SA call flow

2023/10/12 Thursday 1
COPYRIGHT © 2022 Centimani CO. CONFIDENTIAL. ALL RIGHTS RESERVED
3GPP 5G Standalone Access Registration Call flow Rev3.00
August 24, 2022
Centimani corporation（Technical advisor RYUICHI YASUNAGA）
3GPP 5G SA for field Engineer
English version

内容
１．5G RAN & 5GC Access flow
２．5G SA NR＋5G Core detailed Access call flow
Appendix

１．5G RAN & 5GC ACCESS FLOW

5G RAN & 5GC Access flow
2023/10/12 Thursday 4
5G-NR RRC connection configuration
procedure
precondition
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
RRC Idle UE Context
Internal
processing
NAS registration related procedures
NAS identifier related procedures
Internal
processing
5G-EIR UDM
AMF identifier related procedures

2023/10/12 Thursday 5
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Internal
processing
Internal
processing
UE authentication related procedures
5G-EIR UDM
UE authentication related
procedures
Internal
processing
UE authentication related
procedures

2023/10/12 Thursday 6
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Internal
processing
Internal
processing
NAS authentication related procedures
Registration related
procedures
NAS security related procedures
Internal
processing
5G-EIR UDM
Identifier confirmation related procedures
Procedures related to subscriber data management

2023/10/12 Thursday 7
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Internal
processing
Internal
processing
5G-EIR UDM
UE context management related procedures
PCF selection related procedures
Session release related
procedures
Internal
processing
PCF registration related procedures

2023/10/12 Thursday 8
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Internal
processing
5G-EIR UDM
User plane configuration related
procedures
Session release related procedures
AS security registration related
procedures
NAS registration related
procedures
RRC Reconfiguration related
procedures
Internal
processing

2023/10/12 Thursday 9
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Internal
processing
5G-EIR UDM
Procedures related to DL/UL data transfer
Initial Context setting related
procedures
NAS registration related procedures

２．5G SA NR＋5G CORE DETAILED ACCESS CALL FLOW

5G SA NR＋5G Core detailed Access call flow
2023/10/12 Thursday 11
precondition
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
0:RRC Idle
0:UE Context
UE context already exists in Old AMF
DL-Sync
・Cell search and downlink synchronization
・Cell search is a procedure in which the UE acquires
time and frequency synchronization with the cell and
decodes the cell ID and PBCH (MIB) information.
1:MIB（Master Information Block）
2:SIB 1（System Information Block）

2023/10/12 Thursday 12
5G-NR RRC connection setup
3:Msg1: Preamble
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
(Zadoff-Chu sequence)
5: Start PDCCH decoding
for RA-RNTI
4:T300 ・Start the T300 and wait for the RRC
Setup message from the network.
・UE selects a random preamble. The preamble is referred to as a random
access preamble ID (RAPID).
※Preamble transmission is Zadoff-Chu sequence.
6：Assign temporary C-RNTI
・In response to the PRACH transmission, the UE attempts to detect DCI format 1_0 with the CRC
scrambled by the RA-RNTI corresponding to the RACH transmission.
・The UE looks for messages during a configured window of length ra-ResponseWindow.
・The tentative C-RNTI assignment is signaled to the UE in a random
access response message.

【Reference】Preamble （UE ➔ gNB）
2023/10/12 Thursday 13
☑ TS 38.213、 TS 38.321、 TS 38.211
・The UE selects a random preamble.
・The preamble is referenced by a random access preamble ID (RAPID).
・Preamble transmission is Zadoff-Chu sequence.
・Each preamble transmission is associated with an RA-RNTI.
RA-RNTI
The RA-RNTI associated with the PRACH for which the random access preamble is sent
is calculated as follows.
RA-RNTI= 1 + s_id + 14 × t_id + 14 × 80 × f_id + 14 × 80 × 8 × ul_carrier_id
s_id：Index of the first OFDM symbol in the specified PRACH（0≦s_id ＜14）
t_id：The index of the first slot of the specified PRACH within the system frame（0≦t_id ＜80）
f_id：Index of the specified PRACH in the frequency domain（0≤f_id <8）
ul_carrier_id：Uplink carrier used for Msg1 transmission 0 for NUL carriers, 1 for SUL carriers）

2023/10/12 Thursday 14
5G-NR RRC接続設定
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・Frequency domain resource
allocation
・Time domain resource allocation
・Downlink MCS
7:PDCCH DCI Format 1_0 [RA-RNTI]
・The RA-RNTI scrambled DCI message signals the frequency
and time resources allocated for the transmission of the
transport block containing the random access response
message.
・Timing advance command
・UL permission = {frequency hopping
flag, Msg3 PUSCH frequency + time
resource allocation, uplink MCS, TPC
command, CSI request},
・Temporary C-RNTI)
8:Msg2: Random Access Response
・The UE detects DCI format 1_0 with CRC scrambled by
the corresponding RA-RNTI and receives the transport
block on the corresponding PDSCH.
・RAR carries timing advances, uplink grants, and
provisional C-RNTI assignments.
9：ue-identity = random number
between 0 and 2^39-1
・The UE chooses a random identity that will be used during conflict resolution.
10：Extract UL Grant from RAR ・The uplink allocation contained in the RAR will be used to send Msg3 (RRC configuration request).
T300
Timer

【Reference】PDCCH DCI Format 1_0（gNB ➔ UE）
2023/10/12 Thursday 15
☑ TS 38.212
・DCI format 1_0 is used to allocate downlink resources.
・CRC scramble using format 1_0 RA-RNTI.
・In response to the PRACH transmission, the UE attempts to detect DCI format 1_0
with the PDCCH CRC scrambled by the RA-RNTI corresponding to the RACH
transmission.
・The UE looks for messages between a configured window of length ra-
Response Window.
・The RA-RNTI scrambled DCI message signals the frequency and time resources
allocated for the transmission of the transport block containing the random access
response message.

2023/10/12 Thursday 16
The following information is transmitted in RA-RNTI scrambled DCI format 1_0.

【Reference】Random Access Response（gNB ➔ UE）
2023/10/12 Thursday 17
☑ TS 38.213, TS 38.321
・The UE confirms the PDCCH addressed by the RA-RATI.
・Once the PDCCH with RA-RNTI is decoded, the UE receives the downlink transport block
using the RB resources in the message.
・The downlink transport block includes MAC PDUs.
・A UE MAC PDU is composed of one or more MAC sub-PDUs.
・Since multiple UEs may send preambles on the same RACH occasion, they will all be
addressed by the same RA-RNTI.

2023/10/12 Thursday 18
☑ MAC PDU
☑ E/T/RAPID MAC subheader

2023/10/12 Thursday 19
☑ MAC Payload for Random Access Response

2023/10/12 Thursday 20
☑ RAR UL Grant

2023/10/12 Thursday 21
5G-NR RRC接続設定
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・ue-Identity,
・establishment Cause
11:Msg3: RRCSetupRequest
・RRC Setup Request is sent with random ue-Identity and
establishment cause.
・Frequency domain resource allocation
・Downlink MCS
12：PDCCH DCI format１_０［C-RNTI］・The C-RNTI scrambled DCI message signals the frequency and time
resources allocated for the transmission of the transport block containing
the RRC setup message.
13：Setup SRB1 ・Signaling radio bearer 1 is configured.
・radioBearerConfig
{srb-ToAddModList、}
・masterCellGroup
{cellGroupId、rlc-
BearerToAddModList、mac-
CellGroupConfig、
physicalCellGroupConfig}
14:Msg4: RRCSetup
・The RRC configuration message is sent to the master cell with configuration SRB1.
※The message carries the radioBearerConfig and masterCellGroup information elements.
15:T300
16.RRC Connected
17：Performing the cell group configuration
steps
・The UE stops the T300 when receiving the RRC configuration message.

【Reference】RRCSetupRequest （UE ➔ gNB）
2023/10/12 Thursday 22
☑ 38.331
・RRC Setup Request is sent with random ue-Identity and establishment cause.
・The following probable causes are defined.

2023/10/12 Thursday 23
☑ Format 1_0 CRC scramble with C-RNTI
・The following information is transmitted in DCI format 1_0 with PDCCH CRC
scrambled by the assigned C-RNTI.

【Reference】RRCSetup（gNB ➔ UE）
2023/10/12 Thursday 24
☑ 38.331
・The RRC configuration message is sent to the master cell with configuration SRB1.
・The message carries the radioBearerConfig and masterCellGroup information elements.

2023/10/12 Thursday 25
☑ 38.331
・ The RRCSetup message carries radioBearerConfig and masterCellGroup information elements.
☑ RadioBearerConfig

2023/10/12 Thursday 26
☑ 38.331
・ The RRCSetup message carries radioBearerConfig and masterCellGroup information elements.
☑ CellGroupConfig

2023/10/12 Thursday 27
5G-NR RRC connection settings
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
21：RRCSetupComplete [dedicated NAS message: Registration request]
・The UE specifies "Registration Request" in the dedicated
NAS-Message field and transmits an RRC Setup Complete
message.
・Frequency domain resource allocation
・Uplink MCS
19:PDCCH DCI Format 0_0 [C-RNTI] ・The gNB allocates uplink resources to send the RRC
setup complete message to the UE.
18：Perform radio bearer
configuration procedure
・NAS Registration Request =
{Registration type, 5G-GUTI,
Last TAI, Requested NSSAI,
UE Capability, List of PDU
Sessions}
20：Registration Request NAS
メッセージを準備する

2023/10/12 Thursday 28
☑ TS 38.212
・Format 0_0 - used to assign CRC scrambling to the UE in C-RNTI.
・DCI format 0_0 is used to allocate uplink resources to UEs.
※The following information is transmitted in DCI format 0_0 with PDCCH CRC
scrambled by the assigned C-RNTI.

【Reference】Registration Request
2023/10/12 Thursday 29
UE：RRCSetupComplete ➔ gNB：NGAP Initial UE Message ➔
➔ New AMF： Namf_Communication_UEContextTransfer Request ➔ Old AMF
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly allocated
AMF.
・The message is also passed to the old AMF to obtain the UE's AMF context.

【Reference】RRCSetupComplete（UE ➔ gNB）
2023/10/12 Thursday 30
☑ TS 38.331
・The UE sends an RRC Setup Complete message with a registration request in the
dedicated NAS message field.

【Reference】Initial UE Message（gNB ➔ New AMF）
2023/10/12 Thursday 31
☑ TS 38.413
・The gNB sends an initial UE message to the selected AMF.
・The message notifies the registration request received from the UE using the RRC Setup Complete
message.
・"RAN UE NGAP ID" and "RRC Establishment Cause" are also included in the message.
・The AMF uses the "RAN UE NGAP ID" to address the UE context on the gNB.

2023/10/12 Thursday 32
・Contains AN message and UE Policy Container.
※The AN message includes the following.
・[Mapping Of Requested NSSAI]
・UE Radio Capability Update
・UE MM Core Network Capability
・MMはMobility Management?
・PDU Session status
・List of PDU Sessions to be activated
・Follow on request
・MICO mode preference
・MICO mode : Expected power saving mode used in IoT devices etc.
・MICO ： Mobile Initiated Connection Only
・Requested DRX parameters
・DRX ： Discontinuous Reception
・Technology that reduces power consumption by stopping the RF
(Radio Frequency) function and entering a sleep state during periods
when no signals are being received.
・AN parameters
・Registration Request
・Registration type
・SUCI or 5G-GUTI or PEI
・SUCI : Subscription Concealed Identifier
・5G-GUTI : 5G Globally Unique Temporary UE Identity
・last visited TAI (if available)
・TAI: Tracking Area Identity
・Security Parameters
・Requested NSSAI
・network slice identifier
・NSSAI : Network Slice Selection Assistance Information

2023/10/12 Thursday 33
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly
allocated AMF.
UE ： RRCSetupComplete ➔ gNB： NGAP Initial UE Message ➔
New AMF：Namf_Communication_UEContextTransfer Request ➔ Old AMF
① ②

2023/10/12 Thursday 34
☑ TS 24.501
・The Registration Request NAS message is conveyed from the UE to the newly
allocated AMF.
UE ： RRCSetupComplete ➔ gNB： NGAP Initial UE Message ➔
New AMF：Namf_Communication_UEContextTransfer Request ➔ Old AMF
③

2023/10/12 Thursday 35
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
25:Namf_Communication_UEContextTransfer Request
・NAS registration request
27:Namf_Communication_UEContextTransfer Response
・Since 5G-GUTI is included in the registration request and the serving
AMF has changed since the last registration step, the new AMF
requests context transfer from the old AMF.
・The complete NAS registration message received from the UE is
included in the context request.
・UE Context in AMF
= {SUPI, 5G-GUTI,PEI,
UE Radio Capability,
Registration Area, ...}
26：Check the
integrity of the "NAS
registration request"
included in the UE
context transfer
request。
・Old AMF passes AMF UE Context to new AMF.
28：Save the UE
context
・AMF saves the UE context
acquired from Old AMF.
Get UE context from old AMF

【Reference】Namf_Communication_UEContextTransfer Request
（New AMF ➔ Old AMF）
2023/10/12 Thursday 36
☑ 29.502、29.518
・New AMF requires context transfer from Old AMF.
・The complete NAS registration request message received from the UE is included in
the context request.

【Reference】Namf_Communication_UEContextTransfer Response
（Old AMF ➔ New AMF）
2023/10/12 Thursday 37
☑ 29.502、29.518
・Old AMF passes AMF UE Context to new AMF.
UE context in AMF：Integrity protection message from UE that triggers context transfer.

【Reference】UE Context in AMF（AMF）
2023/10/12 Thursday 38
☑ The complete UE context is managed by AMF.
・When the UE attempts to register with the "New AMF", the AMF passes this context
to the "New AMF".

【Reference】UE Context in AMF（Old AMF ➔ New AMF）
2023/10/12 Thursday 39
☑ AM policy association information includes the following AM policy information
and PCF ID.

【Reference】UE Context in AMF（Old AMF ➔ New AMF）
2023/10/12 Thursday 40
☑ Each access type level context within the UE access and mobility context

【Reference】UE Context in AMF（AMF）
2023/10/12 Thursday 41
☑ Context for each PDU session level

2023/10/12 Thursday 42
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・Security header type,
・Identity request message
identity,
・Identity type
・New AMF requests UE identification information (SUCI) from
the UE via a NAS message.
・Security header type,
・Identity response message
identity,
・Mobile identity
32：AUSF selection
30：Home Derive SUCI from
PLMN public key
31:NAS Identity Response
・UE responds to identity request。
SUCI: Subscription Concealed
Identifier
UDM
29:NAS Identity Request
33:Nausf_UEAuthenticate_authenticate Request
・AMF requests UE authentication vector
and algorithm information from AUSF.
(Authentication server function)
34:Nudm_UEAuthenticate_Get Request
SUCI: Subscription Concealed
Identifier
・Request an authentication vector from
AUSF to UDM (Unified Data Management).
NAS authentication and security

【Reference】Identity Request（New AMF ➔ gNB ➔ UE）
2023/10/12 Thursday 43
☑ TS 24.501
・New AMF ➔ DL NAS Transport ➔ gNB ➔ DLInformationTransfer ➔ UE
・New AMF requests UE identification information (SUCI) from the UE via a NAS
message.

【Reference】Identity Response（UE ➔ gNB ➔ NewAMF）
2023/10/12 Thursday 44
☑ TS 24.501
・UE ➔ ULInformationTransfer ➔ gNB ➔ UL NAS Transport ➔ New AMF
・The UE responds to the identity request using SUCI.
・SUCI is derived from Home PLMN's public key.

【Reference】Nausf_UEAuthenticate_authenticate Request
（New AMF ➔ AUSF ）
2023/10/12 Thursday 45
☑ TS 33.501
・AMF requests the UE authentication vector and algorithm information from the
Authentication Server Function (AUSF).
・Resource URI: {apiRoot}/nausf-auth/v1/ue-authentications

【Reference】Nudm_UEAuthenticate_Get Request
（AUSF ➔ UDM）
2023/10/12 Thursday 46
☑ TS 29.503
・The Authentication Server Function (AUSF) requests an authentication vector from
the Unified Data Management Function (UDM).

2023/10/12 Thursday 47
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・Authentication result,
・SUPI
・ngKSI, ・RAND,
・AUTN, ・ABBA
38:NAS Authentication Request ・Start the authentication procedure with the UE.
・Send the key selectors RAND and AUTN to the UE.
UDM
35：
Generati
ng the
authentic
ation
vector
・The UDM generates an authentication
vector for the session.
36：Nudm_UEAuthenticate_Getレスポンス
・UDM responds with authentication data.
・Authentication method and data
37：Nausf_UEAuthentication_authenticateレスポンス
・The response returns the master key used by
AMF to derive the NAS security key and other
security keys.
・SUPI is also returned to AMF.
39:NAS Authentication Response
・The UE responds with an authentication response.
・Authentication response
parameter

【Reference】Nudm_UEAuthenticate_Get Response
（UDM ➔ AUSF）
2023/10/12 Thursday 48
☑ TS 29.503, TS 33.501
・The UDM responds to the AUSF with an authentication vector.

【Reference】Nausf_UEAuthenticate_authenticate Response
（AUSF ➔ New AMF）
2023/10/12 Thursday 49
☑ TS 33.501
・Reply the master key used by AMF to derive the NAS security key and other
security keys.

【Reference】Authentication Request
（New AMF ➔ gNB ➔ UE）
2023/10/12 Thursday 50
☑ TS 24.501
・Start the authentication procedure with the UE.
※Send the key selectors RAND and AUTN to the UE.

【Reference】Authentication Response
（UE ➔ gNB ➔ New AMF）
2023/10/12 Thursday 51
☑ TS 24.501
・The UE responds to the authentication request.

2023/10/12 Thursday 52
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
42:Namf_Communication_RegistrationComplete_Notify
・Selected NAS security
algorithms,Replayed UE security
capabilities,IMEISV request,
ngKSI,Additional 5G security
information
40:NAS Security Mode Command ・The AMF signals the selected NAS security algorithm to the UE.
・AMF also requests IMEISV from the UE.
41:NAS Security Mode Complete ・The UE signals completion of the NAS security procedure.
・The message contains the IMEISV.
・NAS message container,
IMEISV
・Since the AMF has been changed, the new
AMF notifies the old AMF that the UE’s
registration with the new AMF is complete.

【Reference】NAS Security Mode Command
（New AMF ➔ gNB ➔ UE）
2023/10/12 Thursday 53
☑ TS 24.501
・The AMF notifies the selected NAS security algorithm to the UE.
・AMF also requests IMEISV from the UE.

【Reference】NAS Security Mode Complete
（UE ➔ gNB ➔ New AMF）
2023/10/12 Thursday 54
☑ TS 24.501
・UE notifies completion of NAS security procedure.
・The message includes IMEISV.

【Reference】Namf_Communication_RegistrationCompleteNotify
（New AMF ➔ Old AMF）
2023/10/12 Thursday 55
☑ 29.518, 23.502

2023/10/12 Thursday 56
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
44:N5g-eir_EquipmentIdentityCheck Request
・PEI
・SUPI
43：Obtain PEI from UE context.
5G
EIR
45:N5g-eir_EquipmentIdentityCheck Response
・PEI checking result
・PEI is used to verify equipment.
・Call the Equipment Identity Check service.
・This service is provided by 5G-EIR to
check the PEI and determine if the PEI is
blacklisted.
・5G-EIR reports that mobiles (identified by PEI)
are not blacklisted.
Verify that the UE is not blacklisted

【Reference】N5g-eir_EquipmentIdentityCheck Request
（New AMF ➔ 5G-EIR）
2023/10/12 Thursday 57
☑ TS 23.502
・This service is provided by 5G-EIR to check the PEI and determine if the PEI is
blacklisted.

2023/10/12 Thursday 58
Register with UDM and get subscription data
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
47:Nudm_UEContextManagement_Registration Request
・PUT,
Amf 3Gpp Access
Registration = { AMF
Instance Id, Supported
Features, PEI, dereg
Callback Uri, ...}
46：UDMの選択
UDM
48:Nudm_UEContextManagement_Registration Response
・204 No Content
・Select the Unified Data
Management service entity.
・Since AMF has been changed,
New AMF is registered in UDM.
・The response code "204 No Content"
indicates that the registration was successful.
49:Nudm_SubscriberDataManagement_Get Request
50:Nudm_SubscriberDataManagement_Get Response
・AMF requests access and
mobility subscription data.
・The UDM responds with the
requested data.
・GET,
Requested data =
Access and Mobility
Subscription data
・Access and Mobility
Subscription data =
{Supported Features,
GPSI array, Network
Slice Selection Info, ...}

【Reference】Nudm_UEContextManagement_Registration Request
（New AMF ➔ UDM）
2023/10/12 Thursday 59
☑ TS 29.503
・5G-EIR supports PEI blacklist check.
・Resource URI for 3GPP access:
・{ueid}represents the subscriber identifier SUPI or GPSI (see 3GPP TS 23.501)
・SUPI (i.e. imsi or nai) is used with PUT and PATCH methods.
・GPSI (i.e. msisdn or extid) is used with the GET method.
※The UEID pattern is as follows.

【Reference】Amf3GppAccessRegistration
2023/10/12 Thursday 60

【Reference】Amf3GppAccessRegistration
2023/10/12 Thursday 61

【Reference】Nudm_UEContextManagement_Registration Response
（UDM ➔ New AMF）
2023/10/12 Thursday 62
☑ TS 29.503

【Reference】Nudm_SubscriberDataManagement_Get Request
2023/10/12 Thursday 63
☑ TS 29.503

2023/10/12 Thursday 64
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・GET,
Requested data = SMF
Selection Subscription
data
UDM
・SMF Selection
Subscription data =
{Supported Features,
List of S-NSSAIs and
associated information}
・AMF retrieves SMF selective
subscription data.
requested data.
・AMF obtains the UE context in
the SMF data.
requested data.
・GET,
Requested data = UE
context in SMF data
・UE context in SMF data
= {PDU Session
Information, FQDNs for
EPC Interworking}

【Reference】Nudm_SubscriberDataManagement_Get Request
2023/10/12 Thursday 65
☑ TS 29.503

【Reference】Nudm_SubscriberDataManagement_Get Response
（UDM ➔ New AMF）
2023/10/12 Thursday 66
☑ TS 29.503

2023/10/12 Thursday 67
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
UDM
56:Nudm_UEContextManagement_Deregistration_Notify
・The old AMF will be notified that it is no longer
providing services to users.
・UDM sends the POST request provided by Old AMF
during registration to callbackReference
(deregCallbackUri field of Amf3GppAccessRegistration).
57:Nsmf_PDUSession_ReleaseSMContext
・Old Indicates to SMF that AMF is not
associated with the specified PDU session.
・SUPI,
PDU Session ID
55：Creation of UE
context
・Create an AMF UE context for a user.
58：Delete UE
context

【Reference】Nudm_UEContextManagement_Deregistration_Notify
（UDM ➔ Old AMF）
2023/10/12 Thursday 68
☑ TS 29.503
・The following procedures using the DeregistrationNotification service operation are
supported:
⇒UDM starts deregistering NF.
① UDM sends a POST request to callbackReference as provided by Old AMF during
registration. (See Amf3GppAccessRegistration deregCallbackUri field).
② Old AMF service consumer responds with "204 No Content".

【Reference】Nsmf_PDUSession_ReleaseSMContext
（Old AMF ➔ SMF）
2023/10/12 Thursday 69
☑ TS 23.502
・This message allows the AMF-SMF association for a particular PDU session to be
released because the PDU session has been released.

2023/10/12 Thursday 70
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
60:Npcf_AMPolicyControl_Create Request
・AMF liaises with PCF to create policy associations.
・And searching for UE policies and/or access and
mobility control policies.
・Policy Association Request =
{ SUPI, GPSI, PEI, User
Location, ...}
59：Selection of PCF
・Select service entities for policy and
billing functions.
61:Npcf_AMPolicyControl_Create Response
・The PCF responds with policy
association information.
62:Namf_EventExpose_Subscribe Request
・PCF registers events such as “Location Report”,
“Registration State Report”, and “Communication
Failure Report”.
63:Namf_EventExpose_Subscribe Response
・AMF responds with "201 Created"
to indicate successful registration.
・201 Created, Amf
Created Event
Subscription
・Update the policy association with PCF.
・PCF registers AMF events.

【Reference】
Npcf_AMPolicyControl_Create Request（New AMF ➔ PCF）
2023/10/12 Thursday 71
☑ TS 29.513、TS 29.507
・URI configuration：{apiRoot}/{apiName}/{apiVersion}/{apiSpecificResourceUriPart}
※apiRoot: Must be configured as described in 3GPP TS29.501.
※apiName：「npcf-am-policy-control」
※apiVersion：「v1」。
※apiSpecificResourceUriPart: Specify an API-specific string.

【Reference】 Npcf_AMPolicyControl_Create Response
（PCF ➔ New AMF）
2023/10/12 Thursday 72
☑ TS 29.513、TS 29.507
・The PCF responds with policy association information.

【Reference】 Namf_EventExpose_Subscribe Request
2023/10/12 Thursday 73
☑ TS 29.518、TS 23.502
・Applications can subscribe to AMF events by sending subscription requests.
※Resource URI: {apiRoot}/namf-evts/v1/subscriptions
PCF can register for the following events.
Location-Report The NF subscribes to this event to receive the last known location of the UE or group of UEs, and the updated
location of the UE or any UE in the group when the AMF becomes aware of a UE's location change.
Event explanation
Presence-In-AOI-Report The NF subscribes to this event to receive the current state of the UEs within a particular area of interest (AOI)
and receive notifications when the specified UE enters or exits the specified area. Areas can be identified by TA
list, area ID, or specific area of interest name such as "LADN."
Time-Zone-Report NF subscribes to this event. And the current time zone of the UE or group of UEs, and receives the updated
time zone of the UE or any UE in the group once the AMF recognizes the UE's time zone change.
Access-Type-Report The NF subscribes to this event to receive the current access type of the UE or UE group. When the AMF
recognizes a change in the UE's access type, it updates the access type of the UE or any UE in the group.

【Reference】 Namf_EventExpose_Subscribe Request
2023/10/12 Thursday 74
PCF can register for the following events.
Registration-State-Report NFは、このイベントをサブスクライブして、UEまたはUEのグループの現在の登録状態を受信する。AMFがUEの登録状態の変化を認識すると、
UEまたはグループ内の任意のUEの更新された登録状態について報告する。
Event 説明
Presence-In-AOI-Report NFはこのイベントにサブスクライブして、特定の関心領域（AOI）内のUEの現在の状態を受信し、指定されたUEが指定された領域に出入
りしたときに通知を受け取る。エリアは、TAリスト、エリアID、または「LADN」などの特定の関心のあるエリア名で識別できる。
Connectivity-State-Report NFは、このイベントをサブスクライブして、UEまたはＵＥグループの現在の接続状態を受信する。AMFがUEの接続状態の変化を認識すると、
UEまたはグループ内の任意のUEの更新された接続状態について報告する。
Reachability-Report NFは、このイベントをサブスクライブして、UEまたはUEグループの現在の到達可能性を受信する。AMFがUEの到達可能性の変化を認識す
ると、UEまたはグループ内の任意のUEの更新された到達可能性について報告する。
Subscribed-Data-Report NFはこのイベントにサブスクライブして、UDMから受信したUEの現在のサブスクライブデータを受信する。AMFがUDMからUEの更新されたサブ
スクライブデータを受信したときに通知を受信する。
Communication-Failure-Report NFはこのイベントをサブスクライブして、UEまたはUEのグループまたは任意のUEの通信障害レポートを受信する。
UEs-In-Area-Report NFはこのイベントにサブスクライブして、特定のエリアのUEの数を受信する。NFは、最後の既知の位置に
基づいてエリア内のUEをAMFに要求するか、または現在の位置に基づいてエリア内のUEを積極的に探すようにAMFに要求することができる。

【Reference】 Namf_EventExpose_Subscribe Response
（New AMF ➔ PCF）
2023/10/12 Thursday 75
☑ TS 29.518、TS 23.502
・Response code : 201Created is returned in AmfCreatedEventSubscription.
※A "201Created" code indicates a successful subscription.
AmfCreatedEventSubscription

2023/10/12 Thursday 76
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
64:Npcf_AMPolicyControl_Delete
・Old AMF requests deletion of the policy
association when the corresponding UE
context is terminated.
65:Npcf_AMPolicyControl_Delete Response
・PCF uses the HTTP response code 「204 No Content」
to signal a successful deletion.
・204 No Content
・Update the policy association with PCF.
・PCF registers AMF events.

【Reference】 Npcf_AMPolicyControl_Delete
（Old AMF ➔ PCF）
2023/10/12 Thursday 77
☑ TS 29.513、TS 29.507
・Old AMF requests the policy association to be deleted when the corresponding UE
context is terminated.
※For old AMFs, use the URI below to start deleting them.
{apiRoot}/npcf-am-policy-control/v1/policies/{polAssoId}

【Reference】 Npcf_AMPolicyControl_Delete Response
（PCF ➔ Old AMF）
2023/10/12 Thursday 78
☑ TS 29.513、TS 29.507
・PCF will notify the deletion was successful with a 204 NoContent cause code.
※Upon success, an empty response body is returned.

2023/10/12 Thursday 79
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
66:Nsmf_PDUSession_UpdateSMContext Request
・Since the "list of PDU sessions to be launched"
was included in the registration request, the new
AMF initiates a restart of the PDU sessions.
・Requests Session Management Facility (SMF) to
establish a new session.
67:Assign UE IP
Address.
・Assign the TEID that the gNB should
use when sending uplink GTP PDUs to
the UPF.
Configure user plane function (UPF)
・PDU Sessions, Operation
Type = UP activate
68：Assign PDU
session uplink
TEID
・Assign a UE address to a PDU session.
69：Select UPF
・Select the user data plane for any subscriber.

【Reference】 Nsmf_PDUSession_UpdateSMContext Request
（New AMF ➔ SMF）
2023/10/12 Thursday 80
☑ TS 23.502
・Update AMF-SMF association to support PDU sessions.
・Provide the N1/N2SM information received from the UE or AN to the SMF.

2023/10/12 Thursday 81
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
71:Downlink Data
・Packet Forwarding Control Protocol
(PFCP) is used between the SMF
control plane and the UPF data plane.
・Session changes are notified to the
data plane.
Configure user plane function (UPF)
・PDU Sessions, Operation
Type = UP activate
N4 N4
・Session endpoint identifier.
70：PFCP session modification request
72：Start buffer
downlink data
・The UPF starts receiving data destined for the UE.
・Since the PDN session is not established at the
gNB and UE, the UPF needs to buffer the data.
N4 N4
・Session endpoint identifier.
73：PFCPセッション変更応答
・After the session modification is complete,
the UPF data plane responds to the SMF
control plane.
74:Nsmf_PDUSession_UpdateSMContext Response
・SMF notifies AMF that the session
management context has been updated.

【Reference】 Nsmf_PDUSession_UpdateSMContext Response
（SMF ➔ New AMF）
2023/10/12 Thursday 82
☑ TS 23.502
・SMF notifies AMF that the session management context has been updated.

2023/10/12 Thursday 83
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・AMF UE NGAP ID,
・RAN UE NGAP ID,
・UE Aggregate Maximum Bit
Rate,
・GUAMI, PDU Session
Resource Setup Request
List,
・PDU Session ID,
・PDU Session Uplink TEID,
・UE IP Address,
・NAS-PDU,
・S-NSSAI, PDU Session
Resource Setup Request
Transfer,
・Allowed NSSAI, UE Security
Capabilities,
・Security Key
75：Allocate AMF UE
NGAP ID
76:Initial Context Setup Request [NAS-PDU: Registration Accept］
・AMF starts setting up a session with gNB.
・The message usually includes a Registration Accept NAS message.
・The message carries one or more PDU session setup requests.
・Each PDU session is addressed by a "PDU session ID".
・The message also carries the uplink TEID for each PDU session.
・AMF assigns an "AMF UE NGAP ID".
The gNB uses this ID to address the UE context
on the AMF.
※The message also carries the “AMF UE NGAP ID”, “UE aggregate
maximum bit rate", UE security capabilities and security key.

【Reference】 Initial Context Setup Request
（AMF ➔ eNB）
2023/10/12 Thursday 84
☑ TS 38.413
・The purpose of the procedure is to establish the overall initial UE context required at
the NG-RAN node.
・Includes PDU session context, security keys, mobility restriction list, UE radio
capabilities and UE security capabilities, etc., as required.
・The message usually includes a Registration AcceptNAS message.
・The message contains one or more PDU session setup requests.
※Each PDU session is addressed by a "PDU session ID".

2023/10/12 Thursday 85
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・securityConfigSMC
{securityAlgorithmConfig}
78：Derive the K-gNB key
77:SecurityModeCommand
・K-gNB is a key derived by UE and AMF from K-AMF.
79：Derive the K-RRC-int key associated
with the integrity protection algorithm
80：Verify security mode command
message integrity protection
5G-NR AS Security Procedures
81：Derive the K-UP-int key associated
with the integrity protection algorithm
82：Start up SRB Integrity Protect ・Configure the lower layer to apply SRB integrity protection
using the specified algorithm and K-RRC-int key immediately.

【Reference】 SecurityModeCommand
（gNB ➔ UE）
2023/10/12 Thursday 86
☑ TS 38.331
・The SecurityModeCommand message is used to command the activation of AS security.
・Upon receiving the security mode command, the UE performs the following actions:
⇒ Get the K-gNB key. (K-gNB is the key that UE and AMF are derived from K-AMF)
⇒ Derive the K-RRC-int key associated with the integrity protection algorithm.
⇒Check the integrity protection of the security mode command message.
⇒ Derive the K-UP-int key associated with the integrity protection algorithm.
⇒Start SRB integrity protection.

2023/10/12 Thursday 87
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
84：Initiating SRB encryption
83:SecurityModeComplete ・The security mode completion message confirms that the security mode
command has completed successfully.
・This message is integrity protected but not encrypted.
・Encryption will start immediately after sending this message.
5G-NR AS security procedures (continued)
・Once the steps are complete, configure the lower layer to apply SRB encryption using
the``indicated algorithm'', ``K-RRC-enc key‘’.
・Security mode completion message is not encrypted.

【Reference】 SecurityModeComplete
（UE ➔ gNB）
2023/10/12 Thursday 88
☑ TS 38.331
・The SecurityModeComplete message is used to confirm that a security mode command has
completed successfully.
・Sending this message will enable encryption.
⇒The security mode completion message itself is not encrypted.
(However, the integrity of the message is protected.)

2023/10/12 Thursday 89
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
86：Perform the steps to configure the
primary cell group
85:RRCReconfiguration
[Registration Accept (5GS registration result, PDU session status)]
・The RRC reconfiguration message is sent to the UE after configuring
the "radio bearer" and "secondary cell" to start UE measurement.
5G-NR RRC reconfiguration
・masterCellGroup,
secondaryCellGroup,
・radioBearerConfig
(drb-ToAddModList),
・ MeasConfig
(Measurement Config)
87：Perform the secondary cell group
configuration procedure.
89：Start measurements based on the
received MeasConfig
88：Perform the radio bearer
configuration procedure.
90：Processing NAS messages and
setting up PDU sessions to accept
registrations

【Reference】 SecurityModeCommand
（gNB ➔ UE）
2023/10/12 Thursday 90
☑ TS 38.331
・The purpose of the message is to change the RRC connection.
⇒ For example, establishing/changing/releasing RB, performing reconfiguration by
synchronization, setting up/changing/releasing measurements, adding/changing/releasing, Scells and
cell groups.
・As part of the procedure, NAS-specific information can be transferred from the network to the UE.

【Reference】 RRCReconfiguration
（gNB ➔ UE）
2023/10/12 Thursday 91
☑ TS 38.331
・The message has the following fields.
①Registration Accept
➁masterCellGroup
➂secondaryCellGroup
④radioBearerConfig
➄MeasConfig

2023/10/12 Thursday 92
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
5G-NR RRC reconfiguration (continued)
91:RRCReconfigurationComplete
・plinkTxDirectCurrentList
[ {servCellIndex,
uplinkDirectCurrentBWP}]
・Confirm that RRC connection
reconfiguration has completed
successfully.

【Reference】RRCReconfigurationComplete
（gNB ➔ New AMF）
2023/10/12 Thursday 93
☑ TS 38.331
・The RRC Reconfiguration Complete message is used to confirm that the
reconfiguration of the RRC connection has been completed successfully.

2023/10/12 Thursday 94
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
92：Assign PDU session downlink TEID
・Assign a TEID that the UPF will use
to send downlink data to the gNB.
93:Initial Context Setup Response
・PDU Session Downlink TEID
・The gNB notifies that the PDU session
setup was successful.
・This message also includes the Downlink
TEID that must be used (specified for
each PDU session).
94:NAS Registration Complete
・The UE notifies the AMF of the completion
of registration via a "Registration Complete"
message.

【Reference】 Initial Context Setup Response
（UE ➔ gNB）
2023/10/12 Thursday 95
☑ TS 38.413
・This message is sent by the NG-RAN node to confirm the setup of the UE context.

【Reference】 NAS Registration Complete
（UE ➔ gNB ➔ AMF）
2023/10/12 Thursday 96
☑ TS 24.501
・UE ➔ （ULInformationTransfer） ➔ gNB ➔ （UL NAS Transport） ➔ New AMF。

2023/10/12 Thursday 97
ｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑｑ
ｑｑｑｑｑ
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・The UE starts transferring
data after the uplink path
is established.
・gNB sends UE data to
uplink TEID.
Initiating downlink and uplink data transfer
95:Uplink Data
UTEID
96:Uplink Data
97:Nsmf_PDUSession_UpdateSMContext Request
・UPF begins transmitting data to the Internet.
・Session Management
Downlink TEID ・AMF modifies the session
management context based on
updates from the gNB.

【Reference】 Nsmf_PDUSession_UpdateSMContext Request
（AMF ➔ SMF）
2023/10/12 Thursday 98
☑ TS 23.502
・Update AMF-SMF association to support PDU sessions.
・Provide the N1/N2SM information received from the UE or AN to the SMF.

2023/10/12 Thursday 99
ｑｑｑｑｑ
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
・The SMF control plane notifies the
UPF data plane of session updates.
98:PFCP Session Modification Request
N4
N4
・Session Endpoint
Identifier,
・Session Management
Downlink TEID
99：End of buffer
downlink data
・Since the downlink path is
configured, UPF can stop buffering
data.
100:Downlink Data
DL
TEID
・UPF sends buffered data to gNB
using downlink TEID for PDU
session.
・All new downlink data also follows
the same path.
Initiate downlink and uplink data transfer (continued)

【Reference】 PFCP Session Modification Request
（SMF ➔ UPF）
2023/10/12 Thursday 100
☑ TS 29.244
・The PFCP session change request is used by the CP function via the Sxa, Sxb, Sxc, and N4
interfaces to request the UP function to change the PFCP session.

2023/10/12 Thursday 101
ｑｑｑｑｑ
5G NR NodeB
5G UE
UE gNB
5G Core NW
PCF AUSF
SMF UPF
New AMF Old AMF
Initiate downlink and uplink data transfer (continued)
・The UPF data plane responds to the
SMF control plane.
101:PFCP Session Modification Response
N4
N4
・Session Endpoint Identifier
102:Nsmf_PDUSession_UpdateSMContext Response
・Session Endpoint Identifier ・SMF notifies AMF that the
session management context
update is complete.

【Reference】 Nsmf_PDUSession_UpdateSMContext Response
（SMF ➔ AMF）
2023/10/12 Thursday 102
☑ TS 23.502
・SMF notifies AMF that the session management context update is complete.

5GCに接続されているNRによって使用される識別子
2023/10/12 Thursday 104
☑ The following identification information is used for scheduling at cell level:
identifier Purpose
C-RNTI Unique UE identifier used as identifier of RRC connection and for scheduling
CS-RNTI Unique UE identifier used for semi-persistent scheduling on the downlink or
configured grants on the uplink
INT-RNTI Identifier representing interrupt right on downlink
SI-RNTI Identifier for broadcast and system information on the downlink
SP-CSI-RNTI Unique UE identifier used for semi-persistent CSI reporting on PUSCH

2023/10/12 Thursday 105
☑ The following identification information is used to control power and slot format
identifier Purpose
SFI-RNTI Identify slot format
TPC-PUCCH-RNTI Unique UE identification to control PUCCH power
TPC-PUSCH-RNTI Unique UE identification to control PUSCH power
TPC-SRS-RNTI Unique UE identification to control SRS power

2023/10/12 Thursday 106
☑ Identifier used during the random access procedure.
identifier Purpose
RA-RNTI Identification of random access responses on the downlink
Temporary C-RNTI UE identity used temporarily for scheduling during random access procedures
Random value for
contention resolution
UE identification temporarily used for conflict resolution purposes during
random access procedures
☑ In the NR connected to 5GC, the following UE IDs are used at the NG-RAN level.
identifier Purpose
I-RNTI Identify UE context with RRC_INACTIVE

ネットワーク識別子
2023/10/12 Thursday 107
☑ To identify a specific network entity, the following IDs are used in NG-RAN:
identifier Purpose
AMF Name Identify AMF.
NR Cell Global Identifier
(NCGI)
Identifies NR cells globally.
The NCGI consists of the PLMN ID to which the cell belongs and the cell's NR
Cell Identity (NCI).
gNB Identifier (gNB ID) Identify gNB within PLMN.
The gNB ID is included in the NCI for that cell.
Global gNB ID Identify gNB globally.
The global gNB ID is composed of the PLMN ID to which the gNB belongs and
the gNB ID.
MCC and MNC are the same as those included in NCGI.
Tracking Area identity (TAI) Identify tracking area.
The TAI is composed of the PLMN ID to which the tracking area belongs and the
tracking area's TAC (Tracking Area Code).
Single Network Slice
Selection Assistance
information (S-NSSAI)
Identify network slices.

5G Identifiers
2023/10/12 Thursday 108
☑ 5G-GUTI
GUTI: Unique global identifier for the UE that does not reveal SUPI.
☑ SUPI
・IMSI：A Subscription Permanent Identifier is assigned to each subscriber accessing
the 5G network.
☑ SUCI
・P-TMSI + MCC + MNC: The subscription hiding identifier is a global identifier that
can hide the UE identity.
・SUCI may also be used by the visiting network to obtain the authentication vector
from the home network.
☑ PEI
・IMEI: Each UE accessing the 5G network is assigned a Permanent Equipment
Identifier.

5G Identifiers
2023/10/12 Thursday 109
☑ GOSI
・Generic Public Subscription Identifier is used to handle 3GPP subscriptions in non-
3GPP networks.
☑ 5G-S-TMSI
・S-TMSI: An abbreviation of 5G-GUTI used in radio signaling procedures.
・<5G-S-TMSI> = <AMF set ID> <AMF pointer> <5G--TMSI>

COPYRIGHT © 2022 Centimani CO. CONFIDENTIAL. ALL RIGHTS RESERVED 2023/10/12 Thursday 110
It is difficult to understand the 3GPP standardization
technical specifications simply by translating and reading
them.
To understand this, it is essential to check consistency with
actual communication logs based on actual call flow
scenarios, but currently such materials are not widely
shared in Japan.
This document was created within our company to
improve understanding and knowledge of 3GPP technical
specifications.
The content is created to exclude vendor/carrier
dependence as much as possible, but it may contain
descriptions that are not consistent with systems that have
been standardized or put into practical use.
This material is royalty-free.Please use it to help readers
consolidate their knowledge and improve their work
productivity.
THANK YOU FOR
VIEWS
ryuichi@centimani.biz

SA call flow

More Related Content

What's hot (20)

Similar to SA call flow (20)

Recently uploaded (20)

SA call flow