4 Knowing who you are and where you are

4.1 Why a device has to say hello

A network that carries a call to a phone has to answer three questions before the call can start: is this subscriber allowed, is the phone switched on, and which part of the country should be shouted into.

Registration is how the phone answers all three at once, and this chapter is the machinery for keeping those answers true afterwards.

Network access control is the umbrella name, and it covers network selection, identification and authentication, authorisation, barring, policy control and lawful interception §5.2.1.

The device picks a network first, which is not this document's business — the rules are in TS 22.011 and the procedure in TS 23.122 §5.2.2. Then it registers, and the registration procedure runs the authentication and the authorisation against the subscription held in the UDM §5.3.2.1.

The result is that the identity of the serving AMF — the function that keeps track of where a device is and whether it can be reached, from Who does what in the core — is written into the UDM, so the rest of the network can find where this subscriber is being served.

4.2 The names one device is known by

Four identifiers do most of the work, and mixing them up is the commonest misreading of a 5G trace.

• SUPI — Subscription Permanent Identifier. The subscriber, globally unique, held in the UDM and the UDR. It may be an IMSI, or a network-specific name for a private network. It is used only inside the 3GPP system, and it carries the address of the home network so roaming can work §5.9.2.

• SUCI — Subscription Concealed Identifier. The SUPI with the identifying part encrypted. When a device has to tell the network who it is, this is what it sends §5.9.2a.

• PEI — Permanent Equipment Identifier. The hardware, not the subscriber: an IMEI for anything with a 3GPP radio. The network may check it against the 5G-EIR §5.9.3.

• 5G-GUTI — the temporary name. The AMF allocates it, it works across 3GPP and non-3GPP access, and it may be reassigned at any time §5.9.4.

The 5G-GUTI is worth taking apart, because two of its pieces are used constantly. It is a GUAMI plus a 5G-TMSI. The GUAMI names the AMF — country code, network code, region, AMF set, and a pointer to one or more AMFs. The 5G-TMSI names the device inside that AMF §5.9.4.

The shortened form, the 5G-S-TMSI, drops the country and network codes and is what the device hands to the radio network when it opens a connection. The radio network derives the paging moment from the bottom ten bits of it, which is why the AMF has to spread those bits evenly §5.9.4.

4.3 Two state machines that do not move together

The document tracks a device with two independent state machines, and reading them as one is the mistake that makes traces look impossible.

Registration management has two states. In RM-DEREGISTERED the AMF holds no valid location for the device and cannot reach it, though both sides may keep parts of the context so a later registration need not authenticate again §5.3.2.2.2.

In RM-REGISTERED the device may receive the services that need registration §5.3.2.2.3.

Connection management has two states as well, and they are about signalling rather than subscription §5.3.3.1.

In CM-CONNECTED there is a signalling connection: a radio connection between the device and the radio network, and an association between the radio network and the AMF §5.3.3.2.3.

The AMF may keep a device there until it deregisters, and a connected device may sit in the radio network's own RRC_INACTIVE state, where the radio network manages reachability and paging instead of the core.

A phone in a pocket is RM-REGISTERED and CM-IDLE. That combination is the normal one, not an error.

4.4 Where the network thinks you are

While a device is idle, its location is known to the granularity of a list of tracking areas, not a cell §5.4.1.1.

The AMF allocates that list — the registration area — during registration, and may take mobility patterns and area restrictions into account §5.3.2.3.

The device performs a Mobility Registration Update only when its current tracking area is not on the list, which is what keeps a moving phone from signalling every few hundred metres §5.3.2.2.3.

Two other triggers keep the answer honest. A periodic registration timer, given to the device by the AMF, makes it check in even when nothing has happened; if it does not, the AMF may eventually deregister it implicitly §5.4.1.1. And the device re-registers when its capabilities change.

Over non-3GPP access the registration area is smaller and simpler: it holds only the one tracking area value the gateway reported §5.3.2.3.

4.5 Waking a sleeping device

When something arrives for an idle device, the AMF pages it, and the device answers with a Service Request §5.3.3.2.2.

The AMF may choose different paging strategies for different traffic. Where the trigger is a downlink packet, the SMF passes on the 5QI and the ARP of the flow it belongs to, and the AMF uses those to decide how hard to look §5.4.3.1.

Not every device wants to be woken. Three reachability categories are negotiated between the device and the AMF for the idle state §5.4.1.1: ordinary reachability with paging; MICO mode, where only the device may start a connection; and an unavailability period, where nothing is carried at all.

MICO — Mobile Initiated Connection Only — is the one to remember, because it changes what the network promises. While a MICO device is idle the AMF treats it as unreachable and rejects downlink delivery requests, and in exchange the registration area need not be constrained by paging area size §5.4.1.3.

4.6 Where to look next

Access control as a whole is §5.2; registration and connection management, including the state models, are under §5.3. Reachability, paging and the radio capability handling that goes with it are §5.4, and every identifier the system uses is §5.9.

The in-depth course of this track covers these clauses in full, including mobility restrictions, service area restrictions and the RRC_INACTIVE state.