and the UE does not consider the received 5GMM cause value as abnormal case as specified in subclauses 5.5.1.2.7, 5.5.1.3.7 and 5.5.2.3.4;

b) shall start the timer T3540 for a UE in 3GPP access if:

1) the UE receives a REGISTRATION ACCEPT message which does not include a Pending NSSAI IE or UE radio capability ID deletion indication IE;

2) the UE has set the Follow-on request indicator to "No follow-on request pending" in the REGISTRATION REQUEST message;

3) the UE has not included the Uplink data status IE in the REGISTRATION REQUEST message, or the UE has included the Uplink data status IE in the REGISTRATION REQUEST message but the REGISTRATION ACCEPT message indicates that no user-plane resources of any PDU sessions are to be re-established;

4) the UE has not included the Allowed PDU session status IE or has included the Allowed PDU session status IE indicating there is no PDU session(s) for which the UE allowed the user-plane resource to be re-established over 3GPP access in the REGISTRATION REQUEST message, or the UE has included the Allowed PDU session status IE in the REGISTRATION REQUEST message but the REGISTRATION ACCEPT message does not indicate that any user-plane resources of any PDU sessions are to be re-established;

5) the registration procedure has been initiated in 5GMM-IDLE mode, or the UE has set Request type to "NAS signalling connection release" in the UE request type IE in the REGISTRATION REQUEST message and the N1 NAS signalling connection release bit is set to "N1 NAS signalling connection release supported" in the 5GS network feature support IE of the REGISTRATION ACCEPT message;

6) the user-plane resources for PDU sessions have not been set up, except for the case the UE has set Request type to "NAS signalling connection release" in the UE request type IE in the REGISTRATION REQUEST message and the N1 NAS signalling connection release bit is set to "N1 NAS signalling connection release supported" in the 5GS network feature support IE of the REGISTRATION ACCEPT message;

7) the UE need not request resources for V2X communication over PC5 reference point (see 3GPP TS 23.287 [6C]);

8) the UE has included Unavailability period duaration IE in the REGISTRATION REQUEST message; and

9) the UE need not request resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5 (see 3GPP TS 23.304 [6E]);

NOTE 1: The lower layers indicate when the user-plane resources for PDU sessions are successfully established or released.

c) shall start the timer T3540 if the UE receives a REGISTRATION REJECT message indicating:

the 5GMM cause value #9 or #10;

d) shall start the timer T3540 if the UE receives a SERVICE REJECT message indicating:

the 5GMM cause value #9, #10; or

the 5GMM cause value #28 and with no emergency PDU session has been established;

e) shall start the timer T3540 if:

1) the UE receives a CONFIGURATION UPDATE COMMAND message containing the Configuration update indication IE with the Registration bit set to "registration requested" and with:

i) either new allowed NSSAI information or new configured NSSAI information or both included;

ii) the network slicing subscription change indication; or

iii) no other parameters;

2) the user-plane resources for PDU sessions have not been set up; and

f) shall start the timer T3540 for a UE in 3GPP access if:

1) the UE receives a SERVICE ACCEPT message;

2) for the case that the UE sent the:

i) SERVICE REQUEST message, the UE did not set the Service type IE to "signalling" or "high priority access", the UE has not included the Uplink data status IE in the SERVICE REQUEST message, or the UE has included the Uplink data status IE in the SERVICE REQUEST message but the SERVICE ACCEPT message indicates that no user-plane resources of any PDU sessions are to be re-established; or

ii) CONTROL PLANE SERVICE REQUEST message, the UE did not set the Control plane service type IE to "emergency services fallback", the UE has not included the Uplink data status IE in the CONTROL PLANE SERVICE REQUEST message, or the UE has included the Uplink data status IE in the CONTROL PLANE SERVICE REQUEST message but the SERVICE ACCEPT message indicates that no user-plane resources of any PDU sessions are to be re-established;

3) the UE has not included the Allowed PDU session status IE or has included the Allowed PDU session status IE indicating there is no PDU session(s) for which the UE allowed the user-plane resource to be re-established over 3GPP access in the SERVICE REQUEST message or the CONTROL PLANE SERVICE REQUEST message, or the UE has included the Allowed PDU session status IE in the SERVICE REQUEST message or the CONTROL PLANE SERVICE REQUEST message but the SERVICE ACCEPT message does not indicate that any user-plane resources of any PDU sessions are to be re-established;

4) the service request procedure has been initiated in 5GMM-IDLE mode;

5) the user-plane resources for PDU sessions have not been set up;

6) the UE need not request resources for V2X communication over PC5 reference point (see 3GPP TS 23.287 [6C]); and

7) the UE need not request resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5 (see 3GPP TS 23.304 [6E]);

NOTE 2: The lower layers indicate when the user-plane resources for PDU sessions are successfully established or released.

g) may start the timer T3540 if the UE receives any of the 5GMM cause values #3 or #6 or if it receives an AUTHENTICATION REJECT message;

h) shall start the timer T3540 upon completion of the configuration update procedure or the registration procedure if the UE does not have an emergency PDU session and:

1) the UE received a CONFIGURATION UPDATE COMMAND message or a REGISTRATION ACCEPT message while camping on a CAG cell and the entry for the current PLMN in the received "CAG information list" does not include any of the CAG-ID(s) supported by the current CAG cell;

2) the UE received a CONFIGURATION UPDATE COMMAND message or a REGISTRATION ACCEPT message while camping on a non-CAG cell and the entry for the current PLMN in the received "CAG information list" includes an "indication that the UE is only allowed to access 5GS via CAG cells"; or

3) the UE received a CONFIGURATION UPDATE COMMAND message while camping on a CAG cell and the entry for the current PLMN in not included in the received "CAG information list"; or

i) shall start the timer T3540 for a UE in 3GPP access if:

1) the UE receives a SERVICE ACCEPT message; and

2) the UE:

– has set Request type to "NAS signalling connection release" in the UE request type IE in the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message; or

– has set Request type to "Rejection of paging" in the UE request type IE in the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message and the UE receives a CONFIGURATION UPDATE COMMAND message;

j) shall start the timer T3540 if the UE receives the 5GMM cause value #22 along with a T3346 value, and the value indicates that the timer T3346 is neither zero nor deactivated and the NAS procedure has been initiated in 5GMM-IDLE mode; or

k) shall start the timer T3540 if the UE receives a DEREGISTRATION ACCEPT message.

Upon expiry of T3540,

– in cases a), b), f), g), h), i), j) and k) the UE shall locally release the established N1 NAS signalling connection;

– in cases c) and d) the UE shall locally release the established N1 NAS signalling connection and the UE shall initiate the registration procedure as described in subclause 5.5.1.3 or 5.6.1.5; or

– in case e), the UE shall locally release the established N1 NAS signalling connection and perform a new registration procedure as specified in subclause 5.5.1.3.2.

In case a),

– upon receiving a request from the upper layers to perform emergency services fallback only for a UE in 3GPP access or establishing an emergency PDU session, the UE shall stop timer T3540 and shall locally release the N1 NAS signalling connection, before proceeding as specified in subclause 5.5.1.

In case b) and f),

– upon an indication from the lower layers that the user-plane resources for PDU sessions are set up, the UE shall stop timer T3540 and may send uplink signalling via the existing N1 NAS signalling connection or user data via user plane. If the uplink signalling is associated with emergency services fallback only for a UE in 3GPP access or establishing an emergency PDU session, the UE shall stop timer T3540 and send the uplink signalling via the existing N1 NAS signalling connection;

In case b), f) and i),

– upon receipt of a DEREGISTRATION REQUEST message, the UE shall stop timer T3540 and respond to the network-initiated de-registration request via the existing N1 NAS signalling connection as specified in subclause 5.5.2.3;

– upon receipt of a message of a network-initiated 5GMM common procedure except a CONFIGURATION UPDATE COMMAND message without requesting acknowledgement, the UE shall stop timer T3540 and respond to the network-initiated 5GMM common procedure via the existing N1 NAS signalling connection as specified in subclause 5.4;

– if there is no user-plane resources established for PDU sessions, upon receiving a request from the upper layers to perform emergency services fallback only for a UE in 3GPP access or establishing an emergency PDU session, the UE shall stop timer T3540 and shall locally release the N1 NAS signalling connection, before proceeding as specified in subclause 5.6.1;

– if there is no user-plane resources established for PDU sessions, upon receiving a request from the upper layers to perform services other than emergency services fallback only for a UE in 3GPP access or establishing an emergency PDU session, the UE shall wait for the local release of the established N1 NAS signalling connection upon expiry of timer T3540 or wait for timer T3540 being stopped, before initiating NAS signalling;

– upon receipt of a DL NAS TRANSPORT message, the UE shall stop timer T3540 and may send uplink signalling via the existing N1 NAS signalling connection; or

– upon initiation of registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.2.7 for cases h), i), j), subclause 5.5.1.3.7 for cases j), k) or subclause 5.5.1.3.2 for case a), the UE shall stop timer T3540.

In case c) and d),

– upon an indication from the lower layers that the access stratum connection has been released, the UE shall stop timer T3540 and perform a new registration procedure as specified in subclause 5.5.1.3.5 or 5.6.1.5.

In case e),

– upon an indication from the lower layers that the user-plane resources for PDU sessions are set up, the UE shall stop timer T3540 and may send user data via user plane.

NOTE 3: In this case, the new registration procedure is performed when the UE moves to the 5GMM-IDLE mode.

If the UE had set the Follow-on request indicator to "Follow-on request pending" in the REGISTRATION REQUEST message due to pending uplink signalling but cannot send the pending signalling due to new service area restrictions received or due to network not supporting the feature as indicated in the REGISTRATION ACCEPT message (for example UE set the "Follow-on request pending" to send SMS over NAS but AMF notified "SMS over NAS not allowed") and if there is no further pending data or signalling and user plane resources have not been set up, the UE may locally release the established N1 NAS signalling connection upon completion of the registration procedure.

NOTE 4: the UE is allowed to inform the lower layers that there is no 5GMM or 5GSM messages need to be sent over non-3GPP access if the UE receives a REGISTRATION REJECT message over non-3GPP access or a SERVICE REJECT message over non-3GPP access.

If the timer T3540 is not running when the UE enters state 5GMM-DEREGISTERED.PLMN-SEARCH or 5GMM-REGISTERED.PLMN-SEARCH, the UE may locally release the N1 NAS signalling connection.

5.3.1.4 5GMM-CONNECTED mode with RRC inactive indication

This subclause is only applicable for UE’s 5GMM mode over 3GPP access. The 5GMM-CONNECTED mode with RRC inactive indication is not supported when the UE is in NB-N1 mode.

The UE is in 5GMM-CONNECTED mode with RRC inactive indication when the UE is in:

a) 5GMM-CONNECTED mode over 3GPP access at the NAS layer; and

b) RRC_INACTIVE state at the AS layer (see 3GPP TS 38.300 [27]).

Unless stated otherwise, the UE behaviour in 5GMM-CONNECTED mode with RRC inactive indication follows the UE behaviour in 5GMM-CONNECTED over 3GPP access, except that:

a) the UE shall apply the mobility restrictions; and

b) the UE shall perform the PLMN selection procedures

as in 5GMM-IDLE mode over 3GPP access.

The UE shall transition from 5GMM-CONNECTED mode over 3GPP access to 5GMM-CONNECTED mode with RRC inactive indication upon receiving an indication from the lower layers that the RRC connection has been suspended.

NOTE 1: Any pending procedure or uplink data packet when receiving an indication from the lower layers that the RRC connection has been suspended, triggers a request to the lower layers to transition to RRC_CONNECTED state. This is also the case when the pending procedure or uplink data packet triggered a previous request to the lower layers to transition to RRC_CONNECTED state.

If the UE in 3GPP access is configured for eCall only mode as specified in 3GPP TS 31.102 [22] then:

– if the UE with the N1 NAS signalling connection established for eCall over IMS moved to 5GMM-CONNECTED mode with RRC inactive indication, the UE shall start timer T3444; and

– if the UE with the N1 NAS signalling connection established for a call to an HPLMN designated non-emergency MSISDN or URI for test or terminal reconfiguration service moved to 5GMM-CONNECTED mode with RRC inactive indication, the UE shall start timer T3445.

Upon:

a) a trigger of a procedure which requires sending of a NAS message different from a REGISTRATION REQUEST message with the NG-RAN-RCU bit of the 5GS update type IE set to "UE radio capability update needed";

b) an uplink user data packet to be sent for a PDU session with suspended user-plane resources;

c) a trigger to request resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5; or

d) a trigger to request resources for V2X communication over PC5 (see 3GPP TS 23.287 [6C]);

the UE in 5GMM-CONNECTED mode with RRC inactive indication over 3GPP access shall request the lower layers to transition to RRC_CONNECTED state (see 3GPP TS 38.300 [27]).

NOTE 2: If the UE supports Small Data Transmission (SDT) (see 3GPP TS 38.300 [27]), the following applies:

a) if the UE due to pending uplink NAS messages or user data packets is requesting the lower layers to transition to RRC_CONNECTED state, but has not received a response from the lower layers, the UE can send the pending NAS messages or user data packets to the lower layers, and can receive multiple downlink NAS messages or multiple downlink user data packets from the lower layers while the UE remains in 5GMM-CONNECTED mode with RRC inactive indication over 3GPP access (i.e., without transitioning to 5GMM-CONNECTED mode). When the NAS layer triggers the transmission of pending uplink NAS messages or user data packets, and if the SDT is ongoing, the NAS layer will receive the response from the lower layers only after the SDT session has completed or failed;

b) the NAS layer is not aware of the classification of NAS messages or the user data packets as belonging to the SDT session at the lower layers; and

c) the setting of access category and the RRC establishment cause indicated to the lower layers when sending the pending uplink user data packets while the UE remains in 5GMM-CONNECTED mode with RRC inactive indication, is left to implementation.

Upon a trigger to send a REGISTRATION REQUEST message with the NG-RAN-RCU bit of the 5GS update type IE set to "UE radio capability update needed", the UE in 5GMM-CONNECTED mode with RRC inactive indication shall move to 5GMM-IDLE mode over 3GPP access and proceed with the registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3.2.

The UE shall transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-CONNECTED mode over 3GPP access upon receiving an indication from the lower layers that the UE has transitioned to RRC_CONNECTED state (see 3GPP TS 38.300 [27]).

NOTE 3: The AMF can be aware of the transition between 5GMM-CONNECTED mode and 5GMM-CONNECTED mode with RRC inactive indication for a UE (see 3GPP TS 23.502 [9]).

The UE shall trigger a transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode upon selection of a PLMN or SNPN that is not an equivalent PLMN or SNPN to the registered PLMN or SNPN. The UE shall not trigger a transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode upon entering a new PLMN or SNPN which is in the list of equivalent PLMNs or SNPNs.

The UE shall trigger a transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode upon receiving REFRESH command from the UICC as specified in subclause 5.4.5.3.3.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives an indication from the lower layers that the RRC connection has been suspended, the UE shall stay in 5GMM-CONNECTED mode with RRC inactive indication. The UE shall re-initiate any pending procedure that had triggered the request to the lower layers to transition to RRC_CONNECTED state, if still needed.

When the UE in 5GMM-CONNECTED mode with RRC inactive indication receives a fallback indication from lower layers, and the UE has no pending NAS procedure and no pending uplink user data for PDU session(s) with user-plane resources already established, the UE shall:

a) enter 5GMM-IDLE mode; and

b) initiate the registration procedure for mobility and periodic registration update as specified for case o) in subclause 5.5.1.3.2.

If the UE requests the lower layers to transition to RRC_CONNECTED state at initiation of a registration procedure, a service request procedure or a de-registration procedure, upon fallback indication from lower layers, the UE shall:

– enter 5GMM-IDLE mode;

– proceed with the pending procedure; and

– if the pending procedure is a service request or registration request procedure and the SERVICE REQUEST message, the CONTROL PLANE SERVICE REQUEST message or the REGISTRATION REQUEST message does not include UE request type IE with Request type value set to "NAS signalling connection release", the UE shall include the Uplink data status IE in the SERVICE REQUEST message, the CONTROL PLANE SERVICE REQUEST message or in the REGISTRATION REQUEST message, indicating the PDU session(s) without active user-plane resources for which the UE has pending user data to be sent, if any, and the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclauses 5.5.1.3 and 5.6.1 for further details).

If the UE requests the lower layers to transition to RRC_CONNECTED state for other reason than initiation of a registration procedure, or for other reason than a service request procedure, or for other reason than a de-registration procedure, upon fallback indication from lower layers, the UE shall:

1) enter 5GMM-IDLE mode;

2) initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message or the CONTROL PLANE SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.6.1 for further details). If the procedure that triggered the request to the lower layers to transition to RRC_CONNECTED state is the UE-initiated NAS transport procedure and the UE had SMS, location services message, or CIoT user data to send, the UE shall also include the SMS, location services message, or CIoT user data in the CONTROL PLANE SERVICE REQUEST message as described in subclause 5.6.1.2.2; and

3) upon successful service request procedure completion, proceed with any pending procedure.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives a fallback indication from lower layers, and the UE has pending uplink user data for PDU session(s) with user-plane resources already established but no pending NAS procedure, the UE shall:

1) enter 5GMM-IDLE mode; and

In the above cases when the UE receives a fallback indication from lower layers, if the UE is in non-allowed area or not in allowed area, the UE shall behave as specified in subclause 5.3.5.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives an indication from the lower layers that the resumption of the RRC connection has failed, and:

a) if the lower layers indicate that access barring is applicable for all access categories except categories 0 and 2, or access barring is applicable for all access categories except category 0, the UE shall:

1) stay in 5GMM-CONNECTED mode with RRC inactive indication;

b) else, the UE shall:

1) enter 5GMM-IDLE mode; and

2) initiate the registration procedure for mobility and periodic registration update used for mobility (i.e. the 5GS registration type IE set to "mobility registration updating" in the REGISTRATION REQUEST message) for N1 NAS signalling connection recovery as specified for case f) in subclause 5.5.1.3.2.

NOTE 4: An indication from the lower layer that the RRC connection has been released with cause "RRC resume failure" can be considered as an indication that the resumption of the RRC connection has failed.

The UE shall transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode over 3GPP access upon receiving from the lower layers:

a) indication of transition from RRC_INACTIVE state to RRC_IDLE state; or

b) indication of cell selection to E-UTRAN or another RAT that the UE supports.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives an indication from the lower layers about the cell (re-)selection to different RAT that the UE supports, the UE shall initiate the registration procedure for mobility or periodic registration update used for mobility (i.e. the 5GS registration type IE set to "mobility registration updating" in the REGISTRATION REQUEST message) as specified in subclause 5.5.1.3.2.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives an indication from the lower layers of a transition from RRC_INACTIVE state to RRC_IDLE state and 5GMM-REGISTERED.LIMITED-SERVICE is entered, the UE shall subsequently upon entering state 5GMM-REGISTERED.NORMAL-SERVICE and if there is no uplink user data or signalling pending, initiate the registration procedure for mobility and periodic registration update used for mobility (i.e. the 5GS registration type IE set to "mobility registration updating" in the REGISTRATION REQUEST message) for N1 NAS signalling connection recovery as specified in subclause 5.5.1.3.2.

If the UE in 5GMM-CONNECTED mode with RRC inactive indication receives an indication from the lower layers about RAN paging and the MUSIM UE decides not to initiate the service request procedure with service type set to "mobile terminated services" or control plane service type set to "mobile terminating request" to respond to the RAN paging, the UE may initiate the service request procedure and set request type to "NAS signalling connection release" in the UE request type IE and service type to "signalling" in the SERVICE REQUEST message or set request type to "NAS signalling connection release" in the UE request type IE and control plane service type set to "mobile originating request" in the CONTROL PLANE SERVICE REQUEST message to reject the RAN paging as specified in subclause 5.6.1.2 for case o of subclause 5.6.1.1. The UE may include its paging restriction preferences in the Paging restriction IE in the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message as specified in subclause 5.6.1.2 for case o of subclause 5.6.1.1.

NOTE 5: The interworking between the NAS layer and the AS layer triggered by RAN paging is up to UE implementation.

NOTE 6: As an implementation option, the MUSIM UE is allowed to not respond to RAN paging based on the information available in the paging message, e.g. voice service indication.

Upon receiving AMF paging indication from the lower layers, the UE shall transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode over 3GPP access and handle the AMF paging same as the paging request received in the 5GMM-IDLE mode over 3GPP access as specified in subclause 5.6.1.

5.3.1.5 Suspend and resume of the N1 NAS signalling connection

Suspend of the N1 NAS signalling connection can be initiated by the network in 5GMM-CONNECTED mode when user plane CIoT 5GS optimization is used. Resume of the suspended N1 NAS signalling connection is initiated by the UE.

In the UE, when user plane CIoT 5GS optimization is used:

– Upon idle suspend indication from the lower layers, the UE shall enter 5GMM-IDLE mode with suspend indication, shall not consider the N1 NAS signalling connection released and shall not consider the secure exchange of NAS messages terminated (see subclause 4.4.2.5 and 4.4.5).

– Upon trigger of a procedure using an initial NAS message when in 5GMM-IDLE mode with suspend indication, the UE shall:

i) if the initial NAS message is a REGISTRATION REQUEST message with the NG-RAN-RCU bit of the 5GS update type IE set to "UE radio capability update needed", enter 5GMM-IDLE mode without suspend indication and proceed with the registration procedure; or

ii) otherwise, request the lower layer to resume the RRC connection.

NOTE 1: In NB-N1 mode, in the request to the lower layer the data volume information of the initial NAS message is provided to the lower layers. Interactions between the NAS and the lower layers in order to obtain the data volume information of the initial NAS message (see 3GPP TS 36.321 [25E], 3GPP TS 36.331 [25A]) is left to implementations.

– Upon indication from the lower layers that the RRC connection has been resumed when in 5GMM-IDLE mode with suspend indication, the UE shall enter 5GMM-CONNECTED mode. If the pending NAS message is:

i) a SERVICE REQUEST message, the service type IE is not set to "emergency services fallback", and the UE did not include the NAS message container IE in the SERVICE REQUEST message; or

ii) a CONTROL PLANE SERVICE REQUEST message, and the UE did not include the CIoT small data container IE or the NAS message container IE in the CONTROL PLANE SERVICE REQUEST message,

the message shall not be sent. Otherwise the UE shall cipher the message as specified in subclause 4.4.5 and send the pending initial NAS message upon entering 5GMM-CONNECTED mode;

NOTE 2: If a NAS message is discarded and not sent to the network, the uplink NAS COUNT value corresponding to that message is reused for the next uplink NAS message to be sent.

– Upon fallback indication from the lower layers at RRC connection resume when in 5GMM-IDLE mode with suspend indication, the UE shall enter 5GMM-IDLE mode without suspend indication, send any pending initial NAS message and proceed as if RRC connection establishment had been requested;

– Upon indication from the lower layers that the RRC connection resume has failed and indication from the lower layers that the RRC connection is suspended, the UE shall enter 5GMM-IDLE mode with suspend indication and restart the ongoing NAS procedure if required; and

– Upon indication from the lower layers that the RRC connection resume has failed and indication from the lower layers that the RRC connection is not idle suspended, the UE shall enter 5GMM-IDLE mode without suspend indication and restart the ongoing NAS procedure if required.

In the network, when user plane CIoT 5GS optimization is used:

– Upon idle suspend indication from the lower layers, the network shall enter 5GMM-IDLE mode with suspend indication, shall not consider the N1 NAS signalling connection released and shall not consider the secure exchange of NAS messages terminated; and

– Upon indication from the lower layers that it has received the NGAP UE context resume request message as specified in 3GPP TS 38.413 [31] when in 5GMM-IDLE mode with suspend indication, the network shall enter 5GMM-CONNECTED mode.

5.3.2 Permanent identifiers

A globally unique permanent identity, the 5G subscription permanent identifier (SUPI), is allocated to each subscriber for 5GS-based services. The IMSI, the network specific identifier, the GCI and the GLI are valid SUPI types. When the SUPI contains a network specific identifier, a GCI or a GLI, it shall take the form of a network access identifier (NAI). When the UE performs initial registration for onboarding services in SNPN or is registered for onboarding services in SNPN, the SUPI contains the onboarding SUPI derived from the default UE credentials for primary authentication. The UE derives the onboarding SUPI before or during the initial registration for onboarding services in SNPN and uses the derived onboarding SUPI in the initial registration for onboarding services in SNPN and while registered for onboarding services in SNPN.

The structure of the SUPI and its derivatives are specified in 3GPP TS 23.003 [4].

The UE provides the SUPI to the network in concealed form. The SUCI is a privacy preserving identifier containing the concealed SUPI. When the SUPI contains a network specific identifier, a GCI or a GLI, the SUCI shall take the form of a NAI as specified in 3GPP TS 23.003 [4].

A UE supporting N1 mode includes a SUCI:

a) in the REGISTRATION REQUEST message when the UE is attempting initial registration procedure and a valid 5G-GUTI is not available;

b) in the IDENTITY RESPONSE message, if the SUCI is requested by the network during the identification procedure; and

c) in the DEREGISTRATION REQUEST message when the UE initiates a de-registration procedure and a valid 5G-GUTI is not available.

If the UE uses the "null-scheme" as specified in 3GPP TS 33.501 [24] to generate a SUCI, the SUCI contains the unconcealed SUPI.

When:

– not operating in SNPN access operation mode; or

– operating in SNPN access operation mode but not performing initial registration for onboarding services and not registered for onboarding services;

the UE shall use the "null-scheme" if:

a) the home network has not provisioned the public key needed to generate a SUCI;

b) the home network has configured "null-scheme" to be used for the UE;

c) the UE needs to perform a registration procedure for emergency services after the failure of authentication procedure or after reception of a REGISTRATION REJECT message with the 5GMM cause #3 "Illegal UE", or to initiate a de-registration procedure before the registration procedure for emergency services was completed successfully, and the UE does not have a valid 5G-GUTI for the selected PLMN; or

d) the UE receives an identity request for SUCI during a registration procedure for emergency services or during a de-registration procedure that was initiated before the registration procedure for emergency services was completed successfully.

When operating in SNPN access operation mode and:

– performing initial registration for onboarding services; or

– registered for onboarding services;

the UE shall use the "null-scheme" if:

a) the public key needed to generate a SUCI is not configured as part of the default UE credentials for primary authentication; or

b) "null-scheme" usage is configured as part of the default UE credentials for primary authentication.

If:

a) the UE uses the "null-scheme" as specified in 3GPP TS 33.501 [24] to generate a SUCI;

b) the UE operates in SNPN access operation mode and:

1) an indication to use anonymous SUCI which is associated with the selected entry of the "list of subscriber data", is configured in the ME, if the UE is not registering or registered for onboarding services in SNPN; or

2) an indication to use anonymous SUCI which is associated with the default UE credentials for primary authentication, is configured in the ME, if the UE is registering or registered for onboarding services in SNPN;

NOTE 1: The ME can be configured with an indication to use anonymous SUCI associated with an entry of "list of subscriber data" when the EAP method associated with the credentials of the entry supports SUPI privacy at the EAP layer, or can be configured with an indication to use anonymous SUCI associated with the default UE credentials for primary authentication when the EAP method associated with the default UE credentials for primary authentication supports SUPI privacy at the EAP layer, or both.

c) the UE does not need to perform a registration procedure for emergency services, or to initiate a de-registration procedure before the registration procedure for emergency services was completed successfully; and

d) the UE does not receive an identity request for SUCI during a registration procedure for emergency services or during a de-registration procedure that was initiated before the registration procedure for emergency services was completed successfully;

then the UE shall use anonymous SUCI as specified in 3GPP TS 23.003 [4].

A W-AGF acting on behalf of an FN-RG shall use the "null-scheme" as specified in 3GPP TS 33.501 [24] to generate a SUCI.

A W-AGF acting on behalf of an N5GC device shall use the "null-scheme" as specified in 3GPP TS 33.501 [24] to generate a SUCI.

If a UE is a MUSIM UE, the UE shall use a separate permanent equipment identifier (PEI) for each USIM, if any, and each entry of "list of subscriber data", if any, the UE operates for accessing 5GS-based services; otherwise, a UE contains and uses a permanent equipment identifier (PEI) for accessing 5GS-based services. When the UE is registered with a network by using a USIM or an entry of "list of subscriber data", and has provided a PEI, then until the UE is de-registered from the network using the USIM or the entry of "list of subscriber data", the UE shall keep using that PEI in the registration using the USIM or the entry of "list of subscriber data" and shall not provide that PEI in registration using another USIM or another entry of "list of subscriber data".

In this release of the specification, the IMEI, the IMEISV, the MAC address together with the MAC address usage restriction indication and the EUI-64 are the only PEI formats supported by 5GS. The structure of the PEI and its formats are specified in 3GPP TS 23.003 [4].

Each UE supporting at least one 3GPP access technology (i.e. satellite NG-RAN, NG-RAN, satellite E-UTRAN, E-UTRAN, UTRAN or GERAN) contains a PEI in the IMEI format and shall be able to provide an IMEI and an IMEISV upon request from the network.

Each UE not supporting any 3GPP access technologies and supporting NAS over untrusted or trusted non-3GPP access shall have a PEI in the form of the Extended Unique Identifier EUI-64 [48] of the access technology the UE uses to connect to the 5GC.

A UE supporting N1 mode includes a PEI:

a) when neither SUPI nor valid 5G-GUTI is available to use for emergency services in the REGISTRATION REQUEST message with 5GS registration type IE set to "emergency registration";

b) when the network requests the PEI by using the identification procedure, in the IDENTITY RESPONSE message; and

c) when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.

Each 5G-RG supporting only wireline access and each FN-RG shall have a permanent MAC address configured by the manufacturer. For 5G-CRG, the permanent MAC address configured by the manufacturer shall be a cable modem MAC address.

When the 5G-RG contains neither an IMEI nor an IMEISV, the 5G-RG shall use as a PEI the 5G-RG’s permanent MAC address configured by the manufacturer and the MAC address usage restriction indication set to "no restrictions".

The W-AGF acting on behalf of the FN-RG shall use as a PEI the MAC address provided by the FN-RG and if the MAC address provided by the FN-RG is not unique or does not correspond to the FN-RG’s permanent MAC address according to W-AGF’s configuration, the MAC address usage restriction indication set to "MAC address is not usable as an equipment identifier" otherwise the MAC address usage restriction indication set to "no restrictions".

The 5G-RG containing neither an IMEI nor an IMEISV shall include the PEI containing the MAC address together with the MAC address usage restriction indication:

a) when neither SUPI nor valid 5G-GUTI is available to use for emergency services in the REGISTRATION REQUEST message with 5GS registration type IE set to "emergency registration";

b) when the network requests the PEI by using the identification procedure, in the IDENTIFICATION RESPONSE message; and

c) when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.

NOTE 2: In case c) above, the MAC address is provided even though AMF requests the IMEISV.

The W-AGF acting on behalf of the FN-RG shall include the PEI containing the MAC address together with the MAC address usage restriction indication:

a) when the network requests the PEI by using the identification procedure, in the IDENTIFICATION RESPONSE message; and

b) when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.

NOTE 3: In case b) above, the MAC address is provided even though AMF requests the IMEISV.

The W-AGF acting on behalf of the N5GC device shall use as a PEI the MAC address provided by the N5GC device and the MAC address usage restriction indication set to "no restrictions". Based on operator policy, the W-AGF acting on behalf of the N5GC device may encode the MAC address of the N5GC device using the EUI-64 format as specified in [48] and use as a PEI the derived EUI-64.

NOTE 4: The MAC address of an N5GC device is universally/globally unique.

The AMF can request the PEI at any time by using the identification procedure.

5.3.3 Temporary identities

A temporary user identity for 5GS-based services, the 5G globally unique temporary identity (5G-GUTI), is used for identification within the signalling procedures. In case of PLMN the 5G-GUTI is globally unique and in case of SNPN the 5G-GUTI is unique within an SNPN. When the UE is registered to the same PLMN or SNPN over 3GPP and non-3GPP access, the UE and the AMF maintain one 5G-GUTI that is common to both 3GPP and non-3GPP access. When the UE is required to delete the 5G-GUTI according to a NAS procedure, the UE shall delete the 5G-GUTI only if it is not registered to the same PLMN or SNPN through other access. When the UE is registered to different PLMNs or SNPNs over 3GPP access and non-3GPP access, the UE maintains two 5G-GUTIs, a 5G-GUTI for the registration with a PLMN or SNPN over the 3GPP access and another 5G-GUTI for the registration with another PLMN or SNPN over the non-3GPP access. In the paging and service request procedures, a shortened form of the 5G-GUTI, the 5G S-temporary mobile subscriber identity (5G-S-TMSI), is used to enable more efficient radio signalling. The purpose of the 5G-GUTI and 5G-S-TMSI is to provide identity confidentiality, i.e., to protect a user from being identified and located by an intruder. The structure of the 5G-GUTI and its derivatives are specified in 3GPP TS 23.003 [4]. The 5G-GUTI has two main components (see 3GPP TS 23.501 [8]):

a) the GUAMI; and

b) the 5G-TMSI that provides an unambiguous identity of the UE within the AMF(s) identified by the GUAMI.

NOTE: The UE registered with an SNPN over non-3GPP access refers to the UE accessing SNPN services via a PLMN.

The 5G-S-TMSI has three main components:

a) the AMF set ID that uniquely identifies the AMF set within the AMF region;

b) the AMF pointer that identifies one or more AMFs within the AMF set; and

c) the 5G-TMSI.

A UE supporting N1 mode includes a valid 5G-GUTI, if any is available, in the REGISTRATION REQUEST and DEREGISTRATION REQUEST messages. In the SERVICE REQUEST message, the UE includes a valid 5G-S-TMSI as user identity. The AMF shall assign a new 5G-GUTI for a particular UE:

a) during a successful initial registration procedure;

b) during a successful registration procedure for mobility registration update;

c) after a successful service request procedure invoked as a response to a paging request from the network and before the:

1) release of the N1 NAS signalling connection; or

2) suspension of the N1 NAS signalling connection due to user plane CIoT 5GS optimization i.e. before the UE and the AMF enter 5GMM-IDLE mode with suspend indication;

as specified in subclause 5.4.4.1; and

d) after the AMF receives an indication from the lower layers that it has received the NGAP UE context resume request message as specified in 3GPP TS 38.413 [31] for a UE in 5GMM-IDLE mode with suspend indication and this resumption is a response to a paging request from the network, and before the:

1) release of the N1 NAS signalling connection; or

2) suspension of the N1 NAS signalling connection due to user plane CIoT 5GS optimization i.e. before the UE and the AMF enter 5GMM-IDLE mode with suspend indication;

as specified in subclause 5.4.4.1.

The AMF should assign a new 5G-GUTI for a particular UE during a successful registration procedure for periodic registration update. The AMF may assign a new 5G-GUTI at any time for a particular UE by performing the generic UE configuration update procedure.

If a new 5G-GUTI is assigned by the AMF, the UE and the AMF handle the 5G-GUTI as follows:

a) Upon receipt of a 5GMM message containing a new 5G-GUTI, the UE considers the new 5G-GUTI as valid and the old 5G-GUTI as invalid, stops timer T3519 if running, and deletes any stored SUCI. The new 5G-GUTI is stored in a non-volatile memory in the USIM if the corresponding file is present in the USIM, else in the non-volatile memory in the ME, as described in annex C.

b) The AMF considers the old 5G-GUTI as invalid as soon as an acknowledgement for a registration or generic UE configuration update procedure is received.

5.3.4 Registration areas

Within the 5GS, the registration area is managed independently per access type, i.e., 3GPP access or non-3GPP access. The AMF assigns a registration area to the UE during the registration procedure. A registration area is defined as a set of tracking areas and each of these tracking areas consists of one or more cells that cover a geographical area. Within the 5GS, the concept of "registration to multiple tracking areas" applies:

a) A tracking area is identified by a TAI which is broadcast in the cells of the tracking area. The TAI is constructed from a TAC and a PLMN identity. In case of a shared network:

1) one or more TACs; and

2) any of the following:

i) multiple PLMN identities;

ii) multiple SNPN identities; or

iii) one or more PLMN identities and one or more SNPN identities;

are broadcast.

b) In order to reduce the tracking area update signalling within the 5GS, the AMF can assign several tracking areas to the UE. These tracking areas construct a list of tracking areas which is identified by a TAI list. When generating the TAI list, the AMF shall include only TAIs that are applicable on the access where the TAI list is sent. The AMF shall be able to allocate a TAI list over different NG-RAN access technologies. The AMF shall not allocate a TAI list containing both tracking areas in NB-N1 mode and tracking areas not in NB-N1 mode.

c) The UE considers itself registered to a list of tracking areas and does not need to trigger the registration procedure for mobility and periodic registration update used for mobility (i.e. the 5GS registration type IE set to "mobility registration updating" in the REGISTRATION REQUEST message) as long as the UE stays in one of the tracking areas of the list of tracking areas received from the AMF.

d) The UE will consider the TAI list as valid, until it receives a new TAI list in the next registration procedure for mobility and periodic registration update or generic UE configuration update procedure, or the UE is commanded by the network to delete the TAI list by a reject message or it is deregistered from the 5GS. If the registration request is accepted or the TAI list is reallocated by the AMF, the AMF shall provide at least one entry in the TAI list. If the new and the old TAI list are identical, the AMF does not need to provide the new TAI list to the UE during mobility registration update or periodic registration update.

e) The TAI list can be reallocated by the AMF.

f)- When the UE is deregistered from the 5GS, the TAI list in the UE is invalid.

g) The UE includes the last visited registered TAI, if available, to the AMF. The last visited registered TAI is stored in a non-volatile memory in the USIM if the corresponding file is present in the USIM, else in the non-volatile memory in the ME, as described in annex C.

5.3.5 Service area restrictions

5.3.5.1 General

Service area restrictions are applicable only to 3GPP access and to wireline access.

Subclause 5.3.5.2 applies when the UE accesses 5GCN over 3GPP access.

Subclause 5.3.5.3 applies when the 5G-RG or the W-AGF acting on behalf of an FN-CRG (or on behalf of the N5GC device) access 5GCN over wireline access.

NOTE: Service area restrictions are not applicable for the W-AGF acting on behalf of the FN-BRG.

5.3.5.2 3GPP access service area restrictions

The service area restrictions consist of tracking areas forming either an allowed area, or a non-allowed area. The tracking areas belong to either the registered PLMN or its equivalent PLMNs in the registration area. The allowed area can contain up to 16 tracking areas or include all tracking areas in the registered PLMN and its equivalent PLMN(s) in the registration area. The non-allowed area can contain up to 16 tracking areas. The network conveys the service area restrictions to the UE by including either an allowed area, or a non-allowed area, but not both, in the Service area list IE of a REGISTRATION ACCEPT message or a CONFIGURATION UPDATE COMMAND message.

If the network does not convey the service area restrictions to the UE in the Service area list IE of a REGISTRATION ACCEPT message, the UE shall treat all tracking areas in the registered PLMN and its equivalent PLMN(s) in the registration area as allowed area and delete the stored list of "allowed tracking areas" or the stored list of "non-allowed tracking areas".

When the UE receives a Service area list IE with an allowed area indication during a registration procedure or a generic UE configuration update procedure:

a) if the "Type of list" included in the Service area list IE does not indicate "all TAIs belonging to the PLMNs in the registration area are allowed area", the UE shall delete the old list of "allowed tracking areas" and store the tracking areas in the allowed area as the list of "allowed tracking areas". If the UE has a stored list of "non-allowed tracking areas", the UE shall delete that list; or

b) if the "Type of list" included in the Service area list IE indicates "all TAIs belonging to the PLMNs in the registration area are allowed area", the UE shall treat all tracking areas in the registered PLMN and its equivalent PLMN(s) as allowed area and delete the stored list of "allowed tracking areas" or the stored list of "non-allowed tracking areas".

When the UE receives a Service area list IE with a non-allowed area indication during a registration procedure or a generic UE configuration update procedure, the UE shall delete the old list of "non-allowed tracking areas" and store the tracking areas in the non-allowed area as the list of "non-allowed tracking areas". If the UE has a stored list of "allowed tracking areas", the UE shall delete that list.

If the UE is successfully registered to a PLMN and has a stored list of "allowed tracking areas":

a) while the current TAI is in the list of "allowed tracking areas", the UE shall stay in, or enter, the state 5GMM-REGISTERED.NORMAL-SERVICE and is allowed to initiate any 5GMM and 5GSM procedures; and

b) while the UE is camped on a cell which is in the registered PLMN or a PLMN from the list of equivalent PLMNs and the current TAI is not in the list of "allowed tracking areas", the UE shall enter the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE, and:

1) if the UE is in 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication over 3GPP access, the UE:

i) shall not include the Uplink data status IE in the registration procedure for mobility and periodic registration update except for emergency services or for high priority access;

ii) shall not perform the registration procedure for mobility and periodic registration update with Follow-on request indicator set to "Follow-on request pending", except for:

– emergency services;

– high priority access;

– indicating a change of 3GPP PS data off UE status;

– sending an SOR transparent container;

– sending a UE policy container; or

– sending a UE parameters update transparent container;

iii) shall not initiate a service request procedure or request the lower layers to resume a suspended connection, except for:

– emergency services;

– emergency services fallback;

– high priority access;

– responding to paging;

– responding to notification received over non-3GPP access;

– indicating a change of 3GPP PS data off UE status;

– sending an SOR transparent container;

– sending a UE policy container; or

– sending a UE parameters update transparent container; and

2) if the UE is in 5GMM-CONNECTED mode or 5GMM-CONNECTED mode with RRC inactive indication over 3GPP access, the UE:

i) shall not perform the registration procedure for mobility and periodic registration update with Uplink data status IE except for emergency services or for high priority access;

ii) shall not initiate a service request procedure except for:

– emergency services;

– emergency services fallback;

– high priority access;

– responding to paging or responding to notification received over non-3GPP access;

iii) shall not initiate a 5GSM procedure except for:

– emergency services;

– high priority access; or

– indicating a change of 3GPP PS data off UE status; and

iv) shall not perform the NAS transport procedure except for the sending:

– SMS;

– an LPP message;

– a location services message;

– an SOR transparent container;

– a UE policy container;

– a UE parameters update transparent container; or

– a CIoT user data container.

NOTE 1: The contents of CIoT user data container can be data that is not for exception reports, or data that is for exception reports if allowed for the UE (see subclause 6.2.13).

If the UE is successfully registered to a PLMN and has a stored list of "non-allowed tracking areas":

a) while the UE is camped on a cell which is in the registered PLMN or a PLMN from the list of equivalent PLMNs and the current TAI is not in the list of "non-allowed tracking areas", the UE shall stay in, or enter, the state 5GMM-REGISTERED.NORMAL-SERVICE and is allowed to initiate any 5GMM and 5GSM procedures; and

b) while the current TAI is in the list of "non-allowed tracking areas", the UE shall enter the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE, and:

1) if the UE is in 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication over 3GPP access, the UE:

i) shall not include the Uplink data status IE in the registration procedure for mobility and periodic registration update except for emergency services or for high priority access;

ii) shall not perform the registration procedure for mobility and periodic registration update with Follow-on request indicator set to "Follow-on request pending", except for:

– emergency services;

– high priority access;

– indicating a change of 3GPP PS data off UE status;

– sending an SOR transparent container;

– sending a UE policy container; or

– sending a UE parameters update transparent container; and

iii) shall not initiate a service request procedure or request the lower layers to resume a suspended connection, except for:

– emergency services;

– emergency services fallback;

– high priority access;

– responding to paging;

– responding to notification received over non-3GPP access;

– indicating a change of 3GPP PS data off UE status;

– sending an SOR transparent container;

– sending a UE policy container; or

– sending a UE parameters update transparent container; and

2) if the UE is in 5GMM-CONNECTED mode or 5GMM-CONNECTED mode with RRC inactive indication over 3GPP access, the UE:

i) shall not perform the registration procedure for mobility and periodic registration update with the Uplink data status IE except for emergency services or for high priority access;

ii) shall not initiate a service request procedure or request the lower layers to resume a suspended connection, except for:

– emergency services;

– emergency services fallback;

– high priority access; or

– responding to paging or responding to notification received over non-3GPP access;

iii) shall not initiate a 5GSM procedure except for:

– emergency services;

– high priority access; or

– indicating a change of 3GPP PS data off UE status; and

iv) shall not perform the NAS transport procedure except for the sending:

– SMS;

– an LPP message;

– a location services message;

– an SOR transparent container;

– a UE policy container;

– a UE parameters update transparent container; or

– a CIoT user data container.

NOTE 2: The contents of CIoT user data container can be data that is not for exception reports, or data that is for exception reports if allowed for the UE (see subclause 6.2.13).

The list of "allowed tracking areas", as well as the list of "non-allowed tracking areas" shall be erased when:

a) the UE is switched off; and

b) the UICC containing the USIM is removed or an entry of the "list of subscriber data" with the SNPN identity of the SNPN is updated.

When a tracking area is added to the list of "5GS forbidden tracking areas for roaming" or to the list of "5GS forbidden tracking areas for regional provision of service" as specified in the subclauses 5.5.1.2.5 or 5.5.1.3.5, the tracking area shall be removed from the list of "allowed tracking areas" if the tracking area is already present in the list of "allowed tracking areas" and from the list of "non-allowed tracking areas" if the tracking area is already present in the list of "non-allowed tracking areas".

5.3.5.3 Wireline access service area restrictions

If:

a) a SERVICE REJECT message with the 5GMM cause #28 "Restricted service area";

b) a DL NAS TRANSPORT message with the Payload container type IE set to "N1 SM information" and the 5GMM cause #28 "Restricted service area"; or

c) a REGISTRATION ACCEPT message includes the PDU session reactivation result error cause IE with the 5GMM cause #28 "Restricted service area";

is received over wireline access then the 5G-RG or the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device) shall start enforcing the wireline access service area restrictions and shall enter the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE.

While in the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE, the 5G-RG or the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device) shall:

a) if in 5GMM-IDLE mode over wireline access:

1) shall not perform the registration procedure for mobility and periodic registration update with Uplink data status IE except for emergency services or for high priority access; and

2) shall not initiate a service request procedure except for:

– emergency services,

– emergency services fallback; or

– high priority access; and

b) if in 5GMM-CONNECTED mode over wireline access:

1) shall not perform the registration procedure for mobility and periodic registration update with Uplink data status IE except for:

– emergency services;

– emergency services fallback; or

– high priority access;

2) shall not initiate a service request procedure except for emergency services, or high priority access; and

3) shall not initiate a 5GSM procedure except for emergency services or high priority access;

over the wireline access.

When the 5G-RG is switched off, the UICC containing the USIM is removed or the 5G-RG starts using another wireline access network, the 5G-RG shall stop enforcing the wireline access service area restrictions, if enforced.

When the W-AGF acting on behalf of the FN-CRG determines that the FN-CRG is switched off, the W-AGF acting on behalf of the FN-CRG stops enforcing the wireline access service area restrictions, if enforced.

When the W-AGF acting on behalf of the N5GC device determines that the FN-CRG serving the N5GC device is switched off, the W-AGF acting on behalf of the N5GC device stops enforcing the wireline access service area restrictions, if enforced.

5.3.6 Mobile initiated connection only mode

The UE can request the use of mobile initiated connection only (MICO) mode during the registration procedure (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]). The UE shall not request use of MICO mode over non-3GPP access. Furthermore, the UE in 3GPP access shall not request the use of MICO mode during:

a) a registration procedure for initial registration for emergency services (see subclause 5.5.1.2);

b) a registration procedure for initial registration for initiating an emergency PDU session (see subclause 5.5.1.2);

c) a registration procedure for mobility and periodic registration update (see subclause 5.5.1.3) for initiating an emergency PDU session if the UE is in the state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE; or

d) a registration procedure for mobility and periodic registration update (see subclause 5.5.1.3) when the UE has an emergency PDU session established.

If the UE requests the use of MICO mode, the network can accept the use of MICO mode by providing a MICO indication when accepting the registration procedure. The UE may use MICO mode only if the network has provided the MICO indication IE during the last registration procedure. The UE may also request an active time value together with the MICO mode indication during the registration procedure. If the UE requests an active time by including an active time value, the UE may also include the Requested T3512 value IE to request a particular T3512 value to be allocated.

If the network accepts the use of MICO mode and does not include an active time value in T3324 IE to the UE, the AMF may include an "all PLMN registration area allocated" indication in the MICO indication IE to the UE. If the UE indicated the support for strictly periodic registration timer in the MICO indication IE to the network, the network may include a "strictly periodic registration timer supported" indication in the MICO indication IE to the UE.

If the UE requested the use of active time by including an active time value and the network accepts the use of MICO mode and the use of active time, the AMF shall include an active time value in the T3324 IE to the UE. If the AMF indicates active time value to the UE, AMF should not indicate "all PLMN registration area allocated" indication in the MICO indication IE to the UE. Upon entering 5GMM-IDLE mode, AMF shall start the active timer with the active time value indicated to the UE and shall consider the UE is reachable for paging as long as the timer is running. If the UE enters 5GMM-CONNECTED mode over 3GPP access when the active timer is running, the AMF shall stop the active timer.

NOTE 1: The active time value assigned by AMF can be different from the active time value requested by the UE. AMF assigns the active time value based on several factors, e.g. local configuration, expected UE behaviour, UE requested active time value, UE subscription information, network policies etc.

If the UE requested an active time and a requested T3512 value and the network accepts the use of MICO mode, the AMF shall take the UE requested T3512 value into consideration when assigning a value of timer T3512 to the UE.

If the network accepts the use of MICO mode, the UE may deactivate the AS layer and activate MICO mode by entering the state 5GMM-REGISTERED.NO-CELL-AVAILABLE if:

a) the UE is in 5GMM-IDLE mode over3GPP access;

b) the UE is in the 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE (as described in subclause 5.3.5.2) state for 3GPP access; and

c) no T3324 value is received from the network.

If the network accepts the use of MICO mode and indicates an active time value to the UE in a successful registration procedure, the UE shall start the timer T3324 with the value received from the network after entering 5GMM-IDLE mode over 3GPP access. At the expiry of the timer T3324, the UE may activate MICO mode by entering the state 5GMM-REGISTERED.NO-CELL-AVAILABLE if the UE is in the 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE (as described in subclause 5.3.5.2) state for 3GPP access. If the UE enters 5GMM-CONNECTED mode over 3GPP access when the timer T3324 is running, the UE shall stop the timer T3324.

When MICO mode is activated, all NAS timers are stopped and associated procedures aborted except for timers T3512, T3346, T3447, T3396, T3584, T3585, any back-off timers, T3247, and the timer T controlling the periodic search for HPLMN or EHPLMN or higher prioritized PLMNs (see 3GPP TS 23.122 [5]).

NOTE 2: When MICO mode is activated and if the UE is also registered over the non-3GPP access, the AMF will not send a NOTIFICATION message with access type indicating 3GPP access over the non-3GPP access for PDU sessions associated with 3GPP access.

The UE may deactivate MICO mode and activate the AS layer at any time. Upon deactivating MICO mode, the UE may initiate 5GMM procedures (e.g. for the transfer of mobile originated signalling or user data).

When an emergency PDU session is successfully established after the MICO mode was enabled, the UE and the AMF shall locally disable MICO mode. The UE and the AMF shall not enable MICO mode until the AMF accepts the use of MICO mode in the next registration procedure. To enable an emergency call back, the UE should wait for a UE implementation-specific duration of time before requesting the use of MICO mode after the completion of the emergency services.

If the AMF accepts the use of MICO mode and does not indicate "strictly periodic registration timer supported" in the MICO indication IE to the UE, the AMF starts the implicit de-registration timer for 3GPP access when entering 5GMM-IDLE mode for 3GPP access. If AMF accepts the use of MICO mode and indicates "strictly periodic registration timer supported" in the MICO indication IE to the UE, AMF shall start the strictly periodic monitoring timer with T3512 value indicated in the T3512 value IE after the registration procedure is completed. The AMF shall neither stop nor reset the strictly periodic monitoring timer when the NAS signalling connection is established or released for the UE. If the strictly periodic monitoring timer expires when NAS signalling connection is established for the UE, AMF shall restart the strictly periodic monitoring timer with the T3512 value, otherwise AMF shall start the implicit de-registration timer.

When an emergency PDU session is successfully established and the MICO mode is disabled, the UE shall stop timer T3512 if running and the AMF shall stop strictly periodic monitoring timer if running. The UE and the AMF shall behave as if no "strictly periodic registration timer supported" indication was given to the UE in the last registration attempt.

Upon successful completion of an attach procedure or tracking area updating procedure after inter-system change from N1 mode to S1 mode (see 3GPP TS 24.301 [15]), the UE operating in single-registration mode shall locally disable MICO mode. After inter-system change from S1 mode to N1 mode, the UE operating in single-registration mode may re-negotiate MICO mode with the network during the registration procedure for mobility and periodic registration update.

5.3.7 Handling of the periodic registration update timer and mobile reachable timer

The periodic registration update procedure is used over 3GPP access to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by the periodic registration update timer, T3512.

If the UE is registered over the 3GPP access, the AMF maintains an implicit de-registration timer to control when the UE is considered implicitly de-registered over the 3GPP access. If the UE is registered over the non-3GPP access, the AMF also maintains a non-3GPP implicit de-registration timer to control when the UE is considered implicitly de-registered over the non-3GPP access. The UE registered over the non-3GPP access maintains a non-3GPP de-registration timer to control when the UE is considered implicitly de-registered for the non-3GPP access.

The AMF shall start a non-3GPP implicit de-registration timer for the UE registered over non-3GPP access when the N1 NAS signalling connection over non-3GPP access is released.

The UE registered over non-3GPP access shall reset and start a non-3GPP de-registration timer when the N1 NAS signalling connection over non-3GPP access is released. The non-3GPP de-registration timer is stopped when the UE enters 5GMM-CONNECTED mode over non-3GPP access or the 5GMM-DEREGISTERED state over non-3GPP access.

The non-3GPP implicit de-registration timer shall be longer than the non-3GPP de-registration timer.

The value of timer T3512 is sent by the network to the UE in the REGISTRATION ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE until a new value is received. The periodic registration update timer only applies to the UE registered to the 5GS services over 3GPP access.

If timer T3512 received by the UE in a REGISTRATION ACCEPT message contains an indication that the timer is deactivated or the timer value is zero, then timer T3512 is deactivated and the UE shall not perform the periodic registration update procedure.

NOTE 1: The UE does not perform the periodic registration update procedure for non-3GPP access.

If during the registration procedure, the AMF does not indicate "strictly periodic registration timer supported" in the MICO indication IE to the UE, timer T3512 is reset and started with its initial value, when the UE changes from 5GMM-CONNECTED over 3GPP access to 5GMM-IDLE mode over 3GPP access. Timer T3512 is stopped when the UE enters 5GMM-CONNECTED mode over 3GPP access or the 5GMM-DEREGISTERED state over 3GPP access.

If during the registration procedure, the AMF indicates "strictly periodic registration timer supported" in the MICO indication IE to the UE, timer T3512 is started with its initial value after the completion of the registration procedure. The UE shall neither stop nor reset the timer T3512 when the UE enters 5GMM-CONNECTED or when changing from 5GMM-CONNECTED mode to 5GMM-IDLE mode. If the timer T3512 expires,

a) the UE in 5GMM-CONNECTED mode over 3GPP access shall reset and start the timer T3512 with its initial value; or

b) the UE in 5GMM-IDLE mode over 3GPP access shall perform the periodic registration procedure.

If the UE is registered for emergency services, and timer T3512 expires, the UE shall not initiate a periodic registration update procedure, but shall locally de-register from the network. When the UE is camping on a suitable cell, it may re-register to regain normal service.

When a UE is not registered for emergency services, and timer T3512 expires when the UE is in 5GMM-IDLE mode, the periodic registration update procedure shall be started.

If the UE is not registered for emergency services, and is in a state other than 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE over 3GPP access when timer T3512 expires, the periodic registration update procedure is delayed until the UE returns to 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE over 3GPP access.

NOTE 2: When the UE returns to 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE and it needs to initiate other 5GMM procedure than the periodic registration update procedure then, based on UE implementation, the 5GMM procedure can take precedence.

The network supervises the periodic registration update procedure of the UE by means of the mobile reachable timer.

If the UE is not registered for emergency services, the mobile reachable timer shall be longer than the value of timer T3512. In this case, by default, the mobile reachable timer is 4 minutes greater than the value of timer T3512.

The network behaviour upon expiry of the mobile reachable timer is network dependent, but typically the network stops sending paging messages to the UE on the first expiry, and may take other appropriate actions.

If the UE is registered for emergency services, the AMF shall set the mobile reachable timer with a value equal to timer T3512. When the mobile reachable timer expires, the AMF shall locally de-register the UE.

The mobile reachable timer shall be reset and started with the value as indicated above, when the AMF releases the NAS signalling connection for the UE. The mobile reachable timer shall be stopped when a NAS signalling connection is established for the UE.

Upon expiry of the mobile reachable timer the network shall start the implicit de-registration timer over 3GPP access. The value of the implicit de-registration timer over 3GPP access is network dependent. If MICO mode is activated, the network shall start the implicit de-registration timer over 3GPP access when the UE enters 5GMM-IDLE mode at the AMF over 3GPP access. The default value of the implicit de-registration timer over 3GPP access is 4 minutes greater than the value of timer T3512.

If the implicit de-registration timer expires before the UE contacts the network, the network shall implicitly de-register the UE. The implicit de-registration timer shall be stopped when a NAS signalling connection is established for the UE.

If the non-3GPP implicit de-registration timer expires before the UE contacts the network over the non-3GPP access, the network shall implicitly de-register the UE and enter the state 5GMM-DEREGISTERED over non-3GPP access for the UE. The non-3GPP implicit de-registration timer shall be stopped when a NAS signalling connection over non-3GPP access is established for the UE.

If the non-3GPP de-registration timer expires before the UE contacts the network over the non-3GPP access, the UE shall enter the state 5GMM-DEREGISTERED over non-3GPP access. The non-3GPP de-registration timer shall be stopped when a NAS signalling connection over non-3GPP access is established for the UE.

If the AMF provides T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "Non-3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of timer T3512, the AMF sets the mobile reachable timer and the implicit de-registration timer such that the sum of the timer values is greater than the value of timer T3346.

If the AMF provides T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of the non-3GPP de-registration timer, the AMF sets the non-3GPP implicit de-registration timer value to be 8 minutes greater than the value of timer T3346.

If the UE receives T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of the non-3GPP de-registration timer, the UE sets the non-3GPP de-registration timer value to be 4 minutes greater than the value of timer T3346.

5.3.8 Handling of timer T3502

The value of timer T3502 can be sent by the network to the UE in the REGISTRATION ACCEPT message. The UE shall apply this value in all tracking areas of the registration area assigned to the UE, until a new value is received.

The value of timer T3502 can be sent by the network to the UE in the REGISTRATION REJECT message during the initial registration. If a REGISTRATION REJECT message including timer T3502 value was received integrity protected, the UE shall apply this value until a new value is received with integrity protection or a new PLMN or SNPN is selected. Otherwise, the default value of this timer is used.

The default value of this timer is also used by the UE in the following cases:

a) REGISTRATION ACCEPT message is received without a value specified;

b) the UE does not have a stored value for this timer;

c) a new PLMN which is not in the list of equivalent PLMNs or a new SNPN has been entered, the initial registration procedure fails, the registration attempt counter is equal to 5 and no REGISTRATION REJECT message was received from the new PLMN or SNPN;

d) the network indicates that the timer is "deactivated"; or

e) a new PLMN which is not in the list of equivalent PLMNs or a new SNPN has been entered, the registration procedure for mobility and periodic registration update fails and the registration attempt counter is equal to 5.

5.3.9 Handling of NAS level mobility management congestion control

The AMF may detect 5GMM signalling congestion and perform general NAS level congestion control. Under the 5GMM signalling congestion conditions the AMF may reject 5GMM signalling requests from UEs as specified in 3GPP TS 23.501 [8]. The AMF should not reject the following:

a) requests for emergency services;

b) requests for emergency services fallback;

c) requests from UEs configured for high priority access in selected PLMN or SNPN;

d) DEREGISTRATION REQUEST message;

e) requests for mobile terminated services, triggered by paging or a notification procedure; and

f) requests for initial registration or mobility and periodic registration update, when emergency is indicated by lower layers.

When general NAS level congestion control is active, the AMF may include a value for the mobility management back-off timer T3346 in the reject messages. The UE starts the timer T3346 with the value received in the 5GMM reject messages. To avoid that large numbers of UEs simultaneously initiate deferred requests, the AMF should select the value for the timer T3346 for the rejected UEs so that timeouts are not synchronised.

If the UE is registered in the same PLMN over the 3GPP access and non-3GPP access, and the UE receives the timer T3346 from the AMF, the timer T3346 shall apply to both 3GPP access and non-3GPP access.

If the UE receives the paging message or NOTIFICATION message when timer T3346 is running and the UE is registered to the same PLMN over 3GPP access and non-3GPP access, the UE shall stop the timer T3346 for both accesses and respond to the paging message or NOTIFICATION message as specified in subclause 5.6.2 and subclause 5.6.3.

NOTE 1: As an implementation option, MUSIM UE is allowed to not respond to paging based on the information available in the paging message, e.g. voice service indication.

If the timer T3346 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE remains the same, then the timer T3346 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3346 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

let t1 be the time remaining for T3346 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If the UE enters a new PLMN or SNPN while timer T3346 is running, and the new PLMN or SNPN is not equivalent to the PLMN or SNPN where the UE started timer T3346 or enters a new SNPN while T3346 is running, the UE shall stop timer T3346 when initiating 5GMM procedures in the new PLMN or SNPN.

After a change in registration area, if the timer T3346 is running and 5GS update status is 5U1 UPDATED then the UE shall set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE.

If timer T3346 is running or is deactivated, and the UE is a UE configured for high priority access in selected PLMN or SNPN, or the UE needs to initiate signalling for emergency services or emergency services fallback, then the UE is allowed to initiate 5GMM procedures.

NOTE 2: UE can, based on implementation, restrict lower layers of non-3GPP access from establishing access stratum connection on a registered PLMN when timer T3346 is running for the same PLMN.

5.3.10 Handling of DNN based congestion control

The AMF may detect and start performing DNN based congestion control when one or more DNN congestion criteria as specified in 3GPP TS 23.501 [8] are met. If the UE does not provide a DNN for a non-emergency PDU session, then the AMF uses the selected DNN or the DNN associated with the PDU session corresponding to the 5GSM procedure.

When DNN based congestion control is activated at the AMF, the AMF performs the congestion control as specified in subclause 5.4.5 and the UE performs the congestion control as specified in subclause 5.4.5 and subclause 6.2.7.

5.3.11 Handling of S-NSSAI based congestion control

The AMF may detect and start performing S-NSSAI based congestion control when one or more S-NSSAI congestion criteria as specified in 3GPP TS 23.501 [8] are met. If the UE does not provide a DNN for a non-emergency PDU session, then the AMF uses the selected DNN or the DNN associated with the PDU session corresponding to the 5GSM procedure. If the UE does not provide an S-NSSAI for a non-emergency PDU session, then the AMF uses the selected S-NSSAI or the S-NSSAI associated with the PDU session corresponding to the 5GSM procedure.

When S-NSSAI based congestion control is activated at the AMF, the AMF performs the congestion control as specified in subclause 5.4.5 and the UE performs the congestion control as specified in subclause 5.4.5 and subclause 6.2.8.

5.3.12 Handling of local emergency numbers

The additional requirements in subclause 5.3.12A apply to a UE supporting registration or attach procedures via 3GPP access and registration procedures via non-3GPP access.

In case of PLMN, the network may send a local emergency numbers list or an extended local emergency numbers list or both, in the REGISTRATION ACCEPT message, by including the Emergency number list IE and the Extended emergency number list IE, respectively. The Local emergency numbers list can be updated as described in 3GPP TS 24.301 [15], subclause 5.3.7.

In case of SNPN, the network may send an extended local emergency numbers list, in the REGISTRATION ACCEPT message, by including the Extended emergency number list IE. The network shall set the Extended Emergency Number List Validity (EENLV) field within the Extended emergency number list IE to "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received". The UE shall consider the emergency number(s) received in the Extended emergency number list IE valid only in the SNPN from which this IE is received regardless of the received value of the EENLV field within the Extended emergency number list IE.

The UE shall store the local emergency numbers list and the extended local emergency numbers list, as provided by the network. The local emergency numbers list stored in the UE shall be replaced on each receipt of the Emergency number list IE. The extended local emergency numbers list stored in the UE shall be replaced on each receipt of the Extended emergency number list IE. The received local emergency numbers list or the received extended local emergency numbers list or both shall be provided to the upper layers.

The emergency number(s) received in the Emergency number list IE are valid only in PLMNs in the same country as the PLMN from which this IE is received. If no Emergency number list IE is contained in the REGISTRATION ACCEPT message, then the stored local emergency numbers list in the UE shall be kept, except if the UE has successfully registered to a PLMN in a country different from that of the PLMN that sent the list.

The emergency number(s) received in the Extended emergency number list IE are valid only in:

– PLMNs in the same country as the PLMN from which this IE is received, if the Extended Emergency Number List Validity (EENLV) field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid in the country of the PLMN from which this IE is received"; and

– the PLMN from which this IE is received, if the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received"; and

– the SNPN from which this IE is received, regardless of the value of the EENLV field within the Extended emergency number list IE.

If no Extended Local Emergency Numbers List is contained in the REGISTRATION ACCEPT message, and the registered PLMN or the registered SNPN has not changed, then the stored Extended Local Emergency Numbers List in the UE shall be kept. If no Extended Local Emergency Numbers List is contained in the REGISTRATION ACCEPT message, but the registered PLMN or the registered SNPN has changed, then:

– if the last received indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received", the stored Extended Local Emergency Numbers List in the UE shall be deleted; and

– if the last received indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid in the country of the PLMN from which this IE is received" the list shall be kept except if the UE has successfully registered to a PLMN in a country different from that of the PLMN that sent the stored list.

NOTE: To prevent the misrouting of emergency calls, all operators within a country need to follow the regulation or agree on the setting of the Extended emergency number list IE in accordance to national agreement – either to indicate validity within a country or to indicate validity only within the PLMN.

The local emergency numbers list and the extended local emergency numbers list shall be deleted at switch off or removal of the USIM. The UE shall be able to store up to ten entries in the local emergency numbers list and up to twenty entries in the Extended local emergency numbers list, received from the network.

For the use of the local emergency numbers list and the extended local emergency numbers list by the UE see 3GPP TS 24.301 [15], subclause 5.3.7.

5.3.12A Handling of local emergency numbers received via 3GPP access and non-3GPP access

5.3.12A.1 General

The requirements in subclause 5.3.12 with the clarifications and additional conditions in subclause 5.3.12A apply to a UE supporting:

– attach procedures (see 3GPP TS 24.301 [15]) or registration procedures via 3GPP access; and

– registration procedures via non-3GPP access.

The UE shall ignore the presence or absence of local emergency numbers list, extended local emergency numbers list or both, in a REGISTRATION ACCEPT message received via non-3GPP access and keep the stored local emergency numbers list and the extended local emergency numbers list, if available, unless conditions in subclause 5.3.12A.2 are met.

For the purposes of subclause 5.3.12A, the UE is considered neither registered nor attached over 3GPP access if:

1) the UE supports 3GPP access to EPC, the UE does not support 3GPP access to 5GC, and:

a) the EMM sublayer is in the EMM-NULL state, EMM-DEREGISTERED state or EMM-DEREGISTERED-INITIATED state; or

2) the UE supports 3GPP access to 5GC, the UE does not support 3GPP access to EPC, and:

a) the 5GMM sublayer is in the 5GMM-NULL state, 5GMM-DEREGISTERED state or 5GMM-DEREGISTERED-INITIATED state; or

3) supports both 3GPP access to EPC and 3GPP access to 5GC, and:

a) the EMM sublayer is in the EMM-NULL state, EMM-DEREGISTERED state or EMM-DEREGISTERED-INITIATED state; and

a) the 5GMM sublayer is in the 5GMM-NULL state, 5GMM-DEREGISTERED state or 5GMM-DEREGISTERED-INITIATED state.

5.3.12A.2 Receiving a REGISTRATION ACCEPT message via non-3GPP access

If the UE can determine the current country and after switch on or after removal of the USIM, has not been registered or has not been attached via 3GPP access in the current country, then the UE shall store the local emergency numbers list or the extended local emergency numbers list or both, as provided by the network with an MCC matching the current country via non-3GPP access.

NOTE: The UE determines, as the current country, the country in which it is located in accordance with 3GPP TS 24.502 [18].

The UE shall replace a previously stored local emergency numbers list or a previously stored extended local emergency numbers list or both with a local emergency numbers list or an extended local emergency numbers list or both received in a REGISTRATION ACCEPT message via non-3GPP access, if the previously stored local emergency numbers list was also received via non-3GPP access or the previously stored extended local emergency numbers list was also received via non-3GPP access.

The UE shall replace a previously stored extended local emergency numbers list with an extended local emergency numbers list received in a REGISTRATION ACCEPT message via non-3GPP access, if:

– the UE is neither registered nor attached over 3GPP access;

– the REGISTRATION ACCEPT message is received from a PLMN different from which the stored list was received; and

– the stored indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received".

If no extended local emergency numbers list is contained in a REGISTRATION ACCEPT message received via non-3GPP access and the UE is neither registered nor attached over 3GPP access, the stored extended local emergency numbers list in the UE shall be discarded if:

– the UE can determine the current country and the UE has successfully registered to a PLMN in the country and that country is different from that of the PLMN that sent the stored list; or

– the REGISTRATION ACCEPT message is received from a PLMN different from which the stored list was received, and the stored indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received".

5.3.13 Lists of 5GS forbidden tracking areas

If the UE is not operating in SNPN access operation mode, the UE shall store a list of "5GS forbidden tracking areas for roaming", as well as a list of "5GS forbidden tracking areas for regional provision of service". Otherwise the UE shall store a list of "5GS forbidden tracking areas for roaming":

– per SNPN; and

– if the UE supports access to an SNPN using credentials from a credentials holder, per entry of the "list of subscriber data" or PLMN subscription;

and store a list of "5GS forbidden tracking areas for regional provision of service":

– per SNPN; and

– if the UE supports access to an SNPN using credentials from a credentials holder, per entry of the "list of subscriber data" or PLMN subscription.

Within the 5GS, these lists are managed independently per access type, i.e., 3GPP access or wireline access. These lists shall be erased when:

a) the UE is switched off, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the subscribed SNPN identity identifying the current SNPN is updated or, if the UE supports access to an SNPN using credentials from a credentials holder, the entry of the "list of subscriber data" associated with the lists is updated; and

b) periodically (with a period in the range 12 to 24 hours).

Over 3GPP access, when the lists are erased, the UE performs cell selection according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]. A tracking area shall be removed from the list of "5GS forbidden tracking areas for roaming", as well as the list of "5GS forbidden tracking areas for regional provision of service", if the UE receives the tracking area in the TAI list or the Service area list of "allowed tracking areas" in REGISTRATION ACCEPT message or a CONFIGURATION UPDATE COMMAND message. The UE shall not remove the tracking area from "5GS forbidden tracking areas for roaming" or "5GS forbidden tracking areas for regional provision of service" if the UE is registered for emergency services.

In N1 mode over 3GPP access, the UE shall update the suitable list whenever a REGISTRATION REJECT, SERVICE REJECT or DEREGISTRATION REQUEST message is received with the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE or the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE, or is received with the 5GMM cause #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", #15 "no suitable cells in tracking area", or #62 "no network slices available", or a REGISTRATION ACCEPT or SERVICE ACCEPT message is received with the forbidden TAI(s).

If the UE receives ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message provided with S-NSSAI and the PLMN ID in the protocol configuration options IE or extended protocol configuration options IE (see subclause 6.2.2 of 3GPP TS 24.301 [15]), the UE may remove the corresponding tracking area from the "5GS forbidden tracking areas for roaming".

Over wireline access, the 5G-RG, the W-AGF acting on behalf of an FN-RG or the W-AGF acting on behalf of an N5GC device shall update the suitable list whenever a REGISTRATION REJECT, SERVICE REJECT or DEREGISTRATION REQUEST message is received with the 5GMM cause #12 "tracking area not allowed" or #13 "roaming not allowed in this tracking area".

NOTE: In this release of the specification, for untrusted non-3GPP access and trusted non-3GPP access, neither the list of "5GS forbidden tracking areas for roaming" nor the list of "5GS forbidden tracking areas for regional provision of service" is maintained by the UE since the UE is not able to determine the corresponding TAI.

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

5.3.13A Forbidden PLMN lists

In N1 mode, two lists of forbidden PLMN are managed independently per access type, i.e., 3GPP access or non-3GPP access:

– the list of "forbidden PLMNs" as defined in 3GPP TS 23.122 [5] is applicable for 3GPP access in N1 mode. The same list is used by 5GMM for 3GPP access, EMM, GMM and MM (see 3GPP TS 24.301 [15] and 3GPP TS 24.008 [12]), regardless whether the UE is operating in single-registration mode or dual-registration mode.

– the list of "forbidden PLMNs for non-3GPP access to 5GCN" as defined in 3GPP TS 24.502 [18] is applicable for 5GMM for non-3GPP access.

The list of "forbidden PLMNs for GPRS service" as defined in 3GPP TS 23.122 [5] and 3GPP TS 24.008 [12] is applicable for 3GPP access in N1 mode. The same list is used by 5GMM for 3GPP access, EMM and GMM (see 3GPP TS 24.301 [15] and 3GPP TS 24.008 [12]), regardless whether the UE is operating in single-registration mode or dual-registration mode.

5.3.14 List of equivalent PLMNs

The UE shall store a list of equivalent PLMNs. These PLMNs shall be regarded by the UE as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by 5GMM, EMM, GMM and MM (see 3GPP TS 24.301 [15] and 3GPP TS 24.008 [12]) except for the case when the UE operates in dual-registration mode (see subclause 4.8.3).

The UE shall update or delete this list at the end of each registration procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. When the UE is switched off, the UE shall keep the stored list so that it can be used for PLMN selection after switch on. The UE shall delete the stored list if the USIM is removed or when the UE registered for emergency services enters the state 5GMM-DEREGISTERED. The maximum number of possible entries in the stored list is 16.

5.3.14A List of equivalent SNPNs

The UE may support equivalent SNPNs.

If the UE supports equivalent SNPNs, the ME shall store up to one list of equivalent SNPNs:

– per entry of "list of subscriber data"; or

– per the PLMN subscription, if the UE supports access to an SNPN using credentials from a credentials holder.

SNPNs in the list of equivalent SNPNs associated with the selected entry of "list of subscriber data" or the selected PLMN subscription shall be regarded by the UE as equivalent to each other for SNPN selection, cell selection and cell re-selection.

The list of equivalent SNPNs associated with the selected entry of "list of subscriber data" or the selected PLMN subscription is created, replaced or deleted at the end of each registration procedure. The stored list consists of a list of equivalent SNPNs as provided by the network plus the SNPN identity of the registered SNPN that provided the list.

When the UE is switched off, the UE shall keep the stored list(s) so that they can be used for SNPN selection after switch on.

The UE shall delete the stored list associated with an entry of "list of subscriber data" or the PLMN subscription, when the USIM is removed, the associated entry of "list of subscriber data" is updated, or the UE registered for emergency services enters the state 5GMM-DEREGISTERED.

The maximum number of possible entries in each stored list is 16.

Editor’s note: (WI: eNPN_Ph2, CR: 4834) when the UE is registering or is registered for onboarding services in SNPN, it is FFS whether list of equivalent SNPNs is needed.

5.3.15 Transmission failure abnormal case in the UE

The abnormal case 5GMM uplink message transmission failure indication by lower layers can be identified for 5GMM procedures:

When it is specified in the relevant procedure that it is up to the UE implementation to re-run the ongoing procedure that triggered that procedure, the procedure can typically be re-initiated using a retransmission mechanism of the uplink message (i.e. the one that has previously failed to be transmitted) with new sequence number and message authentication code information thus avoiding to re-start the whole procedure.

NOTE: The transmission failure can happen due to TAI change. The lower layer might take some time to read the system information and determine if the current TAI is changed. Therefore, the information of TAI change can be sent to the NAS layer a little after receiving the transmission failure indication from the lower layer. How to handle the retransmission procedure caused by the possible delayed TAI change information is up to UE implementation.

5.3.16 Extended DRX cycle for UEs in 5GMM-IDLE and 5GMM-CONNECTED mode with RRC inactive indication

Extended DRX (eDRX) cycle is supported for a UE in N1 mode. When eDRX is requested by the UE and accepted by the network:

– if the UE is not in NB-N1 mode, eDRX is used when the UE is in 5GMM-IDLE mode or in 5GMM-CONNECTED mode with RRC inactive indication; or

– if the UE is in NB-N1 mode, eDRX is used when the UE is in 5GMM-IDLE mode.

The UE may request the use of eDRX cycle during a registration procedure by including the Requested extended DRX parameters IE (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]). The UE shall not request the use of eDRX during a registration procedure for emergency services. The UE may use the extended idle mode DRX cycle length stored in the USIM (see 3GPP TS 31.102 [22]) when requesting the use of eDRX.

The UE and the network may negotiate eDRX parameters during a registration procedure when the UE has an emergency PDU session.

The network accepts the request to use the eDRX by providing the Negotiated extended DRX parameters IE when accepting the registration procedure. The UE shall use eDRX only if it received the Negotiated extended DRX parameters IE during the last registration procedure and the UE does not have an emergency PDU session.

NOTE: If the UE wants to keep using eDRX, the UE includes the Extended DRX parameters IE in each registration procedure.

If the UE received the Negotiated extended DRX parameters IE during the last registration procedure, upon successful completion of the PDU session release procedure of the emergency PDU session, the UE shall resume eDRX.

If the network has provided the Negotiated extended DRX parameters IE during the last registration procedure, upon successful completion of the PDU session release procedure of the emergency PDU session, the network shall resume eDRX.

If the UE or the network locally releases an emergency PDU session, the UE or the network shall not use eDRX until the UE receives eDRX parameters during a registration procedure with PDU session context synchronization or upon successful completion of a service request procedure with PDU session context synchronization.

If the UE did not receive the Negotiated extended DRX parameters IE, or if the UE has an emergency PDU session, the UE shall use the stored UE specific DRX parameter, if available.

If the network did not accept the request to use eDRX, or if the UE has an emergency PDU session, the network shall use the stored UE specific DRX parameter, if available.

If the network provided the Negotiated extended DRX parameters IE and also assigned a new 5G-GUTI for the UE as described in subclause 5.5.1.3.4 during the last registration procedure, the network shall use the stored UE specific DRX parameter, if available, with the old 5G-GUTI and use the eDRX provided by the network with the new 5G-GUTI until the old 5G-GUTI can be considered as invalid by the network (see subclauses 5.4.4.4 and 5.5.1.3.4).

5.3.17 Service Gap Control

Service gap control (SGC) only applies to 3GPP access.

The network may control the frequency with which UEs can transition from 5GMM-IDLE mode to 5GMM-CONNECTED mode via the SGC as specified in 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]. If the network supports SGC and the service gap time value i.e. T3447 value is available in the 5GMM context of the UE, the AMF shall consider SGC as active for the UE.

The UE and the network negotiate usage of SGC during the registration procedure for initial registration and registration procedure for mobility and periodic registration update:

– the UE supporting SGC indicates its support in the REGISTRATION REQUEST message. If the UE supports SGC and the SGC is active for the UE, the AMF includes T3447 value IE in the REGISTRATION ACCEPT message (see subclause 5.5.1.2 and subclause 5.5.1.3). The UE stores the T3447 value; and

– for UEs that do not support SGC when the network rejects mobility management signalling requests because SGC is active in the network, the mechanism for general NAS level mobility management congestion control as specified in subclause 5.3.9 applies.

The network can provide a new T3447 value to the UE to be used next time it is started or stop timer T3447 in the UE if running with the Generic UE configuration update procedure as specified in subclause 5.4.4.

The UE shall start timer T3447 when the N1 NAS signalling connection is released and if:

– the UE supports SGC, and the T3447 value is available in the UE and does not indicate zero; and

– the N1 NAS signalling connection released was not established for:

– paging;

– registration procedure for initial registration with Follow-on request indicator set to "No follow-on request pending";

– registration procedure for mobility and periodic registration update with Follow-on request indicator set to "No follow-on request pending" and without Uplink data status IE included;

– requests for emergency services; or

– requests for exception data reporting.

If the SGC is active in the network, after the UE transitions from 5GMM-CONNECTED mode to 5GMM-IDLE mode except when the UE was in 5GMM-CONNECTED mode due to:

– paging;

– registration procedure for initial registration with Follow-on request indicator set to "No follow-on request pending";

– registration procedure for mobility and periodic registration update with Follow-on request indicator set to "No follow-on request pending" and without Uplink data status IE included,

– requests for emergency services; or

– requests for exception data reporting,

the network shall start timer T3447 if not already running:

– with the T3447 value available in the 5GMM context minus 4 minutes, if the UE supports SGC and the T3447 value has been sent to the UE with a non-zero value; or

– with the T3447 value available in the 5GMM context if the UE does not support SGC.

When timer T3447 is running, the network allows:

– requests for emergency service;

– requests for emergency services fallback;

– requests for high priority access;

– requests for exception data reporting;

– registration procedure for initial registration with Follow-on request indicator set to "No follow-on request pending";

– registration procedure for mobility and periodic registration update without Uplink data status IE included and with Follow-on request indicator set to "No follow-on request pending"; or

– service request procedure or registration procedure for mobility and periodic registration update triggered by paging and subsequent MO signalling or MO data, if any, until the UE enters 5GMM-IDLE mode.

The UE or the network with a running T3447 timer keeps the timer running when the UE transits from 5GMM-IDLE mode to 5GMM-CONNECTED mode.

NOTE: If the UE transitions from 5GMM-IDLE mode to 5GMM-CONNECTED mode due to registration procedure for initial registration with Follow-on request indicator set to "No follow-on request pending" or mobility and periodic registration update request without Uplink data status IE and with Follow-on request indicator set to "No follow-on request pending", the UE initiates no further MO signalling except for mobility and periodic registration update requests without Uplink data status and with Follow-on request indicator set to "No follow-on request pending" until the UE receives mobile terminated signalling (e.g. DL NAS TRANSPORT message for MT SMS) or MT data over user plane, or after the UE has moved to 5GMM-IDLE state and the service gap timer is not running.

If timer T3447 is running when the UE changes PLMN or enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE remains the same, then timer T3447 is kept running until it expires.

If the AMF determines that the UE operating in single-registration mode has performed an inter-system change from N1 mode to S1 mode and the timer T3447 is running in the AMF, the AMF stops the T3447.

Upon inter-system change from S1 mode to N1 mode, if the UE supports service gap control, T3447 is running in the UE, and the T3447 value IE is included in the REGISTRATION ACCEPT message received from the AMF (see subclause 5.5.1.2 and subclause 5.5.1.3), the UE shall keep T3447 running. Additionally, the UE shall store and replace the currently stored service gap time value with the received T3447 value. Upon expiry of the running T3447 timer, the UE shall use the new value when starting T3447 again.

If the UE is switched off when the timer T3447 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

– let t1 be the time remaining for timer T3447 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

5.3.18 Restriction on use of enhanced coverage

In order to deal with use of extensive resources from the network, the operator may prevent specific subscribers from using enhanced coverage (see 3GPP TS 23.501 [8]). When in NB-N1 mode, the UE shall indicate support for restriction on use of enhanced coverage. When in WB-N1 mode, the UE supporting either CE mode A or CE mode B shall indicate support for restriction on use of enhanced coverage. The UE supporting restriction on use of enhanced coverage indicates its support for restriction on use of enhanced coverage in the REGISTRATION REQUEST message. If the UE supports restriction on use of enhanced coverage, the AMF indicates in the REGISTRATION ACCEPT message (see subclause 5.5.1.2 and subclause 5.5.1.3) that:

a) when in WB-N1 mode, whether CE mode B is restricted for the UE, or both CE mode A and CE mode B are restricted for the UE, or both CE mode A and CE mode B are not restricted for the UE; or

b) when in NB-N1 mode, whether the use of enhanced coverage is restricted or not for the UE.

If:

a) the use of enhanced coverage is restricted;

b) the use of CE mode B is restricted; or

c) the use of CE mode A and CE mode B is restricted,

the UE shall not use enhanced coverage in the registered PLMN and in any PLMN which is in the list of equivalent PLMNs.

If the UE supports CE mode B and the network determines that

a) the use of enhanced coverage is not restricted for the UE; or

b) CE mode B is not restricted for the UE,

the applicable NAS timer values shall be calculated by the network as described in subclause 4.19 and subclause 4.20.

For a UE that supports restriction on use of enhanced coverage or CE mode B, if:

a) the AMF determines to enforce a change in restriction on the use of enhanced coverage or a change in the restriction on the use of CE mode B as described in 3GPP TS 23.501 [8]; and

b) the UE is in 5GMM-CONNECTED mode and there is no ongoing registration procedure,

the AMF shall initiate the generic UE configuration update procedure to indicate registration requested and release of the N1 NAS signalling connection not requested as described in subclause 5.4.4. After the successful completion of the registration procedure for mobility registration update including change of the restriction on the use of enhanced coverage, for any SMF with which the UE has an established PDU session, the AMF updates the SMF with the indication on the use of extended NAS timer setting as described in 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9].

5.3.19 Handling of congestion control for transport of user data via the control plane

The network may activate congestion control for transport of user data via the control plane, as specified in 3GPP TS 23.501 [8].

If the UE has indicated support for the control plane CIoT 5GS optimizations and the network decides to activate the congestion control for transport of user data via the control plane, the network may include a value for the control plane data back-off timer T3448 in REGISTRATION ACCEPT, SERVICE ACCEPT or SERVICE REJECT message, and shall store an control plane data back-off time on a per UE basis. The UE starts the timer T3448 with the value informed in the message. To avoid that large numbers of UEs simultaneously initiate deferred requests, the network should select the value for the timer T3448 for the informed UEs so that timeouts are not synchronised.

The network sends REGISTRATION ACCEPT message or SERVICE ACCEPT message without T3448 value IE to stop the timer T3448 running in the UE as specified in subclause 5.5.1.3.4 and subclause 5.6.1.4.

Based on the stored control plane data back-off time for the UE, the network may reject the transfer of user data via the control plane initiated by the UE.

While the timer T3448 is running, the UE in 5GMM-IDLE mode does not initiate the transport of user data via the control plane procedure, except if the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [17] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [22]) and the user data is related to an exceptional event.

The UE is allowed:

a) to respond to paging with CONTROL PLANE SERVICE REQUEST message without uplink data; or

b) to send a CONTROL PLANE SERVICE REQUEST message for emergency services or for emergency services fallback;

even if the timer T3448 is running.

Upon entering the state 5GMM-DEREGISTERED or a new PLMN which is not equivalent to the PLMN where the UE started the timer T3448, or upon being switched off while the timer T3448 is running, the UE stops the timer T3448.

5.3.19a Specific requirements for UE configured to use timer T3245

5.3.19a.1 UE not operating in SNPN access operation mode

The following requirements apply for a UE that is configured to use timer T3245 (see 3GPP TS 24.368 [17] or 3GPP TS 31.102 [22]).

When the UE adds a PLMN identity to the "forbidden PLMN list" or sets the USIM as invalid for 5GS services for 3GPP access or non-3GPP access, and timer T3245 (see 3GPP TS 24.008 [12]) is not running, the UE shall start timer T3245 as specified in 3GPP TS 24.008 [12], subclause 4.1.1.6.

Upon expiry of the timer T3245, the UE shall erase the "forbidden PLMN list" and "forbidden PLMNs for GPRS service" list and set the USIM to valid for 5GS services for 3GPP access and non-3GPP access. When the lists are erased, the UE performs cell selection according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

If the UE is switched off when the timer T3245 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

– let t1 be the time remaining for T3245 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the UE will follow the behaviour as defined in the paragraph above upon expiry of the timer T3245. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

5.3.19a.2 UE operating in SNPN access operation mode

The following requirements apply for a UE that is configured to use timer T3245 (see 3GPP TS 24.368 [17]).

When the UE adds an SNPN to the "permanently forbidden SNPNs" list or "temporarily forbidden SNPNs" list which are, if the MS supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, or sets the selected entry of the "list of subscriber data" or the selected PLMN subscription as invalid for 3GPP access or non-3GPP access, and timer T3245 (see 3GPP TS 24.008 [12]) is not running, the UE shall start timer T3245 with a random value, uniformly drawn from the range between 12h and 24h.

Upon expiry of the timer T3245, the UE shall erase the "permanently forbidden SNPNs" list(s) and "temporarily forbidden SNPNs" list(s) and set the selected entry of the "list of subscriber data" or the selected PLMN subscription to valid for 3GPP access and non-3GPP access. When the lists are erased, the UE performs cell selection according to 3GPP TS 38.304 [28].

If the UE is switched off when the timer T3245 is running, the UE shall behave as follows when the UE is switched on and the selected entry of the "list of subscriber data" or the selected PLMN subscription remain the same:

5.3.20 Specific requirements for UE when receiving non-integrity protected reject messages

5.3.20.1 General

This subclause specifies the requirements for a UE that is not configured to use timer T3245 (see 3GPP TS 24.368 [17] or 3GPP TS 31.102 [22]) and receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with specific 5GMM causes.

NOTE: Additional UE requirements for this case, requirements for other 5GMM causes, and requirements for the case when the UE receives an integrity protected reject message are specified in subclauses 5.5.1 and 5.6.1.

5.3.20.2 Requirements for UE in a PLMN

The UE shall maintain:

– a list of PLMN-specific attempt counters (see 3GPP TS 24.301 [15]). The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only;

– a list of PLMN-specific attempt counters for non-3GPP access, if the UE supports non-3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via non-3GPP access only;

– a list of PLMN-specific N1 mode attempt counters for 3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only;

– a list of PLMN-specific N1 mode attempt counters for non-3GPP access, if the UE supports non-3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via non-3GPP access only;

– one counter for "SIM/USIM considered invalid for GPRS services" events (see 3GPP TS 24. 008 [12]);

– one counter for "USIM considered invalid for 5GS services over non-3GPP access" events, if the UE supports non-3GPP access; and

– a list of PLMN-specific attempt counters for the determined PLMN with disaster condition, if the UE supports MINT. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only.

A UE supporting non-EPS services shall maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events (see 3GPP TS 24.008 [12]).

The UE shall store the above lists of attempt counters and the event counters in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of MICO mode or power saving mode (see 3GPP TS 24.301 [15]).

The UE implementation-specific maximum value for any of the above counters shall not be greater than 10.

NOTE 1: Different counters can use different UE implementation-specific maximum values.

If the UE receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with 5GMM cause value #3, #6, #7, #11, #12, #13, #15, #27, #31, #62, #72, #73 or #80 before the network has established secure exchange of NAS messages for the N1 NAS signalling connection, the UE shall stop timer T3510 or T3517 if running, and start timer T3247 (see 3GPP TS 24.008 [12]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and take the following actions:

1) if the 5GMM cause value received is #3, #6 or #7, and:

a) if the 5GMM cause value is received over 3GPP access, the UE shall:

i) if the UE is already registered over another access:

– store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

– search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; or

ii) otherwise, if the counter for "SIM/USIM considered invalid for GPRS services" events has a value less than a UE implementation-specific maximum value,

– set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI for 3GPP access;

– if the 5GMM cause value received is #3 or #6, delete the list of equivalent PLMNs if any;

– increment the counter for "SIM/USIM considered invalid for GPRS services" events;

– if the 5GMM cause value received is #3 or #6, and if the counter for "SIM/USIM considered invalid for non-GPRS services" events has a value less than a UE implementation-specific maximum value, increment the counter;

– if a registration procedure was performed, reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter;

– if the UE is operating in single-registration mode, handle the EMM parameters EMM state, EPS update status, EPS attach attempt counter, tracking area updating attempt counter or service request attempt counter, 4G-GUTI, TAI list, eKSI as specified in 3GPP TS 24.301 [15] for the case when the EPS attach, tracking area updating procedure or service request procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection;

– search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and as a UE implementation option, the UE may perform registration attempt over the non-3GPP access, if non-3GPP access is available, and the USIM is not considered invalid for 5GS services over non-3GPP access; and

iii) otherwise proceed as specified in subclauses 5.5.1 and 5.6.1;

b) if the 5GMM cause value is received over non-3GPP access, the UE shall:

i) if the UE is already registered over another access:

– enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

– may perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available; or

ii) otherwise, if the counter for "USIM considered invalid for 5GS services over non-3GPP access" events has a value less than a UE implementation-specific maximum value,

– enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE;

– increment the counter for "USIM considered invalid for 5GS services over non-3GPP access" events; and as a UE implementation option, the UE may either perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available, or if 3GPP access is available, and the SIM/USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access; and

NOTE 2: How to select another access point for non-3GPP access is implementation specific.

iii) otherwise proceed as specified in subclauses 5.5.1 and 5.6.1;

2) if the 5GMM cause value received is #12, #13 or #15, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally, the UE may:

a) if the 5GMM cause value is received over 3GPP access, non-3GPP access is available, the UE is not registered over non-3GPP access yet, and the USIM is not considered invalid for 5GS services over non-3GPP access, perform registration attempt over the non-3GPP access; or

b) if the 5GMM cause value is received over non-3GPP access, 3GPP access is available, the UE is not registered over 3GPP access yet, and the USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access;

3) if the 5GMM cause value received is #11 or #73 and the UE is in its HPLMN or EHPLMN:

a) if the 5GMM cause value is received over 3GPP access, the UE shall:

– set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete, the 5G-GUTI, last visited registered TAI, TAI list, ngKSI for 3GPP access and the list of equivalent PLMNs. Additionally, if a registration procedure was performed, the UE shall reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter;

– if the 5GMM cause value received is #11 and the UE is operating in single-registration mode, handle the EMM parameters EMM state, EPS update status, EPS attach attempt counter, tracking area updating attempt counter or service request attempt counter, 4G-GUTI, TAI list, eKSI as specified in 3GPP TS 24.301 [15] for the case when the EPS attach, tracking area updating procedure or service request procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection;

– if the 5GMM cause value received is #73 and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter or tracking area updating attempt counter, and enter the state EMM-DEREGISTERED;

– search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and as a UE implementation option, the UE may perform registration attempt over the non-3GPP access, if non-3GPP access is available, the UE is not registered over non-3GPP access yet, and the USIM is not considered invalid for 5GS services over non-3GPP access;

b) if the 5GMM cause value is received over non-3GPP access, the UE shall:

– set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete the 5G-GUTI, last visited registered TAI, TAI list and ngKSI for non-3GPP access. Additionally, if a registration procedure was performed, the UE shall reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter; and

– enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. As a UE implementation option, the UE may perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available, or if 3GPP access is available, the UE is not registered over 3GPP access yet, and the USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access;

4) if the 5GMM cause value received is #11 or #73 and the UE is not in its HPLMN or EHPLMN, in addition to the UE requirements specified in subclause 5.5.1 and 5.6.1:

– if the message was received via 3GPP access and if the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter for the PLMN; or

– if the message was received via non-3GPP access and if the PLMN-specific attempt counter for non-3GPP access for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter for non-3GPP access for the PLMN;

5) if the 5GMM cause value received is #27, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally, if the PLMN-specific N1 mode attempt counter for the respective access type and for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the PLMN;

6) if the 5GMM cause value received is #72, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally, if the PLMN-specific N1 mode attempt counter for non-3GPP access for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the PLMN;

7) if the 5GMM cause value received is #31 for a UE that has indicated support for CIoT optimizations, the UE may discard the message or alternatively the UE should:

– set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2);

– search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and

8) if the 5GMM cause value received is #62, the UE may discard the message or alternatively the UE should:

– set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2);

– search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

9) if the 5GMM cause value received is #80, the UE shall proceed as specified in subclauses 5.5.1. If the PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition.

Upon expiry of timer T3247, the UE shall:

– remove all tracking areas from the list of "5GS forbidden tracking areas for regional provision of service" and the list of "5GS forbidden tracking areas for roaming", which were stored in these lists for non-integrity protected NAS reject message;

– set the USIM to valid for 5GS services for 3GPP access, if:

– the counter for "SIM/USIM considered invalid for GPRS services" events has a value less than a UE implementation-specific maximum value;

– set the USIM to valid for 5GS services for non-3GPP access, if:

– the counter for "USIM considered invalid for 5GS services over non-3GPP access" events has a value less than a UE implementation-specific maximum value;

– set the USIM to valid for non-EPS services, if:

– the counter for "SIM/USIM considered invalid for non-GPRS services" events has a value less than a UE implementation-specific maximum value;

– for each PLMN-specific attempt counter that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the extension of the "forbidden PLMNs" list;

– for each PLMN-specific attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs for non-3GPP access to 5GCN";

– re-enable the N1 mode capability for 3GPP access and, for each PLMN-specific N1 mode attempt counter for 3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of PLMNs where N1 mode is not allowed for 3GPP access (see 3GPP TS 23.122 [5]);

– re-enable the N1 mode capability for non-3GPP access and, for each PLMN-specific N1 mode attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of PLMNs where N1 mode is not allowed for non-3GPP access;

– if the UE is supporting A/Gb mode or Iu mode, perform the actions as specified in 3GPP TS 24.008 [12] for the case when timer T3247 expires;

– if the UE is supporting S1 mode, perform the actions as specified in 3GPP TS 24.301 [15] for the case when timer T3247 expires;

– initiate a registration procedure, if still needed, dependent on 5GMM state and 5GS update status, or perform PLMN selection according to 3GPP TS 23.122 [5]; and

– for each PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition that has a value greater than zero and less than a UE implementation-specific maximum value, consider the PLMN which sent the reject message is available for disaster roaming service for the respective determined PLMN with disaster condition.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs". When the USIM is removed, the UE should perform this action.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter for non-3GPP access that has a value greater than zero and less than the UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs for non-3GPP access to 5GCN". When the USIM is removed, the UE should perform this action.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition that has a value greater than zero and less than the UE implementation-specific maximum value, consider the PLMN is available for disaster roaming service for the respective determined PLMN with disaster condition. When the USIM is removed, the UE should perform this action.

NOTE 3: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to 3GPP TS 23.122 [5] the UE will delete the contents of this extension when the UE is switched off or the USIM is removed.

5.3.20.3 Requirements for UE in an SNPN

If the UE is operating in SNPN access operation mode, the UE shall maintain, for each of the entries in the "list of subscriber data":

– one SNPN-specific attempt counter for 3GPP access. The counter is applicable to access attempts via 3GPP access only;

– one SNPN-specific attempt counter for non-3GPP access, if the UE supports accessing SNPN services via a PLMN. The counter is applicable in case of accessing SNPN services via a PLMN only;

– one counter for "the entry for the current SNPN considered invalid for 3GPP access" events; and

– one counter for "the entry for the current SNPN considered invalid for non-3GPP access" events, if the UE supports accessing SNPN services via a PLMN. The counter is applicable in case of accessing SNPN services via a PLMN only.

NOTE 1: The term "non-3GPP access" used in the counter for "SNPN-specific attempt counter for non-3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events, is used to express access to SNPN services via a PLMN.

The UE shall store the above counters in its non-volatile memory. The UE shall erase the attempt counters and reset the event counters to zero when the selected entry of the "list of subscriber data" is updated or USIM is removed for the selected PLMN subscription. The counter values shall not be affected by the activation or deactivation of MICO mode or power saving mode (see 3GPP TS 24.301 [15]).

The UE implementation-specific maximum value for any of the above counters shall not be greater than 10.

NOTE 2: Different counters can use different UE implementation-specific maximum values.

If the UE receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with 5GMM cause value #3, #6, #7, #12, #13, #15, #27, #72, #74, or #75 before the network has established secure exchange of NAS messages for the N1 NAS signalling connection, the UE shall stop timer T3510 or T3517, if running, and start timer T3247 (see 3GPP TS 24.008 [12]) with a random value uniformly drawn from the range between:

a) 15 minutes and 30 minutes for 5GMM cause value #74; or

b) 30 minutes and 60 minutes for other 5GMM cause values;

if the timer is not running, and take the following actions:

a) if the 5GMM cause value received is #3, #6, or #7 and the UE is neither registered for onboarding services in SNPN nor performing initial registration for onboarding services in SNPN:

1) if the 5GMM cause value is received over 3GPP access:

i) if the UE is already registered over another access, the UE shall:

A) store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

B) search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28]; or

ii) otherwise if the counter for "the entry for the current SNPN considered invalid for 3GPP access" events has a value less than a UE implementation-specific maximum value, the UE shall:

A) set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list, and ngKSI for 3GPP access;

B) increment the counter for "the entry for the current SNPN considered invalid for 3GPP access" events;

C) reset the registration attempt counter in case of a REGISTRATION REJECT message or reset the service request attempt counter in case of a SERVICE REJECT message;

D) store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

E) search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28]. As a UE implementation option, if accessing SNPN services via a PLMN is available and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for non-3GPP access, then the UE may attempt to access SNPN services via a PLMN; or

iii) otherwise, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1;

2) if the 5GMM cause value is received over non-3GPP access:

NOTE 3: A 5GMM cause value "received over non-3GPP access" in this subclause refers to a 5GMM cause value received via a PLMN when the UE attempts to access SNPN services via a PLMN.

i) if the UE is already registered over another access, the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; or

ii) otherwise if the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events has a value less than a UE implementation-specific maximum value, the UE shall:

A) set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete the 5G-GUTI, last visited registered TAI, TAI list, and ngKSI for non-3GPP access;

B) enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

C) increment the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events. As a UE implementation option, if 3GPP access is available and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for 3GPP access, then the UE may make a registration attempt over 3GPP access; or

iii) otherwise, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1;

b) if the 5GMM cause value received is #12, #13, or #15, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally:

1) if the 5GMM cause value is received over 3GPP access, accessing SNPN services via a PLMN is available, the UE has not accessed SNPN services via a PLMN yet, and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for non-3GPP access, the UE may attempt to access SNPN services via a PLMN; or

2) if the 5GMM cause value is received over non-3GPP access, 3GPP access is available, the UE is not registered to the current SNPN over 3GPP access yet, and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for 3GPP access, the UE may make a registration attempt over 3GPP access;

NOTE 4: The network does not send 5GMM cause value #13 to the UE operating in SNPN access operation mode in this release of specification.

c) if the 5GMM cause value received is #27, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally, if the SNPN-specific attempt counter for the respective access type and for the current SNPN has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the SNPN;

c1) if the 5GMM cause value received is #72, the UE shall proceed as specified in subclauses 5.5.1 and 5.6.1. Additionally, if the SNPN-specific attempt counter for non-3GPP access for the current SNPN has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the SNPN; and

d) if:

1) the 5GMM cause value received is #74 or #75; or

2) the 5GMM cause value received is #3, #6, or #7 and the UE is registered for onboarding services in SNPN or performing initial registration for onboarding services in SNPN;

in addition to the UE requirements specified in subclauses 5.5.1 and 5.6.1:

1) if the message was received via 3GPP access and if the SNPN-specific attempt counter for 3GPP access for the SNPN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the SNPN-specific attempt counter for 3GPP access for the SNPN; or

2) if the message was received via non-3GPP access and if the SNPN-specific attempt counter for non-3GPP access for the SNPN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the SNPN-specific attempt counter for non-3GPP access for the SNPN.

NOTE 5: The message "received via non-3GPP access" in this subclause refers to a message received via a PLMN when the UE attempts to access SNPN services via a PLMN.

Upon expiry of timer T3247, the UE shall:

– remove, for each SNPN, all tracking areas from the list of "5GS forbidden tracking areas for regional provision of service" and the list of "5GS forbidden tracking areas for roaming" for the SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, which were stored in these lists for non-integrity protected NAS reject message;

– set each entry of the "list of subscriber data" or the PLMN subscription to valid for 3GPP access, if the corresponding counter for "the entry for the current SNPN considered invalid for 3GPP access" events has a value less than a UE implementation-specific maximum value;

– set each entry of the "list of subscriber data" or the PLMN subscription to valid for non-3GPP access, if the corresponding counter for "the entry for the current SNPN considered invalid for non-3GPP access" events has a value less than a UE implementation-specific maximum value;

– remove each SNPN identity from the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access which are, if the MS supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if the corresponding SNPN-specific attempt counter for 3GPP access has a value greater than zero and less than a UE implementation-specific maximum value and the SNPN identity is included in any of the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access;

– remove each SNPN identity from the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access which are, if the MS supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if the corresponding SNPN-specific attempt counter for non-3GPP access has a value greater than zero and less than a UE implementation-specific maximum value and the SNPN identity is included in any of the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access;

– re-enable the N1 mode capability for 3GPP access and, for each SNPN-specific attempt counter for 3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective SNPN from the list of SNPNs for which the N1 mode capability was disabled due to receipt of a reject from the network with 5GMM cause #27 "N1 mode not allowed" (see 3GPP TS 23.122 [5]);

– re-enable the N1 mode capability for non-3GPP access and, for each SNPN-specific attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective SNPN from the list of SNPNs for which N1 mode capability was disabled for non-3GPP access due to receipt of a reject from the network with 5GMM cause #27 "N1 mode not allowed" or 5GMM cause #72 "non-3GPP access to 5GCN not allowed"; and

– initiate a registration procedure, if still needed, dependent on 5GMM state and 5GS update status, or perform SNPN selection according to 3GPP TS 23.122 [5].

When the UE is switched off or a UICC containing the USIM is removed:

– for each SNPN-specific attempt counter for 3GPP access having a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the respective SNPN identity from the "permanently forbidden SNPNs" list(s) for 3GPP access or "temporarily forbidden SNPNs" list(s) for 3GPP access, if available; and

– for each SNPN-specific attempt counter for non-3GPP access having a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the respective SNPN identity from the "permanently forbidden SNPNs" list(s) for non-3GPP access or "temporarily forbidden SNPNs" list(s) for non-3GPP access, if available.

When an entry of the "list of subscriber data" is updated:

– if the UE does not support access to an SNPN using credentials from a credentials holder and the SNPN-specific attempt counter for 3GPP access for the SNPN corresponding to the entry has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the entry from the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, if available;

– if the UE does not support access to an SNPN using credentials from a credentials holder and the SNPN-specific attempt counter for non-3GPP access for the SNPN corresponding to the entry has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the entry from the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access, if available;

– if the UE supports access to an SNPN using credentials from a credentials holder and the SNPN-specific attempt counter for 3GPP access for an SNPN in the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, associated with the entry, has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the SNPN from the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, associated with the entry; and

– if the UE supports access to an SNPN using credentials from a credentials holder and the SNPN-specific attempt counter for non-3GPP access for an SNPN in the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access associated with the entry, has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the SNPN from the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access, associated with the entry.

5.3.21 CIoT 5GS optimizations

CIoT 5GS optimizations provide improved support of small data and SMS transfer. A UE supporting CIoT 5GS optimizations can indicate the 5GS CIoT network behaviour the UE can support and prefers to use during the registration procedure (see 3GPP TS 23.502 [9]). The UE may indicate the support for control plane CIoT 5GS optimization, user plane CIoT 5GS optimization, N3 data transfer and header compression (see subclause 9.11.3.1). Furthermore, the UE may, separately from the indication of support, indicate preference for control plane CIoT 5GS optimization or user plane CIoT 5GS optimization (see subclause 9.11.3.9A). The indication of preference is also considered as the request to use. A UE supporting CIoT EPS optimizations can also indicate the EPS CIoT network behaviour the UE can support during the registration procedure. Furthermore, the UE may, separately from the indication of support, indicate preference for control plane CIoT EPS optimization or user plane CIoT EPS optimization.

NOTE 1: CIoT 5GS optimizations are not supported by NR connected to 5GCN.

NOTE 2: If the UE does not support user plane CIoT 5GS optimization, it does not indicate preference for user plane CIoT 5GS optimization.

The UE can be in NB-N1 mode or WB-N1 mode when requesting the use of CIoT 5GS optimizations during the registration procedure. A UE in NB-N1 mode always indicates support for control plane CIoT 5GS optimization.

In NB-N1 mode, the UE, when requesting the use of CIoT 5GS optimizations, does not:

– request an initial registration for emergency services;

– request a PDU session establishment for emergency PDU session; or

– indicate UE’s usage setting during the registration procedure.

The network does not indicate to the UE support of emergency services when the UE is in NB-N1 mode (see subclause 5.5.1.2.4 and 5.5.1.3.4).

The control plane CIoT 5GS optimization enables support of efficient transport of user data (IP, Ethernet and Unstructured) or SMS messages over control plane via the AMF without triggering user-plane resources establishment. The support of control plane CIoT 5GS optimization is mandatory for the network in NB-N1 mode and optional in WB-N1 mode. Optional header compression of IP data and Ethernet data can be applied to PDU sessions with IP PDU session type and Ethernet PDU session type that are configured to support header compression. For IP header compression, Robust Header Compression (ROHC) protocol specified in IETF RFC 5795 [39B] is used. For Ethernet header compression, Ethernet Header Compression (EHC) protocol specified in 3GPP TS 38.323 [29] is used.

For a UE that supports Location Services (LCS) notification mechanisms in N1 mode, the control plane CIoT 5GS optimization also enables the transport of location services messages from 5GMM-IDLE mode using the CONTROL PLANE SERVICE REQUEST message when location services are requested (see subclause 6.7.1 in 3GPP TS 23.273 [6B]).

The user plane CIoT 5GS optimization enables support for change from 5GMM-IDLE mode over 3GPP access to 5GMM-CONNECTED mode over 3GPP access without the need for using the service request procedure (see subclause 5.3.1.5).

If the UE supports user plane CIoT 5GS optimization, it shall also support N3 data transfer.

If the UE indicates support of one or more CIoT 5GS optimizations and the network supports one or more CIoT 5GS optimizations and decides to accept the registration request, the network indicates the supported CIoT 5GS optimizations to the UE per registration area when accepting the UE request. Network indication of support is interpreted by the UE as the acceptance to use the respective feature. After completion of the registration procedure, the UE and the network can then use the accepted CIoT 5GS optimizations for the transfer of user data (IP, Ethernet, Unstructured and SMS).

A UE in NB-N1 mode or WB-N1 mode can request the use of SMS over NAS by setting the SMS requested bit of the 5GS update type IE in the REGISTRATION REQUEST message as specified in subclauses 5.5.1.2.2 and 5.5.1.3.2.

The AMF indicates whether it allows the use of SMS over NAS for a UE in NB-N1 mode or WB-N1 mode by setting the SMS allowed bit of the 5GS registration result IE in the REGISTRATION ACCEPT message as specified in subclauses 5.5.1.2.4 and 5.5.1.3.4.

If the UE and the network support both the control plane CIoT 5GS optimization and N3 data transfer, then when receiving the UE’s request for a PDU session establishment, the AMF decides whether the PDU session should be NEF PDU session or N6 PDU session as specified in 3GPP TS 23.501 [8] and then:

a) if NEF PDU session is to be established for unstructured data type, the AMF includes control plane only indication for the requested PDU session to the SMF;

b) if N6 PDU session is to be established and the DNN or S-NSSAI of the newly requested N6 PDU session supports interworking with EPS as specified in 3GPP TS 23.502 [9]:

1) if there are existing N6 PDU sessions supporting interworking with EPS for this UE that were established with the control plane only indication, the AMF includes the control plane only indication for the newly requested N6 PDU session to the SMF; or

2) if there are existing N6 PDU sessions supporting interworking with EPS for this UE that were established without the control plane only indication, the AMF does not include the control plane only indication for the newly requested N6 PDU session to the SMF;

3) if there is no existing N6 PDU session supporting interworking with EPS for this UE, the AMF determines whether to include the control plane only indication for the newly requested N6 PDU session to the SMF based on local policies, the UE’s preferred CIoT network behaviour and the supported CIoT network behaviour; and

c) if N6 PDU session is to be established and the DNN or S-NSSAI of the N6 PDU session does not support interworking with EPS as specified in 3GPP TS 23.502 [9], the AMF determines whether to include the control plane only indication for the newly requested N6 PDU session to the SMF based on local policies, the UE’s preferred CIoT network behaviour and the supported CIoT network behaviour.

In NB-N1 mode, if the UE or the network does not support N3 data transfer, then when receiving the UE’s request for a PDU session establishment, the AMF decides whether the PDU session should be NEF PDU session or N6 PDU session as specified in 3GPP TS 23.501 [8] and then includes the control plane only indication for the requested PDU session to the SMF.

If the network supports user plane CIoT 5GS optimization, it shall also support N3 data transfer.

Broadcast system information may provide information about support of CIoT 5GS optimizations (see 3GPP TS 36.331 [25A]). At reception of new broadcast system information, the lower layers deliver it to the 5GMM layer in the UE. The information provided by lower layers is per PLMN and used by the UE to determine whether certain CIoT 5GS optimizations are supported in the cell.

The UE shall not attempt to use CIoT 5GS optimizations which are indicated as not supported.

In NB-N1 mode, at any given time, there cannot be user-plane resources established for a number of PDU sessions that exceeds the UE’ s maximum number of supported user-plane resources. The UE in NB-N1 mode shall not:

a) request the establishment of user-plane resources for a number of PDU sessions that exceeds the UE’ s maximum number of supported user-plane resources; or

b) initiate the establishment of a new PDU session, or request the transfer of a PDU session from the non-3GPP access to the 3GPP access, if:

1) the UE has indicated preference for user plane CIoT 5GS optimization;

2) the network accepted the use of user plane CIoT 5GS optimization; and

3) the UE currently has user-plane resources established fora number of PDU sessions that is equal to the UE’ s maximum number of supported user-plane resources.

The AMF enforces a limit on the number of PDU sessions with active user-plane resources for a UE in NB-N1 mode based on the UE’s maximum number of supported user-plane resources as follows:

a) there can be a maximum of one PDU session with active user-plane resources when the Multiple user-plane resources support bit is set to "Multiple user-plane resources not supported", or

b) there can be a maximum of two PDU sessions with active user-plane resources when the Multiple user-plane resources support bit is set to "Multiple user-plane resources supported".

A PDU session for a UE in NB-N1 mode shall only have one QoS rule and that is the default QoS rule. Reflective QoS is not supported in NB-N1 mode. Reflective QoS is not applicable for a PDU session with control plane only indication.

In NB-N1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of user plane CIoT 5GS optimization, the UE shall pass an indication of the requested CIoT 5GS optimizations to the lower layers. If the UE requests the use of N3 data transfer without user plane CIoT 5GS optimization, then the UE shall also pass an indication of user plane CIoT 5GS optimization to lower layers.

In WB-N1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of control plane CIoT 5GS optimization or user plane CIoT 5GS optimization, the UE shall pass an indication of the requested CIoT 5GS optimizations to the lower layers.

5.3.22 Interaction between MICO mode with active time and extended idle mode DRX cycle

The UE can request the use of both MICO mode with active time and eDRX during a registration procedure but it is up to the network to decide to enable none, one of them or both (see 3GPP TS 23.501 [8]).

If the network accepts the use of both MICO mode with active time (see subclause 5.3.6) and eDRX (see subclause 5.3.16), the extended DRX parameters provided to the UE should allow for multiple paging occasions before the active timer expires.

5.3.23 Forbidden wireline access area

The AMF shall send a REGISTRATION REJECT, SERVICE REJECT or DEREGISTRATION REQUEST message over a wireline access network with the 5GMM cause #77 "wireline access area not allowed", if conditions specified in 3GPP TS 23.316 [6D] for AMF’s enforcement of forbidden area are fulfilled.

If a REGISTRATION REJECT, SERVICE REJECT or DEREGISTRATION REQUEST message is received over a wireline access network with the 5GMM cause #77 "wireline access area not allowed":

a) the 5G-RG shall not access 5GCN over the wireline access network until the 5G-RG is switched off, the UICC containing the USIM is removed, or the 5G-RG starts using another wireline access network;

b) the W-AGF acting on behalf of the FN-CRG shall not access 5GCN until the W-AGF acting on behalf of the FN-CRG determines that the FN-CRG is switched off; and

c) the W-AGF acting on behalf of the N5GC device shall not access 5GCN until the W-AGF acting on behalf of the FN-CRG determines that the FN-CRG serving the N5GC device is switched off.

5.3.24 WUS assistance

A UE supporting reception of WUS assistance information indicates its capability for reception of WUS assistance information during registration procedure (see 3GPP TS 23.501 [8]). The UE supporting WUS assistance information may include its UE paging probability information in the Requested WUS assistance information IE in the REGISTRATION REQUEST message (see 3GPP TS 23.501 [8]). The UE shall not include its UE paging probability information during:

a) a registration procedure for initial registration for emergency services (see subclause 5.5.1.2);

b) a registration procedure for initial registration for initiating an emergency PDU session (see subclause 5.5.1.2);

d) a registration procedure for mobility and periodic registration update (see subclause 5.5.1.3) when the UE has an emergency PDU session established.

The UE and the network may negotiate the UE paging probability information during a registration procedure when the UE does not have an emergency PDU session. The UE paging probability information is an assistance information used to determine the WUS group for paging UE (see 3GPP TS 23.501 [8], 3GPP TS 36.300 [25B]).

NOTE: The determination of UE paging probability information is up to UE implementation.

If a UE supporting WUS assistance information did not receive the Negotiated WUS assistance information IE during the last registration procedure due to an active emergency PDU session over 3GPP access, the UE shall initiate a registration procedure for mobility and periodic registration update to request WUS assistance information after the emergency PDU session is released over 3GPP access.

If the UE does not have an emergency PDU session and the network accepts the use of the WUS assistance information for the UE, the network determines the negotiated UE paging probability information for the UE based on the requested UE paging probability information, if any, local configuration or previous statistical information for the UE, and then indicates the negotiated UE paging probability information in the Negotiated WUS assistance information IE to the UE in the REGISTRATION ACCEPT message. The network shall store the negotiated UE paging probability information in the 5GMM context of the UE for paging.

The UE shall use WUS assistance information only if the UE received the Negotiated WUS assistance information IE during the last registration procedure. If the UE did not receive the Negotiated WUS assistance information IE during the last registration procedure, the UE shall delete any existing WUS assistance information received from the network.

If the network did not accept the request to use WUS assistance information, the network shall delete the stored negotiated UE paging probability information for the UE, if available.

When an emergency PDU session is successfully established after the UE received the Negotiated WUS assistance information IE during the last registration procedure, the UE and the AMF shall not use WUS assistance information until:

– the successful completion of the PDU session release procedure of the emergency PDU session;

– the UE receives WUS assistance information during a registration procedure with PDU session status IE or upon successful completion of a service request procedure, if the UE or the network locally releases the emergency PDU session; or

– the successful completion of the handover of the emergency PDU session to non-3GPP access.

5.3.25 Paging Early Indication with Paging Subgrouping Assistance

A UE may indicate its capability to support NR paging subgrouping during registration procedure when the UE:

– initiates a registration procedure with 5GS registration type IE not set to "emergency registration"; and

– does not have an active emergency PDU session.

If a UE supporting NR paging subgrouping did not indicate its capability to support NR paging subgrouping during the last registration procedure due to an active emergency PDU session over 3GPP access, the UE shall initiate a registration procedure for mobility and periodic registration update procedure to indicate its capability to support NR paging subgrouping after the emergency PDU session is released over 3GPP access.

If the UE indicates support of NR paging subgrouping the UE may include its paging probability information in the Requested PEIPS assistance information IE in the REGISTRATION REQUEST message. If the UE indicates support of NR paging subgrouping and the network supports and accepts the use of the PEIPS assistance information for the UE, the network provides to the UE the Negotiated PEIPS assistance information, including the Paging subgroup ID, in the REGISTRATION ACCEPT message or the CONFIGURATION UPDATE COMMAND message. The Paging subgroup ID is used to determine the NR paging subgroup for paging the UE. The network shall store the Paging subgroup ID in the 5GMM context of the UE.

The UE shall use PEIPS assistance information only if the UE received the Negotiated PEIPS assistance information IE during the last registration procedure. If the UE did not receive the Negotiated PEIPS assistance information IE during the last registration procedure, the UE shall delete any existing PEIPS assistance information received from the network.

If the network did not accept the request to use PEIPS assistance information during the registration procedure, the network shall delete the stored PEIPS assistance information for the UE, if available.

If the UE supports the use of the PEIPS assistance information and the network supports and accepts the use of the PEIPS assistance information, the network may provide the PEIPS assistance information to the UE by including the Updated PEIPS assistance information IE in the CONFIGURATION UPDATE COMMAND message.

When an emergency PDU session is successfully established over 3GPP access after the UE received the Negotiated PEIPS assistance information IE during the last registration procedure, the UE and the AMF shall not use PEIPS assistance information until:

– the successful completion of the PDU session release procedure of the emergency PDU;

– the UE receives PEIPS assistance information during a registration procedure with PDU session status IE or upon successful completion of a service request procedure, if the UE or the network locally releases the emergency PDU session;

– the successful completion of handover of emergency PDU session to non-3GPP access; or

– the successful transfer of the emergency PDU session in 5GS to the EPS or ePDG connected to EPC.

5.3.26 Support for unavailability period

If the UE and network support unavailability period and an event is triggered in the UE that would make the UE unavailable for a certain period of time, the UE may store its 5GMM and 5GSM context in USIM or non-volatile memory to be able to reuse it after its unavailability period.

NOTE: How the UE stores its contexts is UE implementation specific.

Before the event starts, the UE provides an unavailability period duration during the registration procedure or during the de-registration procedure (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]). The support for the unavailability period is negotiated in the registration procedure. If the UE provided an unavailability period duration in the last registration procedure or de-registration procedure, the AMF considers the UE unreachable until the UE re-register to normal service without providing an unavailability period duration. The UE may determine the value of the periodic registration update timer (T3512) provided to the UE based on the unavailability period duration. The AMF releases the N1 signalling connection after the completion of the registration procedure in which the UE provided an unavailability period duration.