5.3.20.3 Requirements for UE in an SNPN

If the UE is operating in SNPN access operation mode, the UE shall maintain, for each of the entries in the "list of subscriber data":

• one SNPN-specific attempt counter for 3GPP access. The counter is applicable to access attempts via 3GPP access only;
• one SNPN-specific attempt counter for non-3GPP access, if the UE supports access to SNPN over non-3GPP access. The counter is applicable in case of access to SNPN over non-3GPP access only;

NOTE 1: If the UE accesses to SNPN service directly over non-3GPP access or if the UE accesses to SNPN services via a PLMN, the SNPN-specific attempt counter for non-3GPP access is used.

• one counter for "the entry for the current SNPN considered invalid for 3GPP access" events; and
• one counter for "the entry for the current SNPN considered invalid for non-3GPP access" events, if the UE supports access to SNPN over non-3GPP access. The counter is applicable in case of access to SNPN over non-3GPP access only.

NOTE 2: If the UE accesses to SNPN service directly over non-3GPP access or if the UE accesses to SNPN services via a PLMN, the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events is used.The UE shall store the above counters in its non-volatile memory. The UE shall erase the attempt counters and reset the event counters to zero when the selected entry of the "list of subscriber data" is updated or USIM is removed for the selected PLMN subscription. The counter values shall not be affected by the activation or deactivation of MICO mode or power saving mode (see 3GPP TS 24.301 [15]).

The UE implementation-specific maximum value for any of the above counters shall not be greater than 10.

NOTE 3: Different counters can use different UE implementation-specific maximum values.

If the UE receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with 5GMM cause value #3, #6, #7, #12, #13, #15, #27, #36, #72, #74, or #75 before the network has established secure exchange of NAS messages for the N1 NAS signalling connection, the UE shall stop timer T3510 or T3517, if running. If the SNPN sending the message is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) and there is next valid time period(s) for the SNPN, the UE shall start timer T3247 (see 3GPP TS 24.008 [12]) with a random value uniformly drawn from the range between the start time point of the next valid time period for localized services in SNPN and:

• for 5GMM cause value #36 or #74:
• 30 minutes after the start time point of the next valid time period for localized services in SNPN, if the next valid time period is longer than 30 minutes; or
• the end time point of the next valid time period for localized services in SNPN, if the next valid time period is not longer than 30 minutes; or
• for other 5GMM cause values:
• 60 minutes after the start time point of the next valid time period for localized services in SNPN, if the next valid time period is longer than 60 minutes; or
• the end time point of the next valid time period for localized services in SNPN, if the next valid time period is not longer than 60 minutes;

otherwise between:

• 15 minutes and 30 minutes for 5GMM cause value #36 or #74; or
• 30 minutes and 60 minutes for other 5GMM cause values;

if the timer is not running, and take the following actions:

• if the 5GMM cause value received is #3, #6, or #7 and the UE is neither registered for onboarding services in SNPN nor performing initial registration for onboarding services in SNPN:
• if the 5GMM cause value is received over 3GPP access:
• if the UE is already registered over another access, the UE shall:

A) store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both the selected entry of the "list of subscriber data" or the selected PLMN subscription, memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

B) search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28]; or

• otherwise if the counter for "the entry for the current SNPN considered invalid for 3GPP access" events has a value less than a UE implementation-specific maximum value, the UE shall:

A) set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list, and ngKSI for 3GPP access;

A1) if the 5GMM cause value received is #3 or #6, delete the list of equivalent SNPNs, if any;

B) increment the counter for "the entry for the current SNPN considered invalid for 3GPP access" events;

C) reset the registration attempt counter in case of a REGISTRATION REJECT message or reset the service request attempt counter in case of a SERVICE REJECT message;

D) store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

E) search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28]. As a UE implementation option, if access to SNPN over non-3GPP access is available and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for non-3GPP access, then the UE may perform registration attempt over non-3GPP access; or

iii) otherwise, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1;

• if the 5GMM cause value is received over non-3GPP access:
• if the UE is already registered over another access, the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; or
• otherwise if the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events has a value less than a UE implementation-specific maximum value, the UE shall:

A) set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete the 5G-GUTI, last visited registered TAI, TAI list, and ngKSI for non-3GPP access;

B) enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and

C) increment the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events. As a UE implementation option, if 3GPP access is available and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for 3GPP access, then the UE may make a registration attempt over 3GPP access; or

iii) otherwise, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1;

• if the 5GMM cause value received is #12, #13, or #15, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally:
• if the 5GMM cause value is received over 3GPP access, access to SNPN over non-3GPP access is available, the UE is not registered over non-3GPP access yet, and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for non-3GPP access, the UE may perform registration attempt over non-3GPP access; or
• if the 5GMM cause value is received over non-3GPP access, 3GPP access is available, the UE is not registered to the current SNPN over 3GPP access yet, and the selected entry of the "list of subscriber data" or the selected PLMN subscription is not considered invalid for 3GPP access, the UE may make a registration attempt over 3GPP access;
• if the 5GMM cause value received is #27, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally, if the SNPN-specific attempt counter for the respective access type and for the current SNPN has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the SNPN;

c1) if the 5GMM cause value received is #72, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally, if the SNPN-specific attempt counter for non-3GPP access for the current SNPN has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the SNPN; and

• if:
• the 5GMM cause value received is #36, #74 or #75; or
• the 5GMM cause value received is #3, #6, or #7 and the UE is registered for onboarding services in SNPN or performing initial registration for onboarding services in SNPN;

in addition to the UE requirements specified in clauses 5.5.1 and 5.6.1:

• if the message was received via 3GPP access and if the SNPN-specific attempt counter for 3GPP access for the SNPN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the SNPN-specific attempt counter for 3GPP access for the SNPN; or
• if the message was received via non-3GPP access and if the SNPN-specific attempt counter for non-3GPP access for the SNPN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the SNPN-specific attempt counter for non-3GPP access for the SNPN.

Upon expiry of timer T3247, the UE shall:

• remove, for each SNPN, all tracking areas from the list of "5GS forbidden tracking areas for regional provision of service" and the list of "5GS forbidden tracking areas for roaming" for the SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, which were stored in these lists for non-integrity protected NAS reject message;
• set each entry of the "list of subscriber data" or the PLMN subscription to valid for 3GPP access, if the corresponding counter for "the entry for the current SNPN considered invalid for 3GPP access" events has a value less than a UE implementation-specific maximum value;
• set each entry of the "list of subscriber data" or the PLMN subscription to valid for non-3GPP access, if the corresponding counter for "the entry for the current SNPN considered invalid for non-3GPP access" events has a value less than a UE implementation-specific maximum value;
• remove each SNPN identity from:
• the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, which are, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription,
• "permanently forbidden SNPNs for access for localized services in SNPN" list for 3GPP access or "temporarily forbidden SNPNs for access for localized services in SNPN" list for 3GPP access, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription; or
• "permanently forbidden SNPNs for onboarding services in SNPN" list for 3GPP access or "temporarily forbidden SNPNs for onboarding services in SNPN" list for 3GPP access;

if the corresponding SNPN-specific attempt counter for 3GPP access has a value greater than zero and less than a UE implementation-specific maximum value and the SNPN identity is included in any of the "permanently forbidden SNPNs" list for 3GPP access, "temporarily forbidden SNPNs" list for 3GPP access, "permanently forbidden SNPNs for access for localized services in SNPN" list for 3GPP access "temporarily forbidden SNPNs for access for localized services in SNPN" list for 3GPP access, "permanently forbidden SNPNs for onboarding services in SNPN" list for 3GPP access, or "temporarily forbidden SNPNs for onboarding services in SNPN" list for 3GPP access;

• remove each SNPN identity from:
• the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access which are, if the MS supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, or
• "permanently forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access or "temporarily forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access;

if the corresponding SNPN-specific attempt counter for non-3GPP access has a value greater than zero and less than a UE implementation-specific maximum value and the SNPN identity is included in any of the "permanently forbidden SNPNs" list for non-3GPP access, "temporarily forbidden SNPNs" list for non-3GPP access, "permanently forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access or "temporarily forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access;

• re-enable the N1 mode capability for 3GPP access and, for each SNPN-specific attempt counter for 3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective SNPN from the list of SNPNs for which the N1 mode capability was disabled due to receipt of a reject from the network with 5GMM cause #27 "N1 mode not allowed" (see 3GPP TS 23.122 [5]);
• re-enable the N1 mode capability for non-3GPP access and, for each SNPN-specific attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective SNPN from the list of SNPNs for which N1 mode capability was disabled for non-3GPP access due to receipt of a reject from the network with 5GMM cause #27 "N1 mode not allowed" or 5GMM cause #72 "non-3GPP access to 5GCN not allowed"; and
• initiate a registration procedure, if still needed, dependent on 5GMM state and 5GS update status, or perform SNPN selection according to 3GPP TS 23.122 [5].

When the UE is switched off or a UICC containing the USIM is removed:

• for each SNPN-specific attempt counter for 3GPP access having a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the respective SNPN identity from the "permanently forbidden SNPNs" list(s) for 3GPP access, "temporarily forbidden SNPNs" list(s) for 3GPP access, "permanently forbidden SNPNs for access for localized services in SNPN" list(s) for 3GPP access, "temporarily forbidden SNPNs for access for localized services in SNPN" list(s) for 3GPP access, "permanently forbidden SNPNs for onboarding services in SNPN" list for 3GPP access or "temporarily forbidden SNPNs for onboarding services in SNPN" list for 3GPP access, if available; and
• for each SNPN-specific attempt counter for non-3GPP access having a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the respective SNPN identity from the "permanently forbidden SNPNs" list(s) for non-3GPP access, "temporarily forbidden SNPNs" list(s) for non-3GPP access, "permanently forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access or "temporarily forbidden SNPNs for onboarding services in SNPN" list for non-3GPP access, if available.

When an entry of the "list of subscriber data" is updated:

• if the UE does not support access to an SNPN using credentials from a credentials holder and equivalent SNPNs, and the SNPN-specific attempt counter for 3GPP access for the SNPN corresponding to the entry has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the entry from the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, if available;
• if the UE does not support access to an SNPN using credentials from a credentials holder and equivalent SNPNs, and the SNPN-specific attempt counter for non-3GPP access for the SNPN corresponding to the entry has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the entry from the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access, if available;
• if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, and the SNPN-specific attempt counter for 3GPP access for an SNPN in the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, associated with the entry, has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the SNPN from the "permanently forbidden SNPNs" list for 3GPP access or "temporarily forbidden SNPNs" list for 3GPP access, associated with the entry;
• if the UE supports access to an SNPN providing access for localized services in SNPN, and the SNPN-specific attempt counter for 3GPP access for an SNPN in the "permanently forbidden SNPNs for access for localized services in SNPN" list or "temporarily forbidden SNPNs for access for localized services in SNPN" list, associated with the entry, has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the SNPN from the "permanently forbidden SNPNs for access for localized services in SNPN" list or "temporarily forbidden SNPNs for access for localized services in SNPN" list for 3GPP access, associated with the entry; and
• if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, and the SNPN-specific attempt counter for non-3GPP access for an SNPN in the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access associated with the entry, has a value greater than zero and less than the UE implementation-specific maximum value, the UE shall remove the SNPN identity corresponding to the SNPN from the "permanently forbidden SNPNs" list for non-3GPP access or "temporarily forbidden SNPNs" list for non-3GPP access, associated with the entry.