19 Living next to 4G

19.1 Why 5G had to move in next door

An operator switching on 5G already owns a working 4G network with all its customers on it, and will not have 5G coverage everywhere for years.

So the two run side by side on the same customers, and a device must be able to walk out of 5G coverage mid-call and land in 4G. Clause §4.3 draws that picture; clause §5.17 says what it costs.

The 4G names first, because the document uses them without explaining them:

• EPS, the Evolved Packet System, is the whole of 4G. EPC is its core. E-UTRAN (also written E-UTRA, and sold as LTE) is its radio network.

• The MME is 4G's mobility function: it tracks where a device is and whether it can be reached. It is the opposite number of the AMF.

• The S-GW is the box the 4G radio hands user packets to. The P-GW is the anchor where those packets meet the outside data network, and it may be split into a control part, PGW-C, and a user part, PGW-U §4.3.1.

• A PDN connection is 4G's version of a PDU session, and the APN — Access Point Name — names the data network it reaches, as a DNN does in 5G.

• An EPS bearer is a pipe inside a PDN connection with its own quality treatment, so it plays the part a QoS Flow plays in 5G. Each carries an identity, the EBI, and a QCI number pointing into a table of quality characteristics the way a 5QI does — see What the network promises.

• The HSS is 4G's subscriber database, the opposite number of the UDM.

19.2 One box wearing two badges

Two systems sharing customers cannot be joined by a translator alone. The answer is to merge the functions holding a session's state, so there is only ever one.

Read that picture from the middle. The SMF+PGW-C is one function that is a 5G session manager on its N interfaces and a 4G control-plane gateway on S5-C. The UPF+PGW-U below it is the same trick in the user plane: N3 towards the 5G radio, S5-U towards the 4G S-GW, one N4 link to its own controller.

Because it is one function, the anchor does not move when the device changes system. That is what makes keeping the IP address possible.

The HSS+UDM at the top is the second merge: one subscriber database, answering S6a to the MME and N8 and N10 to the 5G side. Migration only works if both cores read the same master record for a given user §5.17.1.1.

The PCF is not merged. It stays on the 5G side and reaches the same subscription data through the UDR, keyed by the SUPI §5.17.1.1.

The third merge is the door to the outside world: the SCEF+NEF, joining 4G's exposure function to 5G's so an outside application need not care which core serves the device today.

It answers over N33 the same API a SCEF answers over T8, and holds one shared state across both roles — identity, address and port, monitoring state, the API set, session state §5.17.5.1.

19.3 How a device knows which system to use

A device that speaks 5G NAS — the signalling between device and core — usually speaks 4G NAS too, so it still works where there is no 5G. Which it uses follows from the core serving it §5.17.1.1.

The interesting case is one E-UTRA cell wired to both cores:

• The eNB, the 4G base station, broadcasts that it can also reach a 5G core. The device's radio layer passes that up as an "E-UTRA connected to 5GC" capability.

• When the device's NAS layer wants the 5G core, it says so downwards, and the radio layer puts a "5GC requested" indication in what it sends. The base station reads that and routes the signalling to an AMF or to an MME.

• A device that only does 4G, with 5G radio bolted on as a secondary carrier, never sets that flag, so the base station falls back to its default choice and sends it to an MME §5.17.1.1.

The 5G core can also push a device away, on four grounds: a core-network-type restriction in the subscription, whether EPC connectivity exists at all, the device saying it prefers EPC, and what network behaviour is supported §5.17.1.1.

19.4 One registration, or two

The biggest fork in the clause.

• Single-registration mode. One mobility state, ever. The device is in 5G mode or in 4G mode, and it converts its temporary identity from one world to the other as it crosses. It also keeps its native 5G identity and its 5G security context, so it can pick them up again on return §5.17.2.1.

• Dual-registration mode. Two independent registrations over separate radio connections, two temporary identities held apart, and the device may be registered in 5G only, in 4G only, or in both §5.17.2.1.

Single-registration mode is mandatory for any device supporting both. Dual registration is the option, meant for moving between 4G and 5G-over-NR.

Such a device should hide its E-UTRA capabilities from the 5G side, so it is never handed into an E-UTRA cell and ends up connected twice through one base station §5.17.2.1.

19.5 N26, the wire between the two brains

Set that against the note under the architecture figure: support of N26 in the network is optional §4.3.1. Both are true. N26 is what buys an unbroken session, and nobody is obliged to buy it.

N26 carries the mobility-management and session-management state between source and target, inside one operator's network or between two.

Where it is used the device works in single-registration mode, the network holds one valid mobility state for 3GPP access — in the AMF or the MME, not both — and only one of them is registered in the HSS+UDM §5.17.2.2.1.

Not everything gets to cross. The subscription may bar a core network type or a radio type, and the AMF passes that down to the radio in a Handover Restriction List.

The SMF then decides which sessions may go, on the target's capability and on operator policy, and may release the ones that cannot — though the target has the last word on whether a session lands.

Target shortcomings work the same way: if the MME does not support 15 EPS bearers, the AMF works out which EBIs can be transferred and fetches only those bearer contexts §5.17.2.2.1.

19.5.1 The idle move and the connected move

Idle means no radio connection is up, connected means one is. They take different routes §5.17.2.2.2.

• 5G to 4G, idle. A Tracking Area Update or an Attach carrying a 4G temporary identity mapped from the 5G one, sent as the old native identity, and saying it comes from 5G. It is the radio-layer identity in the same message — the GUMMEI, which names the MME — that is marked "Mapped from 5G-GUTI".

  The MME fetches both contexts from the 5G core. The HSS+UDM then cancels the AMF registration for 3GPP access only — an AMF also serving that device over Wi-Fi keeps it there.

• 4G to 5G, idle. A Mobility Registration with a 5G identity mapped from the 4G one. The device supplies its native 5G identity alongside, which is how the AMF finds the old context and the old security context. The HSS+UDM cancels the MME registration.

• Either direction, connected. Inter-system handover, or an RRC Connection Release — RRC is the signalling between a device and its base station — with a redirection to the other radio. On handover the source core picks the target core node from the tracking area code it is given.

Coming from 4G there is a catching-up step. On the first move of a session built in 4G, the device runs a PDU Session Modification to tell the 5G core what 4G never asked about.

That is reflective QoS support, how many packet filters it holds if that is more than 16, multi-homed IPv6 support, and its maximum data rate for user-plane integrity protection. The network stores it, so later moves do not repeat it §5.17.2.2.2.

19.6 When there is no N26

Without N26 the two cores never talk directly, so the shared database does the carrying. Five things make it work §5.17.2.3.1:

• W1. The AMF tells devices at initial registration that interworking without N26 is supported; the MME may say the same at attach. It holds for the whole registered PLMN and its equivalents in the registration area, and every device on that PLMN gets the same answer.

• W2. When a device attaches in 4G saying it comes from 5G, the MME tells the HSS+UDM not to cancel the AMF registration. Registering in 5G from 4G, the AMF says the same about the MME registration.

• W3. An SMF+PGW-C that supports interworking stores its own name and the DNN in the HSS+UDM when a session is created in 5G.

• W4. The MME stores the gateway and APN in the HSS+UDM when a PDN connection is created in 4G.

• W5. The HSS+UDM hands that name and APN to the target core, picking one by operator policy when several fit.

W3, W4 and W5 are done in N26 networks too, which is what lets a visited network without N26 keep the address for a roamed-in device whose home network only does N26. And with no N26 the source network must not hand the device mapped parameters for the target system §5.17.2.3.1.

A single-registration device then has a choice, and only one branch keeps the address. Going to 4G it can Attach with the Request Type flag "handover" and move its remaining sessions one at a time; or it can do a plain Tracking Area Update, and then the MME tells it to re-attach and the address is lost.

Going to 5G it can establish each session with an "Existing PDU Sessions" flag, or rebuild them from scratch and lose the address §5.17.2.3.2.

A dual-registration device may instead register in the target system early, before moving anything — which is why attaching without a PDN connection is mandatory for it.

It then transfers sessions one by one with a "handover" indication, may keep some on each side, and holds both registrations alive by re-registering periodically in both §5.17.2.3.3.

An incoming message goes through one system and, if nothing answers, should be tried on the other §5.17.2.3.3. In connected state the radio simply releases the connection with a redirection to the other radio §5.17.2.3.4.

19.7 What gets translated at the border

Identities. §Annex B gives the mapping: country and network code pass straight through, the AMF Region ID and AMF Set ID become the MME group identity and part of the MME code, the AMF Pointer the rest of that code, and the 5G-TMSI the M-TMSI.

The fields are not the same size, and while MMEs that know nothing of 5G remain, the two spaces must be partitioned so no value is ambiguous §Annex B.

Session type. Ethernet stays Ethernet if both the 4G core and the device support it there; otherwise Ethernet and Unstructured both travel as "non-IP", and device and SMF each remember the real type so it is restored on the way back.

"non-IP" coming the other way becomes Unstructured. A device that cannot do non-IP in 4G deletes the EBIs itself, so those sessions never leave §5.17.2.1.

Session identity. At PDN connection setup in 4G a 5G-capable device may allocate a PDU Session ID and send it in the protocol configuration options even while its 5G mode is off — so the address can be kept when 5G comes back on §5.17.2.1.

Quality. Having been given a PDU Session ID in the protocol configuration options, and knowing that the subscription does not bar 5G for that connection, the SMF+PGW-C sends mapped QoS parameters to the device.

Between two operators an operator-specific QCI may have to be remapped to a 5QI by agreement, and the document says plainly that this can degrade the service §5.17.2.2.1.

The anchor's own plumbing. While the device sits in 4G, the SMF+PGW-C tells the UPF+PGW-U over N4 to allocate tunnel information per EPS bearer rather than per session, and gives it guaranteed and maximum bit rates per GBR bearer §5.17.1.2.

One anchor per name. The HSS+UDM gives the MME exactly one gateway name per APN. With N26 the AMF pins one SMF+PGW-C per DNN and stores that pairing in the UDM, so the MME cannot be handed two different answers §5.17.2.1.

19.8 Wi-Fi on the far side

The same anchor also serves 4G's Wi-Fi gateway, the ePDG, which is where an untrusted Wi-Fi connection enters the 4G core.

The SMF+PGW-C and UPF+PGW-U speak S2b-C and S2b-U to it. Only GTP-based S2b is supported here, and the S6b interface to the AAA server — the box a data network keeps to check who a subscriber is and what they may use — is optional §4.3.4.1.

In the mirror case — 5G over Wi-Fi through an N3IWF or TNGF, 4G over LTE — the document says only that N26 is not required, and so is not drawn §4.3.3.1. The reason is that those two accesses never hand a radio connection to each other.

Sessions over non-3GPP access do not follow a handover to 4G. They stay anchored in the 5G core, and the device either leaves them there — registered in both systems — releases them, or later moves them into 4G with a PDN connection of request type "Handover" §5.17.3.

19.9 What does not survive

• 2G and 3G. Keeping the IP address across a direct move between 5G and GERAN/UTRAN is not supported §5.17.2.4.

  On the long routes — 5G to 4G to 2G/3G, and back — it is not guaranteed either: the anchor may not hold the older context type, and 5G never gave the device the parameters to activate it §5.17.2.1.

  The device can win it back: after it has moved from 2G/3G into 4G it may release those PDN connections and re-establish them, so that they support interworking to 5G §5.17.2.4.

• A voice handover down to 3G. After 5G SRVCC to UTRAN — SRVCC hands a call already in progress down to the old circuit-switched network — all of the device's PDU sessions are released §5.17.2.4.

• Battery-saving and narrowband settings. MICO mode, in which a device tells the network it will only ever start contact itself and so need not listen for paging, is disabled locally on moving to 4G when one of the triggers of §5.4.1.3 fires. The device can renegotiate it on the way back.

  Moving to NB-IoT — the narrowband radio for cheap, low-rate devices — it drops its dedicated bearers, which NB-IoT does not carry §5.17.2.1.

Two things do cross that you might not expect. URSP rules — the policy telling a device which session an application belongs to — reach a device sitting in 4G through the protocol configuration options of a PDN connection, when device and SMF+PGW-C both support that §5.17.8.

And a data network's own AAA server can still authenticate the device: the SMF+PGW-C runs the same exchanges with PCF, UDM and that server either way, and only the leg to the device differs §5.17.2.5.

19.10 Where this meets the rest of the system

The merged anchor is a plain SMF and UPF whenever the device is in 5G, so The connection to a data network and Where the packets actually go describe it unchanged.

The identity mapping is the 4G end of Every name the system uses, the URSP delivery above the 4G end of Rules, and paying for them, and the slice side of all this sits in One network, many networks.

The roaming figures of §4.3.2 are the interworking versions of the shapes in Being served by somebody else's network, and the exposure figure of §4.3.5.1 the interworking version of Computing close by, and opening the door.