3GPP 5G SA For Field Engineer: English Version

English version
3GPP 5G SA for field Engineer

3GPP 5G Standalone Access Registration Call flow Rev3.00
August 24, 2022
Centimani corporation（Technical advisor RYUICHI YASUNAGA）
COPYRIGHT © 2022 Centimani CO. CONFIDENTIAL. ALL RIGHTS RESERVED 2023/10/12 Thursday 1
内容
１．5G RAN & 5GC Access flow
２．5G SA NR＋5G Core detailed Access call flow
Appendix
１．5G RAN & 5GC ACCESS FLOW
5G RAN & 5GC Access flow
5G UE 5G NR NodeB 5G Core NW
UE gNB New AMF Old AMF SMF UPF PCF AUSF 5G-EIR UDM
RRC Idle precondition UE Context
5G-NR RRC connection configuration

procedure
Internal
processing
NAS registration related procedures
AMF identifier related procedures
NAS identifier related procedures
Internal
processing
Internal
processing
Internal
processing
UE authentication related procedures
UE authentication related
procedures
Internal
processing
UE authentication related
procedures
NAS authentication related procedures
NAS security related procedures
Registration related
procedures
Internal
processing
Internal
Identifier confirmation related procedures
processing
Internal
processing
Procedures related to subscriber data management
Internal
processing
UE context management related procedures
Session release related

procedures
Internal
processing
Internal
processing
PCF selection related procedures
PCF registration related procedures
Session release related procedures
User plane configuration related

procedures
Internal
processing
NAS registration related

procedures
AS security registration related

procedures
RRC Reconfiguration related
procedures
Internal
processing
Internal
processing
Initial Context setting related

procedures
NAS registration related procedures
Procedures related to DL/UL data transfer
２．5G SA NR＋5G CORE DETAILED ACCESS CALL FLOW
5G SA NR＋5G Core detailed Access call flow
UE gNB New AMF Old AMF SMF UPF PCF AUSF
precondition
0:RRC Idle
UE context already exists in Old AMF
0:UE Context
DL-Sync
1:MIB（Master Information Block）・Cell search and downlink synchronization

・Cell search is a procedure in which the UE acquires
time and frequency synchronization with the cell and
decodes the cell ID and PBCH (MIB) information.
2:SIB 1（System Information Block）
5G-NR RRC connection setup
3:Msg1: Preamble ・UE selects a random preamble. The preamble is referred to as a random
access preamble ID (RAPID).
※Preamble transmission is Zadoff-Chu sequence.
(Zadoff-Chu sequence)
4:T300 ・Start the T300 and wait for the RRC

Setup message from the network.
5: Start PDCCH decoding ・In response to the PRACH transmission, the UE attempts to detect DCI format 1_0 with the CRC
for RA-RNTI scrambled by the RA-RNTI corresponding to the RACH transmission.
・The UE looks for messages during a configured window of length ra-ResponseWindow.
6：Assign temporary C-RNTI ・The tentative C-RNTI assignment is signaled to the UE in a random
access response message.
【Reference】Preamble （UE ➔ gNB）
☑ TS 38.213、 TS 38.321、 TS 38.211

・The UE selects a random preamble.
・The preamble is referenced by a random access preamble ID (RAPID).
・Preamble transmission is Zadoff-Chu sequence.
・Each preamble transmission is associated with an RA-RNTI.
RA-RNTI
The RA-RNTI associated with the PRACH for which the random access preamble is sent
is calculated as follows.
RA-RNTI= 1 + s_id + 14 × t_id + 14 × 80 × f_id + 14 × 80 × 8 × ul_carrier_id
s_id：Index of the first OFDM symbol in the specified PRACH（0≦s_id ＜14）

t_id：The index of the first slot of the specified PRACH within the system frame（0≦t_id ＜80）
f_id：Index of the specified PRACH in the frequency domain（0≤f_id <8）
ul_carrier_id：Uplink carrier used for Msg1 transmission 0 for NUL carriers, 1 for SUL carriers）
5G-NR RRC接続設定・The RA-RNTI scrambled DCI message signals the frequency
・Frequency domain resource 7:PDCCH DCI Format 1_0 [RA-RNTI] and time resources allocated for the transmission of the
allocation transport block containing the random access response
・Time domain resource allocation message.
・Downlink MCS
・Timing advance command ・The UE detects DCI format 1_0 with CRC scrambled by
8:Msg2: Random Access Response the corresponding RA-RNTI and receives the transport
・UL permission = {frequency hopping block on the corresponding PDSCH.
flag, Msg3 PUSCH frequency + time ・RAR carries timing advances, uplink grants, and
resource allocation, uplink MCS, TPC provisional C-RNTI assignments.
command, CSI request},
・Temporary C-RNTI)
9：ue-identity = random number ・The UE chooses a random identity that will be used during conflict resolution.
between 0 and 2^39-1
T300
Timer
10：Extract UL Grant from RAR ・The uplink allocation contained in the RAR will be used to send Msg3 (RRC configuration request).
【Reference】PDCCH DCI Format 1_0（gNB ➔ UE）
☑ TS 38.212
・DCI format 1_0 is used to allocate downlink resources.
・CRC scramble using format 1_0 RA-RNTI.
・In response to the PRACH transmission, the UE attempts to detect DCI format 1_0
with the PDCCH CRC scrambled by the RA-RNTI corresponding to the RACH
transmission.
・The UE looks for messages between a configured window of length ra-
Response Window.
・The RA-RNTI scrambled DCI message signals the frequency and time resources
allocated for the transmission of the transport block containing the random access
response message.
The following information is transmitted in RA-RNTI scrambled DCI format 1_0.
【Reference】Random Access Response（gNB ➔ UE）
☑ TS 38.213, TS 38.321
・The UE confirms the PDCCH addressed by the RA-RATI.
・Once the PDCCH with RA-RNTI is decoded, the UE receives the downlink transport block
using the RB resources in the message.
・The downlink transport block includes MAC PDUs.
・A UE MAC PDU is composed of one or more MAC sub-PDUs.
・Since multiple UEs may send preambles on the same RACH occasion, they will all be
addressed by the same RA-RNTI.
☑ MAC PDU
☑ E/T/RAPID MAC subheader
☑ MAC Payload for Random Access Response
☑ RAR UL Grant
5G-NR RRC接続設定
・RRC Setup Request is sent with random ue-Identity and
・ue-Identity, 11:Msg3: RRCSetupRequest
・establishment Cause establishment cause.
・Frequency domain resource allocation

・Time domain resource allocation 12：PDCCH DCI format１_０［C-RNTI］・The C-RNTI scrambled DCI message signals the frequency and time
・Downlink MCS resources allocated for the transmission of the transport block containing
the RRC setup message.
13：Setup SRB1 ・Signaling radio bearer 1 is configured.
・radioBearerConfig 14:Msg4: RRCSetup

・The RRC configuration message is sent to the master cell with configuration SRB1.
{srb-ToAddModList、}
・masterCellGroup
※The message carries the radioBearerConfig and masterCellGroup information elements.
{cellGroupId、rlc-
BearerToAddModList、mac- 15:T300
CellGroupConfig、
physicalCellGroupConfig} ・The UE stops the T300 when receiving the RRC configuration message.
16.RRC Connected
17：Performing the cell group configuration

steps
【Reference】RRCSetupRequest （UE ➔ gNB）
☑ 38.331
・RRC Setup Request is sent with random ue-Identity and establishment cause.
・The following probable causes are defined.
☑ Format 1_0 CRC scramble with C-RNTI

・The following information is transmitted in DCI format 1_0 with PDCCH CRC
scrambled by the assigned C-RNTI.
【Reference】RRCSetup（gNB ➔ UE）
☑ 38.331
・The RRC configuration message is sent to the master cell with configuration SRB1.
・The message carries the radioBearerConfig and masterCellGroup information elements.
☑ 38.331
・ The RRCSetup message carries radioBearerConfig and masterCellGroup information elements.
☑ RadioBearerConfig
☑ 38.331
・ The RRCSetup message carries radioBearerConfig and masterCellGroup information elements.
☑ CellGroupConfig
5G-NR RRC connection settings

18：Perform radio bearer
configuration procedure
・Frequency domain resource allocation 19:PDCCH DCI Format 0_0 [C-RNTI] ・The gNB allocates uplink resources to send the RRC
・Time domain resource allocation setup complete message to the UE.
・Uplink MCS
20：Registration Request NAS

メッセージを準備する・The UE specifies "Registration Request" in the dedicated
NAS-Message field and transmits an RRC Setup Complete
message.
・NAS Registration Request =

21：RRCSetupComplete [dedicated NAS message: Registration request]
{Registration type, 5G-GUTI,
Last TAI, Requested NSSAI,
UE Capability, List of PDU
Sessions}
☑ TS 38.212
・Format 0_0 - used to assign CRC scrambling to the UE in C-RNTI.
・DCI format 0_0 is used to allocate uplink resources to UEs.
※The following information is transmitted in DCI format 0_0 with PDCCH CRC
scrambled by the assigned C-RNTI.
【Reference】Registration Request
UE：RRCSetupComplete ➔ gNB：NGAP Initial UE Message ➔
➔ New AMF： Namf_Communication_UEContextTransfer Request ➔ Old AMF
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly allocated
AMF.
・The message is also passed to the old AMF to obtain the UE's AMF context.
【Reference】RRCSetupComplete（UE ➔ gNB）
☑ TS 38.331
・The UE sends an RRC Setup Complete message with a registration request in the
dedicated NAS message field.
【Reference】Initial UE Message（gNB ➔ New AMF）
☑ TS 38.413
・The gNB sends an initial UE message to the selected AMF.
・The message notifies the registration request received from the UE using the RRC Setup Complete
message.
・"RAN UE NGAP ID" and "RRC Establishment Cause" are also included in the message.
・The AMF uses the "RAN UE NGAP ID" to address the UE context on the gNB.
・Contains AN message and UE Policy Container.

※The AN message includes the following.
・AN parameters ・[Mapping Of Requested NSSAI]

・Registration Request ・UE Radio Capability Update
・Registration type ・UE MM Core Network Capability
・SUCI or 5G-GUTI or PEI ・MMはMobility Management?
・SUCI : Subscription Concealed Identifier ・PDU Session status
・5G-GUTI : 5G Globally Unique Temporary UE Identity ・List of PDU Sessions to be activated
・last visited TAI (if available) ・Follow on request
・TAI: Tracking Area Identity ・MICO mode preference
・Security Parameters ・MICO mode : Expected power saving mode used in IoT devices etc.
・Requested NSSAI ・MICO ： Mobile Initiated Connection Only
・network slice identifier ・Requested DRX parameters
・NSSAI : Network Slice Selection Assistance Information ・DRX ： Discontinuous Reception
・Technology that reduces power consumption by stopping the RF
(Radio Frequency) function and entering a sleep state during periods
when no signals are being received.
UE ： RRCSetupComplete ➔ gNB： NGAP Initial UE Message ➔
New AMF：Namf_Communication_UEContextTransfer Request ➔ Old AMF
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly
allocated AMF.
① ②
UE ： RRCSetupComplete ➔ gNB： NGAP Initial UE Message ➔
New AMF：Namf_Communication_UEContextTransfer Request ➔ Old AMF
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly
allocated AMF.
Get UE context from old AMF

25:Namf_Communication_UEContextTransfer Request
・NAS registration request
・Since 5G-GUTI is included in the registration request and the serving

AMF has changed since the last registration step, the new AMF
requests context transfer from the old AMF.
・The complete NAS registration message received from the UE is
included in the context request.
26：Check the
integrity of the "NAS
registration request"
included in the UE
context transfer ・Old AMF passes AMF UE Context to new AMF.
request。
27:Namf_Communication_UEContextTransfer Response
・UE Context in AMF

28：Save the UE
= {SUPI, 5G-GUTI,PEI, ・AMF saves the UE context
context
UE Radio Capability, acquired from Old AMF.
Registration Area, ...}
【Reference】Namf_Communication_UEContextTransfer Request
（New AMF ➔ Old AMF）
☑ 29.502、29.518
・New AMF requires context transfer from Old AMF.
・The complete NAS registration request message received from the UE is included in
the context request.
【Reference】Namf_Communication_UEContextTransfer Response
（Old AMF ➔ New AMF）
☑ 29.502、29.518
・Old AMF passes AMF UE Context to new AMF.
UE context in AMF：Integrity protection message from UE that triggers context transfer.
【Reference】UE Context in AMF（AMF）
☑ The complete UE context is managed by AMF.

・When the UE attempts to register with the "New AMF", the AMF passes this context
to the "New AMF".
【Reference】UE Context in AMF（Old AMF ➔ New AMF）
☑ AM policy association information includes the following AM policy information
and PCF ID.
【Reference】UE Context in AMF（Old AMF ➔ New AMF）
☑ Each access type level context within the UE access and mobility context
【Reference】UE Context in AMF（AMF）
☑ Context for each PDU session level
・Security header type,

・Identity request message 29:NAS Identity Request
・New AMF requests UE identification information (SUCI) from
identity, the UE via a NAS message.
・Identity type
30：Home Derive SUCI from
PLMN public key
・Security header type, 31:NAS Identity Response

・Identity response message ・UE responds to identity request。
identity,
・Mobile identity
32：AUSF selection
UDM
NAS authentication and security
・AMF requests UE authentication vector 33:Nausf_UEAuthenticate_authenticate Request
SUCI: Subscription Concealed and algorithm information from AUSF.
Identifier (Authentication server function)
・Request an authentication vector from 34:Nudm_UEAuthenticate_Get Request

SUCI: Subscription Concealed AUSF to UDM (Unified Data Management).
Identifier
【Reference】Identity Request（New AMF ➔ gNB ➔ UE）
☑ TS 24.501
・New AMF ➔ DL NAS Transport ➔ gNB ➔ DLInformationTransfer ➔ UE
・New AMF requests UE identification information (SUCI) from the UE via a NAS
message.
【Reference】Identity Response（UE ➔ gNB ➔ NewAMF）
☑ TS 24.501
・UE ➔ ULInformationTransfer ➔ gNB ➔ UL NAS Transport ➔ New AMF
・The UE responds to the identity request using SUCI.
・SUCI is derived from Home PLMN's public key.
【Reference】Nausf_UEAuthenticate_authenticate Request
（New AMF ➔ AUSF ）
☑ TS 33.501
・AMF requests the UE authentication vector and algorithm information from the
Authentication Server Function (AUSF).
・Resource URI: {apiRoot}/nausf-auth/v1/ue-authentications
【Reference】Nudm_UEAuthenticate_Get Request
（AUSF ➔ UDM）
☑ TS 29.503
・The Authentication Server Function (AUSF) requests an authentication vector from
the Unified Data Management Function (UDM).
UDM
35：
・The UDM generates an authentication Generati
vector for the session. ng the
authentic
ation
vector
・Authentication method and data ・UDM responds with authentication data. 36：Nudm_UEAuthenticate_Getレスポンス
・The response returns the master key used by

AMF to derive the NAS security key and other
security keys. 37：Nausf_UEAuthentication_authenticateレスポンス
・Authentication result, ・SUPI is also returned to AMF.
・SUPI
・ngKSI, ・RAND, 38:NAS Authentication Request ・Start the authentication procedure with the UE.
・AUTN, ・ABBA ・Send the key selectors RAND and AUTN to the UE.
39:NAS Authentication Response

・Authentication response ・The UE responds with an authentication response.
parameter
【Reference】Nudm_UEAuthenticate_Get Response
（UDM ➔ AUSF）
☑ TS 29.503, TS 33.501
・The UDM responds to the AUSF with an authentication vector.
【Reference】Nausf_UEAuthenticate_authenticate Response
（AUSF ➔ New AMF）
☑ TS 33.501
・Reply the master key used by AMF to derive the NAS security key and other
security keys.
【Reference】Authentication Request
（New AMF ➔ gNB ➔ UE）
☑ TS 24.501
・Start the authentication procedure with the UE.
※Send the key selectors RAND and AUTN to the UE.
【Reference】Authentication Response
（UE ➔ gNB ➔ New AMF）
☑ TS 24.501
・The UE responds to the authentication request.
・Selected NAS security

algorithms,Replayed UE security 40:NAS Security Mode Command ・The AMF signals the selected NAS security algorithm to the UE.
capabilities,IMEISV request, ・AMF also requests IMEISV from the UE.
ngKSI,Additional 5G security
information
41:NAS Security Mode Complete ・The UE signals completion of the NAS security procedure.
・NAS message container,
・The message contains the IMEISV.
IMEISV
・Since the AMF has been changed, the new

AMF notifies the old AMF that the UE’s
42:Namf_Communication_RegistrationComplete_Notify
registration with the new AMF is complete.
【Reference】NAS Security Mode Command
（New AMF ➔ gNB ➔ UE）
☑ TS 24.501
・The AMF notifies the selected NAS security algorithm to the UE.
・AMF also requests IMEISV from the UE.
【Reference】NAS Security Mode Complete
（UE ➔ gNB ➔ New AMF）
☑ TS 24.501
・UE notifies completion of NAS security procedure.
・The message includes IMEISV.
【Reference】Namf_Communication_RegistrationCompleteNotify
（New AMF ➔ Old AMF）
☑ 29.518, 23.502
Verify that the UE is not blacklisted

5G
EIR
・PEI is used to verify equipment. 43：Obtain PEI from UE context.
・PEI
・SUPI ・Call the Equipment Identity Check service. 44:N5g-eir_EquipmentIdentityCheck Request
・This service is provided by 5G-EIR to
check the PEI and determine if the PEI is
blacklisted.
45:N5g-eir_EquipmentIdentityCheck Response
・PEI checking result ・5G-EIR reports that mobiles (identified by PEI)
are not blacklisted.
【Reference】N5g-eir_EquipmentIdentityCheck Request
（New AMF ➔ 5G-EIR）
☑ TS 23.502
・This service is provided by 5G-EIR to check the PEI and determine if the PEI is
blacklisted.
Register with UDM and get subscription data
・Select the Unified Data UDM

46：UDMの選択
Management service entity.
・PUT,
Amf 3Gpp Access
Registration = { AMF
Instance Id, Supported ・Since AMF has been changed, 47:Nudm_UEContextManagement_Registration Request
Features, PEI, dereg New AMF is registered in UDM.
Callback Uri, ...}
48:Nudm_UEContextManagement_Registration Response
・204 No Content ・The response code "204 No Content"
indicates that the registration was successful.
・GET,
Requested data = 49:Nudm_SubscriberDataManagement_Get Request
Access and Mobility ・AMF requests access and
Subscription data mobility subscription data.
・Access and Mobility 50:Nudm_SubscriberDataManagement_Get Response

Subscription data = ・The UDM responds with the
{Supported Features, requested data.
GPSI array, Network
Slice Selection Info, ...}
【Reference】Nudm_UEContextManagement_Registration Request
（New AMF ➔ UDM）
☑ TS 29.503
・5G-EIR supports PEI blacklist check.
・Resource URI for 3GPP access:
・{ueid}represents the subscriber identifier SUPI or GPSI (see 3GPP TS 23.501)

・SUPI (i.e. imsi or nai) is used with PUT and PATCH methods.
・GPSI (i.e. msisdn or extid) is used with the GET method.
※The UEID pattern is as follows.
【Reference】Amf3GppAccessRegistration
【Reference】Amf3GppAccessRegistration
【Reference】Nudm_UEContextManagement_Registration Response
（UDM ➔ New AMF）
☑ TS 29.503
【Reference】Nudm_SubscriberDataManagement_Get Request
☑ TS 29.503

・GET,
Requested data = SMF
UDM
Selection Subscription
data ・AMF retrieves SMF selective 51:Nudm_SubscriberDataManagement_Get Request
subscription data.
・SMF Selection
Subscription data =
{Supported Features, ・The UDM responds with the 52:Nudm_SubscriberDataManagement_Get Response
List of S-NSSAIs and requested data.
associated information}
・GET, ・AMF obtains the UE context in 53:Nudm_SubscriberDataManagement_Get Request

Requested data = UE the SMF data.
context in SMF data
・UE context in SMF data

・The UDM responds with the 54:Nudm_SubscriberDataManagement_Get Response
= {PDU Session
requested data.
Information, FQDNs for
EPC Interworking}
【Reference】Nudm_SubscriberDataManagement_Get Request
☑ TS 29.503
【Reference】Nudm_SubscriberDataManagement_Get Response
（UDM ➔ New AMF）
☑ TS 29.503
55：Creation of UE ・Create an AMF UE context for a user. UDM

context
・The old AMF will be notified that it is no longer

providing services to users. 56:Nudm_UEContextManagement_Deregistration_Notify
・UDM sends the POST request provided by Old AMF
during registration to callbackReference
(deregCallbackUri field of Amf3GppAccessRegistration).
・SUPI, ・Old Indicates to SMF that AMF is not 57:Nsmf_PDUSession_ReleaseSMContext

PDU Session ID associated with the specified PDU session.
58：Delete UE
context
【Reference】Nudm_UEContextManagement_Deregistration_Notify
（UDM ➔ Old AMF）
☑ TS 29.503
・The following procedures using the DeregistrationNotification service operation are
supported:
⇒UDM starts deregistering NF.
① UDM sends a POST request to callbackReference as provided by Old AMF during

registration. (See Amf3GppAccessRegistration deregCallbackUri field).
② Old AMF service consumer responds with "204 No Content".
【Reference】Nsmf_PDUSession_ReleaseSMContext
（Old AMF ➔ SMF）
☑ TS 23.502
・This message allows the AMF-SMF association for a particular PDU session to be
released because the PDU session has been released.
・Update the policy association with PCF.

・PCF registers AMF events.
・Select service entities for policy and

59：Selection of PCF
billing functions.
・AMF liaises with PCF to create policy associations.

60:Npcf_AMPolicyControl_Create Request
・And searching for UE policies and/or access and
mobility control policies.
・Policy Association Request =

・The PCF responds with policy 61:Npcf_AMPolicyControl_Create Response
{ SUPI, GPSI, PEI, User
association information.
Location, ...}
・PCF registers events such as “Location Report”, 62:Namf_EventExpose_Subscribe Request

“Registration State Report”, and “Communication
Failure Report”.
・201 Created, Amf 63:Namf_EventExpose_Subscribe Response

・AMF responds with "201 Created"
Created Event
to indicate successful registration.
Subscription
【Reference】
Npcf_AMPolicyControl_Create Request（New AMF ➔ PCF）
☑ TS 29.513、TS 29.507
・URI configuration：{apiRoot}/{apiName}/{apiVersion}/{apiSpecificResourceUriPart}
※apiRoot: Must be configured as described in 3GPP TS29.501.
※apiName：「npcf-am-policy-control」
※apiVersion：「v1」。
※apiSpecificResourceUriPart: Specify an API-specific string.
【Reference】 Npcf_AMPolicyControl_Create Response
（PCF ➔ New AMF）
☑ TS 29.513、TS 29.507
・The PCF responds with policy association information.
【Reference】 Namf_EventExpose_Subscribe Request
☑ TS 29.518、TS 23.502
・Applications can subscribe to AMF events by sending subscription requests.
※Resource URI: {apiRoot}/namf-evts/v1/subscriptions
PCF can register for the following events.

Event explanation
Location-Report The NF subscribes to this event to receive the last known location of the UE or group of UEs, and the updated
location of the UE or any UE in the group when the AMF becomes aware of a UE's location change.
Presence-In-AOI-Report The NF subscribes to this event to receive the current state of the UEs within a particular area of interest (AOI)
and receive notifications when the specified UE enters or exits the specified area. Areas can be identified by TA
list, area ID, or specific area of interest name such as "LADN."
Time-Zone-Report NF subscribes to this event. And the current time zone of the UE or group of UEs, and receives the updated
time zone of the UE or any UE in the group once the AMF recognizes the UE's time zone change.
Access-Type-Report The NF subscribes to this event to receive the current access type of the UE or UE group. When the AMF
recognizes a change in the UE's access type, it updates the access type of the UE or any UE in the group.
【Reference】 Namf_EventExpose_Subscribe Request
PCF can register for the following events.
Event 説明
Registration-State-Report NFは、このイベントをサブスクライブして、UEまたはUEのグループの現在の登録状態を受信する。AMFがUEの登録状態の変化を認識すると、
UEまたはグループ内の任意のUEの更新された登録状態について報告する。
Presence-In-AOI-Report NFはこのイベントにサブスクライブして、特定の関心領域（AOI）内のUEの現在の状態を受信し、指定されたUEが指定された領域に出入
りしたときに通知を受け取る。エリアは、TAリスト、エリアID、または「LADN」などの特定の関心のあるエリア名で識別できる。
Connectivity-State-Report NFは、このイベントをサブスクライブして、UEまたはＵＥグループの現在の接続状態を受信する。AMFがUEの接続状態の変化を認識すると、
UEまたはグループ内の任意のUEの更新された接続状態について報告する。
Reachability-Report NFは、このイベントをサブスクライブして、UEまたはUEグループの現在の到達可能性を受信する。AMFがUEの到達可能性の変化を認識す
ると、UEまたはグループ内の任意のUEの更新された到達可能性について報告する。
Subscribed-Data-Report NFはこのイベントにサブスクライブして、UDMから受信したUEの現在のサブスクライブデータを受信する。AMFがUDMからUEの更新されたサブ
スクライブデータを受信したときに通知を受信する。
Communication-Failure-Report NFはこのイベントをサブスクライブして、UEまたはUEのグループまたは任意のUEの通信障害レポートを受信する。
UEs-In-Area-Report NFはこのイベントにサブスクライブして、特定のエリアのUEの数を受信する。NFは、最後の既知の位置に
基づいてエリア内のUEをAMFに要求するか、または現在の位置に基づいてエリア内のUEを積極的に探すようにAMFに要求することができる。
【Reference】 Namf_EventExpose_Subscribe Response
（New AMF ➔ PCF）
☑ TS 29.518、TS 23.502
・Response code : 201Created is returned in AmfCreatedEventSubscription.
※A "201Created" code indicates a successful subscription.
AmfCreatedEventSubscription
・Update the policy association with PCF.

・PCF registers AMF events.
・Old AMF requests deletion of the policy 64:Npcf_AMPolicyControl_Delete

association when the corresponding UE
context is terminated.
・PCF uses the HTTP response code 「204 No Content」 65:Npcf_AMPolicyControl_Delete Response
to signal a successful deletion.
・204 No Content
【Reference】 Npcf_AMPolicyControl_Delete
（Old AMF ➔ PCF）
☑ TS 29.513、TS 29.507
・Old AMF requests the policy association to be deleted when the corresponding UE
context is terminated.
※For old AMFs, use the URI below to start deleting them.
{apiRoot}/npcf-am-policy-control/v1/policies/{polAssoId}
【Reference】 Npcf_AMPolicyControl_Delete Response
（PCF ➔ Old AMF）
☑ TS 29.513、TS 29.507
・PCF will notify the deletion was successful with a 204 NoContent cause code.
※Upon success, an empty response body is returned.
Configure user plane function (UPF)
・Since the "list of PDU sessions to be launched"

・PDU Sessions, Operation
was included in the registration request, the new 66:Nsmf_PDUSession_UpdateSMContext Request
Type = UP activate
AMF initiates a restart of the PDU sessions.
・Requests Session Management Facility (SMF) to
establish a new session.
67:Assign UE IP
・Assign a UE address to a PDU session.
Address.
・Assign the TEID that the gNB should 68：Assign PDU

use when sending uplink GTP PDUs to session uplink
the UPF. TEID
・Select the user data plane for any subscriber. 69：Select UPF
【Reference】 Nsmf_PDUSession_UpdateSMContext Request
（New AMF ➔ SMF）
☑ TS 23.502
・Update AMF-SMF association to support PDU sessions.
・Provide the N1/N2SM information received from the UE or AN to the SMF.
Configure user plane function (UPF)
・Packet Forwarding Control Protocol 70：PFCP session modification request

・PDU Sessions, Operation (PFCP) is used between the SMF
Type = UP activate control plane and the UPF data plane.
・Session changes are notified to the N4 N4
data plane.
・Session endpoint identifier.
71:Downlink Data
・The UPF starts receiving data destined for the UE.
・Since the PDN session is not established at the 72：Start buffer

gNB and UE, the UPF needs to buffer the data. downlink data
73：PFCPセッション変更応答
・After the session modification is complete,
the UPF data plane responds to the SMF
control plane. N4 N4
・Session endpoint identifier.
74:Nsmf_PDUSession_UpdateSMContext Response
・SMF notifies AMF that the session
management context has been updated.
【Reference】 Nsmf_PDUSession_UpdateSMContext Response
（SMF ➔ New AMF）
☑ TS 23.502
・SMF notifies AMF that the session management context has been updated.
・AMF assigns an "AMF UE NGAP ID".

75：Allocate AMF UE
The gNB uses this ID to address the UE context
NGAP ID
on the AMF.
・AMF UE NGAP ID, 76:Initial Context Setup Request [NAS-PDU: Registration Accept］
・RAN UE NGAP ID,
・UE Aggregate Maximum Bit
Rate,
・GUAMI, PDU Session
Resource Setup Request ・AMF starts setting up a session with gNB.
List, ・The message usually includes a Registration Accept NAS message.
・PDU Session ID, ・The message carries one or more PDU session setup requests.
・PDU Session Uplink TEID, ・Each PDU session is addressed by a "PDU session ID".
・UE IP Address, ・The message also carries the uplink TEID for each PDU session.
・NAS-PDU,
・S-NSSAI, PDU Session
Resource Setup Request
※The message also carries the “AMF UE NGAP ID”, “UE aggregate
Transfer,
maximum bit rate", UE security capabilities and security key.
・Allowed NSSAI, UE Security
Capabilities,
・Security Key
【Reference】 Initial Context Setup Request
（AMF ➔ eNB）
☑ TS 38.413
・The purpose of the procedure is to establish the overall initial UE context required at
the NG-RAN node.
・Includes PDU session context, security keys, mobility restriction list, UE radio
capabilities and UE security capabilities, etc., as required.
・The message usually includes a Registration AcceptNAS message.
・The message contains one or more PDU session setup requests.
※Each PDU session is addressed by a "PDU session ID".
5G-NR AS Security Procedures
77:SecurityModeCommand
・securityConfigSMC
{securityAlgorithmConfig}
78：Derive the K-gNB key ・K-gNB is a key derived by UE and AMF from K-AMF.
79：Derive the K-RRC-int key associated

with the integrity protection algorithm
80：Verify security mode command

message integrity protection
81：Derive the K-UP-int key associated

with the integrity protection algorithm
82：Start up SRB Integrity Protect ・Configure the lower layer to apply SRB integrity protection
using the specified algorithm and K-RRC-int key immediately.
【Reference】 SecurityModeCommand
（gNB ➔ UE）
☑ TS 38.331
・The SecurityModeCommand message is used to command the activation of AS security.
・Upon receiving the security mode command, the UE performs the following actions:
⇒ Get the K-gNB key. (K-gNB is the key that UE and AMF are derived from K-AMF)
⇒ Derive the K-RRC-int key associated with the integrity protection algorithm.
⇒Check the integrity protection of the security mode command message.
⇒ Derive the K-UP-int key associated with the integrity protection algorithm.
⇒Start SRB integrity protection.
5G-NR AS security procedures (continued)
83:SecurityModeComplete ・The security mode completion message confirms that the security mode
command has completed successfully.
・This message is integrity protected but not encrypted.
・Encryption will start immediately after sending this message.
・Once the steps are complete, configure the lower layer to apply SRB encryption using
84：Initiating SRB encryption
the``indicated algorithm'', ``K-RRC-enc key‘’.
・Security mode completion message is not encrypted.
【Reference】 SecurityModeComplete
（UE ➔ gNB）
☑ TS 38.331
・The SecurityModeComplete message is used to confirm that a security mode command has
completed successfully.
・Sending this message will enable encryption.
⇒The security mode completion message itself is not encrypted.
(However, the integrity of the message is protected.)
5G-NR RRC reconfiguration

・The RRC reconfiguration message is sent to the UE after configuring
the "radio bearer" and "secondary cell" to start UE measurement.
・masterCellGroup,
secondaryCellGroup,
・radioBearerConfig 85:RRCReconfiguration
(drb-ToAddModList), [Registration Accept (5GS registration result, PDU session status)]
・ MeasConfig
(Measurement Config)
86：Perform the steps to configure the

primary cell group
87：Perform the secondary cell group

configuration procedure.
88：Perform the radio bearer

configuration procedure.
89：Start measurements based on the

received MeasConfig
90：Processing NAS messages and

setting up PDU sessions to accept
registrations
【Reference】 SecurityModeCommand
（gNB ➔ UE）
☑ TS 38.331
・The purpose of the message is to change the RRC connection.
⇒ For example, establishing/changing/releasing RB, performing reconfiguration by
synchronization, setting up/changing/releasing measurements, adding/changing/releasing, Scells and
cell groups.
・As part of the procedure, NAS-specific information can be transferred from the network to the UE.
【Reference】 RRCReconfiguration
（gNB ➔ UE）
☑ TS 38.331
・The message has the following fields.
①Registration Accept
➁masterCellGroup
➂secondaryCellGroup
④radioBearerConfig
➄MeasConfig
5G-NR RRC reconfiguration (continued)
・plinkTxDirectCurrentList 91:RRCReconfigurationComplete ・Confirm that RRC connection

[ {servCellIndex, reconfiguration has completed
uplinkDirectCurrentBWP}] successfully.
【Reference】RRCReconfigurationComplete
（gNB ➔ New AMF）
☑ TS 38.331
・The RRC Reconfiguration Complete message is used to confirm that the
reconfiguration of the RRC connection has been completed successfully.
・Assign a TEID that the UPF will use

92：Assign PDU session downlink TEID to send downlink data to the gNB.
93:Initial Context Setup Response ・The gNB notifies that the PDU session
・PDU Session Downlink TEID setup was successful.
・This message also includes the Downlink
TEID that must be used (specified for
each PDU session).
94:NAS Registration Complete

・The UE notifies the AMF of the completion
of registration via a "Registration Complete"
message.
【Reference】 Initial Context Setup Response
（UE ➔ gNB）
☑ TS 38.413
・This message is sent by the NG-RAN node to confirm the setup of the UE context.
【Reference】 NAS Registration Complete
（UE ➔ gNB ➔ AMF）
☑ TS 24.501
・UE ➔ （ULInformationTransfer） ➔ gNB ➔ （UL NAS Transport） ➔ New AMF。
Initiating downlink and uplink data transfer
95:Uplink Data ・The UE starts transferring

data after the uplink path
UTEID is established.
・gNB sends UE data to
uplink TEID.
ｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑ
96:Uplink Data
・UPF begins transmitting data to the Internet.
・Session Management
97:Nsmf_PDUSession_UpdateSMContext Request
Downlink TEID ・AMF modifies the session
management context based on
ｑｑｑｑｑ
updates from the gNB.
【Reference】 Nsmf_PDUSession_UpdateSMContext Request
（AMF ➔ SMF）
☑ TS 23.502
・Update AMF-SMF association to support PDU sessions.
・Provide the N1/N2SM information received from the UE or AN to the SMF.
Initiate downlink and uplink data transfer (continued)
・Session Endpoint 98:PFCP Session Modification Request

Identifier, ・The SMF control plane notifies the
・Session Management UPF data plane of session updates. N4 N4
Downlink TEID
・Since the downlink path is
99：End of buffer
configured, UPF can stop buffering
downlink data
data.
ｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑ・UPF sends buffered data to gNB
100:Downlink Data using downlink TEID for PDU
DL ｑｑｑｑｑ session.
TEID
・All new downlink data also follows
the same path.
【Reference】 PFCP Session Modification Request
（SMF ➔ UPF）
☑ TS 29.244
・The PFCP session change request is used by the CP function via the Sxa, Sxb, Sxc, and N4
interfaces to request the UP function to change the PFCP session.
Initiate downlink and uplink data transfer (continued)
101:PFCP Session Modification Response

・Session Endpoint Identifier ・The UPF data plane responds to the
SMF control plane. N4 N4
・Session Endpoint Identifier ・SMF notifies AMF that the 102:Nsmf_PDUSession_UpdateSMContext Response
session management
update is complete.
context
ｑｑｑｑｑ
【Reference】 Nsmf_PDUSession_UpdateSMContext Response
（SMF ➔ AMF）
☑ TS 23.502
・SMF notifies AMF that the session management context update is complete.
APPENDIX
5GCに接続されているNRによって使用される識別子
☑ The following identification information is used for scheduling at cell level:
identifier Purpose
C-RNTI Unique UE identifier used as identifier of RRC connection and for scheduling
CS-RNTI Unique UE identifier used for semi-persistent scheduling on the downlink or

configured grants on the uplink
INT-RNTI Identifier representing interrupt right on downlink
SI-RNTI Identifier for broadcast and system information on the downlink
SP-CSI-RNTI Unique UE identifier used for semi-persistent CSI reporting on PUSCH
☑ The following identification information is used to control power and slot format
identifier Purpose
SFI-RNTI Identify slot format
TPC-PUCCH-RNTI Unique UE identification to control PUCCH power
TPC-PUSCH-RNTI Unique UE identification to control PUSCH power
TPC-SRS-RNTI Unique UE identification to control SRS power
☑ Identifier used during the random access procedure.
identifier Purpose
RA-RNTI Identification of random access responses on the downlink
Temporary C-RNTI UE identity used temporarily for scheduling during random access procedures
Random value for UE identification temporarily used for conflict resolution purposes during
contention resolution random access procedures
☑ In the NR connected to 5GC, the following UE IDs are used at the NG-RAN level.
identifier Purpose
I-RNTI Identify UE context with RRC_INACTIVE
ネットワーク識別子
☑ To identify a specific network entity, the following IDs are used in NG-RAN:
identifier Purpose
AMF Name Identify AMF.
NR Cell Global Identifier Identifies NR cells globally.
(NCGI) The NCGI consists of the PLMN ID to which the cell belongs and the cell's NR
Cell Identity (NCI).
gNB Identifier (gNB ID) Identify gNB within PLMN.
The gNB ID is included in the NCI for that cell.
Global gNB ID Identify gNB globally.
The global gNB ID is composed of the PLMN ID to which the gNB belongs and
the gNB ID.
MCC and MNC are the same as those included in NCGI.
Tracking Area identity (TAI) Identify tracking area.
The TAI is composed of the PLMN ID to which the tracking area belongs and the
tracking area's TAC (Tracking Area Code).
Single Network Slice Identify network slices.
Selection Assistance
information (S-NSSAI)
5G Identifiers
☑ 5G-GUTI
GUTI: Unique global identifier for the UE that does not reveal SUPI.
☑ SUPI
・IMSI：A Subscription Permanent Identifier is assigned to each subscriber accessing
the 5G network.
☑ SUCI
・P-TMSI + MCC + MNC: The subscription hiding identifier is a global identifier that
can hide the UE identity.
・SUCI may also be used by the visiting network to obtain the authentication vector
from the home network.
☑ PEI
・IMEI: Each UE accessing the 5G network is assigned a Permanent Equipment
Identifier.
5G Identifiers
☑ GOSI
・Generic Public Subscription Identifier is used to handle 3GPP subscriptions in non-
3GPP networks.
☑ 5G-S-TMSI
・S-TMSI: An abbreviation of 5G-GUTI used in radio signaling procedures.
・<5G-S-TMSI> = <AMF set ID> <AMF pointer> <5G--TMSI>
It is difficult to understand the 3GPP standardization
technical specifications simply by translating and reading
them.
To understand this, it is essential to check consistency with

actual communication logs based on actual call flow
scenarios, but currently such materials are not widely
THANK YOU FOR
shared in Japan. VIEWS
This document was created within our company to
improve understanding and knowledge of 3GPP technical
specifications. ryuichi@centimani.biz
The content is created to exclude vendor/carrier
dependence as much as possible, but it may contain
descriptions that are not consistent with systems that have
been standardized or put into practical use.
This material is royalty-free.Please use it to help readers

consolidate their knowledge and improve their work
productivity.

3GPP 5G SA For Field Engineer: English Version

Uploaded by

Copyright:

Available Formats

You might also like

3GPP 5G SA For Field Engineer: English Version

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

3GPP 5G SA For Field Engineer: English Version

Uploaded by

Copyright:

Available Formats

English version

3GPP 5G SA for field Engineer

１．5G RAN & 5GC Access flow

２．5G SA NR＋5G Core detailed Access call flow

RRC Idle precondition UE Context

5G-NR RRC connection configuration

NAS registration related procedures

AMF identifier related procedures

NAS identifier related procedures

NAS identifier related procedures

NAS identifier related procedures

UE authentication related procedures

UE authentication related procedures

UE authentication related procedures

NAS authentication related procedures

NAS security related procedures

Procedures related to subscriber data management

UE context management related procedures

Session release related

UE context management related procedures

PCF selection related procedures

PCF registration related procedures

Session release related procedures

UE context management related procedures

User plane configuration related

NAS registration related

AS security registration related

Initial Context setting related

NAS registration related procedures

Procedures related to DL/UL data transfer

1:MIB（Master Information Block） ・Cell search and downlink synchronization

2:SIB 1（System Information Block）

5G-NR RRC connection setup

4:T300 ・Start the T300 and wait for the RRC

☑ TS 38.213、 TS 38.321、 TS 38.211

s_id：Index of the first OFDM symbol in the specified PRACH（0≦s_id ＜14）

The following information is transmitted in RA-RNTI scrambled DCI format 1_0.

☑ E/T/RAPID MAC subheader

☑ MAC Payload for Random Access Response

・Frequency domain resource allocation

13：Setup SRB1 ・Signaling radio bearer 1 is configured.

・radioBearerConfig 14:Msg4: RRCSetup

17：Performing the cell group configuration

☑ Format 1_0 CRC scramble with C-RNTI

5G-NR RRC connection settings

20：Registration Request NAS

・NAS Registration Request =

・Contains AN message and UE Policy Container.

・AN parameters ・[Mapping Of Requested NSSAI]

Get UE context from old AMF

・Since 5G-GUTI is included in the registration request and the serving

・UE Context in AMF

UE context in AMF：Integrity protection message from UE that triggers context transfer.

☑ The complete UE context is managed by AMF.

☑ Context for each PDU session level

・Security header type,

・Security header type, 31:NAS Identity Response

・Request an authentication vector from 34:Nudm_UEAuthenticate_Get Request

1:MIB（Master Information Block）・Cell search and downlink synchronization