SA WG2 Meeting #143E S2-210xxxx

24 February - 09 March, 2021, Electronic, Elbonia

CR-Form-v11.2

CHANGE REQUEST
23.502 CR xxxx rev 1 Current version: 16.7.1
For HELP on using this form: comprehensive instructions can be found at
http://www.3gpp.org/Change-Requests.

Proposed change affects: UICC apps ME Radio Access Network Core Network X

Title: Adding support for USS UAV Authentication and Authorization (UUAA) during
Registration
Source to WG: Interdigital
Source to TSG: SA WG2
Work item code: ID_UAS Date: 2021-02-03
Category: B Release: Rel-17
Use one of the following categories: Use one of the following releases:
F (correction) Rel-8 (Release 8)
A (mirror corresponding to a change in an earlier Rel-9 (Release 9)
release) Rel-10 (Release 10)
B (addition of feature), Rel-11 (Release 11)
C (functional modification of feature) Rel-12 (Release 12)
D (editorial modification) Rel-13 (Release 13)
Detailed explanations of the above categories can Rel-14 (Release 14)
be found in 3GPP TR 21.900. Rel-15 (Release 15)
Rel-16 (Release 16)
Reason for change: In the conclusion of TR 23.754 conclusion for Key Issue #2 it says:

Depending on 3GPP network operator and/or regulatory requirements, the UUAA is

performed:

- in 5GS: either as a separate procedure during the 5GS registration procedure (see
clause 6.5.3.1.1), or when the UAV requests user plane resources for UAV
operation (i.e. PDU session establishment) (see clause 8.X.1). From a UE
implementation point of view it is mandatory to support UUAA during Registration
and PDU session establishment procedure. From a network deployment point of
view it is mandatory to support UUAA during PDU session establishment
procedure.

Summary of change: Introduce support for USS UAV Authentication and Authorization (UUAA) during
Registration (UUAA-MM)
Consequences if not UE(UAV) can not be authenticated and authorized to use UAS services when
approved: UUAA during registration is used.
Clauses affected: 4.2.2.2.3
Y N
Other specs X Other core specifications TS/TR … CR ...
affected: X Test specifications TS/TR ... CR ...
(show related CRs) X O&M Specifications TS/TR ... CR ...

Other comments:
 * * * * Start of 1st Change * * * *
4.2.2.2.2 General Registration
 Figure 4.2.2.2.2-1: Registration procedure

1. UE to (R)AN: AN message (AN parameters, Registration Request (Registration type, SUCI or 5G-GUTI or PEI,
[last visited TAI (if available)], Security parameters, [Requested NSSAI], [Mapping Of Requested NSSAI],
[Default Configured NSSAI Indication], [UE Radio Capability Update], [UE MM Core Network Capability],
[PDU Session status], [List Of PDU Sessions To Be Activated], [Follow-on request], [MICO mode preference],
[Requested Active Time], [Requested DRX parameters for E-UTRA and NR], [Requested DRX parameters for
NB-IoT], [extended idle mode DRX parameters], [LADN DNN(s) or Indicator Of Requesting LADN
Information], [NAS message container], [Support for restriction of use of Enhanced Coverage], [Preferred
Network Behaviour], [UE paging probability information], [UE Policy Container (the list of PSIs, indication of
UE support for ANDSP and the operating system identifier)] and [UE Radio Capability ID], PEI, [CAA-level
UAV ID], [USS/UTM address information])).

NOTE 1: The UE Policy Container and its usage is defined in TS 23.503 [20].

In the case of NG-RAN, the AN parameters include e.g. 5G-S-TMSI or GUAMI, the Selected PLMN ID (or
PLMN ID and NID, see TS 23.501 [2], clause 5.30) and NSSAI information, the AN parameters also include
Establishment cause. The Establishment cause provides the reason for requesting the establishment of an RRC
connection. Whether and how the UE includes the NSSAI information as part of the AN parameters is dependent
on the value of the Access Stratum Connection Establishment NSSAI Inclusion Mode parameter, as specified in
clause 5.15.9 of TS 23.501 [2].

The AN parameters shall also include an IAB-Indication if the UE is an IAB-node accessing 5GS.

The Registration type indicates if the UE wants to perform an Initial Registration (i.e. the UE is in RM-
DEREGISTERED state), a Mobility Registration Update (i.e. the UE is in RM-REGISTERED state and initiates
a Registration procedure due to mobility or due to the UE needs to update its capabilities or protocol parameters,
or to request a change of the set of network slices it is allowed to use), a Periodic Registration Update (i.e. the
UE is in RM-REGISTERED state and initiates a Registration procedure due to the Periodic Registration Update
timer expiry, see clause 4.2.2.2.1) or an Emergency Registration (i.e. the UE is in limited service state).

When the UE is using E-UTRA, the UE indicates its support of CIoT 5GS Optimisations, which is relevant for
the AMF selection, in the RRC connection establishment signalling associated with the Registration Request.

When the UE is performing an Initial Registration the UE shall indicate its UE identity in the Registration
Request message as follows, listed in decreasing order of preference in the case of registration with a PLMN:

i) a 5G-GUTI mapped from an EPS GUTI, if the UE has a valid EPS GUTI.

ii) a native 5G-GUTI assigned by the PLMN to which the UE is attempting to register, if available;

iii) a native 5G-GUTI assigned by an equivalent PLMN to the PLMN to which the UE is attempting to
register, if available;

iv) a native 5G-GUTI assigned by any other PLMN, if available.

NOTE 2: This can also be a 5G-GUTIs assigned via another access type.

v) Otherwise, the UE shall include its SUCI in the Registration Request as defined in TS 33.501 [15].

When the UE performing an Initial Registration has both a valid EPS GUTI and a native 5G-GUTI, the UE shall
also indicate the native 5G-GUTI as Additional GUTI. If more than one native 5G-GUTIs are available, the UE
shall select the 5G-GUTI in decreasing order of preference among items (ii)-(iv) in the list above.

When registering with an SNPN with 5G-GUTI as UE identity, the UE shall only use the 5G-GUTI previously
assigned by the same SNPN.

The NAS message container shall be included if the UE is sending a Registration Request message as an Initial
NAS message and the UE has a valid 5G NAS security context and the UE needs to send non-cleartext IEs, see
clause 4.4.6 in TS 24.501 [25]. If the UE does not need to send non-cleartext IEs, the UE shall send a
Registration Request message without including the NAS message container.

If the UE does not have a valid 5G NAS security context, the UE shall send the Registration Request message
without including the NAS message container. The UE shall include the entire Registration Request message
 (i.e. containing cleartext IEs and non-cleartext IEs) in the NAS message container that is sent as part of the
Security Mode Complete message in step 9b.

When the UE is performing an Initial Registration (i.e., the UE is in RM-DEREGISTERED state) with a native
5G-GUTI then the UE shall indicate the related GUAMI information in the AN parameters. When the UE is
performing an Initial Registration with its SUCI, the UE shall not indicate any GUAMI information in the AN
parameters.

When the UE is performing an Initial Registration or a Mobility Registration and if CIoT 5GS Optimisations are
supported the UE shall indicate its Preferred Network Behaviour (see TS 23.501 [2] clause 5.31.2). If S1 mode is
supported the UE's EPC Preferred Network Behaviour is included in the S1 UE network capabilities in the
Registration Request message, see TS 24.501 [25], clause 8.2.6.1.

For an Emergency Registration, the SUCI shall be included if the UE does not have a valid 5G-GUTI available;
the PEI shall be included when the UE has no SUPI and no valid 5G-GUTI. In other cases, the 5G-GUTI is
included and it indicates the last serving AMF.

The UE may provide the UE's usage setting based on its configuration as defined in TS 23.501 [2]
clause 5.16.3.7. The UE provides Requested NSSAI as described in TS 23.501 [2] clause 5.15.5.2.1, and in the
case of Initial Registration or Mobility Registration Update, the UE includes the Mapping Of Requested NSSAI
(if available), which is the mapping of each S-NSSAI of the Requested NSSAI to the HPLMN S-NSSAIs, to
ensure that the network is able to verify whether the S-NSSAI(s) in the Requested NSSAI are permitted based on
the Subscribed S-NSSAIs. In the case of inter PLMN mobility, if the serving PLMN S-NSSAI(s) corresponding
to the established PDU Session(s) are not present in the UE, the associated HPLMN S-NSSAI(s) associated with
the established PDU Session(s) shall be provided in the Mapping Of Requested NSSAI as described in the
clause 5.15.5.2.1 TS 23.501 [2].

The UE includes the Default Configured NSSAI Indication if the UE is using a Default Configured NSSAI, as
defined in TS 23.501 [2].

The UE may include UE paging probability information if it supports the assignment of WUS Assistance
Information from the AMF (see TS 23.501 [2]).

In the case of Mobility Registration Update, the UE includes in the List Of PDU Sessions To Be Activated the
PDU Sessions for which there are pending uplink data. When the UE includes the List Of PDU Sessions To Be
Activated, the UE shall indicate PDU Sessions only associated with the access the Registration Request is
related to. As defined in TS 24.501 [25] the UE shall include always-on PDU Sessions which are accepted by the
network in the List Of PDU Sessions To Be Activated even if there are no pending uplink data for those PDU
Sessions.

NOTE 3: A PDU Session corresponding to a LADN is not included in the List Of PDU Sessions To Be Activated
when the UE is outside the area of availability of the LADN.

The UE MM Core Network Capability is provided by the UE and handled by AMF as defined in TS 23.501 [2]
clause 5.4.4a. The UE includes in the UE MM Core Network Capability an indication if it supports Request
Type flag "handover" for PDN connectivity request during the attach procedure as defined in clause 5.17.2.3.1 of
TS 23.501 [2]. If the UE supports 'Strictly Periodic Registration Timer Indication', the UE indicates its capability
of 'Strictly Periodic Registration Timer Indication' in the UE MM Core Network Capability. If the UE supports
CAG, the UE indicates its capability of "CAG supported" in the UE MM Core Network Capability.

The UE may provide either the LADN DNN(s) or an Indication Of Requesting LADN Information as described
in TS 23.501 [2] clause 5.6.5.

If available, the last visited TAI shall be included in order to help the AMF produce Registration Area for the
UE.

The Security parameters are used for Authentication and integrity protection, see TS 33.501 [15]. Requested
NSSAI indicates the Network Slice Selection Assistance Information (as defined in clause 5.15 of
TS 23.501 [2]). The PDU Session status indicates the previously established PDU Sessions in the UE. When the
UE is connected to the two AMFs belonging to different PLMN via 3GPP access and non-3GPP access then the
PDU Session status indicates the established PDU Session of the current PLMN in the UE.

The Follow-on request is included when the UE has pending uplink signalling and the UE doesn't include List Of
PDU Sessions To Be Activated, or the Registration type indicates the UE wants to perform an Emergency
 Registration. In Initial Registration and Mobility Registration Update, UE provides the UE Requested DRX
parameters, as defined in clause 5.4.5 of TS 23.501 [2]. The UE may provide the extended idle mode DRX
parameters as defined in clause 5.31.7.2 of TS 23.501 [2] to request extended idle mode DRX.

The UE provides UE Radio Capability Update indication as described in TS 23.501 [2].

The UE includes the MICO mode preference and optionally a Requested Active Time value if the UE wants to
use MICO Mode with Active Time.

The UE may indicate its Service Gap Control Capability in the UE MM Core Network Capability, see
TS 23.501 [2] clause 5.31.16.

For a UE with a running Service Gap timer in the UE, the UE shall not set Follow-on Request indication or
Uplink data status in the Registration Request message (see TS 23.501 [2] clause 5.31.16), except for network
access for regulatory prioritized services like Emergency services or exception reporting.

If UE supports RACS and has been assigned UE Radio Capability ID(s), the UE shall indicate a UE Radio
Capability ID as defined in TS 23.501 [2] clause 5.4.4.1a as non-cleartext IE.

The PEI may be retrieved in initial registration from the UE as described in clause 4.2.2.2.1.

The UE includes its CAA-level UAV ID and optional USS/UTM address information if the UE wants to be
registered as an UAV.

2. If a 5G-S-TMSI or GUAMI is not included or the 5G-S-TMSI or GUAMI does not indicate a valid AMF the
(R)AN, based on (R)AT and Requested NSSAI, if available, selects an AMF

The (R)AN selects an AMF as described in TS 23.501 [2], clause 6.3.5. If UE is in CM-CONNECTED state, the
(R)AN can forward the Registration Request message to the AMF based on the N2 connection of the UE.

If the (R)AN cannot select an appropriate AMF, it forwards the Registration Request to an AMF which has been
configured, in (R)AN, to perform AMF selection.

3. (R)AN to new AMF: N2 message (N2 parameters, Registration Request (as described in step 1) and [LTE-M
Indication].

When NG-RAN is used, the N2 parameters include the Selected PLMN ID (or PLMN ID and NID, see
TS 23.501 [2], clause 5.30), Location Information and Cell Identity related to the cell in which the UE is
camping, UE Context Request which indicates that a UE context including security information needs to be
setup at the NG-RAN.

When NG-RAN is used, the N2 parameters shall also include the Establishment cause and IAB-Indication if the
indication is received in AN parameters in step 1.

Mapping Of Requested NSSAI is provided only if available.

If the Registration type indicated by the UE is Periodic Registration Update, then steps 4 to 19 may be omitted.

When the Establishment cause is associated with priority services (e.g. MPS, MCS), the AMF includes a
Message Priority header to indicate priority information. Other NFs relay the priority information by including
the Message Priority header in service-based interfaces, as specified in TS 29.500 [17].

The RAT Type the UE is using is determined (see clause 4.2.2.2.1) and based on it the AMF determines whether
the UE is performing Inter-RAT mobility to or from NB-IoT. If the AMF receives the LTE M indication, then it
considers that the RAT Type is LTE-M and stores the LTE-M Indication in UE Context.

If a UE includes a Preferred Network Behaviour, this defines the Network Behaviour the UE supports and is
expecting to be available in the network as defined in TS 23.501 [2], clause 5.31.2.

If the UE has included the Preferred Network Behaviour, and what the UE indicated it supports in Preferred
Network Behaviour is incompatible with the network support, the AMF shall reject the Registration Request
with an appropriate cause value (e.g. one that avoids retries on this PLMN).

If there is a Service Gap timer running in the UE Context in AMF for the UE, and Follow-on Request indication
or Uplink data status is included in the Registration Request message, the AMF shall ignore the Follow-on
Request indication and Uplink data status and not perform any of the actions related to the status.
 If the UE has included a UE Radio Capability ID in step 1 and the AMF supports RACS, the AMF stores the
Radio Capability ID in UE context.

4. [Conditional] new AMF to old AMF: Namf_Communication_UEContextTransfer (complete Registration

Request) or new AMF to UDSF: Nudsf_Unstructured Data Management_Query().

(With UDSF Deployment): If the UE's 5G-GUTI was included in the Registration Request and the serving AMF
has changed since last Registration procedure, new AMF and old AMF are in the same AMF Set and UDSF is
deployed, the new AMF retrieves the stored UE's SUPI and UE context directly from the UDSF using
Nudsf_UnstructuredDataManagement_Query service operation or they can share stored UE context via
implementation specific means if UDSF is not deployed. This includes also event subscription information by
each NF consumer for the given UE. In this case, the new AMF uses integrity protected complete Registration
request NAS message to perform and verify integrity protection.

(Without UDSF Deployment): If the UE's 5G-GUTI was included in the Registration Request and the serving
AMF has changed since last Registration procedure, the new AMF may invoke the
Namf_Communication_UEContextTransfer service operation on the old AMF including the complete
Registration Request NAS message, which may be integrity protected, as well as the Access Type, to request the
UE's SUPI and UE Context. See clause 5.2.2.2.2 for details of this service operation. In this case, the old AMF
uses either 5G-GUTI and the integrity protected complete Registration request NAS message, or the SUPI and
an indication that the UE is validated from the new AMF, to verify integrity protection if the context transfer
service operation invocation corresponds to the UE requested. The old AMF also transfers the event
subscriptions information by each NF consumer, for the UE, to the new AMF. If the old AMF has not yet
reported a non-zero MO Exception Data Counter to the (H-)SMF, the Context Response also includes the MO
Exception Data Counter.

If the old AMF has PDU Sessions for another access type (different from the Access Type indicated in this step)
and if the old AMF determines that there is no possibility for relocating the N2 interface to the new AMF, the
old AMF returns UE's SUPI and indicates that the Registration Request has been validated for integrity
protection, but does not include the rest of the UE context.

For inter PLMN mobility, UE Context information includes HPLMN S-NSSAIs corresponding to the Allowed
NSSAI for each Access Type, without Allowed NSSAI of old PLMN.

NOTE 4: The new AMF Sets the indication that the UE is validated according to step 9a, if the new AMF has
performed successful UE authentication after previous integrity check failure in the old AMF.

NOTE 5: The NF consumers do not need to subscribe for the events once again with the new AMF after the UE is
successfully registered with the new AMF.

If the new AMF has already received UE contexts from the old AMF during handover procedure, then step 4,5
and 10 shall be skipped.

For an Emergency Registration, if the UE identifies itself with a 5G-GUTI that is not known to the AMF, steps 4
and 5 are skipped and the AMF immediately requests the SUPI from the UE. If the UE identifies itself with PEI,
the SUPI request shall be skipped. Allowing Emergency Registration without a user identity is dependent on
local regulations.

5. [Conditional] old AMF to new AMF: Response to Namf_Communication_UEContextTransfer (SUPI, UE

Context in AMF (as per Table 5.2.2.2.2-1)) or UDSF to new AMF: Nudsf_Unstructured Data
Management_Query(). The old AMF may start an implementation specific (guard) timer for the UE context.

If the UDSF was queried in step 4, the UDSF responds to the new AMF for the Nudsf_Unstructured Data
Management_Query invocation with the related contexts including established PDU Sessions, the old AMF
includes SMF information DNN, S-NSSAI(s) and PDU Session ID, active NGAP UE-TNLA bindings to
N3IWF/TNGF/W-AGF, the old AMF includes information about the NGAP UE-TNLA bindings. If the Old
AMF was queried in step 4, Old AMF responds to the new AMF for the
Namf_Communication_UEContextTransfer invocation by including the UE's SUPI and UE Context.

If old AMF holds information about established PDU Session(s) and it is not an Initial Registration, the old
AMF includes SMF information, DNN(s), S-NSSAI(s) and PDU Session ID(s).
 If old AMF holds UE context established via N3IWF, W-AGF or TNGF, the old AMF includes the CM state via
N3IWF, W-AGF or TNGF. If the UE is in CM-CONNECTED state via N3IWF, W-AGF or TNGF, the old
AMF includes information about the NGAP UE-TNLA bindings.

If old AMF fails the integrity check of the Registration Request NAS message, the old AMF shall indicate the
integrity check failure. If the new AMF is configured to allow emergency services for unauthenticated UE, the
new AMF behaves as follows:

- If the UE has only an emergency PDU Session, the AMF either skips the authentication and security
procedure or accepts that the authentication may fail and continues the Mobility Registration Update
procedure; or

- If the UE has both emergency and non emergency PDU Sessions and authentication fails, the AMF
continues the Mobility Registration Update procedure and deactivates all the non-emergency PDU Sessions
as specified in clause 4.3.4.2.

NOTE 6: The new AMF can determine if a PDU Session is used for emergency service by checking whether the
DNN matches the emergency DNN.

If old AMF holds information about AM Policy Association and the information about UE Policy Association
(i.e. the Policy Control Request Trigger for updating UE Policy as defined in TS 23.503 [20]), the old AMF
includes the information about the AM Policy Association, the UE Policy Association and PCF ID. In the
roaming case, V-PCF ID and H-PCF ID are included.

During inter PLMN mobility, the handling of the UE Radio Capability ID in the new AMF is as defined in
TS 23.501 [2].

NOTE 7: When new AMF uses UDSF for context retrieval, interactions between old AMF, new AMF and UDSF
due to UE signalling on old AMF at the same time is implementation issue.

6. [Conditional] new AMF to UE: Identity Request ().

If the SUCI is not provided by the UE nor retrieved from the old AMF the Identity Request procedure is initiated
by AMF sending an Identity Request message to the UE requesting the SUCI.

7. [Conditional] UE to new AMF: Identity Response ().

The UE responds with an Identity Response message including the SUCI. The UE derives the SUCI by using the
provisioned public key of the HPLMN, as specified in TS 33.501 [15].

8. The AMF may decide to initiate UE authentication by invoking an AUSF. In that case, the AMF selects an
AUSF based on SUPI or SUCI, as described in TS 23.501 [2], clause 6.3.4.

If the AMF is configured to support Emergency Registration for unauthenticated SUPIs and the UE indicated
Registration type Emergency Registration, the AMF skips the authentication or the AMF accepts that the
authentication may fail and continues the Registration procedure.

9a. If authentication is required, the AMF requests it from the AUSF; if Tracing Requirements about the UE are
available at the AMF, the AMF provides Tracing Requirements in its request to AUSF. Upon request from the
AMF, the AUSF shall execute authentication of the UE. The authentication is performed as described in
TS 33.501 [15]. The AUSF selects a UDM as described in TS 23.501 [2], clause 6.3.8 and gets the
authentication data from UDM.

Once the UE has been authenticated the AUSF provides relevant security related information to the AMF. If the
AMF provided a SUCI to AUSF, the AUSF shall return the SUPI to AMF only after the authentication is
successful.

After successful authentication in new AMF, which is triggered by the integrity check failure in old AMF at
step 5, the new AMF invokes step 4 above again and indicates that the UE is validated (i.e. through the reason
parameter as specified in clause 5.2.2.2.2).

9b If NAS security context does not exist, the NAS security initiation is performed as described in TS 33.501 [15].
If the UE had no NAS security context in step 1, the UE includes the full Registration Request message as
defined in TS 24.501 [25].
 The AMF decides if the Registration Request needs to be rerouted as described in clause 4.2.2.2.3, where the
initial AMF refers to the AMF.

9c. The AMF initiates NGAP procedure to provide the 5G-AN with security context as specified in TS 38.413 [10]
if the 5G-AN had requested for UE Context. Also, if the AMF decides that EPS fallback is supported (e.g. based
on UE capability to support Request Type flag "handover" for PDN connectivity request during the attach
procedure as defined in clause 5.17.2.3.1 of TS 23.501 [2], subscription data and local policy), the AMF shall
send an indication "Redirection for EPS fallback for voice is possible" towards 5G-AN as specified in
TS 38.413 [10]. Otherwise, the AMF indicates "Redirection for EPS fallback for voice is not possible". In
addition, if Tracing Requirements about the UE are available at the AMF, the AMF provides the 5G-AN with
Tracing Requirements in the NGAP procedure.

9d. The 5G-AN stores the security context and acknowledges to the AMF. The 5G-AN uses the security context to
protect the messages exchanged with the UE as described in TS 33.501 [15].

10. [Conditional] new AMF to old AMF: Namf_Communication_RegistrationStatusUpdate (PDU Session ID(s) to
be released due to slice not supported).

If the AMF has changed the new AMF informs the old AMF that the registration of the UE in the new AMF is
completed by invoking the Namf_Communication_RegistrationStatusUpdate service operation.

If the authentication/security procedure fails, then the Registration shall be rejected, and the new AMF invokes
the Namf_Communication_RegistrationStatusUpdate service operation with a reject indication towards the old
AMF. The old AMF continues as if the UE context transfer service operation was never received.

If one or more of the S-NSSAIs used in the old Registration Area cannot be served in the target Registration
Area, the new AMF determines which PDU Session cannot be supported in the new Registration Area. The new
AMF invokes the Namf_Communication_RegistrationStatusUpdate service operation including the rejected
PDU Session ID towards the old AMF. Then the new AMF modifies the PDU Session Status correspondingly.
The old AMF informs the corresponding SMF(s) to locally release the UE's SM context by invoking the
Nsmf_PDUSession_ReleaseSMContext service operation.

If new AMF received in the UE context transfer in step 2 the information about the AM Policy Association and
the UE Policy Association and decides, based on local policies, not to use the PCF(s) identified by the PCF ID(s)
for the AM Policy Association and the UE Policy Association, then it will inform the old AMF that the AM
Policy Association and the UE Policy Association in the UE context is not used any longer and then the PCF
selection is performed in step 15.

11. [Conditional] new AMF to UE: Identity Request/Response (PEI).

If the PEI was not provided by the UE nor retrieved from the old AMF the Identity Request procedure is initiated
by AMF sending an Identity Request message to the UE to retrieve the PEI. The PEI shall be transferred
encrypted unless the UE performs Emergency Registration and cannot be authenticated.

For an Emergency Registration, the UE may have included the PEI in the Registration Request. If so, the PEI
retrieval is skipped.

If the UE supports RACS as indicated in UE MM Core Network Capability, the AMF shall use the PEI of the
UE to obtain the IMEI/TAC for the purpose of RACS operation.

12. Optionally the new AMF initiates ME identity check by invoking the N5g-eir_EquipmentIdentityCheck_Get
service operation (see clause 5.2.4.2.2).

The PEI check is performed as described in clause 4.7.

For an Emergency Registration, if the PEI is blocked, operator policies determine whether the Emergency
Registration procedure continues or is stopped.

13. If step 14 is to be performed, the new AMF, based on the SUPI, selects a UDM, then UDM may select a UDR
instance. See TS 23.501 [2], clause 6.3.9.

The AMF selects a UDM as described in TS 23.501 [2], clause 6.3.8.

14a-c. If the AMF has changed since the last Registration procedure, or if the UE provides a SUPI which doesn't
refer to a valid context in the AMF, or if the UE registers to the same AMF it has already registered to a non-
 3GPP access (i.e. the UE is registered over a non-3GPP access and initiates this Registration procedure to add a
3GPP access), the new AMF registers with the UDM using Nudm_UECM_Registration for the access to be
registered (and subscribes to be notified when the UDM deregisters this AMF).

The AMF provides the "Homogenous Support of IMS Voice over PS Sessions" indication (see clause 5.16.3.3 of
TS 23.501 [2]) to the UDM. The "Homogenous Support of IMS Voice over PS Sessions" indication shall not be
included unless the AMF has completed its evaluation of the support of "IMS Voice over PS Session" as
specified in clause 5.16.3.2 of TS 23.501 [2].

During initial Registration, if the AMF and UE supports SRVCC from NG-RAN to UTRAN the AMF provides
UDM with the UE SRVCC capability.

If the AMF determines that only the UE SRVCC capability has changed, the AMF sends UE SRVCC capability
to the UDM.

NOTE 8: At this step, it is possible that the AMF does not have all the information needed to determine the setting
of the IMS Voice over PS Session Supported indication for this UE (see clause 5.16.3.2 of
TS 23.501 [2]). Hence the AMF can send the "Homogenous Support of IMS Voice over PS Sessions"
later on in this procedure.

If the AMF does not have subscription data for the UE, the AMF retrieves the Access and Mobility Subscription
data, SMF Selection Subscription data, UE context in SMF data and LCS mobile origination using
Nudm_SDM_Get. If the AMF already has subscription data for the UE but the SoR Update Indicator in the UE
context requires the AMF to retrieve SoR information depending on the NAS Registration Type ("Initial
Registration" or "Emergency Registration") (see Annex C of TS 23.122 [22]), the AMF retrieves the Steering of
Roaming information using Nudm_SDM_Get. This requires that UDM may retrieve this information from UDR
by Nudr_DM_Query. After a successful response is received, the AMF subscribes to be notified using
Nudm_SDM_Subscribe when the data requested is modified, UDM may subscribe to UDR by
Nudr_DM_Subscribe. The GPSI is provided to the AMF in the Access and Mobility Subscription data from the
UDM if the GPSI is available in the UE subscription data. The UDM may provide indication that the
subscription data for network slicing is updated for the UE. If the UE is subscribed to MPS in the serving
PLMN, "MPS priority" is included in the Access and Mobility Subscription data provided to the AMF. If the UE
is subscribed to MCX in the serving PLMN, "MCX priority" is included in the Access and Mobility Subscription
data provided to the AMF. The UDM also provides the IAB-Operation allowed indication to AMF as part of the
Access and Mobility Subscription data. The AMF shall trigger the setup of the UE context in NG-RAN, or
modification of the UE context in NG-RAN if the initial setup is at step 9c, including an indication that the IAB-
node is authorized.

The new AMF provides the Access Type it serves for the UE to the UDM and the Access Type is set to "3GPP
access". The UDM stores the associated Access Type together with the serving AMF and does not remove the
AMF identity associated to the other Access Type if any. The UDM may store in UDR information provided at
the AMF registration by Nudr_DM_Update.

If the UE was registered in the old AMF for an access, and the old and the new AMFs are in the same PLMN,
the new AMF sends a separate/independent Nudm_UECM_Registration to update UDM with Access Type set to
access used in the old AMF, after the old AMF relocation is successfully completed.

The new AMF creates an UE context for the UE after getting the Access and Mobility Subscription data from
the UDM. The Access and Mobility Subscription data includes whether the UE is allowed to include NSSAI in
the 3GPP access RRC Connection Establishment in clear text. The Access and Mobility Subscription data may
include Enhanced Coverage Restricted information. If received from the UDM and the UE included support for
restriction of use of Enhanced Coverage in step 1, the AMF determines whether Enhanced Coverage is restricted
or not for the UE as specified in TS 23.501 [2] clause 5.31.12 and stores the updated Enhanced Coverage
Restricted information in the UE context.

The Access and Mobility Subscription data may include the NB-IoT UE Priority.

The subscription data may contain Service Gap Time parameter. If received from the UDM, the AMF stores this
Service Gap Time in the UE Context in AMF for the UE.

For an Emergency Registration in which the UE was not successfully authenticated, the AMF shall not register
with the UDM.
 The AMF enforces the Mobility Restrictions as specified in TS 23.501 [2] clause 5.3.4.1.1. For an Emergency
Registration, the AMF shall not check for Mobility Restrictions, access restrictions, regional restrictions or
subscription restrictions. For an Emergency Registration, the AMF shall ignore any unsuccessful registration
response from UDM and continue with the Registration procedure.

NOTE 9: The AMF can, instead of the Nudm_SDM_Get service operation, use the Nudm_SDM_Subscribe service
operation with an Immediate Report Indication that triggers the UDM to immediately return the
subscribed data if the corresponding feature is supported by both the AMF and the UDM.

14d. When the UDM stores the associated Access Type (e.g. 3GPP) together with the serving AMF as indicated in
step 14a, it will cause the UDM to initiate a Nudm_UECM_DeregistrationNotification (see clause 5.2.3.2.2) to
the old AMF corresponding to the same (e.g. 3GPP) access, if one exists. If the timer started in step 5 is not
running, the old AMF may remove the UE context for the same Access Type. Otherwise, the AMF may remove
UE context for the same Access Type when the timer expires. If the serving NF removal reason indicated by the
UDM is Initial Registration, then, as described in clause 4.2.2.3.2, the old AMF invokes the
Nsmf_PDUSession_ReleaseSMContext (SM Context ID) service operation towards all the associated SMF(s) of
the UE to notify that the UE is deregistered from old AMF for the same Access Type. The SMF(s) shall release
the PDU Session on getting this notification.

If the old AMF has established an AM Policy Association and a UE Policy Association with the PCF(s), and the
old AMF did not transfer the PCF ID(s) to the new AMF (e.g. new AMF is in different PLMN), the old AMF
performs an AMF-initiated Policy Association Termination procedure, as defined in clause 4.16.3.2, and
performs an AMF-initiated UE Policy Association Termination procedure, as defined in clause 4.16.13.1. In
addition, if the old AMF transferred the PCF ID(s) in the UE context but the new AMF informed in step 10 that
the AM Policy Association information and UE Policy Association information in the UE context will not be
used then the old AMF performs an AMF-initiated Policy Association Termination procedure, as defined in
clause 4.16.3.2, and performs an AMF-initiated UE Policy Association Termination procedure, as defined in
clause 4.16.13.1.

If the old AMF has an N2 connection for that UE (e.g. because the UE was in RRC Inactive state but has now
moved to E-UTRAN or moved to an area not served by the old AMF), the old AMF shall perform AN Release
(see clause 4.2.6) with a cause value that indicates that the UE has already locally released the NG-RAN's RRC
Connection.

14e. [Conditional] If old AMF does not have UE context for another access type (i.e. non-3GPP access), the Old
AMF unsubscribes with the UDM for subscription data using Nudm_SDM_unsubscribe.

15. If the AMF decides to initiate PCF communication, the AMF acts as follows.

If the new AMF decides to use the (V-)PCF identified by the (V-)PCF ID included in UE context from the old
AMF in step 5, the AMF contacts the (V-)PCF identified by the (V-)PCF ID to obtain policy. If the AMF
decides to perform PCF discovery and selection and the AMF selects a (V)-PCF and may select an H-PCF (for
roaming scenario) as described in TS 23.501 [2], clause 6.3.7.1 and according to the V-NRF to H-NRF
interaction described in clause 4.3.2.2.3.3.

16. [Optional] new AMF performs an AM Policy Association Establishment/Modification. For an Emergency
Registration, this step is skipped.

If the new AMF selects a new (V-)PCF in step 15, the new AMF performs AM Policy Association
Establishment with the selected (V-)PCF as defined in clause 4.16.1.2.

If the (V-)PCF identified by the (V-)PCF ID included in UE context from the old AMF is used, the new AMF
performs AM Policy Association Modification with the (V-)PCF as defined in clause 4.16.2.1.2.

If the AMF notifies the Mobility Restrictions (e.g. UE location) to the PCF for adjustment, or if the PCF updates
the Mobility Restrictions itself due to some conditions (e.g. application in use, time and date), the PCF shall
provide the updated Mobility Restrictions to the AMF. If the subscription information includes Tracing
Requirements, the AMF provides the PCF with Tracing Requirements.

If the AMF supports DNN replacement, the AMF provides the PCF with the Allowed NSSAI and, if available,
the Mapping Of Allowed NSSAI.

If the PCF supports DNN replacement, the PCF provides the AMF with triggers for DNN replacement.
17. [Conditional] AMF to SMF: Nsmf_PDUSession_UpdateSMContext ().

For an Emergency Registered UE (see TS 23.501 [2]), this step is applied when the Registration Type is
Mobility Registration Update.

The AMF invokes the Nsmf_PDUSession_UpdateSMContext (see clause 5.2.8.2.6) in the following scenario(s):

- If the List Of PDU Sessions To Be Activated is included in the Registration Request in step 1, the AMF
sends Nsmf_PDUSession_UpdateSMContext Request to SMF(s) associated with the PDU Session(s) in order
to activate User Plane connections of these PDU Session(s). Steps from step 5 onwards described in
clause 4.2.3.2 are executed to complete the User Plane connection activation without sending the RRC
Inactive Assistance Information and without sending MM NAS Service Accept from the AMF to (R)AN
described in step 12 of clause 4.2.3.2. When a User Plane connection for a PDU Session is activated, the AS
layer in the UE indicates it to the NAS layer.

- If the AMF has determined in step 3 that the UE is performing Inter-RAT mobility to or from NB-IoT,
the AMF sends Nsmf_PDUSession_UpdateSMContext Request to SMF(s) associated with the UEs PDU
Session(s), so the SMF(s) can update them according to the "PDU Session continuity at inter RAT mobility"
subscription data. Steps from step 5 onwards described in clause 4.2.3.2 are executed without sending MM
NAS Service Accept from the AMF to (R)AN described in step 12 of clause 4.2.3.2.

When the serving AMF has changed, the new serving AMF notifies the SMF for each PDU Session that it has
taken over the responsibility of the signalling path towards the UE: the new serving AMF invokes the
Nsmf_PDUSession_UpdateSMContext service operation using SMF information received from the old AMF at
step 5. It also indicates whether the PDU Session is to be re-activated.

NOTE 10:If the UE moves into a different PLMN, the AMF in the serving PLMN can insert or change the V-
SMF(s) in the serving PLMN for Home Routed PDU session(s). In this case, the same procedures
described in clause 4.23.3 are applied for the V-SMF change as for the I-SMF change (i.e. by replacing
the I-SMF with V-SMF). During inter-PLMN change, if the same SMF is used, session continuity can be
supported depending on operator policies.

Steps from step 5 onwards described in clause 4.2.3.2 are executed. In the case that the intermediate UPF
insertion, removal, or change is performed for the PDU Session(s) not included in "PDU Session(s) to be re-
activated", the procedure is performed without N11 and N2 interactions to update the N3 user plane between
(R)AN and 5GC.

The AMF invokes the Nsmf_PDUSession_ReleaseSMContext service operation towards the SMF in the
following scenario:

- If any PDU Session status indicates that it is released at the UE, the AMF invokes the
Nsmf_PDUSession_ReleaseSMContext service operation towards the SMF in order to release any network
resources related to the PDU Session.

If the serving AMF is changed, the new AMF shall wait until step 18 is finished with all the SMFs associated
with the UE. Otherwise, steps 19 to 22 can continue in parallel to this step.

18. [Conditional] If the new AMF and the old AMF are in the same PLMN, the new AMF sends a UE Context
Modification Request to N3IWF/TNGF/W-AGF as specified in TS 29.413 [64].

If the AMF has changed and the old AMF has indicated that the UE is in CM-CONNECTED state via N3IWF,
W-AGF or TNGF and if the new AMF and the old AMF are in the same PLMN, the new AMF creates an NGAP
UE association towards the N3IWF/TNGF/W-AGF to which the UE is connected. This automatically releases
the existing NGAP UE association between the old AMF and the N3IWF/TNGF/W-AGF.

19. N3IWF/TNGF/W-AGF sends a UE Context Modification Response to the new AMF.

19a. [Conditional] After the new AMF receives the response message from the N3IWF, W-AGF or TNGF in
step 19, the new AMF registers with the UDM using Nudm_UECM_Registration as step 14a, but with the
Access Type set to "non-3GPP access". The UDM stores the associated Access Type together with the serving
AMF and does not remove the AMF identity associated to the other Access Type if any. The UDM may store in
UDR information provided at the AMF registration by Nudr_DM_Update.

19b. [Conditional] When the UDM stores the associated Access Type (i.e. non-3GPP) together with the serving
AMF as indicated in step 19a, it will cause the UDM to initiate a Nudm_UECM_DeregistrationNotification (see
 clause 5.2.3.2.2) to the old AMF corresponding to the same (i.e. non-3GPP) access. The old AMF removes the
UE context for non-3GPP access.

19c. The Old AMF unsubscribes with the UDM for subscription data using Nudm_SDM_unsubscribe.

20a. Void.

21. New AMF to UE: Registration Accept (5G-GUTI, Registration Area, [Mobility restrictions], [PDU Session
status], [Allowed NSSAI], [Mapping Of Allowed NSSAI], [Configured NSSAI for the Serving PLMN],
[Mapping Of Configured NSSAI], [rejected S-NSSAIs], [Pending NSSAI], [Mapping Of Pending NSSAI],
[Periodic Registration Update timer], [Active Time], [Strictly Periodic Registration Timer Indication], [LADN
Information], [accepted MICO mode], [IMS Voice over PS session supported Indication], [Emergency Service
Support indicator], [Accepted DRX parameters for E-UTRA and NR], [Accepted DRX parameters for NB-IoT],
[extended idle mode DRX parameters], [Paging Time Window], [Network support of Interworking without
N26], [Access Stratum Connection Establishment NSSAI Inclusion Mode], [Network Slicing Subscription
Change Indication], [Operator-defined access category definitions], [List of equivalent PLMNs], [Enhanced
Coverage Restricted information], [Supported Network Behaviour], [Service Gap Time], [PLMN-assigned UE
Radio Capability ID], [PLMN-assigned UE Radio Capability ID deletion], [WUS Assistance Information],
[Truncated 5G-S-TMSI Configuration]).

If the Requested NSSAI does not include S-NSSAIs which map to S-NSSAIs of the HPLMN subject to Network
Slice-Specific Authentication and Authorization and the AMF determines that no S-NSSAI can be provided in
the Allowed NSSAI for the UE in the current UE's Tracking Area and if no default S-NSSAI(s) not yet involved
in the current UE Registration procedure could be further considered, the AMF shall reject the UE Registration
and shall include in the rejection message the list of Rejected S-NSSAIs, each of them with the appropriate
rejection cause value.

The Allowed NSSAI for the Access Type for the UE is included in the N2 message carrying the Registration
Accept message. The Allowed NSSAI contains only S-NSSAIs that do not require, based on subscription
information, Network Slice-Specific Authentication and Authorization and, based on the UE Context in the
AMF, those S-NSSAIs for which Network Slice-Specific Authentication and Authorization previously
succeeded, regardless of the Access Type. The Mapping Of Pending NSSAI is the mapping of each S-NSSAI of
the Pending NSSAI for the Serving PLMN to the HPLMN S-NSSAIs.

If the UE has indicated its support for Network Slice-Specific Authentication and Authorization procedure in the
UE MM Core Network Capability in the Registration Request, AMF includes in the Pending NSSAI the S-
NSSAIs that map to an S-NSSAI of the HPLMN which in the subscription information has indication that it is
subject to Network Slice-Specific Authentication and Authorization, as described in clause 4.6.2.4 of
TS 24.501 [25]. In such case, the AMF then shall trigger at step 25 the Network Slice-Specific Authentication
and Authorization procedure, specified in clause 4.2.9.2, except, based on Network policies, for those S-NSSAIs
for which Network Slice-Specific Authentication and Authorization have already been initiated on another
Access Type for the same S-NSSAI(s). The UE shall not attempt re-registration with the S-NSSAIs included in
the list of Pending NSSAIs until the Network Slice-Specific Authentication and Authorization procedure has
been completed, regardless of the Access Type.

If the UE has not indicated its support for Network Slice-Specific Authentication and Authorization procedure in
the UE 5GMM Core Network Capability in the Registration Request, and the Requested NSSAI includes S-
NSSAIs which map to HPLMN S-NSSAIs subject to Network Slice-Specific Authentication and Authorization,
the AMF includes those S-NSSAIs in the Requested NSSAI in the Rejected S-NSSAIs.

If no S-NSSAI can be provided in the Allowed NSSAI because:

- all the S-NSSAI(s) in the Requested NSSAI are to be subject to Network Slice-Specific Authentication
and Authorization; or

- no Requested NSSAI was provided or none of the S-NSSAIs in the Requested NSSAI matches any of the
Subscribed S-NSSAIs, and all the S-NSSAI(s) marked as default in the Subscribed S-NSSAIs are to be
subject to Network Slice-Specific Authentication and Authorization.

The AMF shall provide an empty Allowed NSSAI. Upon receiving an empty Allowed NSSAI and a Pending
NSSAI, the UE is registered in the PLMN but shall wait for the completion of the Network Slice-Specific
Authentication and Authorization procedure without attempting to use any service provided by the PLMN on
any access, except e.g. emergency services (see TS 24.501 [25]), until the UE receives an Allowed NSSAI.
The AMF stores the NB-IoT Priority retrieved in Step 14 and associates it to the 5G-S-TMSI allocated to the
UE.

The AMF sends a Registration Accept message to the UE indicating that the Registration Request has been
accepted. 5G-GUTI is included if the AMF allocates a new 5G-GUTI. Upon receiving a Registration Request
message of type "Initial Registration" or "mobility registration update" from the UE, the AMF shall include a
new 5G-GUTI in the Registration Accept message. Upon receiving a Registration Request message of type
"periodic registration update" from the UE, the AMF should include a new 5G-GUTI in the Registration Accept
message. If the UE is already in RM-REGISTERED state via another access in the same PLMN, the UE shall
use the 5G-GUTI received in the Registration Accept for both registrations. If no 5G-GUTI is included in the
Registration Accept, then the UE uses the 5G-GUTI assigned for the existing registration also for the new
registration. If the AMF allocates a new Registration area, it shall send the Registration area to the UE via
Registration Accept message. If there is no Registration area included in the Registration Accept message, the
UE shall consider the old Registration Area as valid. Mobility Restrictions is included if mobility restrictions
applies for the UE and Registration Type is not Emergency Registration. The AMF indicates the established
PDU Sessions to the UE in the PDU Session status. The UE removes locally any internal resources related to
PDU Sessions that are not marked as established in the received PDU Session status. If the AMF invokes the
Nsmf_PDUSession_UpdateSMContext procedure for UP activation of PDU Session(s) in step 18 and receives
rejection from the SMF, then the AMF indicates to the UE the PDU Session ID and the cause why the User
Plane resources were not activated. When the UE is connected to the two AMFs belonging to different PLMN
via 3GPP access and non-3GPP access then the UE removes locally any internal resources related to the PDU
Session of the current PLMN that are not marked as established in received PDU Session status. If the PDU
Session status information was in the Registration Request, the AMF shall indicate the PDU Session status to the
UE.

If the RAT Type is NB-IoT and the network is configured to use the Control Plane Relocation Indication
procedure then the AMF shall include in the Registration Accept message the Truncated 5G-S-TMSI
Configuration that the UE using Control Plane CIoT 5GS Optimisation uses to create the Truncated 5G-S-TMSI,
see TS 23.501 [2] clause 5.31.4.3.

The Allowed NSSAI provided in the Registration Accept is valid in the Registration Area and it applies for all
the PLMNs which have their Tracking Areas included in the Registration Area. The Mapping Of Allowed
NSSAI is the mapping of each S-NSSAI of the Allowed NSSAI to the HPLMN S-NSSAIs. The Mapping Of
Configured NSSAI is the mapping of each S-NSSAI of the Configured NSSAI for the Serving PLMN to the
HPLMN S-NSSAIs.

The AMF shall include in the Registration Accept message the LADN Information for the list of LADNs,
described in TS 23.501 [2] clause 5.6.5, that are available within the Registration area determined by the AMF
for the UE. The AMF may include Operator-defined access category definitions to let the UE determinine the
applicable Operator-specific access category definitions as described in TS 24.501 [25].

If the UE included MICO mode in the Registration Request, then AMF responds in the Registration Accept
message whether MICO mode should be used. When MICO mode is allowed for the UE, the AMF may include
an Active Time value and/or Strictly Periodic Registration Timer Indication in the Registration Accept message.
The AMF determines the Periodic Registration Update timer value, Active Time value and the Strictly Periodic
Registration Timer Indication based on local configuration, Expected UE Behaviour if available, UE indicated
preferences, UE capability, UE subscription information and network policies, or any combination of them so as
to enable UE power saving, as described in TS 23.501 [2], clause 5.31.7. The AMF determines to apply the
Strictly Periodic Registration Timer Indication to the UE if the UE indicates its capability of the Strictly Periodic
Registration Timer Indication in the registration request message, as described in step 1. If the AMF provides the
Periodic Registration Update timer value with the Strictly Periodic Registration Timer Indication to the UE, the
UE and the AMF start the Periodic Registration Update timer after this step, as described in TS 23.501 [2],
clause 5.31.7.5.

In the case of registration over 3GPP access, the AMF Sets the IMS Voice over PS session supported Indication
as described in clause 5.16.3.2 of TS 23.501 [2]. In order to set the IMS Voice over PS session supported
Indication the AMF may need to perform the UE Capability Match Request procedure in clause 4.2.8a to check
the compatibility of the UE and NG-RAN radio capabilities related to IMS Voice over PS. If the AMF hasn't
received Voice Support Match Indicator from the NG-RAN on time then, based on implementation, AMF may
set IMS Voice over PS session supported Indication and update it at a later stage.

In the case of registration over non-3GPP access, the AMF Sets the IMS Voice over PS session supported
Indication as described in clause 5.16.3.2a of TS 23.501 [2].
The Emergency Service Support indicator informs the UE that emergency services are supported, i.e. the UE is
allowed to request PDU Session for emergency services. If the AMF received "MPS priority" from the UDM as
part of Access and Mobility Subscription data, based on operator policy, "MPS priority" is included in the
Registration Accept message to the UE to inform the UE whether configuration of Access Identity 1 is valid
within the selected PLMN, as specified in TS 24.501 [25]. If the AMF received "MCX priority" from the UDM
as part of Access and Mobility Subscription data, based on operator policy and UE subscription to MCX
Services, "MCX priority" is included in the Registration Accept message to the UE to inform the UE whether
configuration of Access Identity 2 is valid within the selected PLMN, as specified in TS 24.501 [25]. The
Accepted DRX parameters are defined in clause 5.4.5 of TS 23.501 [2]. The AMF includes Accepted DRX
parameters for NB-IoT, if the UE included Requested DRX parameters for NB-IoT in the Registration Request
message. The AMF Sets the Network support of Interworking without N26 parameter as described in
clause 5.17.2.3.1 of TS 23.501 [2]. If the AMF accepts the use of extended idle mode DRX, the AMF includes
the extended idle mode DRX parameters and Paging Time Window as described in 5.31.7.2 of TS 23.501 [2].

If the UDM intends to indicate the UE that subscription has changed, the Network Slicing Subscription Change
Indication is included. If the AMF includes Network Slicing Subscription Change Indication, then the UE shall
locally erase all the network slicing configuration for all PLMNs and, if applicable, update the configuration for
the current PLMN based on any received information.

The Access Stratum Connection Establishment NSSAI Inclusion Mode, as specified in TS 23.501 [2]
clause 5.15.9, is included to instruct the UE on what NSSAI, if any, to include in the Access Stratum connection
establishment. The AMF can set the value to modes of operation a,b,c defined in TS 23.501 [2] clause 5.15.9 in
the 3GPP Access only if the Inclusion of NSSAI in RRC Connection Establishment Allowed indicates that it is
allowed to do so.

For a UE registered in a PLMN, the AMF may provide a List of equivalent PLMNs which is handled as
specified in TS 24.501 [25]. For a UE registered in an SNPN, the AMF shall not provide a list of equivalent
PLMNs to the UE.

If the UE included support for restriction of use of Enhanced Coverage in step 1, the AMF sends the Enhanced
Coverage Restricted information to the NG-RAN in N2 message. The AMF also sends Enhanced Coverage
Restricted information to the UE in the Registration Accept message.

If the UE receives Enhanced Coverage Restricted information in the Registration Accept message, the UE shall
store this information and shall use the value of Enhanced Coverage Restricted information to determine if
Enhanced Coverage feature should be used or not.

If the UE and the AMF have negotiated to enable MICO mode and the AMF uses the Extended connected timer,
then the AMF provides the Extended Connected time value to NG-RAN (see clause 5.31.7.3 of TS 23.501 [2]) in
this step. The Extended Connected Time value indicates the minimum time the RAN should keep the UE in
RRC-CONNECTED state regardless of inactivity.

The AMF indicates the CIoT 5GS Optimisations it supports and accepts in the Supported Network Behaviour
information (see TS 23.501 [2], clause 5.31.2) if the UE included Preferred Network Behaviour in its
Registration Request.

The AMF may steer the UE from 5GC by rejecting the Registration Request. The AMF should take into account
the Preferred and Supported Network Behaviour (see TS 23.501 [2], clause 5.31.2) and availability of EPC to the
UE before steering the UE from 5GC.

If the AMF accepts MICO mode and knows there may be mobile terminated data or signalling pending, the
AMF maintains the N2 connection for at least the Extended Connected Time as described in clause 5.31.7.3 of
TS 23.501 [2], and provides the Extended Connected Time value to the RAN.

The AMF includes Service Gap Time if Service Gap Time is present in the subscription information (steps 14a-
c) or the Service Gap Time has been updated by the Subscriber Data Update Notification to AMF procedure (see
clause 4.5.1) and the UE has indicated UE Service Gap Control Capability.

If the UE receives a Service Gap Time in the Registration Accept message, the UE shall store this parameter and
apply Service Gap Control (see TS 23.501 [2] clause 5.31.16).

If the network supports WUS grouping (see TS 23.501 [2]), the AMF shall send the WUS Assistance
Information to the UE. If the UE provided the UE paging probability information in Step 1, the AMF takes it
into account to determine the WUS Assistance Information.
 When the UE and the AMF supports RACS as defined in TS 23.501 [2] clause 5.4.4.1a, and the AMF needs to
configure the UE with a UE Radio Capability ID, and the AMF already has the UE radio capabilities other than
NB-IoT radio capabilities for the UE, the AMF may provide the UE with the UE Radio Capability ID for the UE
radio capabilities the UCMF returns to the AMF in a Nucmf_assign service operation for this UE. Alternatively,
when the UE and the AMF support RACS, the AMF may provide the UE with an indication to delete any
PLMN-assigned UE Radio Capability ID in this PLMN (see TS 23.501 [2] clause 5.4.4.1a).

If the UE is "CAG supported", and the AMF needs to update the CAG information of the UE, the AMF may
include the CAG information as part of the Mobility Restrictions in the Registration Accept message.

21b. [Optional] The new AMF performs a UE Policy Association Establishment as defined in clause 4.16.11. For
an Emergency Registration, this step is skipped.

The new AMF sends a Npcf_UEPolicyControl Create Request to PCF. PCF sends a Npcf_UEPolicyControl
Create Response to the new AMF.

PCF triggers UE Configuration Update Procedure as defined in clause 4.2.4.3.

22. [Conditional] UE to new AMF: Registration Complete ().

The UE sends a Registration Complete message to the AMF when it has successfully updated itself after
receiving any of the [Configured NSSAI for the Serving PLMN], [Mapping Of Configured NSSAI] and a
Network Slicing Subscription Change Indication, or CAG information in step 21.

The UE sends a Registration Complete message to the AMF to acknowledge if a new 5G-GUTI was assigned.

If new 5G-GUTI was assigned, then the UE passes the new 5G-GUTI to its 3GPP access' lower layer when a
lower layer (either 3GPP access or non-3GPP access) indicates to the UE's RM layer that the Registration
Complete message has been successfully transferred across the radio interface.

NOTE 11:The above is needed because the NG-RAN may use the RRC Inactive state and a part of the 5G-GUTI is
used to calculate the Paging Frame (see TS 38.304 [44] and TS 36.304 [43]). It is assumed that the
Registration Complete is reliably delivered to the AMF after the 5G-AN has acknowledged its receipt to
the UE.

When the List Of PDU Sessions To Be Activated is not included in the Registration Request and the Registration
procedure was not initiated in CM-CONNECTED state, the AMF releases the signalling connection with UE,
according to clause 4.2.6.

When the Follow-on request is included in the Registration Request, the AMF should not release the signalling
connection after the completion of the Registration procedure.

If the AMF is aware that some signalling is pending in the AMF or between the UE and the 5GC, the AMF
should not release the signalling connection immediately after the completion of the Registration procedure.

If PLMN-assigned UE Radio Capability ID is included in step 21, the AMF stores the PLMN-assigned UE
Radio Capability ID in UE context if receiving Registration Complete message.

If the UE receives PLMN-assigned UE Radio Capability ID deletion indication in step 21, the UE shall delete
the PLMN-assigned UE Radio Capability ID(s) for this PLMN.

23. [Conditional] AMF to UDM: If the Access and Mobility Subscription data provided by UDM to AMF in 14b
includes Steering of Roaming information with an indication that the UDM requests an acknowledgement of the
reception of this information from the UE, the AMF provides the UE acknowledgement to UDM using
Nudm_SDM_Info. For more details regarding the handling of Steering of Roaming information refer to
TS 23.122 [22].

23a. For Registration over 3GPP Access, if the AMF does not release the signalling connection, the AMF sends
the RRC Inactive Assistance Information to the NG-RAN.

For Registration over non-3GPP Access, if the UE is also in CM-CONNECTED state on 3GPP access, the AMF
sends the RRC Inactive Assistance Information to the NG-RAN.
 The AMF also uses the Nudm_SDM_Info service operation to provide an acknowledgment to UDM that the UE
received CAG information, or the Network Slicing Subscription Change Indication (see step 21 and step 22) and
acted upon it.

24. [Conditional] AMF to UDM: After step 14a, and in parallel to any of the preceding steps, the AMF shall send a
"Homogeneous Support of IMS Voice over PS Sessions" indication to the UDM using Nudm_UECM_Update:

- If the AMF has evaluated the support of IMS Voice over PS Sessions, see clause 5.16.3.2 of
TS 23.501 [2], and

- If the AMF determines that it needs to update the Homogeneous Support of IMS Voice over PS Sessions,
see clause 5.16.3.3 of TS 23.501 [2].

25. [Conditional] If the UE indicates its support for Network Slice-Specific Authentication and Authorization
procedure in the UE MM Core Network Capability in Registration Request, and any S-NSSAI of the HPLMN is
subject to Network Slice-Specific Authentication and Authorization, the related procedure is executed at this
step (see clause 4.2.9.1). Once the Network Slice-Specific Authentication and Authorization procedure is
completed for all S-NSSAIs, the AMF shall trigger a UE Configuration Update procedure to deliver an Allowed
NSSAI containing also the S-NSSAIs for which the Network Slice-Specific Authentication and Authorization
was successful, and include any rejected NSSAIs with an appropriate rejection cause value.

The AMF shall remove the mobility restriction if the Tracking Areas of the Registration Area were previously
assigned as a Non-Allowed Area due to pending Network Slice-Specific Authentication and Authorization.

The AMF stores an indication in the UE context for any S-NSSAI of the HPLMN subject to Network Slice-
Specific Authentication and Authorization for which the Network Slice-Specific Authentication and
Authorization succeeds.

Once completed the Network Slice-Specific Authentication and Authorization procedure, if the AMF determines
that no S-NSSAI can be provided in the Allowed NSSAI for the UE, which is already authenticated and
authorized successfully by a PLMN, and if no default S-NSSAI(s) could be futher considered, the AMF shall
execute the Network-initiated Deregistration procedure described in clause 4.2.2.3.3, and shall include in the
explicit De-Registration Request message the list of Rejected S-NSSAIs, each of them with the appropriate
rejection cause value.

26. [Conditional] If the UE includes the CAA-level UAV ID in the Registration Request and the UE subscription
data includes Aerial UE information, the authentication and authorization by the USS/UTM (UUAA-MM) is
executed at this step (see clause 4.2.X and clause 5.2.2 in TS 23.256[x]).

The mobility related event notifications towards the NF consumers are triggered at the end of this procedure for cases as
described in clause 4.15.4.

* * * * Start of 2nd Change * * * *

4.2.X USS UAV Authentication and Authorization at Registration (UUAA-
MM)
The UUAA-MM procedure is triggered by the AMF during a Registration procedure, when the AMF determines that a
UE with "Aerial UE" information in its subscription, requires UAV authentication and authorization by a USS/UTM, or
when the USS/UTM that authenticated the UAV triggers a re-authentication.

The UAV is authenticated and authorized by USS/UTM using an identifier and credentials, different from the 3GPP
subscription credentials (e.g., SUPI and credentials used for PLMN access). During the UUAA-MM procedure, the
AMF communicates with the USS/UTM via a UAS-NF and forwards authentication messages transparently between
UE and UAS-NF.

The UUAA-MM procedure requires the use of a GPSI which means a subscription that has Aerial UE information shall
include at least one GPSI.
Details of UUAA-MM steps are described in TS 23.256 [X], clause 5.2.2.

* * * * End of Changes * * * *