5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The reference point representation describes standard communication interfaces

between network services. It is a concept of logical interfaces and used for easy
identification. It does not conflict with service-based interfaces. For example, the
communication between the AMF and UDM is still implemented through service-
based interfaces.
 The reference point representation shows how various network functions interact with
each other in 3GPP standard processes.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

1. The AMF performs access control and mobility management of the MME.
2. The SMF performs session management of the MME and integrates SGW-C and
PGW-C functions.
3. The PCF is equivalent to the PCRF.
4. The UDM is equivalent to the HSS.
5. The AUSF is equivalent to the 3GPP AAA server.
6. The UPF is equivalent to the SGW-U and PGW-U.
7. The NEF is equivalent to the SCEF. However, the exposure capabilities of the NEF do
not include the IMS part.
8. The NSSF is a new NF used to select network slices.
9. The NRF is a new NF used for service registration and discovery under the SBA.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Acronym:
 AS Application Server
 SCS Services Capability Server

 3GPP TS 23682 defines the 4G SCEF networking architecture.

Capabilities that the network can expose:
 QoS: Setting up an AS session with required QoS
 Charging: Changing the chargeable party at the session set-up or during the
session
 Communications behavior: Support of third party interaction on information for
predictable communication patterns
 UE status: Informing the third party about a UE's connection properties
 Network status: Informing the third party about potential network issues
 Background data transfer: Resource management for background data
transfer

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 In the LBO architecture, the PCF on the VPLMN may interact with the AF to generate
a PCC rule for the service delivered through the VPLMN. According to the roaming
agreement with the HPLMN operator, the PCF on the VPLMN uses the locally
configured policy as the input of PCC rule generation. The PCF on the VPLMN cannot
access the user policy information of the HPLMN.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 23501 6.2.1.7
 Security Edge Protection Proxy (SEPP)
 The SEPP is a non-transparent proxy that supports the following functions:
 - Inter-PLMN control-plane message filtering and forwarding
 - Topology hiding

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 The 5G System Architecture contains the following reference points:

 N1: Reference point between the UE and the AMF.
 N2: Reference point between the (R)AN and the AMF.
 N3: Reference point between the (R)AN and the UPF.
 N4: Reference point between the SMF and the UPF.
 N6: Reference point between the UPF and a Data Network.
 NOTE 1: The traffic forwarding details of N6 between a UPF acting as an uplink classifier and a local
data network are not specified in this Release of the specification.
 N9: Reference point between two UPFs.
 The following reference points show the interactions that exist between the NF services in the NFs.
These reference points are realized by corresponding NF service-based interfaces and by specifying the
identified consumer and producer NF service as well as their interaction in order to realize a particular
system procedure.
 N5: Reference point between the PCF and an AF.
 N7: Reference point between the SMF and the PCF.
 N8: Reference point between the UDM and the AMF.
 N10: Reference point between the UDM and the SMF.
 N11: Reference point between the AMF and the SMF.
 N12: Reference point between AMF and AUSF.
 N13: Reference point between the UDM and Authentication Server function the AUSF.
 N14: Reference point between two AMFs.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The 5G System Architecture contains the following reference points:

 N15: Reference point between the PCF and the AMF in the case of non-roaming scenario,
PCF in the visited network and AMF in the case of roaming scenario.
 N16: Reference point between two SMFs, (in roaming case between SMF in the visited
network and the SMF in the home network).
 N17: Reference point between AMF and 5G-EIR.
 N18: Reference point between any NF and UDSF.
 N22: Reference point between AMF and NSSF.
 N23: Reference point between PCF and NWDAF.
 N24: Reference point between the PCF in the visited network and the PCF in the home
network.
 N27: Reference point between NRF in the visited network and the NRF in the home
network.
 N31: Reference point between the NSSF in the visited network and the NSSF in the home
network.
 NOTE 2: In some cases, a couple of NFs may need to be associated with each other to
serve a UE.
 In addition to the reference points above, there are interfaces/reference point(s) between
SMF and the CHF. The reference point(s) are not depicted in the architecture illustrations in
this specification.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 NOTE 3: The functionality of these interface/reference points are defined in TS 32.240

[41].
 N32: Reference point between SEPP in the visited network and the SEPP in the home
network.
 NOTE 4: The functionality of N32 reference point is defined in TS 33.501 [29].
 N33: Reference point between NEF and AF.
 N34: Reference point between NSSF and NWDAF.
 N35: Reference point between UDM and UDR
 N36: Reference point between PCF and UDR.
 N37: Reference point between NEF and UDR
 N40: Reference point between SMF and the CHF.
 NOTE 5: The reference points from N40 up to and including N49 are reserved for
allocation and definition in TS 23.503 [45].
 N50: Reference point between AMF and the CBCF.
 NOTE 6: The Public Warning System functionality of N50 reference point is defined in
TS 23.041 [46].

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Compared with the 4G MME, the AMF does not provide the session management
function, but incorporates the NAS transparent transmission function and supports
non-3GPP access.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Compared with the 4G SGW-C/PGW-C, the SMF can selectively activate or

deactivate PDU sessions, and supports Ethernet PDU type (requiring the ARP/IPv6
NS proxy function). NAS-SM and N2-SM are terminated by SMFs. As the 5G Core
introduces the SSC, the SMF determines the SSC type of the PDU session and
whether the UL CL/BP needs to be inserted.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Compared with the 4G PGW-U/SGW-U, the UPF supports the UL CL and BP

functions and forwards PDUs of the Ethernet type.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The UDM+UDR functions as the 4G HSS, but the UDR can store structured data for
the PCF and the NEF at the same time.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Supports authentication for 3GPP access and untrusted non-3GPP access

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 Exposure of capabilities and events:

 NF capabilities and events may be securely exposed by NEF for e.g. 3rd party, Application
Functions, Edge Computing .
 NEF stores/retrieves information as structured data using a standardized interface (Nudr) to the
Unified Data Repository (UDR).

 Secure provision of information from external application to 3GPP network:

 It provides a means for the Application Functions to securely provide information to 3GPP
network, e.g. Expected UE Behavior. In that case the NEF may authenticate and authorize and
assist in throttling the Application Functions.

 Trusted AFs can directly access an NF without communicating with the NEF.
 An Application Function may influence UPF (re)selection and traffic routing via PCF or NEF

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Separation of services and storage is a major feature of the cloud architecture.

 3GPP defines the data layer to decouple the service processing logic from the status
data. The status data is split from NFs and stored at the data layer, which makes the
NFs become stateless. Most status data is closely related to carrier network
implementation, and is difficult to standardize. As specified in 3GPP specifications,
the UDSF is used to store carrier-specific non-transparent data, and the UDR is used
to store subscription data, policy data, structured data, and application data.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. NRF, NNSF, AMF, SMF, UDM, AUSF, PCF, UPF, SMSF, and NEF
 2. N1, N2, N3, N4, N6, or N9 interface (based on the reference point model)

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 NRF, NNSF, AMF, SMF, UDM, AUSF, PCF, UPF, SMSF, and NEF
 N1, N2, N3, N4, N6, and N9 are interfaces based on reference points.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Key technical features:

 Service framework
 Interaction between NFs
 NF service templates

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

The NRF provides the NF registration, NF discovery, and service launch notification functions. These
functions help achieve NF interconnections and on-demand NF and service configurations. In the above
figures, NF service consumers include the AMF, SMF, and PCF.
Note: As specified in 3GPP R15, services are always associated with NFs. This way, a service must be
selected when an NF is selected, and cannot be selected independently.

NRF deployment:
 PLMN level: The NRF is configured with all information about a PLMN. NFs and NF services for the
PLMN can be selected.
 Shared slice level: The NRF is configured with information about multiple shared slices. NFs and NF
services for these shared slices can be selected.
 Slice-specific level: The NRF is configured with the information about a specific slice. NFs and NF
services for this slice can be selected.
The preceding deployment modes are optional. Carriers can determine the layer where the NRF is to be
deployed based on actual requirements.
 NF Services provided by the NRF

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The "change of status" of the NFStatus service operations can imply a request to be
notified of newly registered NF Instances in NRF, or to be notified of profile changes
of a specific NF Instance, or to be notified of the deregistration of an NF Instance.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 An example is taken to describe how the AMF selects an SMF.

 The AMF provides the following information for the NRF: NF type = SMF,
DNN, and S-NSSAI.
 The NRF responds to the AMF with the following information: SMF FQDN and
SMF service: {Nsmf_PDUSession, URL}, {Nsmf_EventExposure, URL}.

 Data set ID
 Indicates the data set to be supported by the NF to be discovered. May be included if
the target NF type is "UDR".
 data sets (i.e. "/subscription-data", "/policy-data", "/exposure-data" and "/application-
data")

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Reference:
 23501 f40
 7.2 Network Function Services

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 AMF profile example:

 The GUAMI in an AMF profile helps other NFs discover a specific AMF. The
AMF set ID helps other NFs discover a specific NF.
 The S-NSSAI list is a set of S-NSSAIs supported by the AMF.

 Service examples provided by the AMF (see section 5.2.2 in 3GPP TS 23.502):
 Namf_Communication: The NF may communicate with a UE and the AN by
using the AMF. The SMF can request the EBI allocation for interworking with
the EPS.
 Namf_EventExposure: Other NFs can subscribe to mobility-related events or
statistics from the AMF.
 Namf_MT: The NF can use the service to check whether the UE is reachable.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 NF interaction is simplified as Request-Response and Subscribe-Notify, so that NFs

can interact with each other over SBIs.
 The Subscribe-Notify NF Service (2): allows the NF_A to help the NF_C subscribe to
notifications from the NF_B. The NF_B directly sends notifications to the NF_C. The
NF_A provides the NF_C notification address (for example, URL) during subscription.
Typical applications:
 The NEF helps the AF subscribe to related notifications on the SMF.
 The SMF directly sends notification messages to the AF.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 For details about the services provided by each NF, see section 5.2 in 3GPP TS
23.502.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Establishment of a PDU session is used as an example to describe how the NRF

uses different NFSs to provide services.
 After the AMF and SMF are powered on, they proactively register with the NRF. The
NRF saves the AMF and SMF information and marks them as available. When the
NFSs provided by the AMF or SMF change or NFSs are no longer provided, the AMF
or SMF requests the NRF update or deregister the NFSs.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 After receiving a session establishment request from the UE, AMF-1 requests the
NRF to discover a desired SMF. The NRF looks up the locally maintained NF
information, selects SMF-1, and sends SMF-1 information to AMF-1.
 After obtaining SMF-1 information, AMF-1 invokes the corresponding service through
an SBI to establish a PDU session.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. 5GC NFs interact based on the service-oriented architecture, and EPC NEs
interwork based on the reference point architecture. 5GC is more flexible. Each NF
has its own interface standard. Other NFS can interact with the NF as long as they
comply with this standard.
 2. 5GC NFs are discovered by an NRF. Each NF registers its capabilities with the
NRF when going online. When other NFs send requests to the NRF, the NRF selects
proper NFs. Network adjustment is dynamic. EPC NE selection is based on static
configuration in the DNS.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 The N1 interface is between the UE and AMF. It is used to transmit NAS messages between the UE
and core network. The NAS messages are irrelevant to the access layer.
 The NAS can be classified into NAS-MM, NAS-SM, NAS-SMS, NAS-UE Policy, and NAS-LCS. NAS-
SM, NAS-SMS, NAS-UE Policy, and NAS-LCS are carried on NAS-MM.
 When a UE accesses the AMF through 3GPP or non-3GPP access modes, each access mode has an
N1 NAS signaling connection.
 NAS-MM supports the following functions:
 Implements the AMF-terminated NAS procedure, including RM/CM status management, secure
NAS signaling connection, and access control for UEs and the AMF.
 Transmits different types of NAS messages, such as NAS-SM and SMS, with the NAS-SM
messages at the same time.
 Uses the same NAS protocol for 3GPP and non-3GPP access.
 The security context between the UE and the AMF provides security functions for all NAS messages.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 The AN includes the RAN for 3GPP access and the N3IWF for untrusted non-3GPP access. They use
the same NGAP protocol. The AMF is the only termination point of the N2 interface.
 As the AMF is decoupled from other control plane functions, the NGAP allows the AMF to function as
the forwarding point of the 5G-AN and other control plane functions.
 The N2 interface defines two different procedures:
 Procedures related to the N2 interface management and are irrelevant to UEs, such as N2
interface setup or reset.
 UE-related procedures, such as NAS message transmission, UE context management, PDU
session management, and handover management.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

Protocol Stack Candidate Final Result

API design RESTful, RPC RESTful (most cases)
Interface description language (IDL) OpenAPI 3.0, YANG OpenAPI 3.0
Serialization method JSON, BSON, CBOR, ProtoBuf JSON
Application layer HTTP/1.1, HTTP/2, Diameter, GTP HTTP/2
Transport layer TCP, UDP, QUIC, SCTP TCP

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The destination well-known port of the PFCP Request message is 8805, and the
source port is allocated by the sender (specified in 3GPP TS 29.244).
 When a UE is in the CM-IDLE state, the UPF can forward downlink data to the SMF.
The SMF triggers different paging policies according to the DSCP value. (Optional
procedure) (3GPP TS 23.502)

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 PDU layer: Indicates the PDU transmitted in the PDU session between a UE and a DN. When the
PDU session type is IPv4, IPv6, or IPv4v6, the PDU layer functions as IPv4 and IPv6 packets. When
the PDU session type is Ethernet, the PDU layer functions as an Ethernet frame.

 GTP-U: This protocol is used to encapsulate multiple paths of different PDUs of user data on the N3
interface. A GTP-U tunnel corresponds to a PDU session, and the layer also carries an identifier
associated with a QoS flow.

 GTP-U: This protocol is used to encapsulate the user data packets of N3 and N9 interfaces. A GTP-U
tunnel corresponds to a PDU session, and the layer carries the identifier associated with the QoS flow.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 MM: Mobility Management

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Network Access Identifier (NAI)

 The GLI, GCI, and carrier ID are also supported for fixed-mobile convergence (FMC).
For details, see section 5.9.2 in TS23.501.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

The format and size of the 5G-GUTI is therefore the following:

<5G-GUTI> = <GUAMI><5G-TMSI>,
where <GUAMI> = <MCC><MNC><AMF Identifier>
and <AMF Identifier> = <AMF Region ID><AMF Set ID><AMF Pointer>
MCC and MNC shall have the same field size as in earlier 3GPP systems.
5G-TMSI shall be of 32 bits length.
AMF Region ID shall be of 8 bits length.
AMF Set ID shall be of 10 bits length.
AMF Pointer shall be of 6 bits length.
 One AMF may correspond to multiple GUAMIs.
 Mapping between 4G-GUTI and 5G-GUTI:
 5GS <MCC> maps to E-UTRAN <MCC>
 5GS <MNC> maps to E-UTRAN <MNC>
 5GS <AMF Region ID> and 5GS <AMF Set ID> map to E-UTRAN <MME Group ID> and part of
E-UTRAN <MME Code> as follows:
 - 8 bits of the 5GS <AMF Region ID> starting at bit 7 and down to bit 0 are mapped into bit 15
and down to bit 8 of the E-UTRAN <MME Group ID>;
 - 8 bits of the 5GS <AMF Set ID> starting at bit 9 and down to bit 2 are mapped into bit 7 and
down to bit 0 of the E-UTRAN <MME Group ID>;
 - 2 bits of the 5GS <AMF Set ID> starting at bit 1 and down to bit 0 are mapped into bit 7 and
down to bit 6 of the E-UTRAN <MME Code>;
 5GS <AMF Pointer> maps to part of E-UTRAN <MME Code> as follows:
 - 6 bits of the 5GS <AMF Pointer> starting at bit 5 and down to bit 0 are mapped into bit 5 and
down to bit 0 of the E-UTRAN <MME Code>.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts
 5GS <5G-TMSI> maps to E-UTRAN <M-TMSI>

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

References
 23003 2.2B Subscription Concealed Identifier (SUCI)
 33501 6.12.2
 As examples, assuming the IMSI 234150999999999, where MCC=234, MNC=15 and
MSISN=0999999999, the Routing Indicator 678, and a Home Network Public Key
Identifier of 27:
 The SUCI for the null-scheme is composed of 0, 234, 15, 678, 0, 0 and 0999999999.
 SIDF: UDM internal module. It can decrypt an SUCI to obtain the SUPI.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 5G inherits the 4G tracking area (TA) based mobility management mechanism.

 The 4G concept of TA list is still in use on the 5G network.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. A SUPI is equivalent to an IMSI, a GPSI is equivalent to an MSISDN, and a 5G-

GUTI is equivalent to a GUTI. TAIs are used on both 4G and 5G networks. A SUCI
has no equivalent 4G concept.
 2. 5GC supports 3GPP and non-3GPP access. New concepts must be introduced to
unify the 3GPP and non-3GPP concepts.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Unified security framework (AMF/AUSF/UDM) irrelevant to network access, unified

authentication method, and unified key architecture.

 Enhanced security capabilities

 Differentiated authentication (USIM/certificate/account password)

 Security for the SBA architecture and capability exposure interfaces

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 ARPF Authentication credential Repository and Processing Function

 AUSF Authentication Server Function

 SEAF Security Anchor Function

 SCMF Security Context Management Function

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Reference: TS 33.501
 The 5G HE AV is generated by the UDM and is the original authentication vector. The
5G AV is generated by the AUSF replacing the XRES in the 5G HE AV with the
HXRES.
 HXRES = Hash (RAND||XRES), where HXRES in the 5G AV can be regarded as the
encrypted original XRES to improve the authentication security in visited areas.

 5G authentication vector (AV): authentication data consisting of RAND, AUTN,

HXRES*, and KSEAF
 5G serving environment authentication vector (SE AV): a vector consisting of RAND,
AUTN and HXRES*
 5G home environment authentication vector (HE AV): authentication data consisting
of RAND, AUTN, XRES*, and KAUSF for the purpose of authenticating UEs using 5G
AKA

 3GPP 33501 6.1.3.2

 5G AKA does not allow retrieval of multiple 5G AVs at a time, including the 5G
AV for the next authentication.
 5G AKA does not support requesting multiple 5G AVs, neither the SEAF pre-
fetching 5G AVs from the home network for future use.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 3GPP TS33.501 (2018.12)

 6.1.3.1 Authentication procedure for EAP-AKA'
 The EAP-AKA' authentication procedure is similar to the EPC authentication
procedure. The SEAF only transparently transmits authentication messages.
Authentication is implemented by the AUSF, which is equivalent to the 4G MME in the
authentication procedure.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 3GPP TS33.501 (2018.12)

 6.1.3.2 Authentication procedure for 5G AKA
 5G AKA: Both the AMF and AUSF participate in UE authentication. The AMF provides
UE authentication services on visited networks, and the AUSF covers the
authentication on home networks.
 The authentication procedure on the AUSF is similar to that on the 4G MME.
 The authentication process on the AMF is complex. The AMF uses the HXRES
obtained from the AUSF to check whether the RES of the UE is valid.
 The HXRES is calculated by applying the hash algorithm for the RAND and XRES
composition. That is, the XRES in the 4 tuples is not transferred from the AUSF to the
AMF. Instead, an encrypted RES (equivalent to the HXRES) is transferred to the
AMF. The AMF also uses the RES obtained from the UE using the same encryption
algorithm to generate the HXRES. If the two values are the same, the AMF
determines that the UE passes the authentication.
 HXRES= Hash (RAND||XRES), where hash is an SHA-256 hashing algorithm.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Re-authentication is not required during handovers, and the anchor key is shared.
 During a handover between a non-3GPP and a 3GPP network, the AMF is a unified
authentication anchor and does not need to obtain the authentication key again.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 When the UE and AMF are in the RM-Deregistered state:

 The UE is not registered with the network. Although the AMF may store some
UE contexts for next authentication, the contexts hold no valid location or
routing information for the UE.

 The UE selects a PLMN to initiate a registration procedure. If the AMF accepts

this procedure, the UE and AMF enter the RM-Registered state.

 The AMF can reject the registration request of the UE and maintain the current
state.
 When the UE and the AMF are in the RM-Registered state, the UE can perform:

 A mobility registration update procedure to update the UE location

 A periodic registration update procedure to notify the network that the UE is

still active

 A registration update procedure to update UE capability information or to re-

negotiate protocol parameters with the network

 A deregistration procedure

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 When the UE/AMF is in the CM-CONNECTED state:

 A UE has a NAS signaling connection with the AMF, and has N2 and N3
connections.

 The UE reachability (location) information in the AMF is the cell or base station
information.

 Uplink and downlink data services and signaling procedures can be directly
performed.
 When the UE/AMF is in the CM-IDLE state:

 There is no NAS signaling connection between the UE and AMF, and the AN,
N2, and N3 connections do not exist.

 The UE reachability (location) information in the AMF is the RA (TA list).

 To perform services, the UE needs to perform a Service Request procedure to

enter the CM-CONNECTED state.

 When the AMF has data to be sent to the UE, the AMF sends a paging request
to the UE in the RA to execute the Service Request procedure triggered by the
network side.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 When a UE changes from the CM-IDLE state to the CM-CONNECTED state, it needs to initiate a
service request procedure or a registration procedure (TAU), which consumes a lot of signaling. The
RRC Inactive state is introduced to quickly restore connections and reduce power consumption. In the
RRC Inactive state, the UE context is stored in the RAN. The N2 interface between the RAN and CN is
not released, but the RRC connection between the UE and gNodeB is released. In this case, the UE
enters the RRC Inactive state.
 In the RRC Inactive state, the UE is in the CM-CONNECTED state from the perspective of CN.
 The RAN determines whether a UE enters the RRC Inactive state. The CN provides the following
information for the RAN:
 UE specific DRX values
 RA provided to the UE
 Periodic registration update timer
 Whether the UE is in MICO mode
 Information from the UE permanent identifier
 When the UE is in the CM-CONNECTED with RRC Inactive state, the UE may resume the RRC
connection due to:
 Uplink data pending
 UE-initiated NAS signaling procedure
 A response to RAN paging
 Notification of the network that it has left the RAN-based notification area (RNA)
 RAN area update procedure initiated when the RAN paging timer expires
 The NG RAN triggers paging when:
 Downlink NAS messages are to be transmitted.
 Downlink data is to be transmitted.
 If the UE resumes the connection in a different NG-RAN node within the same PLMN, the UE AS
context is retrieved from the old NG-RAN node, and a procedure is triggered towards the CN.
 If the UE in the RRC Inactive state fails to restore the RRC connection, it enters the CM-IDLE state.
 If the UE in the RRC Inactive state performs cell selection to the GERAN/UTRAN/E-UTRAN, it follows
idle mode procedures of the selected RAT. For details, see TS 23.501 5.17 (by 2018.5.26).

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 RRC connection restoration

 If the NG-RAN changes, the NG-RAN obtains the UE context from the NG-
RAN accessed last time.
 In this case, an N2 path switch (an Xn-based handover) is triggered.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. What are the similarities and differences between the 5GC UE status and the EPC
UE status?
 Similarities: The MM-Registered and MM-Deregistered, as well as CM-
CONNECTED and CM-IDLE states are retained.
 Differences: The CM-CONNECTED with RRC Inactive state has been added
for 5G to reduce the number of signaling interactions before a UE performs
data services.
 2. In the CM-CONNECTED with RRC Inactive state, the downlink data can reach the
gNodeB, but the gNodeB cannot forward the data to the UE. Therefore, the gNodeB
must have the paging function. In addition, the P-TAU timer and the reachability timer
are not started. Therefore, the wireless side is required to provide the two functions.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Note: 3GPP TS 23.501 did not support IPv4v6 and stipulated that an IPv4 PDU
session and an IPv6 PDU session can be established at the same time if the
support for a dual-stack address is required. However, the latest version (3GPP TS
23.501-f10) supports IPv4v6 and stipulates the usage scenario: An IPv4v6 address
is applied for when the MT and TE are separated and the MT does not know the IP
address type supported by the TE. The SMF allocates IPv4, IPv6, and IPv4v6
addresses based on the DNN configuration and carrier policies. (By 2018-05-27)

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The 5GC supports a PDU connectivity service (a service that provides exchange of
PDUs between a UE and a data network identified by a DNN). The PDU connectivity
service is supported using PDU sessions that are established upon requests from the
UE.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The SSC mode associated with a PDU session does not change during the lifetime
of a PDU session.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 5G QoS is a framework based on QoS flows. The QoS flow is the finest granularity
for 5G QoS control.

 The RAN can use multiple QoS flows to share one DRB according to the policy. For
example, GBR QoS flows use one DRB, and non-GBR QoS flows use one DRB.

 Note: User-plane service policies (such as MFBR enforcement) are not regarded as
QoS differentiation. These policies are completed by UPFs on an SDF level
granularity.

 5G QoS flow: The finest granularity for QoS forwarding treatment in the 5G system.
All packets mapped to the same 5G QoS flow receive the same forwarding
treatment (for example, scheduling policy, queue management policy, rate shaping
policy, and RLC configuration). Providing different QoS forwarding treatments
requires different 5G QoS flows.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Method for the UE to obtain a QoS rule

 Explicitly provided to the UE using a PDU session establishment/modification
procedure
 Pre-configured in the UE
 Implicitly derived by the UE by applying reflective QoS

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 If a QoS rule does not contain a packet filter set or a packet filter set contains all UL
packets, RQA cannot be enabled.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The UL and DL session-AMBRs are enforced by the UPF, and the DL session-AMBR
needs to be enforced separately in every UPF that terminates the N6 interface.
 UL and DL UE-AMBRs are enforced by (R)AN.
 If the UE receives a session-AMBR, it needs to enforce the UL session-AMBR.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 NOTE 2: It is required that default MDBV is supported by a PLMN supporting the related 5QIs.
 NOTE 3: This MDBV value is set to 1354 bytes to avoid IP fragmentation for the IPv6 based, IPSec protected GTP
tunnel to the 5G-AN node (the value is calculated as in Annex C of TS 23.060 [56] and further reduced by 4 bytes to
allow for the usage of a GTP-U extension header).
 NOTE 4: A delay of 1 ms for the delay between a UPF terminating N6 and a 5G-AN should be subtracted from a given
PDB to derive the packet delay budget that applies to the radio interface.
 NOTE 5: A delay of 2 ms for the delay between a UPF terminating N6 and a 5G-AN should be subtracted from a given
PDB to derive the packet delay budget that applies to the radio interface.
 NOTE 6: A delay of 5 ms for the delay between a UPF terminating N6 and a 5G-AN should be subtracted from a given
PDB to derive the packet delay budget that applies to the radio interface.
 23501 5.3.7
 Priority Level
 The Priority Level associated with 5G QoS characteristics indicates a priority in scheduling resources among
QoS Flows. The lowest Priority Level value corresponds to the highest priority.
 Packet Delay Budget
 The Packet Delay Budget (PDB) defines an upper bound for the time that a packet may be delayed between
the UE and the UPF that terminates the N6 interface.
 Packet Error Rate
 The Packet Error Rate (PER) defines an upper bound for the rate of PDUs (e.g. IP packets) that have been
processed by the sender of a link layer protocol (e.g. RLC in RAN of a 3GPP access) but that are not
successfully delivered by the corresponding receiver to the upper layer (e.g. PDCP in RAN of a 3GPP
access).
 Default Averaging Window
 Each GBR QoS flow is associated with an averaging window. The window indicates that the GFBR/MFBR

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

time needs to be calculated (for example, in the (R)AN, UPF, UE).

 Each standard 5QI (GBR and delay-critical GBR resource type) is associated with the
default value of the averaging window. The averaging window can also be sent to the
(R)AN and UPF together with the standardized 5QI. If it is received, it should be used
instead of the default value.
 Maximum Data Burst Volume
 Each GBR QoS Flow with Delay-critical resource type shall be associated with a
Maximum Data Burst Volume (MDBV).
 MDBV denotes the largest amount of data that the 5G-AN is required to serve within a
period of 5G-AN PDB (i.e. 5G-AN part of the PDB).
 PDB=Packet Delay Budget
 This parameter is used to prevent IP fragmentation for ultra-low latency services.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 The ARP is used to determine whether to accept a bearer establishment or

modification request, or reject the request if resources are limited.
 The ARP priorities 1-8 must only be assigned to resources for services that are
authorized to receive prioritized treatment within a carrier domain (that is, that are
authorized by the serving network). The ARP priorities 9-15 can be assigned to
resources that are authorized by the home network and therefore are applicable when
a UE is roaming. This ensures that future releases can use ARP priorities 1-8 to
indicate emergency and other priority services within a carrier domain in a backward
compatible manner. However, this does not prevent the use of ARP priorities 1-8 in
roaming situations in the case that appropriate roaming agreements exist that ensure
a compatible use of these priorities.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 If RQ control is used, the RQA can be signaled to the RAN through the N2
interface, as described in clause 5.7.5.3. RQA indicates that certain traffic carried
on a QoS flow is subject to reflective QoS.

 RQA is an optional parameter. It indicates that some (not all) traffic carried over
the QoS flow is affected by the RQA. The (R) AN allows RQI transmission for AN
resources corresponding to a QoS flow only if an RQA is signaled in the QoS
flow. The RQA may be sent to the NG-RAN via the N2 reference point at UE
context establishment in NG-RAN and at QoS Flow establishment or
modification.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 Application scenario: The Reflective QoS mechanism can be used for a new SDF to be added to a QoS flow. The
downlink QoS rule is generated by the SMF and sent to the UPF, and the UPF then sends the service flows that
require UE derived QoS rule creation to the UE by labeling the service flows (with the RQI, FQI) on the user plane.
The uplink QoS rule is generated by the UE based on the downlink service flows to reduce the signaling for QoS
rule updates.
 Control mechanism:
 Control plane:
 When the SMF determines to activate the reflective QoS mechanism, the SMF sends the SDF QoS control
information containing the RQI to the UPF, and sends a QoS profile containing the RQA to the AN.
 User plane:
 The UPF receives the data packets corresponding to the SDF, and contains the RQI in the tunnel of the
data packets.
 The AN sets the air interface data packet header to contain the RQI according to the RQI in the data
packets.
 When a UE receives data packets containing the RQI, the UE checks whether there are uplink QoS rules
corresponding to the data packets on the local end. If there are not, the UE generates a UE derived QoS
rule and starts a timer. If there are, the UE restarts a timer. When the timer expires, the UE derived QoS
rule is deleted. If there is an uplink QoS rule corresponding to data packets on the local end but the QFI
associated with the downlink packets is different from the QFI in the uplink QoS rule stored on the local
end, the UE updates the QFI corresponding to the QoS rule.
 Exit mechanism

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Control plane:
 When the 5GC determines to no longer use reflective QoS for a specific SDF, the SMF
removes the RQI in the corresponding SDF information provided to the UPF through the
N4 interface.
 User plane:
 When the UPF receives this instruction for this SDF, the UPF no longer sets the RQI in
the header on the N3 reference point.
 The UPF continues to accept the UL traffic of the SDF for the originally authorized QoS
flow for a carrier configurable time.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 The SMF can control the data path of a PDU session so that the PDU session can correspond to
multiple N6 interfaces at the same time. Different UPFs of the same PDU session provide access to the
same DN. In addition, the UPF allocated during the PDU session establishment is associated with the
SSC mode of the PDU session, and the additional UPF (for example, the additional UPF used to be
selectively routed to a DN) allocated in the same PDU session is independent of the SSC mode of the
PDU session.
 The selective DN service routing supports the forwarding of some selected services to the N6 interface
of a DN closer to the UE.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 In the case of PDU sessions with the type of IPv4, IPv6, IPv4v6, or Ethernet, the SMF may decide to
insert a UL CL in the data path of a PDU session. The UPF diverts (local) traffic based on the UL CL
delivered by the SMF.
 The insertion and removal of a UL CL are determined by the SMF. A UL CL is delivered over the N4
interface and executed by the UPF. The SMF may decide to insert a UPF supporting the UL CL function
in the data path of a PDU session during or after the PDU session establishment, or to remove a UPF
supporting the UL CL function from the data path of a PDU session after the PDU session
establishment. The SMF may insert more than one UPF supporting the UL CL function in the data path
of a PDU session.
 The UPF supporting the UL CL function is used for uplink traffic steering and downlink traffic merging,
and can be used for traffic measurement, charging, and session-AMBR enforcement.
 The UE is unaware of and does not participate in UL CL and traffic steering.
 When the UPF supporting the UL CL function is inserted in the data path of a PDU session, there are
multiple PDU session anchors for the PDU session. These PDU session anchors (UPFs) provide
different access to the same DN. However, a PDU session of an IP address type has only one IP
anchor.
 When there are multiple UPFs in the data path of a PDU session, only one UPF can provide the N3
interface.
 One UPF can support both the UL CL and PDU session anchor functions.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 A PDU session can be associated with multiple IPv6 prefixes. A UPF supporting the branching point
function can steer traffic to different anchors UPFs according to different UE IPv6 prefixes. The UE
selects different IPv6 prefixes for different services based on routing information and priorities. For
details about how the UE obtains routing information and priorities, see RFC 4191.
 A UPF supporting the branching point function is used for uplink traffic steering and downlink traffic
merging, and can be used for traffic measurement, charging, and session-AMBR enforcement. The
insertion and removal of a UPF supporting the branching point function are determined by the SMF and
delivered through the N4 interface. The SMF may decide to insert a UPF supporting the branching point
function in the data path of a PDU session during or after the PDU session establishment, or to remove
a UPF supporting the branching point function from the data path of a PDU session after the PDU
session establishment.
 IPv6 multi-homing takes effect only for IPv6. When the UE requests to establish an IPv6 or IPv4v6 PDU
session, the UE also indicates whether the UE supports the IPv6 multi-homing function.
 The multi-homing PDU session can be used to support make-before-break service continuity to support
SSC mode 3. The multi-homing PDU session can also be used to support cases where a UE needs to
access both a local service (such as a local server) and a central service (such as the Internet).
 A UPF can support both the branching point and the PDU session anchor functions.
 The UE has two IPV6 addresses in this case.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 An LADN service area is a set of tracking areas. The LADN service is provided by the visited PLMN.
 The LADN service applies only to 3GPP networks and does not apply to the home routed
scenario.
 The LADN service is a part of the DNN subscription data.
 The UE needs to know whether the DNN is an LADN DNN.
 The LADN information is delivered by the AMF to the UE during the registration procedure or UE
Configuration Update procedure. The AMF delivers only the TA (that is, the intersection of the LADN
service area and the current registration area) that belongs to the current registration area of the UE.
 Based on the LADN information in the UE, the UE performs the following actions:
 (a) When the UE is out of an LADN service area, the UE:
 Must not request to activate the user plane connection of a PDU session for this LADN
DNN.
 Must not request to establish or modify a PDU session for this LADN DNN.
 Does not need to release any existing PDU session for this LADN DNN unless the UE
receives explicit PDU session release request from a network.
 (b) When the UE is in an LADN service area, the UE:
 May request a PDU session establishment or modification for this LADN DNN.
 May request to activate the user plane connection of the existing PDU session for this
LADN DNN.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

The following parameter(s) and information may be considered by the SMF for UPF selection and re-
selection:
- UPF's dynamic load.
- UPF's relative static capacity among UPFs supporting the same DNN.
- UPF location available at the SMF.
- UE location information.
- Capability of the UPF and the functionality required for the particular UE session: An appropriate UPF can
be selected by matching the functionality and features required for an UE.
- Data Network Name (DNN).
- PDU Session Type (i.e. IPv4, IPv6, IPv4v6, Ethernet Type or Unstructured Type) and if applicable, the
static IP address/prefix.
- SSC mode selected for the PDU Session.
- UE subscription profile in UDM.
- DNAI as included in the PCC Rules and described in clause 5.6.7.
- Local operator policies.
- S-NSSAI.
- Access technology being used by the UE.
- Information related to user plane topology and user plane terminations, that may be deduced from:
- AN-provided identities (e.g. CellID, TAI), available UPF(s) and DNAI(s);
- Information regarding the user plane interfaces of UPF(s).This information may be acquired by the SMF
using N4;
- Information regarding the N3 User Plane termination(s) of the AN serving the UE. This may be deduced
from AN-provided identities (e.g. CellID, TAI);
- Information regarding the N9 User Plane termination(s) of UPF(s) if needed;
-Information regarding the User plane termination(s) corresponding to DNAI(s).

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 Network slice is an E2E network, including the RAN, transport network (TN), and core network (CN). It
requires a cross-domain slice management system.

 Network slices require isolation of resources, security, and OAM. Different domains can use different
technologies to achieve this isolation. For example, the CN uses virtualization technology. FlexE and
VPN technologies can be used to provide better service isolation with a given amount of bandwidth. The
RAN can use differentiated air interface technologies for resource isolation.

 Slices can be customized.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 Slices A, B, C are typical network slices. Each slice has two instances.
 The NFs in slice A are completely isolated.
 Some control plane NFs are shared between instances, and some are isolated. User plane
NFs are isolated on slice B.
 The entire control plane is shared, and the entire user plane is isolated on slice C.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 There are three standard SSTs: eMBB (1), URLLC (2), and MIoT (3).
 Example:
 0x01000001 identifies a slice of the eMBB type. There may be three slice instances for selection.
 0x02000001 and 0x02000002 identify a slice of the URLLC type and share one slice instance.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 DNN: It is the same as an APN used on an EPS network.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

 1. If a UE attempts to register with a PLMN using a radio access technology (RAT), the UE first sends a
Registration Request message to the (R)AN. If the UE stores the configured NSSAI of the PLMN or the
allowed NSSAI for the RAT and the PLMN, the UE includes the requested NSSAI in the NAS
Registration Request message and the AN message. The requested NSSAI includes the S-NSSAI of the
UE-requested slice.
 2. The (R)AN selects the initial AMF based on the globally unique AMF ID (GUAMI) or requested NSSAI.
If the UE does not provide the requested NSSAI or GUAMI in the AN message, the (R)AN sends the
Registration Request message from the UE to the initial AMF.
 3. The initial AMF looks up the UDM for UE subscription data including the subscribed S-NSSAIs. The
initial AMF determines whether it can provide services for the UE, according to the received requested
NSSAI, subscribed S-NSSAI, and local configuration. If the initial AMF can serve the UE, it is the serving
AMF. It constructs the allowed NSSAI based on the subscribed S-NSSAI and the requested NSSAI and
sends the allowed NSSAI to the UE through a registration accept message. If the initial AMF cannot
provide services for the UE or cannot make a decision, the AMF needs to send a query request to the
NSSF for information about the target AMF.
 4. Query parameters include the requested NSSAI, subscribed S-NSSAI, SUPI, and TAI of the UE.
 5. The NSSF selects an AMF set or a candidate AMF list that can serve the UE, and an allowed NSSAI
suitable for the RAT. It may further select an NSI serving the UE, and an NRF used to select an NF in
the instance. These are selected according to the received information and local configuration. The
information is sent to the initial AMF after selection.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 6. If the initial AMF is not in the AMF set or the AMF address is unavailable in local
information, the initial AMF obtains the candidate AMF list by checking with the NRF.
The NRF sends a group of available AMF lists, including the AMF pointer and
address. The initial AMF selects an AMF as the target AMF. If the initial AMF cannot
obtain the candidate AMF list by checking with the NRF, the initial AMF needs to send
the Registration Request message to the target AMF through the (R)AN. The
message includes the AMF set and the allowed NSSAI.
 7a. If the initial AMF directly sends the NAS message to the target AMF based on
the local policy and the subscription data, the initial AMF sends the Registration
Request message and other information except for the AMF set obtained from the
NSSF to the target AMF.
 7b. If the initial AMF determines to forward the NAS message to the target AMF
through the (R)AN based on the local policy and subscription information, the initial
AMF sends a Reroute NAS message to the (R)AN. The Reroute NAS message
includes the target AMF set information and the Registration Request message, and
the related information obtained from the NSSF.
 8. After receiving the registration request message sent in step 7, the target AMF
continues with the registration procedure. It sends the UE a registration accept
message containing the allowed NSSAI and NSSP.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Session management:
 The control planes for session management on different slices are isolated.
 The AMF and SMF are decoupled. Different SMFs can be selected for different slices.

 The user planes for session management on different slices are isolated.
 The UPFs for different slices can be independent from each other.
 A session cannot be migrated between different slices.

 The SMF sends the S-NSSAI mapping to a session to a gNodeB, so that the
gNodeB can allocate resources based on the S-NSSAI.
 A UE selects the HPLMN S-NSSAI mapped to the session according to the
configured NSSP.
 In roaming scenarios, the UE maps the HPLMN S-NSSAI to the VPLMN S-
NSSAI based on the mapping.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. The AMFs can be shared, but the SMF and UPF cannot.
 2. A maximum of eight slices.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. The AMF requests the NSSF to provide the NRF information based on the S-
NSSAI.
 2. The NSSF sends the NRF information.
 3. The AMF requests the NRF to provide the SMF information.
 4. The NRF sends the SMF information.
Note: If the AMF has obtained the NRF information, steps 1 and 2 can be skipped. (For
example, the AMF has obtained the NRF information during the attach procedure.)

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

1. The AMF requests the NSSF to return the information about the NRF used for SMF
selection based on the S-NSSAI.
2. The NSSF returns the NRF information.
3. The AMF requests the NRF to return the SMF information.
4. The NRF returns the SMF information.
Note: If the AMF has identified the NRF, steps 1 and 2 can be skipped. (For example, the
NRF information has been obtained during the attach procedure.)

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 1. PDU sessions are similar to PDN connections. QoS flows are similar to bearers.
QoS rules are similar to TFTs.
 2. The Notification Control and RQA have been added for the 5GC. The changes are
made to reduce the signaling resources required for creating dedicated bearers and
updating the TFTs.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

1. The UE sends an MM-NAS registration request to the AMF.

The registration request includes the registration type, SUCI/SUPI/5G-GUTI, security parameters,
requested NSSAI, mapped requested NSSAI, UE 5GC capability, PDU session status, PDU session to
be reactivated, follow-on request, and preference for the MICO mode.
2. If the registration request includes the 5G-GUTI of the UE and the serving AMF changes, the new AMF
sends the Namf_Communication_UEContextTransfer containing the complete registration request
information (to verify integrity of the NAS message) to obtain the UE SUPI and MM context from the old
AMF. The old AMF sends a response message to the new AMF. The response information contains the
UE SUPI, MM context, SMF information, PCF ID, and other information. If the old AMF holds information
about an activated PDU session, the old AMF contains SMF information in the response message. The
SMF information contains an S-NSSAI, an SMF ID, and a PDU session ID.
3. (Optional) If the SUPI is not provided by the UE in the previous step and is not retrieved from the old
AMF, the new AMF sends an identity request message to the UE to request the UE SUCI.
4. The AMF can request the AUSF to initiate UE authentication. In this case, the AMF needs to select an
AUSF based on the SUPI or SUCI.
5. (Optional) If the AMF changes, the new AMF notifies the old AMF that the registration of the new AMF is
complete for the UE.
6. (Optional) If the UE does not provide the PEI and cannot obtain the PEI from the old AMF, the AMF
initiates an identity request procedure, and sends an identity request message to the UE to obtain the
PEI.
7. The new AMF performs ME authentication, that is, PEI authentication.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

8a-c. If the AMF is different from the AMF registered previously, the SUPI provided by the UE cannot indicate a valid context in the
AMF, or the UE registers with the AMF registered in non-3GPP access, the new AMF registers with the UDM and subscribes to
UDM deregistration notification for the AMF. The UDM stores the AMF identifier and the associated access type. The AMF
obtains the access and mobility subscription data from the UDM, and the SMF selects the subscription data. The new AMF
provides the access type of the serving UE for the UDM, and the access type is set to 3GPP access. The UDM stores the
associated access type and serving AMF in the UDR. After obtaining the mobility subscription context from the UDM, the new
AMF sets up an MM context for the UE and subscribes to related status from the UDM.
8d. When the UDM stores the associated access type and the serving AMF, as described in step 8a, the UDM initiates a
Nudm_UECM_DeregistrationNotification service operation to the old AMF corresponding to the 3GPP access. The old AMF
removes the MM context of the UE. If the service NF removal reason indicated by the UDM is the initial registration, the old
AMF notifies all the UE-associated SMFs that the UE deregisters from the old AMF, and the old AMF unsubscribes from the
subscription information in the UDM.
9. If the AMF decides to communicate with a PCF, the AMF selects the PCF. If the new AMF obtains the PCF ID from the old AMF
in step 2 and is successfully associated with the PCF identified by the PCF ID, the AMF selects the (V-) PCF through the PCF
ID. If the PCF identified by PCF ID is unavailable or the PCF ID cannot be obtained from the old AMF, the AMF selects the
PCF.
10. The PCF may request UE event subscription.
11. (Optional) If the registration request in step 1 contains the PDU session to be activated, the AMF requests the SMF related to
the PDU session to activate the user plane connection of the PDU session. If the PDU session status indicates that the PDU
session is released by the UE, the AMF instructs the SMF to release the network resources related to the PDU session.
12. The new AMF sends a registration accept message (5G-GUTI, RA, mobility restriction information, PDU session status, allowed
NSSAI, periodic registration update timer, LADN information, accepted MICO mode, IMS voice over PS session supported
indication, and emergency service support indicator) to notify the UE that the registration request is accepted.
13. (Optional) If a new 5G-GUTI is allocated, the UE sends a registration complete message to the AMF for confirmation.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

1. A UE requests to establish a PDU session. The request message contains slice information, DNN, SSC
mode, and PDU type. If this procedure is used for inter-system handovers or 3GPP and non-3GPP
handovers, this message also contains the "Existing PDU Session" indication.
2. The AMF selects an SMF for PDU session establishment based on information, including the slice
information and DNN. If the request message contains the "Existing PDU Session" indication, the AMF
selects an SMF based on the mapping between the PDU session ID or DNN (saved on the HSS and UDM)
and the SMF.
3. The SMF obtains session-related subscription data from the UDM.
5. The SMF obtains session-related policy information from the PCF.
6-12. The SMF selects a UPF based on information, including the UE location, DNN, and S-NSSAI. An E2E
user-plane path is set up. During this procedure, the SMF or UPF allocates uplink tunnels and notifies the
RAN of such information, and the RAN allocates downlink tunnels and notifies the UPF of such information.
13. The SMF subscribes to UE mobility event notifications on the AMF. For example, a notification is sent if
a UE moves to or out of the specified service area.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

 5G Core Basic Concepts

1. A UE requests to establish a PDU session. The request message contains slice information, DNN, SSC
mode, PDU type, and UE encapsulation location on the RAN. If this procedure is used for inter-system
handovers or 3GPP and non-3GPP handovers, this message also contains the "Existing PDU Session"
indication.
2. The AMF selects an SMF for PDU session establishment based on information, including the slice
information and DNN. If the request message contains the "Existing PDU Session" indication, the AMF
selects an SMF based on the mapping between the PDU session ID or DNN (saved on the HSS and UDM)
and the SMF.
3. The SMF obtains session-related subscription data from the UDM, and obtains session-related policy
information from the PCF.
5. The SMF selects a UPF based on information, including the UE location, DNN, and S-NSSAI.
6-15. An E2E user-plane path is set up. During this procedure, the SMF or UPF allocates uplink tunnels
and notifies the RAN of such information, and the RAN allocates downlink tunnels and notifies the UPF of
such information.
16. The SMF subscribes to UE mobility event notifications on the AMF. For example, a notification is sent if
a UE moves to or out of the specified service area.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

 Answer to question 1: A main difference between the 5GC registration procedure and
the EPC attach procedure is that a session cannot be established in the 5G
registration procedure, and a PDN connection must be established in the EPC attach
procedure. In addition, slices are introduced in the 5GC registration procedure, and
therefore a network slice that the UE is allowed to access is determined in the 5GC
registration procedure, the gNodeB also selects an AMF based on the slice that the
UE wants to access.
 Answer to question 2: The 5GC session establishment procedure is similar to the
EPC PDN connection establishment procedure. The difference is that the SMF and
UPF need to be selected based on slice information. In addition, the 5GC supports
different SSC modes. The 4G network does not have the SSC mode concept. Only
one tunnel is established for 5G PDU sessions, and one tunnel is established for each
bearer of the 4G PDN connection.

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.

5G Core Basic Concepts

Copyright © Huawei Technologies Co., Ltd. All rights reserved.