NG-RAN and 5G-NR. Frédéric Launay
<home network public key id>.out <HPLMN defined scheme out>.
Figure 1.8. The fields of the SUCI identifier
The SUPI type value is used to indicate whether the SUPI identifier corresponds to the IMSI identity (type = 0) or a network-specific identifier (type = 1).
The hni field corresponds to the country code (MCC (Mobile Network Country)) and the operator code (MNC (Mobile Network Code)).
The ri field is defined over four digits. The default value is 0, but a specific value is used to identify on which partition of the UDR database the mobile subscription is stored (in the case of UDR, composed of different memory stacks).
The hnkey field identifies the key used for the encryption of the SUCI identifier.
The outfield is the result of the encryption of the mobile’s IMSI identity (MSIN (Mobile Subscriber Identification Number)) including the message authentication value (MAC (Message Authentication Code)).
After authentication, the AMF provides a 5G-GUTI. Each 5G-GUTI is unique. This 5G-TMSI identifier is concatenated with the AMF identifier, in order to constitute the 5G-GUTI identifier (Figure 1.9).
The GUAMI identity corresponds to the AMF address. The GUAMI identity is the concatenation of the identity of the PLMN and the identity of the AMF:
<GUAMI> = <MCC><MNC><AMF Identifier>.
The 5G-S-TMSI identifier combines the AMF identity (AMF pool ID and pointer) as well as the 5G-TMSI identifier:
<5G-S-TMSI> = <AMF Set ID><AMF Pointer><5G-TMSI>.
The 5G-S-TMSI identifier is used as a radio identification for paging notifications.
Figure 1.9. The fields of the 5G-GUTI identifier
Once registered, the connection state of the mobile at the AMF level is either the connected state (CM-CONNECTED) or the standby state (CM-IDLE).
In the CM-CONNECTED state, a NAS connection is established between the mobile and the AMF function. Because the NAS connection is encapsulated in the RRC message, the mobile is both in the CM-CONNECTED state with the AMF and in the RRC_CONNECTED state with the NG-RAN node. The NG-RAN node creates a UE context with RNTI (Radio Network Temporary Identifier).
After a period of inactivity, the NG-RAN node can:
1 – suspend the radio connection. The mobile goes to the RRC_INACTIVE state, the context is kept by the NG-RAN node and the UE context is kept at the AMF level (the mobile is still in the CM-CONNECTED state);
2 – release the radio bearer and remove the UE context. The mobile goes to the RRC_IDLE state and the UE context goes to the CM_IDLE state at the AMF level.
In the RRC_IDLE state, the mobile listens to the information sent by the NG-RAN node. In the RRC_IDLE state, cell reselection is managed by the mobile.
1.3.1.2. The identity of the mobile at the level of NG-RAN
Each NG-RAN node manages a set of mobiles. The NG-RAN node assigns a specific RNTI radio identifier to each mobile. A broadcast identifier is also used to broadcast information like the common control channel and information system.
Consequently, for any mobile in the standby mode, the NG-RAN node uses the following radio identities:
1 – P-RNTI (Paging) to send a paging request;
2 – SI-RNTI (System Information) to broadcast SIB messages;
3 – RA-RNTI (Random) to identify a mobile when requesting radio access (random access procedure; see Chapter 3);
4 – TC-RNTI (Temporary Cell) which helps to retrieve the information exchanged during the connection procedure, following the random procedure.
If the mobile is in the RRC_INACTIVE state (in the standby mode) on the NG-RAN, its identifier is called I-RNTI.
If the mobile is in the RRC_CONNECTED state, connected with the NG-RAN node, then several radio identities are used per mobile:
1 – C-RNTI (Cell): unique identification of the mobile for the RRC connection and for scheduling;
2 – CS-RNTI (Configured Scheduling): radio identifier of the mobile for the RRC connection and for semi-persistent scheduling;
3 – SP-CSI-RNTI (Semi-Persistent): radio identifier of the mobile used for the transmission of radio channel information (CSI: Channel State Information) on the uplink traffic channel with semi-persistent scheduling;
4 – MCS-RNTI (Modulation Coding Scheme): radio identifier of the mobile to indicate the modulation and coding scheme (MCS) of the mobile for the transmission of data on the downlink and uplink traffic links;
5 – TPC-RNTI (Transmit Power Control RNTI) is used to retrieve the information corresponding to the power control for both the traffic and uplink control channels.
1.3.2. Mobile mobility
1.3.2.1. Mobility in the idle mode
When the mobile is in the idle state, it is located by the AMF from the TAI (Tracking Area Identity) value.
The mobile listens to the broadcast information and to the paging information sent by the NG-RAN node.
If the mobile is in the discontinuous reception mode (DRX), the frame that carries the paging notification is calculated from the 5G-identity S-TMSI of the UE modulo 1024.
The mobile becomes aware of the paging when the content of the paging message carries the 5G-S-TMSI identifier or the I-RNTI identifier of the mobile.
The mobile informs the AMF of a change of tracking zone when it falls under the coverage of a radio node whose TAI is different from the previous TAI coverage zone.
The selection or reselection of cells is based on the transmitted synchronization signal CD-SSB (Cell Defining Synchronization Signal and PBCH Block) specific to each cell.
1.3.2.2. Mobility in RRC_Inactive
The mobile is in the RRC_INACTIVE state for the NG-RAN and in the CM_CONNECTED state for the 5G core network. The mobile context is always stored on the node where the mobile was connected.
The mobile can move in the RAN Notification Area (RNA) without notifying the NG-RAN nodes. An RNA zone comprises one or several cells located in the same TAI zone.
In the case of mobile terminating data, the UPF transfers the packet to the last NG-RAN node on which the mobile had established a radio connection. The NG-RAN node broadcasts a paging request over the air interface and transmits (through the Xn interface) a paging order to neighboring NG-RAN nodes that are configured on the same RNA area. If the paging request fails (the mobile is not reachable), then the NG-RAN node informs the AMF.
If the mobile establishes a radio connection with an NG-RAN node other than the last serving node, then the new NG-RAN node initiates a procedure to retrieve the context of the mobile UE from the old serving node. In the case where the request fails, the NG-RAN node triggers a new RRC connection.