26 Relays, satellites, femtos and shared networks

26.1 Why an odd-shaped radio is the core network's problem

The core draws its boundary at two reference points and nothing else: N2 for control signalling to the AMF (the function that tracks where a device is), N3 for user packets to the UPF (the function that forwards them). Anything that terminates both is an access network.

That boundary holds up well. Almost every shape in this chapter reaches the core over N2 and N3 exactly as a mast on a roof does. But each one asks for one thing extra — an authorisation, a second location, an identifier in a message, a longer list of operators on the air.

This is the tour. Each section says what the thing is, why it exists, and the one thing the core does differently.

26.2 Two operators, one radio

Radio sites cost more than core networks do, so operators share them. In this release the shared part is the radio access network only: the 5G Multi-Operator Core Network, or 5G MOCN §5.18.1.

Every cell of the shared radio broadcasts the identifiers of the operators reachable through it — a PLMN ID (a country code plus a network code), or a PLMN ID together with an NID where the operator is a stand-alone private network.

Each identifier comes with its own parameters: cell identity, tracking areas, and CAG identifiers, the names of a closed access group that only listed subscribers may use §5.18.2. The set of operators must be the same for every cell of one tracking area.

The device picks one, tells NG-RAN — the 5G radio network — which it picked at RRC establishment, and NG-RAN tells the core §5.18.3.

From then on the network is expected to leave that choice alone: the AMF hands NG-RAN a prioritised list of permitted operators in the Mobility Restriction List, and NG-RAN uses that list when choosing a handover target §5.18.4.

The AMF also gives the device the list of operators it should treat as equivalent to its serving one §5.18.2a.

A slice is defined inside one operator's network, so each sharing operator defines and supports its own set of slices over the common radio §5.18.5. The rest of slicing is One network, many networks.

26.2.1 When the second operator has no core in reach either

Indirect network sharing goes one step further: the shared radio talks only to the hosting operator's core, and the participating operator hangs off that §5.18.1.

The radio broadcasts a PLMN ID for the hosting operator and one for each participating operator. A device of a participating operator selects its own identifier as usual.

The hosting AMF serves it, then selects the participating operator's SMF (the function that sets up a session and steers its traffic) as the anchor and an SMF of its own as the visited one, on the home-routed roaming pattern of Being served by somebody else's network.

Two rules keep the identifiers straight. Messages between the hosting and the participating network carry the selected PLMN ID as the serving one; messages that stay inside the hosting network carry the hosting operator's own.

Messages to the participating operator carry both, so the far side can tell an indirect sharing case from ordinary roaming §5.18.1.

Slice identifiers are mapped rather than shared. Where the broadcast identifier is the device's own home one, the device asks with its home slice identifiers and the hosting AMF maps them to hosting slice identifiers for the radio.

Only home ones come back, so the shared radio never needs the mapping table §5.18.5.

The same machinery covers a disaster. When one operator's network fails, a hosting operator can carry its users indirectly; the device notices nothing, and the AMF adds a Disaster Roaming service indication so the participating operator's functions can tell who is arriving this way §5.18.6.

If several hosting operators can help, each broadcasts a different PLMN ID standing for the same stricken operator, to split the load. §Annex R adds that ordinary mobility restrictions and handover procedures are reused unchanged §R.1.

26.3 A base station whose backhaul is radio

Integrated access and backhaul, IAB, lets a base station reach the network over another base station's NR radio instead of a fibre §5.35.1.

An IAB node is two halves. The IAB-UE half registers, authenticates and is handled as a device. The gNB-DU half — the radio part of a base station that has been split in two — serves real devices and further IAB nodes.

The matching control half lives in the IAB-donor, and the two are joined by F1, the link inside a split base station.

So the core sees ordinary devices and one ordinary gNB, and quality of service stays a radio matter — if the backhaul cannot carry a flow, NG-RAN simply rejects the request §5.35.3. Charging is unchanged, because donor and core already have both sets of sessions separately §5.35.5.

The one core-side addition is authorisation. The node sends an IAB-indication at RRC establishment; the donor picks an AMF that supports IAB and passes the indication on; the AMF checks the subscription and answers NG-RAN with "authorized" or "not authorized" §5.35.2.

Not authorised means the registration is rejected, or kept with the negative indication in NG-RAN's hands. Multi-hop is allowed, and a node may change parent during operation when a link fails §5.35.1.

26.4 The same node, on a bus

A mobile base station relay, MBSR, is an IAB node that moves. Two limits apply: one hop to the donor, and NR Uu on both links §5.35A.1.

It announces itself with a mobile IAB-indication, and must not send the plain IAB-indication as well. Authorisation is by subscription and can be limited by place and time, so the AMF builds a registration area whose tracking areas are all authorised for relay operation §5.35A.4.

The interesting part is withdrawal. When authorisation ends, the AMF either deregisters the relay with a "re-registration required" flag or updates it with a UE Configuration Update, and tells NG-RAN the new status.

NG-RAN then hands over the devices the relay was serving before the F1 connection is released, and the AMF waits for that to happen §5.35A.4.

A relay that has no PDU session of its own would break handover, which normally carries session information. So NG-RAN sends a dummy PDU session, the AMF sees an empty context, involves no SMF at all, and marks the message so the target radio ignores what it receives §5.35A.3.4.

Two more small things. The donor may add an "Additional ULI" — the location of the relay's own UE half — beside the ordinary location of a served device, and the AMF may use it for mobility restrictions and pass it on for location services §5.35A.6.

And access to the relay is controlled with CAG identifiers from Networks that are not for everybody, optionally with a validity time, so a permission expires by itself §5.35A.7.

26.5 A whole gNB behind a PDU session

Mobile gNB with wireless access backhauling, MWAB, solves the same problem in a completely different way §5.49.1.1.

Where IAB relays at layer 2, MWAB tunnels at layer 3. The MWAB-UE half registers somewhere and establishes ordinary PDU sessions (The connection to a data network); the gNB half then runs its N2, N3, Xn — the link from one base station to its neighbour — and management traffic inside them §5.49.1.2.

Two networks are therefore in play at once: the backhaul network that serves the UE half, and the network whose identity the gNB half broadcasts. They may be different operators, or private networks, and the devices being served know nothing of the first — §Annex S draws every combination §S.2 §S.3.

Quality of service has to be carried across the join by hand. The gNB half and the anchor UPF mark N3 and Xn packets with DSCP values, the priority marking IP routers read.

The gNB half then tells its UE half how those values map to QoS Flows in the backhaul network, with the packet filters and the parameters to ask for, and the UE half establishes or modifies backhaul sessions to match §5.49.1.3.

Slices work the same way: a slice of the broadcast network is associated with a traffic descriptor, and a device's session is put on the backhaul session that association points to §5.49.1.4.

The two halves are authorised separately, which is the point people miss. The UE half is authorised by dedicated slice identifiers and data network names in its subscription §5.49.3.2.

The gNB half is authorised by the management system of the network it broadcasts, which also decides when and where it must shut down §5.49.3.3.

When authorisation ends the gNB hands over the devices it serves, releases the ones it cannot, and only then drops its cells — so the AMF is configured to delay releasing the backhaul session long enough for that to finish §5.49.3.2.

Emergency calls get their own treatment: the relay may be configured with a dedicated slice and data network name for backhaul sessions carrying emergency traffic, and a relay serving an emergency session does not stop operating until those devices are moved elsewhere §5.49.8.

26.6 Two smaller shapes

A network controlled repeater is a radio amplifier that the network supervises. The document describes only the dealings of its control half with the core, and that half is handled with the procedures defined for a device.

So the core's whole contribution is an authorisation flag in the subscription, checked at registration and pushed to NG-RAN — and pushed again with a UE Context Modification if it ever changes §5.47.

An NR femto is a base station in a home or an office. It connects to the core directly or through an NR Femto Gateway, which concentrates N2: to the AMF it looks like a gNB, to the femto cells it looks like an AMF §5.50.2.

Because of that disguise, a handover into a femto needs the AMF to include the target radio node identity in the Handover Request so the gateway knows where to route it.

Access is controlled with CAG identifiers, and the hosting party — the owner of the femto — plays the role of CAG owner and may provision subscribers through an application function, non-roaming only §5.50.1 §5.50.3.

A locally deployed UPF next to the femto turns it into an edge site, which is Computing close by, and opening the door.

26.7 Backhaul through space

A satellite may carry the link between the access network and the core §5.43.1.

The core can be told about it: when the AMF knows a satellite backhaul is in use it may report the Satellite backhaul category to the SMF, and reports again when it changes, including the change to a terrestrial link §5.43.4.

The category is one of GEO, MEO, LEO (geostationary, medium and low earth orbit), OTHERSAT and the four DYNAMIC_ variants of those. Dynamic means the latency or the bandwidth varies over time, for instance because links between satellites are used and change. Only one category is ever indicated.

Where the category is dynamic, the PCF (the function that turns operator policy into the rules a session is run by) may ask for delay measurement between device and anchor, so the promises of What the network promises are checked rather than assumed §5.43.5.

A UPF can also be on the satellite, in this release only on a geostationary one. The AMF works out the GEO Satellite ID from configuration and sends it to the SMF.

The SMF turns it into a DNAI (the name of a place where traffic may leave the network) and selects the on-board UPF as anchor, or inserts it as an uplink classifier with a local anchor §5.43.2.

Two devices under the same satellite can then be switched to each other on board, without the traffic going down to the ground and back — one SMF controls both sides, and N19 tunnels or N6 carry traffic between UPFs on different satellites §5.43.3.1 §5.43.3.3.

§Annex Q deals with a different question: telling a device when satellite coverage will exist at all. The format is not standardised in this release; the annex sketches it as a true/false value per grid point per time slot, per radio type, delivered over a PDU session or a series of concatenated text messages.

26.8 Devices that do less on purpose

Reduced-capability devices — NR RedCap, and the smaller NR eRedCap — trade radio capability for price and battery. The core's part is only to know which is which §5.41.

The device declares itself at RRC establishment, NG-RAN passes an indication to the AMF in the Initial UE Message, and the AMF stores it, treats it as the RAT type — the name of the radio technology in use — and signals it onward to the SMS function, the SMF and the PCF.

Functions talking to the charging function include it as the RAT type. It survives an AMF change and is re-supplied by the target radio after a handover from 4G.

Small devices that send small messages are a different subject, in Small devices, small messages.

26.9 When one SMF cannot cover the whole country

The last shape is not a radio at all. An SMF may have a service area smaller than the network. When a device is outside its SMF's area, or the SMF cannot reach the place where traffic should leave, an intermediate SMF is inserted between AMF and SMF: N11 towards the AMF, N16a towards the SMF §5.34.1.

The AMF decides. It learns each SMF's service area and supported DNAIs from the NRF (the register other functions are found in, How one function finds another), and inserts, changes or removes the intermediate SMF as the device moves or as the anchor SMF names a new DNAI §5.34.3.

The intermediate SMF then owns the local user-plane functions: it chooses and inserts the uplink classifier and the local anchor itself, and the anchor SMF never needs to know their addresses §5.34.4 §5.34.11. The user-plane shapes are in Where the packets actually go.

Two limits are worth remembering. A session whose data network name is a local one is released or rejected if an intermediate SMF has to be inserted, so local data networks have to be planned to fit inside one SMF's area §5.34.1.

And in home-routed roaming, if the home SMF does not support changing the visited SMF, the AMF must release the session rather than change it §5.34.9.