4.5.1 General

When the UE needs to access the 5GS, and the UE:

• not operating as an IAB-node (see 3GPP TS 23.501 [8]);
• not acting as a 5G ProSe layer-2 UE-to-network relay UE (see 3GPP TS 23.304 [6E]) whose access attempt is triggered by a 5G ProSe layer-2 remote UE;
• not acting as a 5G ProSe multi-hop layer-2 UE-to-network relay UE (see 3GPP TS 23.304 [6E]) whose access attempt is triggered by a 5G ProSe multi-hop layer-2 remote UE or by 5G ProSe layer-2 intermediate UE-to-network relay UE; and
• not acting as an NCR-MT node (see 3GPP TS 38.300 [27]);

first performs access control checks to determine if the access is allowed. Access control checks shall be performed for the access attempts defined by the following list of events:

NOTE 1: Although the UE operating as an IAB-node or as an NCR-MT node skips the access control checks, the UE operating as an IAB-node or as an NCR-MT node determines an access category and one or more access identities for each access attempt in order to derive an RRC establishment cause. In this case the NAS provides the RRC establishment cause but does not provide the access category and the one or more access identities to the lower layers.

NOTE 1A: Although the UE acting as a 5G ProSe layer-2 UE-to-network relay UE or a 5G ProSe multi-hop layer-2 UE-to-network relay UE skips the access control checks, the UE determines an access category and one or more access identities for each access attempt in order to derive an RRC establishment cause.

• the UE is in 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication over 3GPP access and an event that requires a transition to 5GMM-CONNECTED mode occurs; and
• the UE is in 5GMM-CONNECTED mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication and one of the following events occurs:
• 5GMM receives an MO-IMS-registration-related-signalling-started indication, an MO-MMTEL-voice-call-started indication, an MO-MMTEL-video-call-started indication or an MO-SMSoIP-attempt-started indication from upper layers;
• 5GMM receives a request from upper layers to send a mobile originated SMS over NAS unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
• 5GMM receives a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session establishment unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
• 5GMM receives a request from upper layers to send an UL NAS TRANSPORT message for the purpose of UE-requested PDU session modification procedure unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
• 5GMM receives a request to re-establish the user-plane resources for an existing PDU session;
• 5GMM is notified that an uplink user data packet is to be sent for a PDU session with suspended user-plane resources;
• 5GMM receives a request from upper layers to send a mobile originated location request unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
• 5GMM receives a request from upper layers to send a mobile originated signalling transaction towards the PCF by sending an UL NAS TRANSPORT message including a UE policy container (see 3GPP TS 24.587 [19B], 3GPP TS 24.554 [19E], 3GPP TS 24.577 [60] and 3GPP TS 24.514 [62]) unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode to 5GMM-CONNECTED mode; and
• 5GMM receives an indication from lower layers of the RAN timing synchronization status change, and decides to transition the UE from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-CONNECTED mode as specified in clause 5.3.1.4.

NOTE 2: 5GMM specific procedures initiated by NAS in 5GMM-CONNECTED mode or 5GMM-CONNECTED mode with RRC inactive indication are not subject to access control, e.g. a registration procedure after PS handover will not be prevented by access control (see clause 5.5).

NOTE 3: LPP messages, SLPP messages, or location event report messages transported in the UL NAS TRANSPORT message sent in response to a mobile terminating or network induced location request, and the corresponding access attempts are handled as MT access.

NOTE 4: Initiating a mobile originated signalling transaction towards the UDM by sending an UL NAS TRANSPORT message including an SOR transparent container is not supported. Therefore, access control for these cases has not been specified.

When the NAS detects one of the above events, the NAS needs to perform the mapping of the kind of request to one or more access identities and one access category and lower layers will perform access barring checks for that request based on the determined access identities and access category.

NOTE 5: The NAS is aware of the above events through indications provided by upper layers or through determining the need to start 5GMM procedures through normal NAS behaviour, or both.

To determine the access identities and the access category for a request, the NAS checks the reason for access, types of service requested and profile of the UE including UE configurations, against a set of access identities and access categories defined in 3GPP TS 22.261 [3], namely:

• a set of standardized access identities;
• a set of standardized access categories; and
• a set of operator-defined access categories, if available.

For the purpose of determining the applicable access identities from the set of standardized access identities defined in 3GPP TS 22.261 [3], the NAS shall follow the requirements set out in:

• clause 4.5.2 and the rules and actions defined in table 4.5.2.1, if the UE is not operating in SNPN access operation mode over 3GPP access; or
• clause 4.5.2A and the rules and actions defined in table 4.5.2A.1, if the UE is operating in SNPN access operation mode over 3GPP access.

In order to enable access barring checks for access attempts identified by lower layers in 5GMM-CONNECTED mode with RRC inactive indication, the UE provides the applicable access identities to lower layers.

NOTE 6: When and how the NAS provides the applicable access identities to lower layers is UE implementation specific.

NOTE 7: Although the UE operating as an IAB-node or as an NCR-MT node skips the access control checks, the UE provides the applicable access identities to lower layers for access attempts identified by lower layers in 5GMM-CONNECTED mode with RRC inactive indication.

For the purpose of determining the applicable access category from the set of standardized access categories and operator-defined access categories defined in 3GPP TS 22.261 [3], the NAS shall follow the requirements set out in:

• clause 4.5.2 and the rules and actions defined in table 4.5.2.2, if the UE is not operating in SNPN access operation mode over 3GPP access; or
• clause 4.5.2A and the rules and actions defined in table 4.5.2A.2, if the UE is operating in SNPN access operation mode over 3GPP access.