4.5.3 Operator-defined access categories

Operator-defined access category definitions can be signalled to the UE using NAS signalling. Each operator-defined access category definition consists of the following parameters:

• a precedence value which indicates in which order the UE shall evaluate the operator-defined category definition for a match;
• an operator-defined access category number, i.e. access category number in the 32-63 range that uniquely identifies the access category in the PLMN or SNPN in which the access categories are being sent to the UE;
• criteria consisting of one or more access category criteria type and associated access category criteria type values. The access category criteria type can be set to one of the following:
• DNN;
• Void;
• OS Id + OS App Id of application triggering the access attempt; or
• S-NSSAI; and

NOTE 1: An access category criteria type can be associated with more than one access category criteria values.

• optionally, a standardized access category. This standardized access category is used in combination with the access identities of the UE to determine the RRC establishment cause as specified in clause 4.5.6.

If the access attempt is to establish a new PDU session i.e. it is triggered by:

• a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session establishment unless the request triggered a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode; or
• a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode triggered by a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session establishment,

then:

• the access attempt matches access category criteria type DNN if the DNN requested by the UE during the PDU session establishment procedure matches any of the access criteria type values associated with the access criteria type DNN; and
• the access attempt matches access category criteria type S-NSSAI if the S-NSSAI requested by the UE during the PDU session establishment procedure matches any of the access criteria type values associated with the access criteria type S-NSSAI.

If the access attempt is for an existing PDU session i.e. it is triggered by:

• a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session modification unless the request triggered a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
• a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode triggered by a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session modification;
• a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode triggered by a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session release;
• a service request procedure (or a registration procedure if the UE is in state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE) requesting user-plane resources for a PDU session; or
• an uplink user data packet is to be sent for a PDU session with suspended user-plane resources,

then:

• the access attempt matches access category criteria type DNN if the DNN provided by the network in the PDU SESSION ESTABLISHMENT ACCEPT message matches any of the access criteria type values associated with the access criteria type DNN; and
• the access attempt matches access category criteria type S-NSSAI if the S-NSSAI associated with the PDU session matches any of the access criteria type values associated with the access criteria type S-NSSAI.

NOTE 2: In order to avoid having access attempts for non-always-on PDU sessions blocked due to access barring of always-on PDU sessions, it is recommended that the network assigns the highest precedence values to operator-defined access category definition which can be matched by always-on PDU sessions.

An access attempt matches the criteria of an operator-defined access category definition, if the access attempt matches all access category criteria types included in the criteria with any of the associated access criteria type values.

Each operator-defined access category definition has a different precedence value.

Several operator-defined access category definitions can have the same operator-defined access category number.

If:

• an access category in bullet d) is not provided;
• an access category in bullet d) is provided and is not a standardized access category; or
• an access category in bullet d) is provided, is a standardized access category and is not recognized by the UE;

the UE shall use instead access category 7 (MO_data) in combination with the access identities of the UE to determine the RRC establishment cause as specified in clause 4.5.6.

The operator-defined access category definitions are valid in the PLMN which provided them and in a PLMN equivalent to the PLMN which provided them, or in the SNPN which provided them and in an SNPN equivalent to the SNPN which provided them, as specified in annex C.

If the UE stores operator-defined access category definitions valid in the selected PLMN or the RPLMN, or valid in the selected SNPN or RSNPN, then access control in 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication will only be performed for the event a) defined in clause 4.5.1. If the transition from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication over 3GPP access to 5GMM-CONNECTED mode is due to a UE NAS initiated 5GMM specific procedure, then this access attempt shall be mapped to one of the standardized access categories in the range < 32, see clause 4.5.2. I.e. for this case the UE shall skip the checking of operator-defined access category definitions.

If the UE stores operator-defined access category definitions valid in the selected PLMN or the RPLMN, or valid in the selected SNPN or RSNPN, then access control in 5GMM-CONNECTED mode and in 5GMM-CONNECTED mode with RRC inactive indication will only be performed for the events 1) to 8) defined in clause 4.5.1.

The UE shall handle the operator-defined access category definitions stored for the RPLMN or RSNPN as specified in clause 5.4.4.3, clause 5.5.1.2.4, and clause 5.5.1.3.4.

When the UE is switched off, the UE shall keep the operator-defined access category definitions so that the operator-defined access category definitions can be used after switch on.

When the UE selects a new PLMN which is not equivalent to the previously selected PLMN, or selects a new SNPN which is not equivalent to the previously selected SNPN, the UE shall stop using the operator-defined access category definitions stored for the previously selected PLMN or SNPN and should keep the operator-defined access category definitions stored for the previously selected PLMN or SNPN.

NOTE 3: When the UE selects a new PLMN which is not equivalent to the previously selected PLMN, or selects a new SNPN which is not equivalent to the previously selected SNPN, the UE can delete the operator-defined access category definitions stored for the previously selected PLMN or SNPN e.g. if there is no storage space in the UE.