Editing My 3GPP 24.501 notes (section)

== 5.3 General on elementary 5GMM procedures ==

=== 5.3.1 5GMM modes and N1 NAS signalling connection ===

==== 5.3.1.1 Establishment of the N1 NAS signalling connection ====

<span style="color:red">When the UE is in 5GMM-IDLE mode over 3GPP access and needs to transmit an initial NAS message, the UE shall request the lower layer to establish an RRC connection. Upon indication from the lower layers that the RRC connection has been established, the UE shall consider that the N1 NAS signalling connection over 3GPP access is established and enter 5GMM-CONNECTED mode over 3GPP access</span>.

<span style="color:red">When the UE is in 5GMM-IDLE mode over non-3GPP access, and the UE receives an indication from the lower layers of non-3GPP access, that the access stratum connection is established between the UE and the network, the UE shall send an initial NAS message, consider the N1 NAS signalling connection is established and enter 5GMM-CONNECTED mode over non-3GPP access</span>.

Initial NAS messages are:
<ol type="a">
<li>REGISTRATION REQUEST message;</li>
<li>DEREGISTRATION REQUEST message;</li>
<li>SERVICE REQUEST message; and</li>
<li>CONTROL PLANE SERVICE REQUEST.</li>
</ol>

If the UE is capable of both N1 mode and S1 mode and lower layers provide an indication that the current E-UTRA cell is connected to both EPC and 5GCN, for the routing of the REGISTRATION REQUEST message during the initial registration procedure to the appropriate core network (EPC or 5GCN), the UE NAS provides the lower layers with the selected core network type information.

For the routing of the initial NAS message to the appropriate AMF, <span style="color:red">if the UE holds a 5G-GUTI or 4G-GUTI, the UE NAS provides the lower layers with the UE identity according to the following rules</span>:
<ol type="a">
<li>if the registration procedure for mobility and periodic update was triggered due to the last CONFIGURATION UPDATE COMMAND message containing the Configuration update indication IE with the Registration bit set to "registration requested" and including:
# no other parameters;
# one or both of the Allowed NSSAI IE and the Configured NSSAI IE; or
# the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed";
:the <span style="color:red">UE NAS shall not provide the lower layers with the 5G-S-TMSI or the registered GUAMI</span>;</li>
<li>if the service request procedure was initiated over non-3GPP access, <span style="color:red">the UE NAS shall provide the lower layers with the registered GUAMI, but shall not provide the lower layers with the 5G-S-TMSI</span>;</li>
<li>if the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over untrusted non-3GPP access, <span style="color:red">the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclause 5.5.1.2.2 and 5.5.1.3.2, but shall not provide the lower layers with the 5G-S-TMSI</span>;

if the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over trusted non-3GPP access, <span style="color:red">the UE NAS shall provide the lower layers with the 5G-GUTI, if available, otherwise shall provide the lower layers with the SUCI</span>;

if the UE is the 5G-RG and the initial NAS message other than the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message was initiated over wireline access, <span style="color:red">the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclause 5.5.1.2.2 and 5.5.1.3.2, if available, otherwise shall not provide the lower layers with any UE identity</span>;</li>
<li>if the UE does not hold a 5G-GUTI that was previously assigned by the same PLMN with which the UE is performing the registration procedure and if:
# the UE operating in the single-registration mode performs a registration procedure for mobility and periodic update indicating "mobility registration updating" following an inter-system change from S1 mode to N1 mode; or
# the UE which was previously registered in S1 mode before entering state EMM-DEREGISTERED, performs an initial registration procedure, the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface not supported" from the network, and the UE holds a 4G-GUTI;

then <span style="color:red">the UE NAS provides the lower layers with a GUAMI part of the 5G-GUTI mapped from 4G-GUTI as specified in 3GPP TS 23.003 with an indication that the GUAMI is mapped from EPS</span>; or</li>
<li>otherwise:
# if the tracking area of the current cell is in the registration area, <span style="color:red">the UE NAS shall provide the lower layers with the 5G-S-TMSI, but shall not provide the registered GUAMI to the lower layers</span>; or
# if the tracking area of the current cell is not in the registration area, <span style="color:red">the UE NAS shall provide the lower layers with the GUAMI of the 5G-GUTI that the UE NAS has selected as specified in the subclauses 5.5.1.2.2 and 5.5.1.3.2, but shall not provide the lower layers with the 5G-S-TMSI</span>.</li>
</ol>


For 3GPP access and untrusted non-3GPP access, if the UE does not hold a 5G-GUTI and the UE does not hold a 4G-GUTI, <span style="color:red">the UE NAS does not provide the lower layers with the 5G-S-TMSI or the registered GUAMI</span>. For trusted non-3GPP access, if the UE does not hold a 5G-GUTI and the UE does not hold a 4G-GUTI, <span style="color:red">the UE NAS provides the lower layers with the SUCI</span>.

The UE NAS also provides the lower layers with the identity of the selected PLMN (see 3GPP TS 38.331) if the UE is not operating in SNPN access operation mode. If the UE is operating in SNPN access operation mode, the UE NAS provides the lower layers with the SNPN identity of the selected SNPN. In a shared network, the UE shall choose one of the PLMN identity(ies) or SNPN identity(ies) as specified in 3GPP TS 23.122.

The UE NAS layer may provide the lower layers with an NSSAI as specified in subclause 4.6.2.3.

If the UE performs initial registration for onboarding services in SNPN or is registered for onboarding services in SNPN, the UE NAS layer shall provide the lower layers with an indication that the connection is for onboarding.

==== 5.3.1.2 Re-establishment of the N1 NAS signalling connection ====

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has no pending NAS procedure and no pending uplink user data for PDU session(s) with user-plane resources already established, the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode; and</li>
<li><span style="color:red">initiate the registration procedure for mobility and periodic registration update</span> and include the Uplink data status IE in the REGISTRATION REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.5.1.3 for further details).</li>
</ol>
When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has pending uplink user data for PDU session(s) with user-plane resources already established but no pending NAS procedure, the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode; and</li>
<li>initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication (see subclause 5.6.1 for further details).</li>
</ol>

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending registration procedure, a service request procedure, or a de-registration procedure, the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode;</li>
<li>proceed with the pending procedure; and</li>
<li>if the pending procedure is a service request or <span style="color:red">registration procedure</span> and the SERVICE REQUEST message, the CONTROL PLANE SERVICE REQUEST message or the REGISTRATION REQUEST message does not include UE request type IE with Request type value set to "NAS signalling connection release", the UE shall include the Uplink data status IE in the SERVICE REQUEST message, or <span style="color:red">in the REGISTRATION REQUEST message</span>, indicating the PDU session(s) for which user-plane resources were not active prior to receiving a fallback indication from the lower layers and the UE has pending user data to be sent over 3GPP access, if any, and the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclauses 5.5.1.3 and 5.6.1 for further details).</li>
</ol>

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending NAS procedure other than a registration procedure, a service request procedure, or a de-registration procedure, the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode;</li>
<li>initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.6.1 for further details); and</li>
<li>upon successful service request procedure completion, proceed with any pending procedure.</li>
</ol>

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has no pending NAS procedure and no pending uplink user data for PDU session(s) with user-plane resources already established, and the UE was using network resources for ProSe direct discovery over PC5 or ProSe direct communication over PC5 (see 3GPP TS 23.304), the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode; and</li>
<li>initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.6.1 for further details).</li>
</ol>
The cases above apply when the UE is in an allowed area or when the UE is not in a non-allowed area.

When the UE:
<ol type="a">
<li>is in a non-allowed area or is not in an allowed area;</li>
<li>is in 5GMM-CONNECTED mode over 3GPP access;</li>
<li>receives a fallback indication from lower layers; and</li>
<li>does not have signalling pending,</li>
</ol>
the UE shall:
<ol type="a">
<li>enter 5GMM-IDLE mode; and</li>
<li><span style="color:red">initiate the registration procedure for mobility and periodic registration update</span>. The UE shall not include the Uplink data status IE in the REGISTRATION REQUEST message except if the PDU session for which user-plane resources were active is an emergency PDU session, or if the UE is configured for high priority access in the selected PLMN.</li>
</ol>

In the above cases when the UE receives a fallback indication from lower layers, if the UE is in non-allowed area or not in allowed area, the UE shall behave as specified in subclause 5.3.5.

==== 5.3.1.3 Release of the N1 NAS signalling connection ====

See spec for details...

==== 5.3.1.4 5GMM-CONNECTED mode with RRC inactive indication ====

See spec for details...

==== 5.3.1.5 Suspend and resume of the N1 NAS signalling connection ====

See spec for details...

=== 5.3.2 Permanent identifiers ===
A globally unique permanent identity, the 5G subscription permanent identifier (SUPI), is allocated to each subscriber for 5GS-based services. The IMSI, the network specific identifier, the GCI and the GLI are valid SUPI types. When the SUPI contains a network specific identifier, a GCI or a GLI, it shall take the form of a network access identifier (NAI). When the UE performs initial registration for onboarding services in SNPN or is registered for onboarding services in SNPN, the SUPI contains the onboarding SUPI derived from the default UE credentials for primary authentication. The UE derives the onboarding SUPI before or during the initial registration for onboarding services in SNPN and uses the derived onboarding SUPI in the initial registration for onboarding services in SNPN and while registered for onboarding services in SNPN.

The structure of the SUPI and its derivatives are specified in 3GPP TS 23.003. See [[My 3GPP TS 23.003 notes]]

The UE provides the SUPI to the network in concealed form. The SUCI is a privacy preserving identifier containing the concealed SUPI. When the SUPI contains a network specific identifier, a GCI or a GLI, the SUCI shall take the form of a NAI as specified in 3GPP TS 23.003.

<span style="color:red">A UE supporting N1 mode includes a SUCI:</span>
<ol type="a">
<li>in the REGISTRATION REQUEST message when the UE is attempting initial registration procedure <span style="color:red">and a valid 5G-GUTI is not available</span>;</li>
<li>in the IDENTITY RESPONSE message, <span style="color:red">if the SUCI is requested by the network during the identification procedure</span>; and</li>
<li>in the DEREGISTRATION REQUEST message when the UE initiates a de-registration procedure <span style="color:red">and a valid 5G-GUTI is not available</span>.</li>
</ol>
<span style="color:red">If the UE uses the "null-scheme" as specified in 3GPP TS 33.501 to generate a SUCI, the SUCI contains the unconcealed SUPI.</span>

When:
* not operating in SNPN access operation mode; or
* operating in SNPN access operation mode but not performing initial registration for onboarding services and not registered for onboarding services;

the UE shall use the "null-scheme" if:
<ol type="a">
<li>the home network has not provisioned the public key needed to generate a SUCI;</li>
<li>the home network has configured "null-scheme" to be used for the UE;</li>
<li>the UE needs to perform a registration procedure for emergency services after the failure of authentication procedure or after reception of a REGISTRATION REJECT message with the 5GMM cause #3 "Illegal UE", or to initiate a de-registration procedure before the registration procedure for emergency services was completed successfully, and the UE does not have a valid 5G-GUTI for the selected PLMN; or</li>
<li>the UE receives an identity request for SUCI during a registration procedure for emergency services or during a de-registration procedure that was initiated before the registration procedure for emergency services was completed successfully.</li>
</ol>

When operating in SNPN access operation mode and:
* performing initial registration for onboarding services; or
* registered for onboarding services;

the UE shall use the "null-scheme" if:
<ol type="a">
<li>the public key needed to generate a SUCI is not configured as part of the default UE credentials for primary authentication; or</li>
<li>"null-scheme" usage is configured as part of the default UE credentials.</li>
</ol>

If:
<ol type="a">
<li>the UE uses the "null-scheme" as specified in 3GPP TS 33.501 [24] to generate a SUCI;</li>
<li>the UE operates in SNPN access operation mode and:
# an indication to use anonymous SUCI which is associated with the selected entry of the "list of subscriber data", is configured in the ME, if the UE is not registering or registered for onboarding services in SNPN; or
# an indication to use anonymous SUCI which is associated with the default UE credentials, is configured in the ME, if the UE is registering or registered for onboarding services in SNPN;</li>
NOTE 1: The ME can be configured with an indication to use anonymous SUCI associated with an entry of "list of subscriber data" when the EAP method associated with the credentials of the entry supports SUPI privacy at the EAP layer, or can be configured with an indication to use anonymous SUCI associated with the default UE credentials when the EAP method associated with the default UE credentials supports SUPI privacy at the EAP layer, or both.
</br></br>
Editor's note: (WI eNPN, CR 4139) it is FFS whether another UE-level configuration for usage of anonymous SUCI is needed.

<li>the UE does not need to perform a registration procedure for emergency services, or to initiate a de-registration procedure before the registration procedure for emergency services was completed successfully; and</li>
<li>the UE does not receive an identity request for SUCI during a registration procedure for emergency services or during a de-registration procedure that was initiated before the registration procedure for emergency services was completed successfully;</li>
</ol>
then the UE shall use anonymous SUCI as specified in 3GPP TS 23.003.

A W-AGF acting on behalf of an FN-RG shall use the "null-scheme" as specified in 3GPP TS 33.501 to generate a SUCI.

A W-AGF acting on behalf of an N5GC device shall use the "null-scheme" as specified in 3GPP TS 33.501 to generate a SUCI.

If a UE is a MUSIM UE, the UE shall use a separate permanent equipment identifier (PEI) for each USIM, if any, and each entry of "list of subscriber data", if any, the UE operates for accessing 5GS-based services; otherwise, a UE contains and uses a permanent equipment identifier (PEI) for accessing 5GS-based services. When the UE is registered with a network by using a PEI, the UE shall not use that PEI to register with another network until the UE is de-registered from the network.

In this release of the specification, the IMEI, the IMEISV, the MAC address together with the MAC address usage restriction indication and the EUI-64 are the only PEI formats supported by 5GS. The structure of the PEI and its formats are specified in 3GPP TS 23.003.

Each UE supporting at least one 3GPP access technology (i.e. satellite NG-RAN, NG-RAN, E-UTRAN, UTRAN or GERAN) contains a PEI in the IMEI format and shall be able to provide an IMEI and an IMEISV upon request from the network.

Each UE not supporting any 3GPP access technologies and supporting NAS over untrusted or trusted non-3GPP access shall have a PEI in the form of the Extended Unique Identifier EUI-64 of the access technology the UE uses to connect to the 5GC.

A UE supporting N1 mode includes a PEI:
<ol type="a">
<li>when neither SUPI nor valid 5G-GUTI is available to use for emergency services in the REGISTRATION REQUEST message with 5GS registration type IE set to "emergency registration";</li>
<li>when the network requests the PEI by using the identification procedure, in the IDENTITY RESPONSE message; and</li>
<li>when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.</li>
</ol>

Each 5G-RG supporting only wireline access and each FN-RG shall have a permanent MAC address configured by the manufacturer. For 5G-CRG, the permanent MAC address configured by the manufacturer shall be a cable modem MAC address.

When the 5G-RG contains neither an IMEI nor an IMEISV, the 5G-RG shall use as a PEI the 5G-RG's permanent MAC address configured by the manufacturer and the MAC address usage restriction indication set to "no restrictions".

The Wireless Access Gateway Function (W-AGF) acting on behalf of the Fixed Network Residential Gateway (FN-RG) shall use as a PEI the MAC address provided by the FN-RG and if the MAC address provided by the FN-RG is not unique or does not correspond to the FN-RG's permanent MAC address according to W-AGF's configuration, the MAC address usage restriction indication set to "MAC address is not usable as an equipment identifier" otherwise the MAC address usage restriction indication set to "no restrictions".

The 5G-RG containing neither an IMEI nor an IMEISV shall include the PEI containing the MAC address together with the MAC address usage restriction indication:
<ol type="a">
<li>when neither SUPI nor valid 5G-GUTI is available to use for emergency services in the REGISTRATION REQUEST message with 5GS registration type IE set to "emergency registration";</li>
<li>when the network requests the PEI by using the identification procedure, in the IDENTIFICATION RESPONSE message; and</li>
<li>when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.</li>
</ol>
:NOTE 2: In case c) above, the MAC address is provided even though AMF requests the IMEISV.

The W-AGF acting on behalf of the FN-RG shall include the PEI containing the MAC address together with the MAC address usage restriction indication:
<ol type="a">
<li>when the network requests the PEI by using the identification procedure, in the IDENTIFICATION RESPONSE message; and</li>
<li>when the network requests the IMEISV by using the security mode control procedure, in the SECURITY MODE COMPLETE message.</li>
</ol>
:NOTE 3: In case b) above, the MAC address is provided even though AMF requests the IMEISV.

The W-AGF acting on behalf of the N5GC device shall use as a PEI the MAC address provided by the N5GC device and the MAC address usage restriction indication set to "no restrictions". Based on operator policy, the W-AGF acting on behalf of the N5GC device may encode the MAC address of the N5GC device using the EUI-64 format as specified in IEEE "Guidelines for Use of Extended Unique Identifier (EUI), Organizationally Unique Identifier (OUI), and Company ID (CID)" and use as a PEI the derived EUI-64.
:NOTE 4: The MAC address of an N5GC device is universally/globally unique.

The AMF can request the PEI at any time by using the identification procedure.

=== 5.3.3 Temporary identities ===

<span style="color:red">A temporary user identity for 5GS-based services, the 5G globally unique temporary identity (5G-GUTI), is used for identification within the signalling procedures. In case of PLMN the 5G-GUTI is globally unique and in case of Standalone Non-Public Network (SNPN) the 5G-GUTI is unique within an SNPN. When the UE is registered to the same PLMN or SNPN over 3GPP and non-3GPP access, the UE and the AMF maintain one 5G-GUTI that is common to both 3GPP and non-3GPP access. When the UE is required to delete the 5G-GUTI according to a NAS procedure, the UE shall delete the 5G-GUTI only if it is not registered to the same PLMN or SNPN through other access. When the UE is registered to different PLMNs or SNPNs over 3GPP access and non-3GPP access, the UE maintains two 5G-GUTIs, a 5G-GUTI for the registration with a PLMN or SNPN over the 3GPP access and another 5G-GUTI for the registration with another PLMN or SNPN over the non-3GPP access. In the paging and service request procedures, a shortened form of the 5G-GUTI, the 5G S-temporary mobile subscriber identity (5G-S-TMSI), is used to enable more efficient radio signalling. The purpose of the 5G-GUTI and 5G-S-TMSI is to provide identity confidentiality, i.e., to protect a user from being identified and located by an intruder.</span> The structure of the 5G-GUTI and its derivatives are specified in 3GPP TS 23.003. The 5G-GUTI has two main components (see 3GPP TS 23.501):
<ol type="a"><li>the GUAMI; and</li>
<li>the 5G-TMSI that provides an unambiguous identity of the UE within the AMF(s) identified by the GUAMI.</li>
</ol>
:NOTE: The UE registered with an SNPN over non-3GPP access refers to the UE accessing SNPN services via a PLMN.

The 5G-S-TMSI has three main components:
<ol type="a">
<li>the AMF set ID that uniquely identifies the AMF set within the AMF region;</li>
<li>the AMF pointer that identifies one or more AMFs within the AMF set; and</li>
<li>the 5G-TMSI.</li>
</ol>

A UE supporting N1 mode includes a valid 5G-GUTI, if any is available, in the REGISTRATION REQUEST and DEREGISTRATION REQUEST messages. In the SERVICE REQUEST message, the UE includes a valid 5G-S-TMSI as user identity. <span style="color:red">The AMF shall assign a new 5G-GUTI for a particular UE</span>:
<ol type="a">
<li><span style="color:green">during a successful initial registration procedure</span>;</li>
<li><span style="color:green">during a successful registration procedure for mobility registration update</span>;</li>
<li><span style="color:green">after a successful service request procedure invoked as a response to a paging request from the network and before</span> the:
# release of the N1 NAS signalling connection; or
# suspension of the N1 NAS signalling connection due to user plane CIoT 5GS optimization i.e. before the UE and the AMF enter 5GMM-IDLE mode with suspend indication;
:as specified in subclause 5.4.4.1; and</li>
<li><span style="color:green">after the AMF receives an indication from the lower layers that it has received the NGAP UE context resume request message as specified in 3GPP TS 38.413 for a UE in 5GMM-IDLE mode with suspend indication and this resumption is a response to a paging request from the network, and before</span> the:
# release of the N1 NAS signalling connection; or
# suspension of the N1 NAS signalling connection due to user plane CIoT 5GS optimization i.e. before the UE and the AMF enter 5GMM-IDLE mode with suspend indication;
:as specified in subclause 5.4.4.1.</li>
</ol>

<span style="color:red">The AMF should assign a new 5G-GUTI for a particular UE during a successful registration procedure for periodic registration update.</span> <span style="color:red">The AMF may assign a new 5G-GUTI at any time for a particular UE by performing the generic UE configuration update procedure.</span>

If a new 5G-GUTI is assigned by the AMF, the UE and the AMF handle the 5G-GUTI as follows:
<ol type="a"><li>Upon receipt of a 5GMM message containing a new 5G-GUTI, the UE considers the new 5G-GUTI as valid and the old 5G-GUTI as invalid, stops timer T3519 if running, and deletes any stored SUCI. The new 5G-GUTI is stored in a non-volatile memory in the USIM if the corresponding file is present in the USIM, else in the non-volatile memory in the ME, as described in annex C.</li>
<li>The AMF considers the old 5G-GUTI as invalid as soon as an acknowledgement for a registration or generic UE configuration update procedure is received.</li>
</ol>

=== 5.3.4 Registration areas ===

Within the 5GS, <span style="color:red">the registration area is managed independently per access type, i.e., 3GPP access or non-3GPP access. The AMF assigns a registration area to the UE during the registration procedure</span>. A registration area is defined as a set of tracking areas and each of these tracking areas consists of one or more cells that cover a geographical area. Within the 5GS, the concept of "registration to multiple tracking areas" applies:
<ol type="a">
<li>A tracking area is identified by a TAI which is broadcast in the cells of the tracking area. The TAI is constructed from a TAC and a PLMN identity. In case of a shared network:
<ol type="1"><li>one or more TACs; and</li>
<li>any of the following:
<ol type="i">
<li>multiple PLMN identities;</li>
<li>multiple SNPN identities; or</li>
<li>one or more PLMN identities and one or more SNPN identities;
	are broadcast.</li></ol>
</li></ol>
<li>In order to reduce the tracking area update signalling within the 5GS, the AMF can assign several tracking areas to the UE. These tracking areas construct a list of tracking areas which is identified by a TAI list. When generating the TAI list, the AMF shall include only TAIs that are applicable on the access where the TAI list is sent. The AMF shall be able to allocate a TAI list over different NG-RAN access technologies. The AMF shall not allocate a TAI list containing both tracking areas in NB-N1 mode and tracking areas not in NB-N1 mode.</li>
<li>The UE considers itself registered to a list of tracking areas and does not need to trigger the registration procedure for mobility and periodic registration update used for mobility (i.e. the 5GS registration type IE set to "mobility registration updating" in the REGISTRATION REQUEST message) as long as the UE stays in one of the tracking areas of the list of tracking areas received from the AMF.</li>
<li>The UE will consider the TAI list as valid, until it receives a new TAI list in the next registration procedure for mobility and periodic registration update or generic UE configuration update procedure, or the UE is commanded by the network to delete the TAI list by a reject message or it is deregistered from the 5GS. If the registration request is accepted or the TAI list is reallocated by the AMF, the AMF shall provide at least one entry in the TAI list. If the new and the old TAI list are identical, the AMF does not need to provide the new TAI list to the UE during mobility registration update or periodic registration update.</li>
<li>The TAI list can be reallocated by the AMF.</li>
<li>When the UE is deregistered from the 5GS, the TAI list in the UE is invalid.</li>
<li>The UE includes the last visited registered TAI, if available, to the AMF. The last visited registered TAI is stored in a non-volatile memory in the USIM if the corresponding file is present in the USIM, else in the non-volatile memory in the ME, as described in annex C.</li>
</ol>

=== 5.3.5 Service area restrictions ===

==== 5.3.5.1 General ====

Service area restrictions are applicable only to 3GPP access and to wireline access.

Subclause 5.3.5.2 applies when the UE accesses 5GCN over 3GPP access.

Subclause 5.3.5.3 applies when the 5G-RG or the W-AGF acting on behalf of an FN-CRG (or on behalf of the N5GC device) access 5GCN over wireline access.
:NOTE:	Service area restrictions are not applicable for the W-AGF acting on behalf of the FN-BRG.

==== 5.3.5.2 3GPP access service area restrictions ====

<span style="color:blue">The service area restrictions consist of tracking areas forming either an allowed area, or a non-allowed area</span>. The tracking areas belong to either the registered PLMN or its equivalent PLMNs in the registration area. The allowed area can contain up to 16 tracking areas or include all tracking areas in the registered PLMN and its equivalent PLMN(s) in the registration area. The non-allowed area can contain up to 16 tracking areas. The network conveys the service area restrictions to the UE by including either an allowed area, or a non-allowed area, but <span style="color:red">not both</span>, in the Service area list IE of a REGISTRATION ACCEPT message or a CONFIGURATION UPDATE COMMAND message.

If the network does not convey the service area restrictions to the UE in the Service area list IE of a REGISTRATION ACCEPT message, the UE shall treat all tracking areas in the registered PLMN and its equivalent PLMN(s) in the registration area as allowed area and delete the stored list of "allowed tracking areas" or the stored list of "non-allowed tracking areas".

When the UE receives a Service area list IE with an allowed area indication during a registration procedure or a generic UE configuration update procedure:
<ol type="a">
<li>if the "Type of list" included in the Service area list IE does not indicate "all TAIs belonging to the PLMNs in the registration area are allowed area", the UE shall delete the old list of "allowed tracking areas" and store the tracking areas in the allowed area as the list of "allowed tracking areas". If the UE has a stored list of "non-allowed tracking areas", the UE shall delete that list; or</li>
<li>if the "Type of list" included in the Service area list IE indicates "all TAIs belonging to the PLMNs in the registration area are allowed area", the UE shall treat all tracking areas in the registered PLMN and its equivalent PLMN(s) as allowed area and delete the stored list of "allowed tracking areas" or the stored list of "non-allowed tracking areas".</li>
</ol>

When the UE receives a Service area list IE with a non-allowed area indication during a registration procedure or a generic UE configuration update procedure, the UE shall delete the old list of "non-allowed tracking areas" and store the tracking areas in the non-allowed area as the list of "non-allowed tracking areas". If the UE has a stored list of "allowed tracking areas", the UE shall delete that list.

If the UE is successfully registered to a PLMN and has a stored list of "allowed tracking areas":

See spec for details...

=== 5.3.6 Mobile initiated connection only (MICO) mode ===

=== 5.3.7 Handling of the periodic registration update timer and mobile reachable timer ===

The periodic registration update procedure is used over 3GPP access to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by the periodic registration update timer, T3512.

If the UE is registered over the 3GPP access, the AMF maintains an implicit de-registration timer to control when the UE is considered implicitly de-registered over the 3GPP access. If the UE is registered over the non-3GPP access, the AMF also maintains a non-3GPP implicit de-registration timer to control when the UE is considered implicitly de-registered over the non-3GPP access. The UE registered over the non-3GPP access maintains a non-3GPP de-registration timer to control when the UE is considered implicitly de-registered for the non-3GPP access.

The AMF shall start a non-3GPP implicit de-registration timer for the UE registered over non-3GPP access when the N1 NAS signalling connection over non-3GPP access is released.

The UE registered over non-3GPP access shall reset and start a non-3GPP de-registration timer when the N1 NAS signalling connection over non-3GPP access is released. The non-3GPP de-registration timer is stopped when the UE enters 5GMM-CONNECTED mode over non-3GPP access or the 5GMM-DEREGISTERED state over non-3GPP access.

The non-3GPP implicit de-registration timer shall be longer than the non-3GPP de-registration timer.

The value of timer T3512 is sent by the network to the UE in the REGISTRATION ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE until a new value is received. The periodic registration update timer only applies to the UE registered to the 5GS services over 3GPP access.

If timer T3512 received by the UE in a REGISTRATION ACCEPT message contains an indication that the timer is deactivated or the timer value is zero, then timer T3512 is deactivated and the UE shall not perform the periodic registration update procedure.
:NOTE 1: The UE does not perform the periodic registration update procedure for non-3GPP access.

If during the registration procedure, the AMF does not indicate "strictly periodic registration timer supported" in the MICO indication IE to the UE, timer T3512 is reset and started with its initial value, when the UE changes from 5GMM-CONNECTED over 3GPP access to 5GMM-IDLE mode over 3GPP access. Timer T3512 is stopped when the UE enters 5GMM-CONNECTED mode over 3GPP access or the 5GMM-DEREGISTERED state over 3GPP access.

If during the registration procedure, the AMF indicates "strictly periodic registration timer supported" in the MICO indication IE to the UE, timer T3512 is started with its initial value after the completion of the registration procedure. The UE shall neither stop nor reset the timer T3512 when the UE enters 5GMM-CONNECTED or when changing from 5GMM-CONNECTED mode to 5GMM-IDLE mode. If the timer T3512 expires,
<ol type="a">
<li>the UE in 5GMM-CONNECTED mode over 3GPP access shall reset and start the timer T3512 with its initial value; or</li>
<li>the UE in 5GMM-IDLE mode over 3GPP access shall perform the periodic registration procedure.</li>
</ol>

If the UE is registered for emergency services, and timer T3512 expires, the UE shall not initiate a periodic registration update procedure, but shall locally de-register from the network. When the UE is camping on a suitable cell, it may re-register to regain normal service.

When a UE is not registered for emergency services, and timer T3512 expires when the UE is in 5GMM-IDLE mode, the periodic registration update procedure shall be started.

If the UE is not registered for emergency services, and is in a state other than 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE over 3GPP access when timer T3512 expires, the periodic registration update procedure is delayed until the UE returns to 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE over 3GPP access.
:NOTE 2: When the UE returns to 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE and it needs to initiate other 5GMM procedure than the periodic registration update procedure then, based on UE implementation, the 5GMM procedure can take precedence.

The network supervises the periodic registration update procedure of the UE by means of the mobile reachable timer.

If the UE is not registered for emergency services, the mobile reachable timer shall be longer than the value of timer T3512. In this case, by default, the mobile reachable timer is 4 minutes greater than the value of timer T3512.

The network behaviour upon expiry of the mobile reachable timer is network dependent, but typically the network stops sending paging messages to the UE on the first expiry, and may take other appropriate actions.

If the UE is registered for emergency services, the AMF shall set the mobile reachable timer with a value equal to timer T3512. When the mobile reachable timer expires, the AMF shall locally de-register the UE.

The mobile reachable timer shall be reset and started with the value as indicated above, when the AMF releases the NAS signalling connection for the UE. The mobile reachable timer shall be stopped when a NAS signalling connection is established for the UE.

Upon expiry of the mobile reachable timer the network shall start the implicit de-registration timer over 3GPP access. The value of the implicit de-registration timer over 3GPP access is network dependent. If MICO mode is activated, the network shall start the implicit de-registration timer over 3GPP access when the UE enters 5GMM-IDLE mode at the AMF over 3GPP access. The default value of the implicit de-registration timer over 3GPP access is 4 minutes greater than the value of timer T3512.

If the implicit de-registration timer expires before the UE contacts the network, the network shall implicitly de-register the UE. The implicit de-registration timer shall be stopped when a NAS signalling connection is established for the UE.

If the non-3GPP implicit de-registration timer expires before the UE contacts the network over the non-3GPP access, the network shall implicitly de-register the UE and enter the state 5GMM-DEREGISTERED over non-3GPP access for the UE. The non-3GPP implicit de-registration timer shall be stopped when a NAS signalling connection over non-3GPP access is established for the UE.

If the non-3GPP de-registration timer expires before the UE contacts the network over the non-3GPP access, the UE shall enter the state 5GMM-DEREGISTERED over non-3GPP access. The non-3GPP de-registration timer shall be stopped when a NAS signalling connection over non-3GPP access is established for the UE.

If the AMF provides T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "Non-3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of timer T3512, the AMF sets the mobile reachable timer and the implicit de-registration timer such that the sum of the timer values is greater than the value of timer T3346.

If the AMF provides T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of the non-3GPP de-registration timer, the AMF sets the non-3GPP implicit de-registration timer value to be 8 minutes greater than the value of timer T3346.

If the UE receives T3346 value IE in the DEREGISTRATION REQUEST message with Access type set to "3GPP access" in Deregistration type IE, REGISTRATION REJECT message during a registration procedure for mobility and periodic registration update or SERVICE REJECT message and the value of timer T3346 is greater than the value of the non-3GPP de-registration timer, the UE sets the non-3GPP de-registration timer value to be 4 minutes greater than the value of timer T3346.

=== 5.3.9 Handling of NAS level mobility management congestion control ===