6.3 Network-requested 5GSM procedures

24.5013GPPNon-Access-Stratum (NAS) protocol for 5G System (5GS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

6.3.1 PDU session authentication and authorization procedure

6.3.1.1 General

The purpose of the PDU session authentication and authorization procedure is to enable the DN:

a) to authenticate the upper layers of the UE, when establishing the PDU session;

b) to authorize the upper layers of the UE, when establishing the PDU session;

c) both of the above; or

d) to re-authenticate the upper layers of the UE after establishment of the PDU session.

The PDU session authentication and authorization procedure can be performed only during or after the UE-requested PDU session procedure establishing a non-emergency PDU session. The PDU session authentication and authorization procedure shall not be performed during or after the UE-requested PDU session establishment procedure establishing an emergency PDU session.

The upper layers store the association between a DNN and corresponding credentials, if any, for the PDU session authentication and authorization.

If the UE is registered for onboarding services in SNPN the SMF may initiate the PDU session authentication and authorization procedure based on local policy with a DCS as specified in 3GPP TS 33.501 [24] clause I.9.2.4.1 or a DN‑AAA server as specified in 3GPP TS 33.501 [24] clause I.9.2.4.2.

If the UE is registered for onboarding services in SNPN and the network initiates the PDU session authentication and authorization procedure, the UE shall use the default UE credentials for secondary authentication for the PDU session authentication and authorization procedure.

The network authenticates the UE using the Extensible Authentication Protocol (EAP) as specified in IETF RFC 3748 [34].

EAP has defined four types of EAP messages:

a) an EAP-request message;

b) an EAP-response message;

c) an EAP-success message; and

d) an EAP-failure message.

The EAP-request message is transported from the network to the UE using the PDU SESSION AUTHENTICATION COMMAND message of the PDU EAP message reliable transport procedure.

The EAP-response message to the EAP-request message is transported from the UE to the network using the PDU SESSION AUTHENTICATION COMPLETE message of the PDU EAP message reliable transport procedure.

If the PDU session authentication and authorization procedure is performed during the UE-requested PDU session establishment procedure:

a) and the DN authentication of the UE completes successfully, the EAP-success message is transported from the network to the UE as part of the UE-requested PDU session establishment procedure in the PDU SESSION ESTABLISHMENT ACCEPT message.

b) and the DN authentication of the UE completes unsuccessfully, the EAP-failure message is transported from the network to the UE as part of the UE-requested PDU session establishment procedure in the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU session authentication and authorization procedure is performed after the UE-requested PDU session establishment procedure:

a) and the DN authentication of the UE completes successfully, the EAP-success message is transported from the network to the UE using the PDU SESSION AUTHENTICATION RESULT message of the PDU EAP result message transport procedure.

b) and the DN authentication of the UE completes unsuccessfully, the EAP-failure message is transported from the network to the UE using the PDU SESSION RELEASE COMMAND message of the network-requested PDU session release procedure.

There can be several rounds of exchange of an EAP-request message and a related EAP-response message for the DN to complete the authentication and authorization of the request for a PDU session (see example in figure 6.3.1.1).

The SMF shall set the authenticator retransmission timer specified in IETF RFC 3748 [34] subclause 4.3 to infinite value.

NOTE: The PDU session authentication and authorization procedure provides a reliable transport of EAP messages and therefore retransmissions at the EAP layer of the SMF do not occur.

Figure 6.3.1.1: PDU session authentication and authorization procedure

6.3.1.2 PDU EAP message reliable transport procedure

6.3.1.2.1 PDU EAP message reliable transport procedure initiation

In order to initiate the PDU EAP message reliable transport procedure, the SMF shall create a PDU SESSION AUTHENTICATION COMMAND message.

The SMF shall set the PTI IE of the PDU SESSION AUTHENTICATION COMMAND message to "No procedure transaction identity assigned".

The SMF shall set the EAP message IE of the PDU SESSION AUTHENTICATION COMMAND message to the EAP-request message provided by the DN or generated locally.

The SMF shall send the PDU SESSION AUTHENTICATION COMMAND message, and the SMF shall start timer T3590 (see example in figure 6.3.1.1).

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided a DNN during the PDU session establishment, the UE shall stop timer T3396, if it is running for the DNN provided by the UE. If the UE did not provide a DNN during the PDU session establishment, the UE shall stop the timer T3396 associated with no DNN if it is running.

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI and a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the [S-NSSAI of the PDU session, DNN] combination. If the UE provided a DNN but did not provide an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, DNN] combination provided by the UE. If the UE provided an S-NSSAI but did not provide a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [S-NSSAI, no DNN] combination provided by the UE. If the UE provided neither a DNN nor an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, no DNN] combination provided by the UE. The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running.

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI during the PDU session establishment, the UE shall stop timer T3585, if it is running for the S-NSSAI of the PDU session. If the UE did not provide an S-NSSAI during the PDU session establishment, the UE shall stop the timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running.

NOTE 1: Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3396 associated with the DNN (or no DNN, if no DNN was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3396 and the timer T3584.

NOTE 2: Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3585 associated with the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3585 and the timer T3584.

Upon receipt of a PDU SESSION AUTHENTICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE passes to the upper layers the EAP message received in the EAP message IE of the PDU SESSION AUTHENTICATION COMMAND message. Apart from this action and the stopping of timers T3396, T3584 and T3485 (if running), the authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.

6.3.1.2.2 PDU EAP message reliable transport procedure accepted by the UE

The UE shall create a PDU SESSION AUTHENTICATION COMPLETE message when the upper layers provide an EAP-response message responding to the received EAP-request message.

The UE shall set the EAP message IE of the PDU SESSION AUTHENTICATION COMPLETE message to the EAP-response message.

The UE shall transport the PDU SESSION AUTHENTICATION COMPLETE message and the PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5. Apart from this action, the authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.

Upon receipt of a PDU SESSION AUTHENTICATION COMPLETE message, the SMF shall stop timer T3590 and provides the EAP message received in the EAP message IE of the PDU SESSION AUTHENTICATION COMPLETE message to the DN or handles it locally.

6.3.1.2.3 Abnormal cases on the network side

The following abnormal cases can be identified:

a) T3590 expired.

The SMF shall, on the first expiry of the timer T3590, retransmit the PDU SESSION AUTHENTICATION COMMAND message and shall reset and start timer T3590. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3590, the SMF shall abort the procedure.

b) Collision of UE-requested PDU session release procedure and a PDU session authentication and authorization procedure.

When the SMF receives a PDU SESSION RELEASE REQUEST message during the PDU session authentication and authorization procedure, and the PDU session indicated in the PDU SESSION RELEASE REQUEST message is the PDU session that the SMF had requested to authenticate, the SMF shall abort the PDU session authentication and authorization procedure and proceed with the UE-requested PDU session release procedure.

6.3.1.2.4 Abnormal cases in the UE

The following abnormal cases can be identified:

a) PDU session inactive for the received PDU session ID.

If the PDU session ID in the PDU SESSION AUTHENTICATION COMMAND message belongs to any PDU session in state PDU SESSION INACTIVE in the UE, the UE shall send a 5GSM STATUS message with the 5GSM cause IE set to #43 "Invalid PDU session identity".

b) Collision of UE-requested PDU session release procedure and a PDU session authentication and authorization procedure.

When the UE receives a PDU SESSION AUTHENTICATION COMMAND message during the UE-requested PDU session release procedure, and the PDU session indicated in PDU SESSION AUTHENTICATION COMMAND message is the PDU session that the UE had requested to release, the UE shall ignore the PDU SESSION AUTHENTICATION COMMAND message and proceed with the UE-requested PDU session release procedure.

6.3.1.3 PDU EAP result message transport procedure

6.3.1.3.1 PDU EAP result message transport procedure initiation

PDU EAP result message transport procedure is initiated by the SMF if the PDU session authentication and authorization procedure is performed after the PDU session is established and the DN authentication of the UE completes successfully.

In order to initiate the PDU EAP result message transport procedure, the SMF shall create a PDU SESSION AUTHENTICATION RESULT message.

The SMF shall set the PTI IE of the PDU SESSION AUTHENTICATION RESULT message to "No procedure transaction identity assigned".

The SMF shall set the EAP message IE of the PDU SESSION AUTHENTICATION RESULT message to the EAP-success message provided by the DN.

The SMF shall send the PDU SESSION AUTHENTICATION RESULT message.

Upon receipt of a PDU SESSION AUTHENTICATION RESULT message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE passes to the upper layers the EAP message received in the EAP message IE of the PDU SESSION AUTHENTICATION RESULT message. Apart from this action, the authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.

6.3.1.3.2 Abnormal cases in the UE

The following abnormal cases can be identified:

a) PDU session inactive for the received PDU session ID.

If the PDU session ID in the PDU SESSION AUTHENTICATION RESULT message belongs to any PDU session in state PDU SESSION INACTIVE in the UE, the UE shall send a 5GSM STATUS message with the 5GSM cause IE set to #43 "Invalid PDU session identity".

b) Collision of UE-requested PDU session release procedure and a PDU EAP result message transport procedure.

When the UE receives a PDU SESSION AUTHENTICATION RESULT message during the UE-requested PDU session release procedure, and the PDU session indicated in PDU SESSION AUTHENTICATION RESULT message is the PDU session that the UE had requested to release, the UE shall ignore the PDU SESSION AUTHENTICATION RESULT message and proceed with the UE-requested PDU session release procedure.

6.3.1A Service-level authentication and authorization procedure

6.3.1A.1 General

The purpose of the service-level authentication and authorization (service-level-AA) procedure is to enable the DN using NEF services for authentication:

a) to authenticate the upper layers of the UE, when establishing the PDU session;

b) to authorize the upper layers of the UE, when establishing the PDU session;

c) both of the above; or

d) to re-authenticate the upper layers of the UE after establishment of the PDU session.

The service-level authentication and authorization procedure is used for UUAA as specified in 3GPP TS 23.256 [6AB].

NOTE 1: The authentication protocol for UUAA is out of scope of 3GPP in this release of specification.

The service-level authentication and authorization procedure can be performed only during or after the UE-requested PDU session procedure establishing a non-emergency PDU session. The service-level authentication and authorization procedure shall not be performed during or after the UE-requested PDU session establishment procedure establishing an emergency PDU session.

If the service-level authentication and authorization procedure is performed during the UE-requested PDU session establishment procedure:

a) and the service-level-AA procedure of the UE completes successfully, the service-level-AA response is transported from the network to the UE as a part of the UE-requested PDU session establishment procedure in the PDU SESSION ESTABLISHMENT ACCEPT message; or

b) and the service-level-AA procedure of the UE completes unsuccessfully, the service-level-AA response is transported from the network to the UE as a part of the UE-requested PDU session establishment procedure in the PDU SESSION ESTABLISHMENT REJECT message.

NOTE 2: If the SMF receives the HTTP code set to "4xx" or "5xx" as specified in 3GPP TS 29.500 [20AA] or the SMF detects a UUAA-SM failure as specified in 3GPP TS 29.256 [21B], then the SMF considers that the UUAA-SM procedure has completed unsuccessfully.

If the service-level authentication and authorization procedure is performed for the established PDU session with re-authentication purpose:

a) and the service-level-AA procedure of the UE completes successfully, the service-level-AA response is transported from the network to the UE as a part of the network-requested PDU session modification procedure in the PDU SESSION MODIFICATION COMMAND message; or

b) and the service-level-AA procedure of the UE completes unsuccessfully, the service-level-AA response is transported from the network to the UE as a part of the network-requested PDU session release procedure in the PDU SESSION RELEASE COMMAND message.

There can be several rounds of exchange of a service-level-AA payload for the service to complete the service-level authentication and authorization of the request for a PDU session (see example in figure 6.3.1A.1-1).

If the UE receives the service-level-AA response in the PDU SESSION ESTABLISHMENT ACCEPT message or the PDU SESSION ESTABLISHMENT REJECT message, the UE passes it to the upper layer.

Figure 6.3.1A.1-1: Service-level authentication and authorization procedure

6.3.1A.2 Service-level authentication and authorization procedure initiation

In order to initiate the service-level authentication and authorization procedure, the SMF shall create a SERVICE-LEVEL AUTHENTICATION COMMAND message.

The SMF shall set the PTI IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message to "No procedure transaction identity assigned".

The SMF shall set the service-level-AA payload in the Service-level-AA container IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message to the payload provided by the DN via the NEF. If a payload type associated with the payload is provided by the DN via the NEF, the SMF shall set the service-level-AA payload type with the value set to the payload type.

NOTE: In case of UUAA, the service-level-AA payload is provided by the DN via the UAS-NF.

The SMF shall send the SERVICE-LEVEL AUTHENTICATION COMMAND message, and the SMF shall start timer T3594 (see example in figure 6.3.1A.1-1).

Upon receipt of a SERVICE-LEVEL AUTHENTICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE passes to the upper layers the service-level-AA payload received in the Service-level-AA container IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message. Apart from this action, the service-level authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.

6.3.1A.3 Service-level authentication and authorization procedure accepted by the UE

When the upper layers provide a service-level-AA payload, the UE shall create a SERVICE-LEVEL AUTHENTICATION COMPLETE message and set the service-level-AA payload of the Service-level-AA container IE to the service-level-AA payload received from the upper layers, and if the service-level-AA payload type is received in the SERVICE-LEVEL AUTHENTICATION COMMAND message from the SMF, set the service-level-AA payload type of the Service-level-AA container IE to the service-level-AA payload type received from the SMF.

The UE shall transport the SERVICE-LEVEL AUTHENTICATION COMPLETE message and the PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5. Apart from this action, the service-level authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.

Upon receipt of a SERVICE-LEVEL AUTHENTICATION COMPLETE message, the SMF shall stop timer T3594 and provides the service-level-AA payload received in the Service-level-AA container IE of the SERVICE-LEVEL AUTHENTICATION COMPLETE message to the DN.

6.3.1A.4 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Expiry of timer T3594.

On the first expiry of the timer T3594, the SMF shall resend the SERVICE-LEVEL AUTHENTICATION COMMAND message and shall reset and restart timer T3594. This retransmission is repeated four times, i.e., on the fifth expiry of timer T3594, the SMF shall abort the procedure and send PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause #29 "user authentication or authorization failed" as specified in subclause 6.4.1.4.1.

6.3.1A.5 Abnormal cases in the UE

The following abnormal case can be identified:

a) Collision of UE-requested PDU session release procedure and a service-level authentication and authorization procedure.

When the UE receives a SERVICE-LEVEL AUTHENTICATION COMMAND message during the UE-requested PDU session release procedure, and the PDU session indicated in SERVICE-LEVEL AUTHENTICATION COMMAND message is the PDU session that the UE has requested to release, the UE shall ignore the SERVICE-LEVEL AUTHENTICATION COMMAND message and proceed with the UE-requested PDU session release procedure.

6.3.2 Network-requested PDU session modification procedure

6.3.2.1 General

The purpose of the network-requested PDU session modification procedure is to enable the network to modify a PDU session, re-negotiate header compression configuration associated to a PDU session, convey a port management information container, to trigger EAS rediscovery, provide updated DNS server address(es) due to the newly selected local DNS server or the newly selected EASDF, provide updated ECS configuration information, remove joined UE from one or more multicast MBS sessions associated with a PDU session, update ATSSS parameters (e.g. ATSSS rules), update the MBS service area or the security information of multicast MBS session that the UE has joined or to inform about the result of service-level AA procedure or C2 authorization for UAS services.

6.3.2.2 Network-requested PDU session modification procedure initiation

In order to initiate the network-requested PDU session modification procedure, the SMF shall create a PDU SESSION MODIFICATION COMMAND message.

If the authorized QoS rules of the PDU session is modified or is marked as to be synchronised with the UE, the SMF shall set the Authorized QoS rules IE of the PDU SESSION MODIFICATION COMMAND message to the authorized QoS rules of the PDU session. The SMF shall ensure that the number of the packet filters used in the authorized QoS rules of the PDU Session does not exceed the maximum number of packet filters supported by the UE for the PDU session. The SMF may bind service data flows for which the UE has requested traffic segregation to a dedicated QoS flow for the PDU session, if possible. Otherwise the SMF may bind the service data flows to an existing QoS flow. The SMF shall use only one dedicated QoS flow for traffic segregation. If the UE has requested traffic segregation for multiple service data flows with different QoS handling, the SMF shall bind all these service data flows to a single QoS flow. If the SMF allows traffic segregation for service data flows in a QoS rule, then the SMF shall create a new authorized QoS rule for these service data flows and shall delete packet filters corresponding to these service data flows from the other authorized QoS rules.

If the authorized QoS flow descriptions of the PDU session is modified or is marked as to be synchronised with the UE, the SMF shall set the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message to the authorized QoS flow descriptions of the PDU session.

If SMF creates a new authorized QoS rule for a new QoS flow, then SMF shall include the authorized QoS flow description for that QoS flow in the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message, if:

a) the newly created authorized QoS rules is for a new GBR QoS flow;

b) the QFI of the new QoS flow is not the same as the 5QI of the QoS flow identified by the QFI;

c) the new QoS flow can be mapped to an EPS bearer as specified in subclause 4.11.1 of 3GPP TS 23.502 [9]; or

d) the new QoS flow is established for the PDU session used for relaying, as specified in subclause 5.6.2.1 of 3GPP TS 23.304 [6E].

NOTE 0: In cases other than above listed cases, it is up to the SMF implementation to include the authorized QoS flow description of the new QoS flow for the new authorized QoS rule in the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message.

If the session-AMBR of the PDU session is modified, the SMF shall set the selected Session-AMBR IE of the PDU SESSION MODIFICATION COMMAND message to the session-AMBR of the PDU session.

If interworking with EPS is supported for the PDU session and if the mapped EPS bearer contexts of the PDU session is modified, the SMF shall set the Mapped EPS bearer contexts IE of the PDU SESSION MODIFICATION COMMAND message to the mapped EPS bearer contexts of the PDU session. If the association between a QoS flow and the mapped EPS bearer context is changed, the SMF shall set the EPS bearer identity parameter in Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message to the new EPS bearer identity associated with the QoS flow.

If the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure and the PDU SESSION MODIFICATION REQUEST message includes a 5GSM capability IE, the SMF shall:

a) if the RQoS bit is set to:

1) "Reflective QoS supported", consider that the UE supports reflective QoS for this PDU session; or

2) "Reflective QoS not supported", consider that the UE does not support reflective QoS for this PDU session; and;

b) if the MH6-PDU bit is set to:

1) "Multi-homed IPv6 PDU session supported", consider that this PDU session is supported to use multiple IPv6 prefixes; or

2) "Multi-homed IPv6 PDU session not supported", consider that this PDU session is not supported to use multiple IPv6 prefixes.

If the SMF considers that reflective QoS is supported for QoS flows belonging to this PDU session, the SMF may include the RQ timer IE set to an RQ timer value in the PDU SESSION MODIFICATION COMMAND message.

If a port management information container needs to be delivered (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]) and the UE has set the TPMIC bit to "Transport of port management information container supported" in the 5GSM capability IE, the SMF shall include a Port management information container IE in the PDU SESSION MODIFICATION COMMAND message.

For a PDN connection established when in S1 mode, upon the first inter-system change from S1 mode to N1 mode, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the PDU session type is "IPv4", "IPv6", "IPv4v6" or "Ethernet" and the PDU SESSION MODIFICATION REQUEST message includes a Maximum number of supported packet filters IE, the SMF shall consider this number as the maximum number of packet filters that can be supported by the UE for this PDU session. Otherwise the SMF considers that the UE supports 16 packet filters for this PDU session.

For a PDN connection established when in S1 mode, upon the first inter-system change from S1 mode to N1 mode, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the SMF shall consider that the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink and the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink are valid for the lifetime of the PDU session.

For a PDN connection established when in S1 mode, upon the first inter-system change from S1 mode to N1 mode, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure and the SMF determines, based on local policies or configurations in the SMF and the Always-on PDU session requested IE in the PDU SESSION MODIFICATION REQUEST message (if available), that either:

a) the requested PDU session needs to be an always-on PDU session, the SMF shall include the Always-on PDU session indication IE in the PDU SESSION MODIFICATION COMMAND message and shall set the value to "Always-on PDU session required"; or

b) the requested PDU session shall not be an always-on PDU session and:

1) if the UE included the Always-on PDU session requested IE, the SMF shall include the Always-on PDU session indication IE in the PDU SESSION MODIFICATION COMMAND message and shall set the value to "Always-on PDU session not allowed"; or

2) if the UE did not include the Always-on PDU session requested IE, the SMF shall not include the Always-on PDU session indication IE in the PDU SESSION MODIFICATION COMMAND message.

For a PDN connection established when in S1 mode, upon the first inter-system change from S1 mode to N1 mode, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the UE supports EDC and the network allows the use of EDC, then the SMF shall include the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message with the EDC usage allowed indicator.

For a PDN connection established when in S1 mode, upon the first inter-system change from S1 mode to N1 mode, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the UE supports EDC and the network requires the use of EDC, then the SMF shall include the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message with the EDC usage required indicator.

If a QoS flow for URLLC is created in a PDU session and the SMF has not provided the Always-on PDU session indication IE with the value set to "Always-on PDU session required" in the UE-requested PDU session establishment procedure or a network-requested PDU session modification procedure for the PDU session, the SMF shall include the Always-on PDU session indication IE in the PDU SESSION MODIFICATION COMMAND message and shall set the value to "Always-on PDU session required".

If the value of the RQ timer is set to "deactivated" or has a value of zero, the UE considers that RQoS is not applied for this PDU session and remove the derived QoS rule(s) associated with the PDU session, if any.

If the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the SMF shall set the PTI IE of the PDU SESSION MODIFICATION COMMAND message to the PTI of the PDU SESSION MODIFICATION REQUEST message received as part of the UE-requested PDU session modification procedure.

If the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure and the UE has included the Requested MBS container IE in the PDU SESSION MODIFICATION REQUEST message with the MBS operation set to "Join multicast MBS session", the SMF:

a) shall include the TMGI for the multicast MBS session IDs that the UE is allowed to join, if any, in the Received MBS container IE, shall set the MBS decision to "MBS join is accepted" for each of those Received MBS information, may include the MBS start time to indicate the time when the multicast MBS session starts, and shall include the MBS security container in each of those Received MBS information if security protection is applied for that multicast MBS session and the control plane security procedure is used as specified in annex W.4.1.2 in 3GPP TS 33.501 [24], and shall use separate QoS flows dedicated for multicast by including the Authorized QoS flow descriptions IE if no separate QoS flows dedicated for multicast exist or if the SMF wants to establish new QoS flows dedicated for multicast;

NOTE 1: The network determines whether security protection applies or not for the multicast MBS session as specified in 3GPP TS 33.501 [24].

b) shall include the TMGI for multicast MBS session IDs that the UE is rejected to join, if any, in the Received MBS container IE, shall set the MBS decision to "MBS join is rejected" for each of those Received MBS information, shall set the Rejection cause for each of those Received MBS information with the reason of rejection and, if the Rejection cause is set to "multicast MBS session has not started or will not start soon", may include an MBS back-off timer value; and

c) may include in the Received MBS container IE the MBS service area for each multicast MBS session and include in it the MBS TAI list, the NR CGI list or both, that identify the service area(s) for the local MBS service;

NOTE 2: For an multicast MBS session that has multiple MBS service areas, the MBS service areas are indicated to the UE using MBS service announcement as described in 3GPP TS 23.247 [53], which is out of scope of this specification.

in the PDU SESSION MODIFICATION COMMAND message. If the UE has set the Type of multicast MBS session ID to "Source specific IP multicast address" in the Requested MBS container IE for certain multicast MBS session(s) in the PDU SESSION MODIFICATION REQUEST message, the SMF shall include the Source IP address information and Destination IP address information in the Received MBS information together with the TMGI for each of those multicast MBS sessions.

NOTE 3: Including the Source IP address information and Destination IP address information in the Received MBS information in that case is to allow the UE to perform the mapping between the requested multicast MBS session ID and the provided TMGI.

NOTE 4: In SNPN, TMGI is used together with NID to identify an MBS Session.

If:

a) the SMF wants to remove joined UE from one or more multicast MBS sessions; or

b) the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure and the UE has included the Requested MBS container IE in the PDU SESSION MODIFICATION REQUEST message with the MBS operation set to "Leave multicast MBS session",

the SMF shall include the multicast MBS session IDs that the UE is removed from, if any, in the Received MBS container IE in the PDU SESSION MODIFICATION COMMAND message and shall set the MBS decision to "Remove UE from multicast MBS session" for each of those Received MBS information. The SMF may include the updated MBS service area in each of the Received MBS information, if any. The SMF may delete the QoS flows associated for the multicast by including the Authorized QoS flow descriptions IE in the PDU SESSION MODIFICATION COMMAND message. If the UE is removed from multicast MBS session due to the MBS session release, the SMF shall set the Rejection cause to "multicast MBS session is released". The SMF shall include the Rejection cause for each of the Received MBS information, if any, and set its value with the reason of removing the UE from the corresponding multicast MBS session.

NOTE 5: based on operator’s policy, e.g. after a locally configured time period, the SMF is allowed to trigger the removal of joined UE from an multicast MBS session when the UE moves outside all the MBS service area(s) of that multicast MBS session.

If the SMF wants to update the MBS security information of an multicast MBS session that the UE has joined, the SMF shall include the corresponding multicast MBS session ID and the MBS security container in the Received MBS container IE in the PDU SESSION MODIFICATION COMMAND message, and shall set the MBS Decision to "MBS security information update" in the Received MBS information.

If the SMF wants to update the MBS service area of an multicast MBS session that the UE has joined, the SMF shall include the corresponding multicast MBS session ID and the updated MBS service area in the Received MBS container IE in the PDU SESSION MODIFICATION COMMAND message, and shall set the MBS decision to "MBS service area update" in the Received MBS information.

NOTE 6: The MBS service area of an multicast MBS session is also allowed to be updated to the UE using the MBS service announcement as described in 3GPP TS 23.247 [53], which is out of scope of this specification.

If the network needs to update ATSSS parameters (see subclause 5.2.4 of 3GPP TS 24.193 [13B]), the SMF shall include the ATSSS container IE with the updates of ATSSS parameters in the PDU SESSION MODIFICATION COMMAND message.

If the network-requested PDU session modification procedure is not triggered by a UE-requested PDU session modification procedure, the SMF shall set the PTI IE of the PDU SESSION MODIFICATION COMMAND message to "No procedure transaction identity assigned".

If the selected SSC mode of the PDU session is "SSC mode 3" and the SMF requests the relocation of SSC mode 3 PDU session anchor with multiple PDU sessions as specified in 3GPP TS 23.502 [9], the SMF shall include 5GSM cause #39 "reactivation requested" , in the PDU SESSION MODIFICATION COMMAND message, and may include the PDU session address lifetime in a PDU session address lifetime parameter in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message.

The SMF shall send the PDU SESSION MODIFICATION COMMAND message, and the SMF shall start timer T3591 (see example in figure 6.3.2.2.1).

NOTE 7: If the SMF requests the relocation of SSC mode 3 PDU session anchor with multiple PDU sessions as specified in 3GPP TS 23.502 [9], the reallocation requested indication indicating whether the SMF is to be reallocated or the SMF is to be reused is provided to the AMF.

If the control plane CIoT 5GS optimization is enabled for a PDU session and the IP header compression configuration IE was included in the PDU SESSION ESTABLISHMENT REQUEST message or the PDU SESSION MODIFICATION REQUEST message, and the SMF supports control plane CIoT 5GS optimization and IP header compression for control plane CIoT 5GS optimization, the SMF may include the IP header compression configuration IE in the PDU SESSION MODIFICATION COMMAND message to re-negotiate IP header compression configuration associated to the PDU session.

If the control plane CIoT 5GS optimization is enabled for a PDU session and the Ethernet header compression configuration IE was included in the PDU SESSION ESTABLISHMENT REQUEST message or the PDU SESSION MODIFICATION REQUEST message, and the SMF supports control plane CIoT 5GS optimization and Ethernet header compression for control plane CIoT 5GS optimization, the SMF may include the Ethernet header compression configuration IE in the PDU SESSION MODIFICATION COMMAND message to re-configure Ethernet header compression configuration associated with the PDU session.

If the network-requested PDU session modification procedure is associated with C2 authorization procedure, the SMF shall send the PDU SESSION MODIFICATION COMMAND message by including the Service-level-AA container IE containing:

a) the service-level-AA response with the value of C2AR field set to the "C2 authorization was successful";

b) if a payload is provided from the UAS-NF, the service-level-AA payload with the value set to the payload; and

c) if a payload type associated with the payload is provided from the UAS-NF, the service-level-AA payload type with the value set to the payload type; and

d) if the CAA-level UAV ID is provided from the UAS-NF, the service-level device ID set to the CAA-level UAV ID.

NOTE 8: The C2 authorization payload in the service-level-AA payload can include one or both of the C2 session security information and C2 pairing information.

If the service-level-AA procedure is triggered for the established PDU session for UAS services with re-authentication purpose, and the SMF is provided by the UAS-NF with the successful UUAA-SM result, the SMF shall transmit a PDU SESSION MODIFICATION COMMAND message to the UE, where the PDU SESSION MODIFICATION COMMAND message shall include the Service-level-AA container IE containing:

a) the service-level-AA response with the value of SLAR field set to "Service level authentication and authorization was successful";

b) if received the CAA-level UAV ID from the UAS-NF, the service-level device ID with the value set to the CAA-level UAV ID;

c) if received a payload from the UAS-NF, the service-level-AA payload with the value set to the payload; and

d) if received a payload type associated with the payload, the service-level-AA payload type with the value set to the payload type.

If the SMF needs to provide new ECS configuration information to the UE and the UE has indicated support for ECS configuration information provisioning in the PDU SESSION ESTABLISHMENT REQUEST message or while in S1 mode, then the SMF may include the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message with:

– at least one of ECS IPv4 Address(es), ECS IPv6 Address(es), ECS FQDN(s);

– at least one associated ECSP identifier;and

– optionally, spatial validity conditions associated with the ECS address;

NOTE 9: The IP address(es) and/or FQDN(s) are associated with the ECSP identifier and replace previously provided ECS configuration information associated with the same ECSP identifier, if any.

If the SMF needs to provide DNS server address(es) to the UE and the UE has provided the DNS server IPv4 address request, the DNS server IPv6 address request or both of them, in the PDU SESSION ESTABLISHMENT REQUEST message or a PDU SESSION MODIFICATION REQUEST message, then the SMF shall include the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message with one or more DNS server IPv4 address(es), one or more DNS server IPv6 address(es) or both of them.

If the SMF needs to trigger EAS rediscovery and the UE has indicated support of the EAS rediscovery in the PDU SESSION ESTABLISHMENT REQUEST message or the PDU SESSION MODIFICATION REQUEST message, then the SMF shall include the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message:

a) with the EAS rediscovery indication without indicated impact; or

b) with the following:

1) one or more EAS rediscovery indication(s) with impacted EAS IPv4 address range, if the UE supports EAS rediscovery indication(s) with impacted EAS IPv4 address range;

2) one or more EAS rediscovery indication(s) with impacted EAS IPv6 address range, if the UE supports EAS rediscovery indication(s) with impacted EAS IPv6 address range;

3) one or more EAS rediscovery indication(s) with impacted EAS FQDN, if the UE supports EAS rediscovery indication(s) with impacted EAS FQDN; or

4) any combination of the above.

When UE has requested P-CSCF IPv6 address or P-CSCF IPv4 address and the SMF has provided P-CSCF address(es) during the PDU session establishment procedure, if the network-requested PDU session modification procedure is triggered for P-CSCF restoration, the SMF shall include the P-CSCF IP address(es) in the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message as specified in subclause 5.8.2.2 of 3GPP TS 23.380 [54].

Figure 6.3.2.2.1: Network-requested PDU session modification procedure

6.3.2.3 Network-requested PDU session modification procedure accepted by the UE

Upon receipt of the PDU SESSION MODIFICATION COMMAND message, if the UE provided a DNN during the PDU session establishment, the UE shall stop timer T3396, if it is running for the DNN provided by the UE. If the UE did not provide a DNN during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3396 associated with no DNN if it is running. If the PDU SESSION MODIFICATION COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3396 associated with no DNN if it is running.

Upon receipt of the PDU SESSION MODIFICATION COMMAND message, if the UE provided an S-NSSAI and a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the [S-NSSAI of the PDU session, DNN] combination provided by the UE. If the UE provided a DNN and did not provide an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, DNN] combination provided by the UE. If the UE provided an S-NSSAI and did not provide a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [S-NSSAI, no DNN] combination provided by the UE. If the UE provided neither a DNN nor an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, no DNN] combination provided by the UE. The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running.

Upon receipt of the PDU SESSION MODIFICATION COMMAND message, if the UE provided an S-NSSAI during the PDU session establishment, the UE shall stop timer T3585, if it is running for the S-NSSAI of the PDU session. If the UE did not provide an S-NSSAI during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION MODIFICATION COMMAND is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION MODIFICATION COMMAND is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running;

If the PDU SESSION MODIFICATION COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3585 associated with no S-NSSAI if it is running.

NOTE 1: Upon receipt of the PDU SESSION MODIFICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3396 associated with the DNN (or no DNN, if no DNN was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3396 and the timer T3584.

NOTE 2: Upon receipt of the PDU SESSION MODIFICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3585 associated with the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3585 and the timer T3584.

If the PDU SESSION MODIFICATION COMMAND message includes the Authorized QoS rules IE, the UE shall process the QoS rules sequentially starting with the first QoS rule.

If the PDU SESSION MODIFICATION COMMAND message includes the Mapped EPS bearer contexts IE, the UE shall process the mapped EPS bearer contexts sequentially starting with the first mapped EPS bearer context.

If the PDU SESSION MODIFICATION COMMAND message includes the Authorized QoS flow descriptions IE, the UE shall process the QoS flow descriptions sequentially starting with the first QoS flow description.

The UE shall replace the stored authorized QoS rules, authorized QoS flow descriptions and session-AMBR of the PDU session with the received value(s), if any, in the PDU SESSION MODIFICATION COMMAND message.

If the PDU SESSION MODIFICATION COMMAND message includes a Mapped EPS bearer contexts IE, the UE shall check each mapped EPS bearer context for different types of errors as follows:

NOTE 3: An error detected in a mapped EPS bearer context does not cause the UE to discard the Authorized QoS rules IE and Authorized QoS flow descriptions IE included in the PDU SESSION MODICATION COMMAND message, if any.

a) Semantic error in the mapped EPS bearer operation:

1) operation code = "Create new EPS bearer" and there is already an existing mapped EPS bearer context with the same EPS bearer identity associated with any PDU session.

2) operation code = "Delete existing EPS bearer" and there is no existing mapped EPS bearer context with the same EPS bearer identity associated with the PDU session that is being modified.

3) operation code = "Modify existing EPS bearer" and there is no existing mapped EPS bearer context with the same EPS bearer identity associated with the PDU session that is being modified.

4) operation code = "Create new EPS bearer" or "Modify existing EPS bearer" and the resulting mapped EPS bearer context has invalid mandatory parameters or missing mandatory parameters (e.g., mapped EPS QoS parameters or traffic flow template for a dedicated EPS bearer context).

In case 1, if the existing mapped EPS bearer context is associated with the PDU session that is being modified, the UE shall not diagnose an error, further process the create request and, if it was process successfully, delete the old EPS bearer context.

In case 2, the UE shall not diagnose an error, further process the delete request and, if it was processed successfully, consider the mapped EPS bearer context as successfully deleted.

Otherwise, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

b) if the mapped EPS bearer context includes a traffic flow template, the UE shall check the traffic flow template for different types of TFT IE errors as follows:

1) Semantic errors in TFT operations:

i) TFT operation = "Create new TFT" when there is already an existing TFT for the EPS bearer context.

ii) When the TFT operation is an operation other than "Create a new TFT" and there is no TFT for the EPS bearer context.

iii) TFT operation = "Delete packet filters from existing TFT" when it would render the TFT empty.

iv) TFT operation = "Delete existing TFT" for a dedicated EPS bearer context.

In case iv, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #41 "semantic error in the TFT operation".

In the other cases the UE shall not diagnose an error and perform the following actions to resolve the inconsistency:

In case i, the UE shall further process the new activation request to create a new TFT and, if it was processed successfully, delete the old TFT.

In case ii, the UE shall:

– process the new request and if the TFT operation is "Delete existing TFT" or "Delete packet filters from existing TFT", and if no error according to items 2, 3, and 4 was detected, consider the TFT as successfully deleted;

– process the new request as an activation request, if the TFT operation is "Add packet filters in existing TFT" or "Replace packet filters in existing TFT".

In case iii, if the packet filters belong to a dedicated EPS bearer context, the UE shall process the new deletion request and, if no error according to items 2, 3, and 4 was detected, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #41 "semantic error in the TFT operation".

In case iii, if the packet filters belong to the default EPS bearer context, the UE shall process the new deletion request and if no error according to items 2, 3, and 4 was detected then delete the existing TFT, this corresponds to using match-all packet filter for the default EPS bearer context.

2) Syntactical errors in TFT operations:

i) When the TFT operation = "Create new TFT", "Add packet filters in existing TFT", "Replace packet filters in existing TFT" or "Delete packet filters from existing TFT" and the packet filter list in the TFT IE is empty.

ii) TFT operation = "Delete existing TFT" or "No TFT operation" with a non-empty packet filter list in the TFT IE.

iii) TFT operation = "Replace packet filters in existing TFT" when the packet filter to be replaced does not exist in the original TFT.

iv) TFT operation = "Delete packet filters from existing TFT" when the packet filter to be deleted does not exist in the original TFT.

v) Void.

vi) When there are other types of syntactical errors in the coding of the TFT IE, such as a mismatch between the number of packet filters subfield, and the number of packet filters in the packet filter list.

In case iii, the UE shall not diagnose an error, further process the replace request and, if no error according to items 3 and 4 was detected, include the packet filters received to the existing TFT.

In case iv, the UE shall not diagnose an error, further process the deletion request and, if no error according to items 3 and 4 was detected, consider the respective packet filter as successfully deleted.

3) Semantic errors in packet filters:

i) When a packet filter consists of conflicting packet filter components which would render the packet filter ineffective, i.e. no IP packet will ever fit this packet filter. How the UE determines a semantic error in a packet filter is outside the scope of the present document.

ii) When the resulting TFT, which is assigned to a dedicated EPS bearer context, does not contain any packet filter applicable for the uplink direction among the packet filters created on request from the network.

After sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #44 "semantic errors in packet filter(s)".

4) Syntactical errors in packet filters:

i) When the TFT operation = "Create new TFT", "Add packet filters to existing TFT", or "Replace packet filters in existing TFT" and two or more packet filters in the resultant TFT would have identical packet filter identifiers.

ii) When the TFT operation = "Create new TFT", "Add packet filters to existing TFT" or "Replace packet filters in existing TFT", and two or more packet filters among all TFTs associated with this PDN connection would have identical packet filter precedence values.

iii) When there are other types of syntactical errors in the coding of packet filters, such as the use of a reserved value for a packet filter component identifier.

In case i, if two or more packet filters with identical packet filter identifiers are contained in the new request, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #45 "syntactical error in packet filter(s)". Otherwise, the UE shall not diagnose an error, further process the new request and, if it was processed successfully, delete the old packet filters which have the identical packet filter identifiers.

In case ii, if the old packet filters do not belong to the default EPS bearer context, the UE shall not diagnose an error, shall further process the new request and, if it was processed successfully, shall delete the old packet filters which have identical filter precedence values.

In case ii, if one or more old packet filters belong to the default EPS bearer context, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #45 "syntactical errors in packet filter(s)".

And if a new EPS bearer identity parameter in Authorized QoS flow descriptions IE is received for a QoS flow which can be transferred to EPS, the UE shall update the association between the QoS flow and the mapped EPS bearer context, based on the new EPS bearer identity and the mapped EPS bearer contexts. If the "Delete existing EPS bearer" operation code in the Mapped EPS bearer contexts IE was received, the UE shall discard the association between the QoS flow and the corresponding mapped EPS bearer context.

If:

a) the UE detects different errors in the mapped EPS bearer contexts as described above which requires sending a PDU SESSION MODIFICATION REQUEST message to delete the erroneous mapped EPS bearer contexts; and

b) optionally, if the UE detects errors in QoS rules that require to delete at least one QoS rule as described in subclause 6.3.2.4 which requires sending a PDU SESSION MODIFICATION REQUEST message to delete the erroneous QoS rules;

the UE, after sending the PDU SESSION MODIFICATION COMPLETE message for the ongoing PDU session modification procedure, may send a single PDU SESSION MODIFICATION REQUEST message to delete the erroneous mapped EPS bearer contexts, and optionally to delete the erroneous QoS rules. The UE shall include a 5GSM cause IE in the PDU SESSION MODIFICATION REQUEST message.

NOTE 4: The 5GSM cause to use cannot be different from #41 "semantic error in the TFT operation", #42 "syntactical error in the TFT operation", #44 "semantic error in packet filter(s)", #45 "syntactical errors in packet filter(s)", #83 "semantic error in the QoS operation", #84 "syntactical error in the QoS operation", or #85 "Invalid mapped EPS bearer identity". The selection of a 5GSM cause is up to UE implementation.

Upon receipt of a PDU SESSION MODIFICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, if the UE accepts the PDU SESSION MODIFICATION COMMAND message, the UE considers the PDU session as modified and the UE shall create a PDU SESSION MODIFICATION COMPLETE message.

If the PDU SESSION MODIFICATION COMMAND message contains the PTI value allocated in the UE-requested PDU session modification procedure, the UE shall stop the timer T3581. The UE should ensure that the PTI value assigned to this procedure is not released immediately.

NOTE 5: The way to achieve this is implementation dependent. For example, the UE can ensure that the PTI value assigned to this procedure is not released during the time equal to or greater than the default value of timer T3591.

While the PTI value is not released, the UE regards any received PDU SESSION MODIFICATION COMMAND message with the same PTI value as a network retransmission (see subclause 7.3.1).

If the selected SSC mode of the PDU session is "SSC mode 3" and the PDU SESSION MODIFICATION COMMAND message includes 5GSM cause #39 "reactivation requested", the UE can provide to the upper layers the PDU session address lifetime if received in the PDU session address lifetime parameter of the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message. After the completion of the network-requested PDU session modification procedure:

a) if the PDU session is an MA PDU session:

1) established over both 3GPP access and non-3GPP access, and:

– the UE is registered over both 3GPP access and non-3GPP access in the same PLMN:

– the UE should re-initiate a UE-requested PDU session establishment procedure as specified in subclause 6.4.1 over the access the PDU SESSION MODIFICATION COMMAND message is received; or

– the UE is registered over both 3GPP access and non-3GPP access in different PLMNs:

– the UE should re-initiate UE-requested PDU session establishment procedures as specified in subclause 6.4.1 over both accesses. The UE should re-initiate the UE-requested PDU session establishment procedure over the access the PDU SESSION MODIFICATION COMMAND message is received first; or

2) established over only single access:

– the UE should re-initiate a UE-requested PDU session establishment procedure as specified in subclause 6.4.1 over the access the user plane resources were established; or

b) if the PDU session is a single access PDU session:

– the UE should re-initiate a UE-requested PDU session establishment procedure as specified in subclause 6.4.1 over the access the PDU session was associated with; and

for the re-initiated UE-requested PDU session establishment procedure(s) the UE should set a new PDU session ID different from the PDU session ID associated with the present PDU session and should set:

a) the PDU session type to the PDU session type associated with the present PDU session;

b) the SSC mode to the SSC mode associated with the present PDU session;

c) the DNN to the DNN associated with the present PDU session; and

d) the S-NSSAI to the S-NSSAI associated with (if available in roaming scenarios) a mapped S-NSSAI if provided in the UE-requested PDU session establishment procedure of the present PDU session.

If the UE has indicated support for CIoT 5GS optimizations and receives a small data rate control parameters container in the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message, the UE shall store the small data rate control parameters value and use the stored small data rate control parameters value as the maximum allowed limit of uplink user data for the PDU session in accordance with 3GPP TS 23.501 [8]. If the UE has a previously stored small data rate control parameter value for the PDU session, the UE shall replace the stored small data rate control parameters value for the PDU session with the received small data rate control parameters value in the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message.

If the UE has indicated support for CIoT 5GS optimizations and receives an additional small data rate control parameters for exception data container in the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message, the UE shall store the additional small data rate control parameters for exception data value and use the stored additional small data rate control parameters for exception data value as the maximum allowed limit of uplink exception data for the PDU session in accordance with 3GPP TS 23.501 [8]. If the UE has a previously stored additional small data rate control parameters for exception data value for the PDU session, the UE shall replace the stored additional small data rate control parameters for exception data value for the PDU session with the received additional small data rate control parameters for exception data value in the Extended protocol configuration options IE in the PDU SESSION MODIFICATION COMMAND message.

The UE shall include the PDU session ID of the old PDU session which is about to get released in the old PDU session ID IE of the UL NAS TRANSPORT message that transports the PDU SESSION ESTABLISHMENT REQUEST message.

NOTE 6: The UE is expected to maintain the PDU session for which the PDU SESSION MODIFICATION COMMAND message including 5GSM cause #39 "reactivation requested" is received during the time indicated by the PDU session address lifetime value or until receiving an indication from upper layers (e.g. that the old PDU session is no more needed).

If the selected PDU session type of the PDU session is "Unstructured", the UE supports inter-system change from N1 mode to S1 mode, the UE does not support establishment of a PDN connection for the PDN type set to "non-IP" in S1 mode, and the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message contains an EPS bearer identity (EBI), then the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions. After sending the PDU SESSION MODIFICATION COMPLETE message for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

If the selected PDU session type of the PDU session is "Ethernet", the UE supports inter-system change from N1 mode to S1 mode, the UE does not support establishment of a PDN connection for the PDN type set to "non-IP" in S1 mode, the UE, the network or both of them do not support Ethernet PDN type in S1 mode, and the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message contains an EPS bearer identity (EBI), the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions. After sending the PDU SESSION MODIFICATION COMPLETE message for the ongoing PDU session modification procedure, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

For a UE which is registered for disaster roaming services and for a PDU session which is not a PDU session for emergency services:

a) if the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION MODIFICATION COMMAND message contains an EPS bearer identity (EBI), then the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions; and

b) the UE shall locally delete the contents of the Mapped EPS bearer contexts IE if it is received in the PDU SESSION MODIFICATION COMMAND message.

If the Always-on PDU session indication IE is included in the PDU SESSION MODIFICATION COMMAND message and:

a) the value of the IE is set to "Always-on PDU session required", the UE shall consider the established PDU session as an always-on PDU session; or

b) the value of the IE is set to "Always-on PDU session not allowed", the UE shall not consider the established PDU session as an always-on PDU session.

If the UE does not receive the Always-on PDU session indication IE in the PDU SESSION MODIFICATION COMMAND message:

a) if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure upon an inter-system change from S1 mode to N1 mode for a PDN connection established when in S1 mode, the UE shall not consider the modified PDU session as an always-on PDU session; or

b) otherwise:

1) if the UE has received the Always-on PDU session indication IE with the value set to "Always-on PDU session required" for this PDU session, the UE shall consider the PDU session as an always-on PDU session; or

2) otherwise the UE shall not consider the PDU session as an always-on PDU session.

If the PDU SESSION MODIFICATION COMMAND message contains a Port management information container IE, the UE shall forward the contents of the Port management information container IE to the DS-TT (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]).

If the UE receives a Serving PLMN rate control IE in the PDU SESSION MODIFICATION COMMAND message, the UE shall store the Serving PLMN rate control IE value, replacing any existing value, and use the stored serving PLMN rate control value as the maximum allowed limit of uplink control plane user data for the corresponding PDU session in accordance with 3GPP TS 23.501 [8].

If the PDU SESSION MODIFICATION COMMAND message includes the Received MBS container IE, for each of the Received MBS informations:

a) if MBS decision is set to "MBS join is accepted", the UE shall consider that it has successfully joined the multicast MBS session. The UE shall store the received TMGI and shall use it for any further operation on that multicast MBS session. The UE shall store the received MBS service area associated with the received TMGI, if any, and provide the received TMGI to lower layers. The UE may provide the MBS start time if it is included in the Received MBS information to upper layers;

b) if MBS decision is set to "MBS join is rejected", the UE shall consider the requested join as rejected. The UE shall store the received MBS service area associated with the received TMGI, if any. If the received Rejection cause is set to "User is outside of local MBS service area", the UE shall not request to join the same multicast MBS session if neither current TAI nor CGI of the current cell is part of the received MBS service area. If the received Rejection cause is set to "multicast MBS session has not started or will not start soon" and an MBS back-off timer value is included with value that indicates neither zero nor deactivated, the UE shall start a back-off timer T3530 with the value provided in the MBS back-off timer value for the received TMGI, and shall not attempt to join the multicast MBS session with the same TMGI, the Source IP address information of the TMGI, or the Destination IP address information of the TMGI until the expiry of T3530. If the MBS back-off timer value indicates that this timer is deactivated, the UE shall not attempt to join the multicast MBS session with the same TMGI until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated. If the MBS back-off timer value indicates zero, the UE may attempt to join the MBS session with the same TMGI;

c) if the MBS decision is set to "Remove UE from multicast MBS session", the UE shall consider that it has successfully left the multicast MBS session, and if the received Rejection cause is set to "multicast MBS session is released", the UE shall consider the multicast MBS session as released. Then the UE shall indicate to lower layers to delete the stored TMGI;

d) if the MBS decision is set to "MBS service area update", the UE shall store the received MBS service area associated with the received TMGI and replace the current MBS service area with the received one. or

e) if the MBS decision is set to "MBS security information update", the UE shall replace the current MBS security information with the MBS security information received in the MBS security container associated with the received TMGI.

If the UE has indicated support for ECS configuration information provisioning in the SESSION ESTABLISHMENT REQUEST message or while in S1 mode, then upon receiving

– one or more ECS IPv4 address(es), ECS IPv6 address(es), ECS FQDN(s);

– one or more associated ECSP identifier(s);and

– optionally spatial validity conditions associated with the ECS address

in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message, then the UE shall pass them to the upper layers..

If the UE supports receiving DNS server addresses in protocol configuration options and receives one or more DNS server IPv4 address(es), one or more DNS server IPv6 address(es) or both of them, in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message, then the UE shall pass the received DNS server IPv4 address(es), if any, and the received DNS server IPv6 address(es), if any, to upper layers.

NOTE 7: The received DNS server address(es) replace previously provided DNS server address(es), if any.

If the UE supports the EAS rediscovery and receives:

a) the EAS rediscovery indication without indicated impact; or

b) the following:

1) one or more EAS rediscovery indication(s) with impacted EAS IPv4 address range, if supported by the UE;

2) one or more EAS rediscovery indication(s) with impacted EAS IPv6 address range, if supported by the UE;

3) one or more EAS rediscovery indication(s) with impacted EAS FQDN, if supported by the UE; or

4) any combination of the above;

in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message, then the UE shall pass the EAS rediscovery indication and the received impacted EAS IPv4 address range(s), if supported and included, the received EAS IPv6 address range(s), if supported and included, and the received EAS FQDN(s), if supported and included, to upper layers.

NOTE 8: The upper layers handle the EAS rediscovery indication and the impacted EAS IPv4 address range(s), if any, the impacted EAS IPv6 address range(s), if any, and the received EAS FQDN(s), if any, according to 3GPP TS 23.548 [10A].

Upon receipt of PDU SESSION MODIFICATION COMMAND message, if the network-requested PDU session modification procedure is triggered by a UE-requested PDU session modification procedure, the Service-level-AA container IE is included, then the UE shall forward the service-level-AA contents of the Service-level-AA container IE to the upper layers.

If the UE supports EDC and receives the EDC usage allowed indicator in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message, the UE shall indicate to upper layers that network allows the use of EDC.

If the UE supports EDC and receives the EDC usage required indicator in the Extended protocol configuration options IE of the PDU SESSION MODIFICATION COMMAND message, the UE shall indicate to upper layers that network requires the use of EDC.

NOTE 9: Handling of indication that network allows the use of EDC or that network requires the use of EDC is specified in 3GPP TS 23.548 [182].

The UE shall transport the PDU SESSION MODIFICATION COMPLETE message and the PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5.

After sending the PDU SESSION MODIFICATION COMPLETE message, if the "Create new EPS bearer" operation code in the Mapped EPS bearer contexts IE was received in the PDU SESSION MODIFICATION COMMAND message and there is neither a corresponding Authorized QoS flow descriptions IE in the PDU SESSION MODIFICATION COMMAND message nor an existing QoS flow description corresponding to the EPS bearer identity included in the mapped EPS bearer context, the UE shall send a PDU SESSION MODIFICATION REQUEST message including a Mapped EPS bearer contexts IE to delete the mapped EPS bearer context.

After sending the PDU SESSION MODIFICATION COMPLETE message, if for the PDU session being modified, there are mapped EPS bearer context(s) but none of them is associated with the default QoS rule, the UE shall locally delete the mapped EPS bearer context(s) and shall locally delete the stored EPS bearer identity (EBI) in all the QoS flow descriptions of the PDU session, if any.

If a port management information container needs to be delivered (see 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9]), the UE shall include a Port management information container IE in the PDU SESSION MODIFICATION COMPLETE message.

Upon receipt of a PDU SESSION MODIFICATION COMPLETE message, the SMF shall stop timer T3591 and shall consider the PDU session as modified. If the selected SSC mode of the PDU session is "SSC mode 3" and the PDU SESSION MODIFICATION COMMAND message included 5GSM cause #39 "reactivation requested", the SMF shall start timer T3593. If the PDU Session Address Lifetime value is sent to the UE in the PDU SESSION MODIFICATION COMMAND message then timer T3593 shall be started with the same value, otherwise it shall use a default value. If the PDU SESSION MODIFICATION COMPLETE message contains a Port management information container IE, the SMF shall handle the contents of the Port management information container IE as specified in 3GPP TS 23.501 [8] and 3GPP TS 23.502 [9].

6.3.2.4 Network-requested PDU session modification procedure not accepted by the UE

Upon receipt of a PDU SESSION MODIFICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, if the UE rejects the PDU SESSION MODIFICATION COMMAND message, the UE shall create a PDU SESSION MODIFICATION COMMAND REJECT message.

NOTE 1: The way to achieve this is implementation dependent. For example, the UE can ensure that the PTI value assigned to this procedure is not released during the time equal to or greater than the default value of timer T3591.

While the PTI value is not released, the UE regards any received PDU SESSION MODIFICATION COMMAND message with the same PTI value as a network retransmission (see subclause 7.3.1).

The UE shall set the 5GSM cause IE of the PDU SESSION MODIFICATION COMMAND REJECT message to indicate the reason for rejecting the PDU session modification.

The 5GSM cause IE typically indicates one of the following 5GSM cause values:

#26 insufficient resources;

#44 semantic error in packet filter(s);

#45 syntactical error in packet filter(s);

#83 semantic error in the QoS operation; or

#84 syntactical error in the QoS operation.

If the selected SSC mode of the PDU session is "SSC mode 3" and the PDU SESSION MODIFICATION COMMAND messages includes 5GSM cause #39 "reactivation requested", while the UE does not have sufficient resources for initiating the PDU session establishment procedure as specified in subclause 6.4.1 then the UE shall set cause IE to #26 "insufficient resources".

If the PDU SESSION MODIFICATION COMMAND message includes a request to add a new authorized QoS rule, or a request to modify the authorized QoS rules, or both, and the UE decides to reject the request due to e.g. the supported number of authorized QoS rules or number of packet filters associated with a PDU session having reached the maximum number, then the UE shall set the 5GSM cause IE to #26 "insufficient resources".

NOTE 2: The maximum number of supported authorized QoS rules or packet filters associated with a PDU session is implementation specific.

If the PDU SESSION MODIFICATION COMMAND message includes a request to add a new authorized QoS flow description, or a request to modify the authorized QoS flow descriptions, or both and the UE decides to reject the request due to e.g. the supported number of authorized QoS flow descriptions, then the UE shall set the 5GSM cause IE to #26 "insufficient resources".

NOTE 3: The maximum number of supported authorized QoS flow descriptions associated with a PDU session is implementation specific.

If the PDU SESSION MODIFICATION COMMAND message includes the Authorized QoS rules IE, the UE shall process the QoS rules sequentially starting with the first QoS rule. The UE shall check the QoS rule and the QoS flow description provided in the PDU SESSION MODIFICATION COMMAND message for different types of errors as follows:

NOTE 4: If an error is detected in a QoS rule or a QoS flow description which requires rejecting the PDU SESSION MODIFICATION COMMAND message, then the Authorized QoS rules IE, the Authorized QoS flow descriptions IE, the Mapped EPS bearer contexts IE and any other IE (RQ timer value IE, Always-on PDU session indication IE, etc) included in the PDU SESSION MODIFICATION COMMAND message are discarded, if any.

a) Semantic errors in QoS operations:

1) When the rule operation is "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters", "Modify existing QoS rule and delete packet filters" or "Modify existing QoS rule without modifying packet filters" on the default QoS rule and the DQR bit is set to "the QoS rule is not the default QoS rule".

2) When the rule operation is "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters", "Modify existing QoS rule and delete packet filters" or "Modify existing QoS rule without modifying packet filters" on a QoS rule which is not the default QoS rule and the DQR bit is set to "the QoS rule is the default QoS rule".

3) When the rule operation is "Create new QoS rule" and the DQR bit is set to "the QoS rule is the default QoS rule" when there’s already a default QoS rule with different QoS rule identifier.

4) When the rule operation is "Delete existing QoS rule" on the default QoS rule.

5) When the rule operation is "Create new QoS rule", "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters", "Modify existing QoS rule and delete packet filters ", or "Modify existing QoS rule without modifying packet filters" and two or more QoS rules associated with this PDU session would have identical precedence values, and the UE is not in NB-N1 mode.

6) When the rule operation is "Modify existing QoS rule and delete packet filters", the QoS rule is a QoS rule of a PDU session of IPv4, IPv6, IPv4v6 or Ethernet PDU session type, and the packet filter list in the resultant QoS rule is empty.

7) When the rule operation is "Create new QoS rule", there is already an existing QoS rule with the same QoS rule identifier and the UE is not in NB-N1 mode.

8) When the rule operation is "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters", "Modify existing QoS rule and delete packet filters" or "Modify existing QoS rule without modifying packet filters", the associated QoS rule does not exist and the UE is not in NB-N1 mode.

9) When the rule operation is different than "Delete existing QoS rule", the DQR bit of the QoS rule is set to "the QoS rule is not the default QoS rule" and the UE is in NB-N1 mode.

10) When the rule operation is "Create new QoS rule", the DQR bit is set to "the QoS rule is not the default QoS rule", and the PDU session type of the PDU session is "Unstructured".

11) When the rule operation is "Delete existing QoS rule" and there is no existing QoS rule with the same QoS rule identifier.

12) When the flow description operation is "Create new QoS flow description", there is already an existing QoS flow description with the same QoS flow identifier and the UE is not in NB-N1 mode.

13) When the flow description operation is "Modify existing QoS flow description", the associated QoS flow description does not exist and the UE is not in NB-N1 mode.

14) When the flow description operation is "Delete existing QoS flow description" and there is no existing QoS flow description with the same QoS flow identifier.

15) When the flow description operation is different than "Delete existing QoS flow description", the QFI is not the same as the QFI of the default QoS rule and the UE is in NB-N1 mode.

16) When the flow description operation is "Create new QoS flow description" or "Modify existing QoS flow description", the QFI associated with the QoS flow description is not the same as the QFI of the default QoS rule, and the PDU session type of the PDU session is "Unstructured".

17) When the rule operation is "Modify existing QoS rule and add packet filters", the "packet filter list" field contains a match-all packet filter, the resultant QoS rule is the default QoS rule and there is already an existing match-all packet filter associated with the default QoS rule.

18) When the rule operation is "Create new QoS rule" and the DQR bit is set to "the QoS rule is not the default QoS rule", or the rule operation is "Modify existing QoS rule and add packet filters" on a QoS rule which is not the default QoS rule or "Modify existing QoS rule and replace all packet filters" on a QoS rule which is not the default QoS rule, and one match-all packet filter is to be associated with the resultant QoS rule.

In case 4, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #83 "semantic error in the QoS operation".

In case 5, if the old QoS rule (i.e. the QoS rule that existed before the PDU SESSION MODIFICATION COMMAND message was received) is not the default QoS rule, the UE shall not diagnose an error, shall further process the new request and, if it was processed successfully, shall delete the old QoS rule which has identical precedence value. Furthermore, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall send a PDU SESSION MODIFICATION REQUEST message with 5GSM cause #83 "semantic error in the QoS operation" to delete the QoS rule.

In case 5, if the old QoS rule (i.e. the QoS rule that existed before the PDU SESSION MODIFICATION COMMAND message was received) is the default QoS rule, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #83 "semantic error in the QoS operation".

In case 6, if the QoS rule is not the default QoS rule, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall send a PDU SESSION MODIFICATION REQUEST message with 5GSM cause #83 "semantic error in the QoS operation" to delete the QoS rule.

In case 6, if the QoS rule is the default QoS rule, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #83 "semantic error in the QoS operation".

In case 7, if the existing QoS rule is not the default QoS rule and the DQR bit of the new QoS rule is set to "the QoS rule is not the default QoS rule", the UE shall not diagnose an error, further process the create request and, if it was processed successfully, delete the old QoS rule (i.e. the QoS rule that existed when case 7 was detected). If the existing QoS rule is the default QoS rule or the DQR bit of the new QoS rule is set to "the QoS rule is the default QoS rule", the UE shall reject the PDU SESSION MODIFICATION COMMAND message with 5GSM cause #83 "semantic error in the QoS operation".

In case 9 or case 10, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall send a PDU SESSION MODIFICATION REQUEST message with 5GSM cause #83 "semantic error in the QoS operation" to delete the QoS rule.

In case 11, the UE shall not diagnose an error, further process the delete request and, if it was processed successfully, consider the respective QoS rule as successfully deleted.

In case 12, the UE shall not diagnose an error, further process the create request and, if it was processed successfully, delete the old QoS flow description (i.e. the QoS flow description that existed when case 12 was detected).

In case 14, the UE shall not diagnose an error, further process the delete request and, if it was processed successfully, consider the respective QoS flow description as successfully deleted.

In case 15 or case 16, after sending the PDU SESSION MODIFICATION COMPLETE for the ongoing PDU session modification procedure, the UE shall send a PDU SESSION MODIFICATION REQUEST message with 5GSM cause #83 "semantic error in the QoS operation" to delete the QoS flow description.

Otherwise, the UE shall reject the PDU SESSION MODIFICATION COMMAND message with 5GSM cause #83 "semantic error in the QoS operation".

b) Syntactical errors in QoS operations:

1) When the rule operation is "Create new QoS rule", "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters" or "Modify existing QoS rule and delete packet filters", the PDU session type of the PDU session is IPv4, IPv6, IPv4v6 or Ethernet PDU session type, and the packet filter list in the QoS rule is empty.

2) When the rule operation is "Delete existing QoS rule" or "Modify existing QoS rule without modifying packet filters" with a non-empty packet filter list in the QoS rule.

3) When the rule operation is "Modify existing QoS rule and delete packet filters" and the packet filter to be deleted does not exist in the original QoS rule.

4) Void.

5) When there are other types of syntactical errors in the coding of the Authorized QoS rules IE or the Authorized QoS flow descriptions IE, such as: a mismatch between the number of packet filters subfield and the number of packet filters in the packet filter list when the rule operation is "delete existing QoS rule" or "create new QoS rule", or the number of packet filters subfield is larger than the maximum possible number of packet filters in the packet filter list (i.e., there is no QoS rule precedence subfield included in the QoS rule IE), the QoS Rule Identifier is set to "no QoS rule identifier assigned", or the QoS flow identifier is set to "no QoS flow identifier assigned".

6) When the rule operation is "Modify existing QoS rule and add packet filters" or "Modify existing QoS rule and replace all packet filters", the DQR bit is set to "the QoS rule is the default QoS rule", the PDU session type of the PDU session is "Unstructured", and the packet filter list in the QoS rule is not empty.

7) When, the

A) rule operation is "Create new QoS rule", "Modify existing QoS rule and add packet filters", "Modify existing QoS rule and replace all packet filters", "Modify existing QoS rule and delete packet filters" or "Modify existing QoS rule without modifying packet filters", there is no QoS flow description with a QFI corresponding to the QFI of the resulting QoS rule and the UE determines, by using the QoS rule’s QFI as the 5QI, that there is a resulting QoS rule for a GBR QoS flow (as described in 3GPP TS 23.501 [8] table 5.7.4-1).

B) flow description operation is "Delete existing QoS flow description", and the UE determines, by using the QoS rule’s QFI as the 5QI, that there is a resulting QoS rule for a GBR QoS flow (as described in 3GPP TS 23.501 [8] table 5.7.4-1) with a QFI corresponding to the QFI of the QoS flow description that is deleted (i.e. there is no associated QoS flow description with the same QFI).

8) When the flow description operation is "Create new QoS flow description" or "Modify existing QoS flow description", and the UE determines that there is a QoS flow description of a GBR QoS flow (as described in 3GPP TS 23.501 [8] table 5.7.4-1) which lacks at least one of the mandatory parameters (i.e., GFBR uplink, GFBR downlink, MFBR uplink and MFBR downlink). If the QoS flow description does not include a 5QI, the UE determines this by using the QFI as the 5QI,

In case 3 the UE shall not diagnose an error, further process the deletion request and, if no error according to items c and d was detected, consider the respective packet filter as successfully deleted.

In case 6, after completion of the PDU session modification procedure, the UE shall send a PDU SESSION MODIFICATION REQUEST message with 5GSM cause #84 "syntactical error in the QoS operations" to delete all the packet filters for the default QoS rule.

In case 7, if the Authorized QoS rules IE contains at least one other valid QoS rule, the UE shall not diagnose an error and shall further process the request, if no error according to items c and d was detected. After completion of the PDU session modification procedure, the UE shall delete the QoS rule for which no corresponding QoS flow description is available and initiate UE-requested PDU session modification procedure with 5GSM cause #84 "syntactical error in the QoS operation" to delete the QoS rule for which it has deleted.

In case 8, if the default QoS rule is associated with the QoS flow description which lacks at least one of the mandatory parameters, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #84 "syntactical error in the QoS operation". Otherwise, if the Authorized QoS rules IE contains at least one other valid QoS rule or the QoS flow description IE contains at least one other valid QoS flow description, the UE shall not diagnose an error and shall further process the request, if no error according to items c and d was detected. After completion of the PDU session modification procedure, the UE shall delete the QoS flow description which lacks at least one of the mandatory parameters and the associated QoS rule(s), if any, and initiate UE-requested PDU session modification procedure with 5GSM cause #84 "syntactical error in the QoS operation" to delete the QoS flow description and the associated QoS rule(s), if any, which it has deleted.

Otherwise the UE shall reject the PDU SESSION MODIFICATION COMMAND message with 5GSM cause #84 "syntactical error in the QoS operation".

NOTE 5: It is not considered an error if the UE determines that after processing all QoS operations on QoS rules and QoS flow descriptions there is a QoS flow description that is not associated with any QoS rule and the UE is not in NB-N1 mode.

c) Semantic errors in packet filters:

1) When a packet filter consists of conflicting packet filter components which would render the packet filter ineffective, i.e. no IP packet will ever fit this packet filter. How the UE determines a semantic error in a packet filter is outside the scope of the present document.

The UE shall reject the PDU SESSION MODIFICATION COMMAND message with 5GSM cause #44 "semantic error in packet filter(s)".

d) Syntactical errors in packet filters:

1) When the rule operation is "Create new QoS rule", "Modify existing QoS rule and add packet filters" or "Modify existing QoS rule and replace all packet filters", and two or more packet filters in the resultant QoS rule would have identical packet filter identifiers.

2) When there are other types of syntactical errors in the coding of packet filters, such as the use of a reserved value for a packet filter component identifier.

In case 1, if two or more packet filters with identical packet filter identifiers are contained in the PDU SESSION MODIFICATION COMMAND message, the UE shall reject the PDU SESSION MODIFICATION COMMAND with 5GSM cause #45 "syntactical errors in packet filter(s)". Otherwise, the UE shall not diagnose an error, further process the PDU SESSION MODIFICATION COMMAND message and, if it was processed successfully, replace the old packet filter with the new packet filter which have the identical packet filter identifiers.

Otherwise the UE shall reject the PDU SESSION MODIFICATION COMMAND message with 5GSM cause #45 "syntactical errors in packet filter(s)".

If:

a) the UE detects errors in QoS rules that require to delete at least one QoS rule as described above which requires sending a PDU SESSION MODIFICATION REQUEST message to delete the erroneous mapped EPS bearer contexts; and

b) optionally, if the UE detects different errors in the mapped EPS bearer contexts as described in subclause 6.3.2.3 which requires sending a PDU SESSION MODIFICATION REQUEST message to delete the erroneous QoS rules;

the UE, after sending the PDU SESSION MODIFICATION COMPLETE message for the ongoing PDU session modification procedure, may send a single PDU SESSION MODIFICATION REQUEST message to delete the erroneous QoS rules, and optionally to delete the erroneous mapped EPS bearer contexts. The UE shall include a 5GSM cause IE in the PDU SESSION MODIFICATION REQUEST message.

NOTE 6: The 5GSM cause to use cannot be different from #41 "semantic error in the TFT operation", #42 "syntactical error in the TFT operation", #44 "semantic error in packet filter(s)", #45 "syntactical errors in packet filter(s)", #83 "semantic error in the QoS operation", #84 "syntactical error in the QoS operation", or #85 "Invalid mapped EPS bearer identity". The selection of a 5GSM cause is up to UE implementation.

The UE shall transport the PDU SESSION MODIFICATION COMMAND REJECT message and the PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5.

Upon receipt of a PDU SESSION MODIFICATION COMMAND REJECT message with 5GSM cause value in state PDU SESSION MODIFICATION PENDING, the SMF shall stop timer T3591, enter the state PDU SESSION ACTIVE and abort the PDU session modification procedure.

6.3.2.5 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Expiry of timer T3591.

On the first expiry of the timer T3591, the SMF shall resend the PDU SESSION MODIFICATION COMMAND message and shall reset and restart timer T3591. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3591, the SMF shall abort the procedure and enter the state PDU SESSION ACTIVE.

The SMF may continue to use the previous configuration of the PDU session or initiate the network-requested PDU session release procedure. If the SMF decides to continue to use the previous configuration of the PDU session and

i) the Authorized QoS rules IE is included in the PDU SESSION MODIFICATION COMMAND message, the SMF may mark the corresponding authorized QoS rule(s) of the PDU session as to be synchronised with the UE; and

ii) the Authorized QoS flow descriptions IE is included in the PDU SESSION MODIFICATION COMMAND message, the SMF may mark the corresponding authorized QoS flow description(s) of the PDU session as to be synchronised with the UE.

b) Void.

c) Collision of UE-requested PDU session release procedure and network-requested PDU session modification procedure.

If the SMF receives a PDU SESSION RELEASE REQUEST message during the network-requested PDU session modification procedure, and the PDU session indicated in the PDU SESSION RELEASE REQUEST message is the PDU session that the SMF had requested to modify, the SMF shall abort the PDU session modification procedure and proceed with the UE-requested PDU session release procedure.

d) Collision of UE-requested PDU session modification procedure and network-requested PDU session modification procedure.

If the network receives a PDU SESSION MODIFICATION REQUEST message during the network-requested PDU session modification procedure, and the PDU session indicated in the PDU SESSION MODIFICATION REQUEST message is the PDU session that the network had requested to modify, the network shall ignore the PDU SESSION MODIFICATION REQUEST message received in the state PDU SESSION MODIFICATION PENDING. The network shall proceed with the network-requested PDU session modification procedure as if no PDU SESSION MODIFICATION REQUEST message was received from the UE.

e) 5G access network cannot forward the message.

If the SMF determines based on content of the n2SmInfo attribute specified in 3GPP TS 29.502 [20A] that the DL NAS TRANSPORT message carrying the PDU SESSION MODIFICATION COMMAND message was not forwarded to the UE by the 5G access network, then the SMF shall abort the procedure and enter the state PDU SESSION ACTIVE.

f) 5G access network cannot forward the message due to handover.

If the SMF determines based on content of the n2SmInfo attribute specified in 3GPP TS 29.502 [20A] that the DL NAS TRANSPORT message carrying the PDU SESSION MODIFICATION COMMAND message was not forwarded to the UE by the 5G access network due to handover, then the SMF shall abort the procedure and enter the state PDU SESSION ACTIVE.

The SMF may re-initiate, up to a pre-configured number of times, the network-requested PDU session modification procedure when the SMF detects that the handover is completed successfully or has failed or at the expiry of the configured guard timer as specified in 3GPP TS 23.502 [9].

g) Collision of re-establishment of the user-plane resources and network-requested PDU session modification procedure for the same PDU session.

If the SMF receives an indication from the AMF to re-establish the user-plane resources during the network-requested PDU session modification procedure for the same PDU session, the network shall abort the network-requested PDU session modification procedure and proceed with re-establishment of the user-plane resources for the PDU session as specified in 3GPP TS 29.502 [20A] subclause 5.2.2.3.2.2.

NOTE: After the completion of re-establishment of the user-plane resources for the PDU session, the SMF can re-initiate the network-requested PDU session modification procedure for the PDU session.

h) Collision of UE-requested PDU session establishment procedure and network-requested PDU session modification procedure.

If the network receives a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing PDU session" or "existing emergency PDU session" during the network-requested PDU session modification procedure, and the PDU session ID indicated in the PDU SESSION ESTABLISHMENT REQUEST message is the PDU session that the network had requested to modify, the network shall abort the network-requested PDU session modification procedure and proceed with the UE-requested PDU session establishment procedure.

6.3.2.6 Abnormal cases in the UE

The following abnormal cases can be identified:

a) PDU session inactive for the received PDU session ID.

If the PDU session ID in the PDU SESSION MODIFICATION COMMAND message belongs to any PDU session in state PDU SESSION INACTIVE in the UE, the UE shall set the 5GSM cause IE to #43 "Invalid PDU session identity" in the 5GSM STATUS message, and set the PDU session ID to the received PDU session ID in the UL NAS TRANSPORT message as specified in subclause 5.4.5.

b) Collision of network-requested PDU session modification procedure and UE-requested PDU session modification procedure.

If the UE receives a PDU SESSION MODIFICATION COMMAND message during the UE-requested PDU session modification procedure, the PTI IE of the PDU SESSION MODIFICATION COMMAND message is set to "No procedure transaction identity assigned", and the PDU session indicated in the PDU SESSION MODIFICATION COMMAND message is the PDU session that the UE had requested to modify, the UE shall abort internally the UE-requested PDU session modification procedure, enter the state PDU SESSION ACTIVE and proceed with the network-requested PDU session modification procedure.

6.3.3 Network-requested PDU session release procedure

6.3.3.1 General

The purpose of the network-requested PDU session release procedure is to enable the network to release a PDU session or the user-plane resources on a single access of an MA PDU session.

6.3.3.2 Network-requested PDU session release procedure initiation

In order to initiate the network-requested PDU session release procedure, the SMF shall create a PDU SESSION RELEASE COMMAND message.

The SMF shall set the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message to indicate the reason for releasing the PDU session.

The 5GSM cause IE typically indicates one of the following 5GSM cause values:

#8 operator determined barring;

#26 insufficient resources;

#29 user authentication or authorization failed;

#36 regular deactivation;

#38 network failure;

#39 reactivation requested;

#46 out of LADN service area;

#67 insufficient resources for specific slice and DNN;

#69 insufficient resources for specific slice.

If the selected SSC mode of the PDU session is "SSC mode 2" and the SMF requests the relocation of SSC mode 2 PDU session anchor with different PDU sessions as specified in 3GPP TS 23.502 [9], the SMF shall include 5GSM cause #39 "reactivation requested".

If the network-requested PDU session release procedure is triggered by a UE-requested PDU session release procedure, the SMF shall set the PTI IE of the PDU SESSION RELEASE COMMAND message to the PTI of the PDU SESSION RELEASE REQUEST message received as part of the UE-requested PDU session release procedure and shall not include the Access type IE in the PDU SESSION RELEASE COMMAND.

If the network-requested PDU session release procedure is not triggered by a UE-requested PDU session release procedure, the SMF shall set the PTI IE of the PDU SESSION RELEASE COMMAND message to "No procedure transaction identity assigned".

If the PDU session ID included in PDU SESSION RELEASE COMMAND message is associated with one or more multicast MBS sessions and either the Access type IE is not included or the Access type IE indicates "3GPP access", the SMF shall consider the UE as removed from the associated multicast MBS sessions.

Based on the local policy and user’s subscription data, if the SMF decides to release the PDU session after determining:

a) the UE has moved between a tracking area in NB-N1 mode and a tracking area in WB-N1 mode;

b) the UE has moved between a tracking area in NB-S1 mode and a tracking area in WB-N1 mode;

c) the UE has moved between a tracking area in WB-S1 mode and a tracking area in NB-N1 mode; or

d) a PDU session is not only for control plane CIoT 5GS optimization any more,

the SMF shall:

a) include the 5GSM cause value #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message; or

b) include a 5GSM cause value other than #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message.

NOTE: The included 5GSM cause value is up to the network implementation.

If the SMF receives UE presence in LADN service area from the AMF indicating that the UE is out of the LADN service area and the SMF decides to release the PDU session, the SMF shall include the 5GSM cause value #46 "out of LADN service area" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message. Upon receipt of the 5GSM cause value #46 "out of LADN service area" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message, the UE shall release the PDU session.

The SMF may include a Back-off timer value IE in the PDU SESSION RELEASE COMMAND message when the 5GSM cause value #26 "insufficient resources" is included in the PDU SESSION RELEASE COMMAND message. If the 5GSM cause value is #26 "insufficient resources" and the PDU SESSION RELEASE COMMAND message is sent to a UE configured for high priority access in selected PLMN or SNPN or the request type was set to "initial emergency request" or "existing emergency PDU session" for the establishment of the PDU session, the network shall not include a Back-off timer value IE.

The SMF may include a Back-off timer value IE in the PDU SESSION RELEASE COMMAND message when the 5GSM cause value #67 "insufficient resources for specific slice and DNN" is included in the PDU SESSION RELEASE COMMAND message. If the 5GSM cause value is #67 "insufficient resources for specific slice and DNN" and the PDU SESSION RELEASE COMMAND message is sent to a UE configured for high priority access in selected PLMN or SNPN or the request type was set to "initial emergency request" or "existing emergency PDU session" for the establishment of the PDU session, the network shall not include a Back-off timer value IE.

The SMF may include a Back-off timer value IE in the PDU SESSION RELEASE COMMAND message when the 5GSM cause #69 "insufficient resources for specific slice" is included in the PDU SESSION RELEASE COMMAND message. If the 5GSM cause value is #69 "insufficient resources for specific slice" and the PDU SESSION RELEASE COMMAND message is sent to a UE configured for high priority access in selected PLMN or SNPN or the request type was set to "initial emergency request" or "existing emergency PDU session" for the establishment of the PDU session, the network shall not include a Back-off timer value IE.

The SMF should include a Back-off timer value IE in the PDU SESSION RELEASE COMMAND message when the 5GSM cause value #29 "user authentication or authorization failed" is included in the PDU SESSION RELEASE COMMAND message.

If the service-level-AA procedure is triggered for the established PDU session for UAS services with re-authentication purpose, and the SMF is informed by the UAS-NF that UUAA-SM is unsuccessful or if the SMF receives UUAA revocation notification message from the UAS-NF as described in 3GPP TS 23.256 [6AB], the SMF shall transmit the PDU SESSION RELEASE COMMAND message to the UE, including:

a) the service-level-AA response in the Service-level-AA container IE, with the SLAR field set to the value of "Service level authentication and authorization was not successful or service level authorization is revoked"; and

b) the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message.

If the PDU session was established for C2 communication and the SMF is informed by UAS-NF that C2 authorization is revoked, the SMF shall include:

a) the service-level-AA response with the value of the C2AR field set to the "C2 authorization was not successful or C2 authorization is revoked" in the service-level-AA container IE of the PDU SESSION RELEASE COMMAND message, and

b) the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION RELEASE COMMAND message.

The SMF shall send:

a) the PDU SESSION RELEASE COMMAND message; and

b) the N1 SM delivery skip allowed indication:

1) if the SMF allows the AMF to skip sending the N1 SM container to the UE and the 5GSM cause IE is not set to #39 "reactivation requested"; or

2) if the SMF allows the AMF to skip sending the N1 SM container to the UE and the Access type IE is not included

towards the AMF, and the SMF shall start timer T3592 (see example in figure 6.3.3.2.1).

Figure 6.3.3.2.1: Network-requested PDU session release procedure

6.3.3.3 Network-requested PDU session release procedure accepted by the UE

For a single access PDU session, upon receipt of a PDU SESSION RELEASE COMMAND message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE considers the PDU session as released and the UE shall create a PDU SESSION RELEASE COMPLETE message.

For an MA PDU session, upon receipt of the PDU SESSION RELEASE COMMAND message, the UE shall behave as follows:

a) if the PDU SESSION RELEASE COMMAND message includes the Access type IE and the MA PDU session has user-plane resources established on both 3GPP access and non-3GPP access, the UE shall consider the user-plane resources on the access indicated in the Access type IE as released and shall create a PDU SESSION RELEASE COMPLETE message. If the Access type IE indicates "3GPP access" and there is one or more multicast MBS sessions associated with the MA PDU session, the UE shall locally leave these associated multicast MBS sessions;

b) if the PDU SESSION RELEASE COMMAND message includes the Access type IE and the MA PDU session has user-plane resources established on only the access indicated in the Access type IE, the UE shall consider the MA PDU session as released and shall create a PDU SESSION RELEASE COMPLETE message; and

c) if the PDU SESSION RELEASE COMMAND message does not include the Access type IE, the UE shall consider the MA PDU session as released and shall create a PDU SESSION RELEASE COMPLETE message.

If there is one or more multicast MBS sessions associated with the PDU session the UE considers as released, the UE shall locally leave these associated multicast MBS sessions.

If the PDU SESSION RELEASE COMMAND message contains the PTI value allocated in the UE-requested PDU session release procedure, the UE shall stop the timer T3582. The UE should ensure that the PTI value assigned to this procedure is not released immediately.

While the PTI value is not released, the UE regards any received PDU SESSION RELEASE COMMAND message with the same PTI value as a network retransmission (see subclause 7.3.1).

If the PDU SESSION RELEASE COMMAND message includes 5GSM cause #39 "reactivation requested", then after completion of the network-requested PDU session release procedure, the UE should re-initiate the UE-requested PDU session establishment procedure as specified in subclause 6.4.1 for:

a) the PDU session type associated with the released PDU session;

b) the SSC mode associated with the released PDU session;

c) the DNN associated with the released PDU session; and

d) the S-NSSAI associated with (if available in roaming scenarios) a mapped S-NSSAI if provided in the UE-requested PDU session establishment procedure of the released PDU session.

NOTE 2: User interaction is necessary in some cases when the UE cannot re-initiate the UE-requested PDU session establishment procedure automatically.

If the PDU SESSION RELEASE COMMAND message is received without the Back-off timer value IE or includes 5GSM cause #39 "reactivation requested", and the UE provided an S-NSSAI during the PDU session establishment, the UE shall stop timer T3585 if it is running for the S-NSSAI of the PDU session. If the UE did not provide an S-NSSAI during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3585 associated with no S-NSSAI if it is running. If the PDU SESSION RELEASE COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION RELEASE COMMAND is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running.

If the PDU SESSION RELEASE COMMAND message is received without the Back-off timer value IE or includes 5GSM cause #39 "reactivation requested", and the UE provided a DNN during the PDU session establishment, the UE shall stop timer T3396 if it is running for the DNN provided by the UE. If the UE did not provide a DNN during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3396 associated with no DNN if it is running. If the PDU SESSION RELEASE COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3396 associated with no DNN if it is running.

If the PDU SESSION RELEASE COMMAND message is received without the Back-off timer value IE or includes 5GSM cause #39 "reactivation requested", and the UE provided an S-NSSAI and a DNN during the PDU session establishment, the UE shall stop timer T3584 if it is running for the [S-NSSAI of the PDU session, DNN] combination provided by the UE. If the UE did not provide an S-NSSAI during the PDU session establishment, the UE shall stop the timer T3584 associated with [no S-NSSAI, DNN] if it is running. If the UE did not provide a DNN during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3584 associated with [S-NSSAI of the PDU session, no DNN] combination, if it is running. If the PDU SESSION RELEASE COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3584 associated with [S-NSSAI of the PDU session, no DNN] if it is running. If the UE provided neither a DNN nor an S-NSSAI during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop the timer T3584 associated with [no S-NSSAI, no DNN] if it is running. If the PDU SESSION RELEASE COMMAND message was received for an emergency PDU session, the UE shall not stop the timer T3584 associated with [no S-NSSAI, no DNN] if it is running. The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running.

NOTE 3: If the PDU SESSION RELEASE COMMAND message is received without the Back-off timer value IE or includes 5GSM cause #39 "reactivation requested" for a PDU session, the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3396 associated with the DNN (or no DNN, if no DNN was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3396 and the timer T3584.

NOTE 4: If the PDU SESSION RELEASE COMMAND message is received without the Back-off timer value IE or includes 5GSM cause #39 "reactivation requested" for a PDU session, the UE provided a DNN (or no DNN) and an S-NSSAI of the PDU session (or no S-NSSAI) when the PDU session is established, timer T3585 associated with the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI of the PDU session (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3585 and the timer T3584.

If the PDU SESSION RELEASE COMMAND message includes 5GSM cause #26 "insufficient resources" and the Back-off timer value IE, the UE shall ignore the 5GSM congestion re-attempt indicator IE provided by the network, if any, and the UE shall take different actions depending on the timer value received for timer T3396 in the Back-off timer value:

a) If the timer value indicates neither zero nor deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates neither zero nor deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. The UE shall then start timer T3396 with the value provided in the Back-off timer value IE and:

2) shall not send a PDU SESSION ESTABLISHMENT REQUEST message without an DNN and with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without an DNN provided by the UE, if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until timer T3396 expires or timer T3396 is stopped.

The UE shall not stop timer T3396 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates that this timer is deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. The UE:

1) shall not send a PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same DNN until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same DNN from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the same DNN, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for the same DNN from the network; and

2) shall not send a PDU SESSION ESTABLISHMENT REQUEST message without a DNN and with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without a DNN provided by the UE, if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without an DNN provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without a DNN provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for a non-emergency PDU session established without a DNN provided by the UE.

The timer T3396 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero, the UE:

1) shall stop timer T3396 associated with the corresponding DNN, if running, and may send a PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same DNN; and

2) if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN, if running, and may send a PDU SESSION ESTABLISHMENT REQUEST message without a DNN, or a PDU SESSION MODIFICATION REQUEST message without an DNN provided by the UE.

If the PDU SESSION RELEASE COMMAND message includes 5GSM cause #26 "insufficient resources" and the Back-off timer value IE is not included, then the UE may send a PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same DNN or without a DNN.

When the timer T3396 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3396 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3396 is associated (if any) is not updated, then timer T3396 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3396 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3396 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

– let t1 be the time remaining for T3396 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If the 5GSM cause value is #39 "reactivation requested", the UE shall ignore the Back-off timer value IE and 5GSM congestion re-attempt indicator IE provided by the network, if any.

If the 5GSM cause value is #67 "insufficient resources for specific slice and DNN" and the Back-off timer value IE is included, the UE shall take different actions depending on the timer value received for timer T3584 in the Back-off timer value:

a) If the timer value indicates neither zero nor deactivated, and both an S-NSSAI and a DNN were provided by the UE during the PDU session establishment the UE shall stop timer T3584 associated with the [S-NSSAI of the PDU session, DNN] combination, if it is running. If the timer value indicates neither zero nor deactivated, an S-NSSAI and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with [S-NSSAI of the PDU session, no DNN] combination, if it is running. If the timer value indicates neither zero nor deactivated, no S-NSSAI and a DNN was provided during the PDU session establishment, the UE shall stop timer T3584 associated with the [no S-NSSAI, DNN] combination, if it is running. If the timer value indicates neither zero nor deactivated and neither S-NSSAI nor DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with the [no S-NSSAI, no DNN] combination, if it is running. The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running. The UE shall then start timer T3584 with the value provided in the Back-off timer value IE.

1) The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or PDU SESSION MODIFICATION REQUEST message with the exception of those identified in subclause 6.4.2.1, for the [S-NSSAI of the PDU session, DNN] combination, until timer T3584 expires or timer T3584 is stopped;

2) shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with the exception of those identified in subclause 6.4.2.1, for the [S-NSSAI of the PDU session, no DNN] combination, if no DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped;

3) shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or another PDU SESSION MODIFICATION REQUEST message with the exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, DNN] combination, if no S-NSSAI was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped; and

4) shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with the exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, no DNN] combination, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped.

The UE shall not stop timer T3584 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated:

1) if both S-NSSAI and DNN were provided by the UE during the PDU session establishment, the UE shall stop timer T3584 associated with the [S-NSSAI of the PDU session, DNN] combination (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the [S-NSSAI of the PDU session, DNN] combination that was sent by the UE, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the [S-NSSAI of the PDU session, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the [S-NSSAI of the PDU session, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for the [S-NSSAI of the PDU session, DNN] combination from the network;

2) if an S-NSSAI was provided but a DNN was not provided by the UE during the PDU session establishment, the UE shall stop timer T3584 associated with the [S-NSSAI of the PDU session, no DNN] combination (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the [S-NSSAI of the PDU session, no DNN] combination, if no DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the [S-NSSAI of the PDU session, no DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established the [S-NSSAI of the PDU session, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for a non-emergency PDU session established for the [S-NSSAI of the PDU session, no DNN] combination from the network;

3) if an S-NSSAI was not provided but a DNN was provided by the UE during the PDU session establishment, the UE shall stop timer T3584 associated with the [no S-NSSAI, DNN] combination (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message, or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the [no S-NSSAI, DNN], if no S-NSSAI was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives an PDU SESSION MODIFICATION COMMAND message for the [no S-NSSAI, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the [no S-NSSAI, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for the same [no S-NSSAI, DNN] combination from the network; and

4) if neither S-NSSAI nor DNN were provided by the UE during the PDU session establishment, the UE shall stop timer T3584 associated with the [no S-NSSAI, no DNN] combination (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the [no S-NSSAI, no DNN] combination, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the [no S-NSSAI, no DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established for the [no S-NSSAI, no DNN] combination from the network or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for a non-emergency PDU session established for the [no S-NSSAI, no DNN] combination from the network.

The timer T3584 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero:

If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs" is included in the PDU SESSION RELEASE COMMAND message with the 5GSM cause value #67 "insufficient resources for specific slice and DNN", then the UE shall apply the timer T3584 for all the PLMNs. Otherwise, the UE shall apply the timer T3584 for the registered PLMN.

If the 5GSM cause value is #67 "insufficient resources for specific slice and DNN" and the Back-off timer value IE is not included, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same [S-NSSAI, DNN] combination.

When the timer T3584 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3584 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3584 is associated (if any) is not updated, then timer T3584 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3584 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3584 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

– let t1 be the time remaining for T3584 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If the 5GSM cause value is #69 "insufficient resources for specific slice" and the Back-off timer value IE is included, the UE shall take different actions depending on the timer value received for timer T3585 in the Back-off timer value:

a) If the timer value indicates neither zero nor deactivated and an S-NSSAI was provided during the PDU session establishment, the UE shall stop timer T3585 associated with the S-NSSAI of the PDU session, if it is running. If the timer value indicates neither zero nor deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION RELEASE COMMAND is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running;

The UE shall then start timer T3585 with the value provided in the Back-off timer value IE and:

1) if an S-NSSAI was provided by the UE during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the S-NSSAI of the PDU session, until timer T3585 expires or timer T3585 is stopped; and

The UE shall not stop timer T3585 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated and an S-NSSAI was provided during the PDU session establishment, the UE shall stop timer T3585 associated with the S-NSSAI of the PDU session, if it is running. If the timer value indicates that this timer is deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for current access type or both 3GPP access type and non-3GPP access type, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running;

In addition:

1) if an S-NSSAI was provided by the UE during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST, or PDU SESSION MODIFICATION REQUEST with exception of those identified in subclause 6.4.2.1, for the S-NSSAI of the PDU session until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or a PDU SESSION MODIFICATION COMMAND message for the S-NSSAI of the PDU session from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the S-NSSAI of the PDU session from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for the S-NSSAI of the PDU session from the network; and

2) if the request type was different from "initial emergency request" and from "existing emergency PDU session", and an S-NSSAI was not provided by the UE during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without an S-NSSAI provided by the UE, , until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE or including 5GSM cause #39 "reactivation requested" for a non-emergency PDU session established without an S-NSSAI provided by the UE.

The timer T3585 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero:

1) if an S-NSSAI was provided by the UE during the PDU session establishment, the UE shall stop timer T3585 associated with the S-NSSAI of the PDU session (including the timer T3585 applied for all the PLMNs, if running, and the timer T3585 applied for the registered PLMN, if running), if running, and may send another PDU SESSION ESTABLISHMENT REQUEST, or PDU SESSION MODIFICATION REQUEST message for the S-NSSAI of the PDU session; and

2) if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI (including the timer T3585 applied for all the PLMNs, if running, and the timer T3585 applied for the registered PLMN, if running), if running, and may send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI, or another PDU SESSION MODIFICATION REQUEST message without an S-NSSAI provided by the UE.

If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs" is included in the PDU SESSION RELEASE COMMAND message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE shall apply the timer T3585 for all the PLMNs. Otherwise, the UE shall apply the timer T3585 for the registered PLMN.

If the 5GSM cause value is #69 "insufficient resources for specific slice" and the Back-off timer value IE is not included, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same S-NSSAI or without an S-NSSAI.

When the timer T3585 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3585 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3585 is associated (if any) is not updated, then timer T3585 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3585 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" for the SNPN to which timer T3585 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

– let t1 be the time remaining for T3585 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

NOTE 5: As described in this subclause, upon PLMN change or inter-system change, the UE does not stop the timer T3584 or T3585. This means the timer T3584 or T3585 can still be running or be deactivated for the given 5GSM procedure, the PLMN, the S-NSSAI and optionally the DNN combination when the UE returns to the PLMN or when it performs inter-system change back from S1 mode to N1 mode. Thus the UE can still be prevented from sending another PDU SESSION ESTABLISHMENT REQUEST or PDU SESSION MODIFICATION REQUEST message in the PLMN for the same S-NSSAI and optionally the same DNN.

Upon PLMN change, if T3584 is running or is deactivated for an S-NSSAI, a DNN, and old PLMN, but T3584 is not running and is not deactivated for the S-NSSAI, the DNN, and new PLMN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI and the same DNN in the new PLMN.

Upon PLMN change, if T3585 is running or is deactivated for an S-NSSAI and old PLMN, but T3585 is not running and is not deactivated for the S-NSSAI and new PLMN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI in the new PLMN.

If the PDU SESSION RELEASE COMMAND message includes 5GSM cause #29 "user authentication or authorization failed "and the Back-off timer value IE, the UE shall behave as follows:

a) if the timer value indicates neither zero nor deactivated and:

1) if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment, the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and [PLMN, DNN, (mapped) HPLMN S-NSSAI] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

2) if the UE provided a DNN to the network during the PDU session establishment, the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and [PLMN, DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

3) if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment, it shall start the back-off timer accordingly for the PDU session establishment procedure and the [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination. Dependent on the combination, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

4) if the UE did not provide a DNN to the network during the PDU session establishment, it shall start the back-off timer accordingly for the PDU session establishment procedure and the [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, no DNN] in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

b) if the timer value indicates that this timer is deactivated and:

1) if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

2) if the UE provided a DNN to the network during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

3) if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

4) if the UE did not provide a DNN to the network during the PDU session establishment, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, no DNN] in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; and

c) if the timer value indicates zero, the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [PLMN, no DNN, no S-NSSAI] in the current PLMN.

The UE shall not stop any back-off timer:

a) upon a PLMN change;

b) upon an inter-system change; or

c) upon registration over another access type.

If the PDU SESSION RELEASE COMMAND message includes:

a) 5GSM cause #29 "user authentication or authorization failed"; and

b) the service-level-AA response in the Service-level-AA container IE with the SLAR field set to the value of "Service level authentication and authorization was not successful or service level authorization is revoked",

the UE shall forward the service-level-AA response to the upper layers, so the UUAA authorization data is deleted as specified in 3GPP TS 33.256 [24B].

The UE shall transport the PDU SESSION RELEASE COMPLETE message and the PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5.

Upon receipt of a PDU SESSION RELEASE COMPLETE message, the SMF shall stop timer T3592 and shall consider the PDU session as released.

6.3.3.4 N1 SM delivery skipped

If the PDU SESSION RELEASE COMMAND message was sent along the N1 SM delivery skip allowed indication towards AMF, then upon receipt of an indication that N1 SM delivery was skipped, the SMF shall stop timer T3592 and shall consider the PDU session as released.

6.3.3.5 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Expiry of timer T3592.

The SMF shall, on the first expiry of the timer T3592, retransmit the PDU SESSION RELEASE COMMAND message and shall reset and start timer T3592. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3592, the SMF shall abort the procedure.

b) Collision of network-requested PDU session release procedure and UE-requested PDU session modification procedure.

When the SMF receives a PDU SESSION MODIFICATION REQUEST message during the network-requested PDU session release procedure, and the PDU session indicated in PDU SESSION MODIFICATION REQUEST message is the PDU session that the SMF had requested to release, the SMF shall ignore the PDU SESSION MODIFICATION REQUEST message and proceed with the PDU session release procedure.

c) Collision of network-requested PDU session release procedure and UE-requested PDU session release procedure.

If the SMF receives a PDU SESSION RELEASE REQUEST message after sending a PDU SESSION RELEASE COMMAND message to the UE, and the PDU session ID in the PDU SESSION RELEASE REQUEST message is the same as the PDU session ID in the PDU SESSION RELEASE COMMAND message, the SMF shall ignore the PDU SESSION RELEASE REQUEST message and proceed with the network-requested PDU session release procedure.

d) Collision of re-establishment of the user-plane resources and network-requested PDU session release procedure for the same PDU session.

If the SMF receives an indication from the AMF to re-establish the user-plane resources during the network-requested PDU session release procedure for the same PDU session, the SMF shall not re-establish the user-plane resources for the PDU session as specified in 3GPP TS 29.502 [20A] subclause 5.2.2.3.2.2 and proceed with the network-requested PDU session release procedure.

6.3.3.6 Abnormal cases in the UE

The following abnormal cases can be identified:

a) PDU session inactive for the received PDU session ID.

If the PDU session ID in the PDU SESSION RELEASE COMMAND message belongs to any PDU session in state PDU SESSION INACTIVE in the UE, the UE shall include the 5GSM cause #43 "Invalid PDU session identity" in the 5GSM STATUS message, and set the PDU session ID to the received PDU session ID in the UL NAS TRANSPORT message as specified in subclause 5.4.5.

b) User-plane resources of the MA PDU session on the access indicated in the Access type IE not established.

If the PDU session is an MA PDU session and has user-plane resources established on a single access different from the access indicated in the Access type IE, the UE shall not diagnose an error, further process the release command and consider the user-plane resources of the MA PDU session on the access indicated in the Access type IE as successfully released.