5.4.5.3.3 Network-initiated NAS transport of messages accepted by the UE

Upon reception of a DL NAS TRANSPORT message, the UE shall stop the timer T3346 if running.

Upon reception of a DL NAS TRANSPORT message, if the Payload container type IE is set to:

• "N1 SM information" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the 5GSM message in the Payload container IE and the PDU session ID are handled in the 5GSM procedures specified in clause 6;
• "SMS", the UE shall forward the content of the Payload container IE to the SMS stack entity;
• "LTE Positioning Protocol (LPP) message container", the UE shall forward the payload container type, the content of the Payload container IE and the routing information included in the Additional information IE to the upper layer location services application;

c1) "SLPP message container", the UE shall forward the payload container type, the content of the Payload container IE and the routing information included in the Additional information IE to the upper layer location services application;

• "SOR transparent container" and if the Payload container IE:
• successfully passes the integrity check and the SOR counter check (see 3GPP TS 33.501 [24]), the ME shall store the received SOR counter as specified in annex C and proceed as follows:
• If the Payload container IE indicates a list of preferred PLMN/access technology combinations is provided and the list type indicates "PLMN ID and access technology list", then the ME shall replace the highest priority entries in the "Operator Controlled PLMN Selector with Access Technology" list stored in the ME;
• If the list type indicates "secured packet", then the ME shall behave as if a SMS is received with protocol identifier set to SIM data download, data coding scheme set to class 2 message and SMS payload as secured packet contents of SOR transparent container IE. The SMS payload is forwarded to UICC as specified in 3GPP TS 23.040 [4A];

iii) If the Payload container IE includes SOR-SNPN-SI, the ME shall replace SOR-SNPN-SI of the selected entry of the "list of subscriber data" or associated with the selected PLMN subscription, as specified in 3GPP TS 23.122 [5] with the received SOR-SNPN-SI;

• If the SOR-CMCI is present, in plain text, and the Store SOR-CMCI in ME indicator is set to "Store SOR-CMCI in ME" then the UE shall store or delete the SOR-CMCI in the non-volatile memory of the ME as described in clause C.1; and
• If the Payload container IE includes SOR-SNPN-SI-LS, the ME shall replace SOR-SNPN-SI-LS of the selected entry of the "list of subscriber data" or associated with the selected PLMN subscription, as specified in 3GPP TS 23.122 [5] with the received SOR-SNPN-SI-LS;

If the ACK bit of the SOR header for SOR data type in the SOR transparent container is set to "acknowledgement requested" and the list type indicates:

A) "PLMN ID and access technology list"; or

B) "secured packet" and the ME receives status bytes from the UICC indicating that the UICC has received the secured packet successfully;

then the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "SOR transparent container" as specified in clause 5.4.5.2.2. In the Payload container IE carrying the acknowledgement, the UE shall set the ME support of SOR-CMCI indicator to "SOR-CMCI supported by the ME". Additionally, if the UE supports access to an SNPN using credentials from a credentials holder and the UE is not operating in SNPN access operation mode, the UE may set the ME support of SOR-SNPN-SI indicator to "SOR-SNPN-SI supported by the ME". Additionally, if the UE supports access to an SNPN providing access for localized services in SNPN, the UE shall set the ME support of SOR-SNPN-SI-LS indicator to "SOR-SNPN-SI-LS supported by the ME".

The UE shall proceed with the behaviour as specified in 3GPP TS 23.122 [5] annex C; or

• does not successfully pass the integrity check or the SOR counter check (see 3GPP TS 33.501 [24]) then the UE shall discard the content of the payload container IE and proceed with the behaviour as specified in 3GPP TS 23.122 [5] annex C.
• void;
• void;
• "N1 SM information" and:
• the 5GMM cause IE is set to the 5GMM cause #22 "Congestion", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to DNN based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;
• the 5GMM cause IE is set to the 5GMM cause #28 "Restricted service area", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to service area restrictions along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, enters the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE and, if the DL NAS TRANSPORT message is received over 3GPP access, performs the registration procedure for mobility and periodic registration update without waiting for the release of the N1 NAS signalling connection (see clauses 5.3.5 and 5.5.1.3);
• the 5GMM cause IE is set to the 5GMM cause #65 "maximum number of PDU sessions reached", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the PLMN's maximum number of PDU sessions has been reached, along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message;
• the 5GMM cause IE is set to the 5GMM cause #67 "insufficient resources for specific slice and DNN", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to S-NSSAI and DNN based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;
• the 5GMM cause IE is set to the 5GMM cause #69 "insufficient resources for specific slice", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to S-NSSAI only based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;

5a) the 5GMM cause IE is set to the 5GMM cause #78 "PLMN not allowed to operate at the present UE location", the UE shall consider as an abnormal case and treat it as unexpected cause and behave as specified in case g1) if this cause value is received from a PLMN which is not deployed in 5G PLMN/access technology combination with specific satellite features, otherwise, the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the UE is registered to a PLMN that is not allowed to operate at the present UE location along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message.

Additionally, if the cause is received from a 5G PLMN/access technology combination with specific satellite features, the UE shall not send the UL NAS TRANSPORT message to transport any of the data types listed in clause 5.4.5.2.1. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2), delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over non-3GPP access, the UE shall additionally delete the list of equivalent PLMNs, 5G-GUTI and ngKSI. The UE shall store:

• for satellite NG-RAN access, the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location"; or
• for NG-RAN access, the PLMN/access technology combination and, if it is known, the current geographical location in the list of "LSP PLMNs not allowed to operate at the present UE location",

and shall start a corresponding timer instance (see clause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5];

If the message was received via a 5G PLMN/access technology combination with specific satellite features and the UE is operating in single-registration mode, the UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED, delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall enter the state EMM-DEREGISTERED.

• the 5GMM cause IE is set to the 5GMM cause #90 "payload was not forwarded", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to routing failure along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message. The UE shall ignore the Back-off timer value IE, if any;
• the 5GMM cause IE is set to the 5GMM cause #91 "DNN not supported or not subscribed in the slice", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the DNN is not supported or not subscribed in a slice along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE, if any;
• the 5GMM cause IE is set to the 5GMM cause #92 "insufficient user-plane resources for the PDU session", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to insufficient user-plane resources along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message.
• the 5GMM cause IE is set to the 5GMM cause #79 "UAS services not allowed", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the UE is marked in the UE's 5GMM context that it is not allowed to request UAS services along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message.

g1) "N1 SM information" and:

• the 5GMM cause IE is set to the 5GMM cause other than any of the cause values specified in bullet g) above, the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to unexpected cause along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message;
• "UE policy container", the UE policy container in the Payload container IE is handled in the UE policy delivery procedures specified in annex D;
• "UE parameters update transparent container" and if the Payload container IE
• successfully passes the integrity check and the UE parameter update counter check (see 3GPP TS 33.501 [24]), the ME shall store the received UE parameter update counter as specified in annex C and proceed as follows:

i0) if the UE supports UE parameters update header protection and the UE parameters update list includes a UE parameters update data set with the UE parameters update data set type indicating "protected UE parameters update header information", then the UE shall use header information from the UE parameters update data set with the UE parameters update data set type indicating "protected UE parameters update header information", otherwise the UE shall use header information from the UE parameters update header in the UE parameters update transparent container;

• if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data",

A) the ME shall behave as if an SMS is received with protocol identifier set to SIM data download, data coding scheme set to class 2 message and SMS payload as secured packet contents of UE parameters update transparent container IE. The SMS payload is forwarded to UICC as specified in 3GPP TS 23.040 [4A];

B) if the ACK bit is set to "acknowledgment requested" and if the ME receives status bytes from the UICC indicating that the UICC has received the secured packet successfully, the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in clause 5.4.5.2.2; and

C) if the ME receives a REFRESH command from the UICC as specified in 3GPP TS 31.111 [22A] and if the REG bit is set to "re-registration requested", and:

C1) the UE is registered over 3GPP access, then the UE shall wait until the emergency services over 3GPP access, if any, are completed, enter 5GMM-IDLE mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on non-3GPP access or the UE is not registered over non-3GPP access, or wait until the de-registration procedure over non-3GPP access specified in case C2) or C3) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on non-3GPP access, and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2;

C2) the UE is registered over non-3GPP access and does not have emergency services ongoing over non-3GPP access, then the UE shall locally release the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on 3GPP access or the UE is not registered over 3GPP access, or wait until the de-registration procedure over 3GPP access specified in case C1) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on 3GPP access, and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2; and

C3) the UE is registered over non-3GPP access and has an emergency services ongoing over non-3GPP access, then the UE shall wait until the emergency services are completed before locally releasing the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on 3GPP access or if the UE is not registered over 3GPP access, or wait until the de-registration procedure over 3GPP access specified in case C1) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on 3GPP access, and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2;

• if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Default configured NSSAI update data",

A) if the ACK bit is set to "acknowledgment requested" and if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in clause 5.4.5.2.2

B) the ME shall replace the stored default configured NSSAI with the default configured NSSAI included in the default configured NSSAI update data. In case of SNPN, the ME shall replace the stored default configured NSSAI associated with the selected entry of the "list of subscriber data" or the PLMN subscription with the default configured NSSAI included in the default configured NSSAI update data; and

C) if the REG bit is set to "re-registration requested" and the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility registration update as specified in clause 5.5.1.3.

if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE used the old default configured NSSAI to create the requested NSSAI in a REGISTRATION REQUEST message, because the UE does not have a configured NSSAI for the current PLMN or SNPN, and the UE has an stored allowed NSSAI for the current PLMN or SNPN which contains one or more S-NSSAIs that are not included in the new default configured NSSAI, the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility and periodic registration update as specified in clause 5.5.1.3;

iii) if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Disaster roaming information update data",

A) if the ACK bit is set to "acknowledgment requested" and if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data" or a UE parameters update data set with UE parameters update data set type indicating "Default configured NSSAI update data", the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in clause 5.4.5.2.2;

B) the UE shall delete the indication of whether disaster roaming is enabled in the UE stored in the ME, if any, and store the indication of whether disaster roaming is enabled in the UE included in the disaster roaming information update data in the ME;

C) the UE shall delete the indication of applicability of "lists of PLMN(s) to be used in disaster condition" provided by a VPLMN' stored in the ME, if any, and store the indication of 'applicability of "lists of PLMN(s) to be used in disaster condition" provided by a VPLMN' included in the disaster roaming information update data in the ME;

C1) the UE shall delete the indication of whether disaster roaming is enabled in EPS in the UE stored in the ME, if any, and store the indication of whether disaster roaming is enabled in EPS in the UE included in the disaster roaming information update data in the ME; and

D) if the REG bit is set to "re-registration requested" and the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility registration update as specified in clause 5.5.1.3; and

• if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "ME routing indicator update data":

A) if the ACK bit is set to "acknowledgment requested" and the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Default configured NSSAI update data", the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in clause 5.4.5.2.2;

B) the UE shall set or replace the routing indicator of the selected entry of the "list of subscriber data" with the routing indicator included in the ME routing indicator update data; and

C) if the REG bit is set to "re-registration requested", and:

C1) the UE is registered over 3GPP access and is not registered over non-3GPP access, then the UE shall wait until the emergency services over 3GPP access, if any, are completed, enter 5GMM-IDLE mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication, perform a de-registration procedure, delete its 5G-GUTI, and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2;

C2) the UE is registered over non-3GPP access and is not registered over 3GPP access, then the UE shall locally release the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure, delete its 5G-GUTI, and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2; or

C3) the UE is registered over 3GPP access and non-3GPP access to same SNPN, then the UE shall wait until the emergency services over 3GPP access, if any, are completed, enter 5GMM-IDLE mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication over 3GPP access, perform a de-registration procedure over 3GPP access, locally release the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure over non-3GPP access, delete its 5G-GUTI and then initiate a registration procedure for initial registration as specified in clause 5.5.1.2; and

• does not successfully pass the integrity check or the UE parameter update counter check (see 3GPP TS 33.501 [24]), then the UE shall discard the content of the payload container IE;
• "Location services message container" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the UE shall forward the payload container type, the content of the Payload container IE and the routing information in the Additional information IE if included to the upper layer location services application;
• "CIoT user data container" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the UE shall forward the content of the Payload container IE and the PDU session ID to the 5GSM sublayer.

During the establishment of the PDU session identified by the PDU session ID, if the UE:

• provided a DNN and an S-NSSAI, the UE shall stop the timer T3396 associated with the DNN (if running), the timer T3584 associated with the [DNN, S-NSSAI] combination (if running), and the timer T3585 associated with the S-NSSAI (if running);
• provided a DNN and did not provide an S-NSSAI, the UE shall stop the timer T3396 associated with the DNN (if running), the timer T3584 associated with the [DNN, no S-NSSAI] combination (if running), and the timer T3585 associated with the no S-NSSAI (if running);
• provided an S-NSSAI and did not provide a DNN, the UE shall stop the timer T3396 associated with no DNN (if running), the timer T3584 associated with the [no DNN, the S-NSSAI] combination (if running), and the timer T3585 associated with the S-NSSAI (if running); or
• did not provide a DNN or an S-NSSAI, the UE shall stop the timer T3396 associated with no DNN (if running), the timer T3584 associated with [no DNN, no S-NSSAI] combination (if running), and timer T3585 associated with no S-NSSAI (if running).

The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running.

The timer T3585 to be stopped applies to all the PLMN and for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running.

• "CIoT user data container" and:
• the 5GMM cause IE is set to the 5GMM cause #22 "Congestion", the UE passes to the 5GSM sublayer an indication that the CIoT user data was not forwarded due to DNN based congestion control along with the CIoT user data from the Payload container IE, the time value from the Back-off timer value IE, and the PDU session ID from the PDU session ID IE of the DL NAS TRANSPORT message (see clause 6.4.2.4.2);
• the 5GMM cause IE is set to the 5GMM cause #67 "insufficient resources for specific slice and DNN", the UE passes to the 5GSM sublayer an indication that the CIoT user data was not forwarded due to S-NSSAI and DNN based congestion control along with the CIoT user data from the Payload container IE, the back-off timer value from the Back-off timer value IE, and the PDU session ID from the PDU session ID IE of the DL NAS TRANSPORT message (see clause 6.4.2.4.2);
• the 5GMM cause IE is set to the 5GMM cause #69 "insufficient resources for specific slice", the UE passes to the 5GSM sublayer an indication that the CIoT user data was not forwarded due to S-NSSAI only based congestion control along with the CIoT user data from the Payload container IE, the back-off timer value from the Back-off timer value IE, and the PDU session ID from the PDU session ID IE of the DL NAS TRANSPORT message (see clause 6.4.2.4.2); or
• the 5GMM cause IE is set to the 5GMM cause #90 "payload was not forwarded", the UE passes to the 5GSM sublayer an indication that the user data container was not forwarded due to routing failure along with the user data container from the Payload container IE and the PDU session ID from the PDU session ID IE of the DL NAS TRANSPORT message;
• "CIoT user data container" and:
• the 5GMM cause IE is set to the 5GMM cause other than any of the cause values specified in bullet l) above, the UE passes to the upper layer an indication that the CIoT user data was not forwarded due to unexpected cause along with the CIoT user data from the Payload container IE of the DL NAS TRANSPORT message;
• "service-level-AA container", the UE shall forward the content of the Payload container IE to the upper layers;

m1) "Event notification", the UE shall forward the received event notification indicator(s) to the upper layers (see 3GPP TS 23.216 [6A] and 3GPP TS 24.237 [14AA] for the "SRVCC handover cancelled, IMS session re-establishment required" indicator);

m2) "UPP-CMI container" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the UE shall forward the payload container type, the content of the Payload container IE and the routing information included in the Additional information IE to the upper layer location services application for user plane connection management for user plane positioning;

NOTE 2: The user plane connection establishment for user plane positioning connection management is specified in 3GPP TS 24.572 [64].

m3) "UPP-CMI container" and the 5GMM cause IE is set to the 5GMM cause #94 "User plane positioning not authorized", the UE passes to the upper layer location services application an indication that user plane positioning is not authorized by the network; or

• "Multiple payloads", the UE shall first decode the content of the Payload container IE (see clause 9.11.3.39) to obtain the number of payload container entries and for each payload container entry, the UE shall:
• decode the payload container type field;
• decode the optional IE fields and the payload container contents field in the payload container entry; and
• handle the content of each payload container entry the same as the content of the Payload container IE and the associated optional IEs as specified in bullets a) to m3) above according to the payload container type field.