Samir's whitepaper5g

Defence
5G (3GPP Rel.15) Technology Introduction-2018, by Mr. Samir Mohanty
5G Technology Introduction
Samir Mohanty
Authors: Mr. Samir Mohanty,
Technical Manager (5G/AI)
Organization: L&T Defense
Bangalore, India
M:9019195214/9741405214
Samir.Mohanty@larsentoubro.com
White Paper
This white paper summarizes significant additional Technology components based on 5G, which are Included
in 3GPP Release 14/15/16 specifications. The 5G technology as specified within 3GPP Release was first
commercially deployed by end Sep 2017. Since then the number of commercial networks is strongly increasing
around the globe. 5G has become the fastest developing mobile system technology ever. As other cellular
technologies, 5G is continuously worked on in terms of improvements. 3GPP groups added technology
components according to so- called releases. Initial enhancements were included in 3GPP Release 15,
followed by more significant improvements in 3GPP Release 14. Beyond Release 14 a number of different
market terms have been used. However, 3GPP reaffirmed that the naming for the technology family and its
evolution continues to be covered by the term 5G.
Table of Contents
1 Introduction.....................................................................................................4

Defence
2 Technology Components of 5G Release 14/15/16..........................................5
2.1 Small Cell Enhancements............................................................................... 7
2.1.1 Higher Order Modulation (256QAM) ............................................................... 7
2.1.2 Dual Connectivity for 5G................................................................................. 9
2.2 Device to Device communication (D2D)........................................................ 13
2.2.1 5G D2D ProSe Scenarios............................................................................. 14
2.2.2 Overall 5G Network Architecture .................................................................. 14
2.2.3 PHY and MAC layer for ProSe: New logical, transport and physical channels15
2.2.4 Direct Discovery ........................................................................................... 16
2.2.5 ProSe Direct Communication........................................................................ 24
2.2.6 Synchronization aspects............................................................................... 26
2.3 Core Network Solution.................................................................................. 30
2.3.1 RAN Solution................................................................................................ 31
2.4 HetNet mobility enhancements..................................................................... 34
2.4.1 Improve overall HO performance based on mobility information ................... 34
2.4.2 UE based solutions for mobility robustness .................................................. 35
2.4.3 Improvements to recovery from RLF............................................................. 35
2.5 RAN enhancements for Machine-Type and other mobile data applications .. 37
2.6.1 UE Power Consumption Optimization........................................................... 38
2.6.2 Signaling Overhead Reduction ..................................................................... 39
2.7 LTE TDD-FDD joint operation including Carrier Aggregation ........................ 40
2.8 Enhanced Interference Mitigation & Traffic Adaption (eIMTA)....................... 41
2.8.1 Deployment scenarios .................................................................................. 41
2.8.2 Reconfiguration procedure and higher layer configuration ............................ 42
2.8.3 HARQ, CSI feedback and power control....................................................... 43
2.8.4 UE capabilities.............................................................................................. 43
2.8.5 eIMTA in combination with other technology components ............................ 44
2.9 Further downlink MIMO and Massive enhancements.................................... 45
2.10 Coverage Enhancements ............................................................................. 48
Table of Contents

Defence
3 Conclusion....................................................................................................53
4 5G frequency bands .....................................................................................54
5 Literature ......................................................................................................56
6 5G-CORE.....................................................................................................58
7 5G-PCRF......................................................................................................59
9 5G-IMS.........................................................................................................60

Defence
1 Introduction:

Defence
LTE-Advanced is a term used for the version of LTE that addresses IMT- Advanced requirements, as specified
in 3GPP Release 10 and beyond. The world’s first LTE-Advanced network using Carrier Aggregation was
commercially launched in South Korea by SK Telecom (which included a compatible handset) in June 2013.
Carrier Aggregation is important for carriers around the world as it allows them to create larger spectrum
swaths by combining disparate spectrum assets. The larger the spectrum swaths, the better the efficiency of
LTE; however, Carrier Aggregation is just one component of LTE-Advanced; it also includes other elements
such as Coordinated Multi-Point (CoMP), Self-Optimizing Networks (SON), small cell enhancements,
Enhanced Inter-Cell Interference Coordination (eICIC) and advanced Multi-Input Multi-Output (MIMO) antenna
technology to improve network performance and capacity.
AT&T launched LTE-Advanced in Chicago in early 2014, making them the first major U.S. carrier to offer the
service. It is expected that all four national U.S. carriers – AT&T, Sprint, T-Mobile and Verizon – will launch
LTE-Advanced in 2014 and 2015.
LTE-Advanced is both backwards- and forwards-compatible with LTE, meaning LTE devices will operate in
newer LTE-Advanced networks, and LTE-Advanced devices will operate in older LTE networks.
In preparation for the next generation of wireless technology, called IMT-Advanced by the International
Telecommunication Union (ITU), LTE-Advanced was first standardized by 3GPP in Release 10 and developed
further in Releases 11 to 13. In November 2010, the ITU ratified LTE-Advanced as IMT-Advanced. LTE-
Advanced is a further evolution of LTE, an OFDMA-based technology, specified in Release 8 and 9, which is

Defence
supported by a tremendous ecosystem of manufacturers and operators worldwide, and has already proven
itself to be the global next generation technology.
3GPP developed the following capabilities for LTE-Advanced with specifications in Release 11 and beyond
which are considered the most important features for LTE-Advanced:
Wider bandwidth support for up to 100 MHz via aggregation of 20 MHz blocks (Carrier Aggregation)
Uplink MIMO (two transmit antennas in the device)
Higher order downlink MIMO of up to 8 by 8 in Release 10
Coordinated Multipoint Transmission (CoMP) with two proposed approaches: coordinated scheduling and/or
beam forming, and joint processing/transmission in Release 11
Heterogeneous network (Het-net) support including enhanced Inter-Cell Interference Coordination (eICIC)
Relays
The table below summarizes anticipated LTE-Advanced performance relative to IMT-Advanced requirements.
In all cases, projections of LTE-Advanced performance exceed that of the IMT-Advanced requirements.
LTE-Advanced (with 8X* MIMO, 20+20 MHz, Downlink 64 QAM, Uplink 64 QAM) is expected to deliver 1.2
Gbps downlink throughput and 568 Mbps uplink throughput.
It is expected to be the next decade before OFDMA-based systems like LTE have the largest percentage of
subscribers, and it could be well toward the end of the next decade before LTE-Advanced has a large
subscriber base.
LTE will address the market needs of the next decade. After that, operators may deploy 4G networks using
LTE-Advanced technology as a foundation. As new spectrum becomes available, in the next decade,
especially if it includes wide radio channels, then LTE-Advance will be the ideal technology for these new
bands. Even in existing bands, operators are likely to eventually upgrade their LTE networks to LTE-Advanced
to obtain spectral efficiency gains and capabilities.
LTE and LTE-Advance are practical and popular technologies, with more than 700 million subscribers, more
than 420 commercial networks and a peak data rate of 450 Mbps, This highly capable technology is set to get
even with the latest enhancements.
Improved radio capabilities will make mobile broadband services more efficient, providing higher qualities will
make mobile broadband services more efficient, providing higher quality and enabling new sets of services on
top of LTE networks.
These features, are defined in 3GPP R13/14 and are collectively known as "LTE-Advance Pro" The
developments will enable the Programmable world for billions of Connected Internet of Thinking (IoT) devices,
Vehicular communication for Intelligent Traffic System (ITS) and Public safety/Critical Communications. LTE-
Advance Pro raises user data rate to several Gbps, cuts Latency to just a few milliseconds, gives access to
unlicensed 5 Ghz spectrum and increases networks efficiency.

Defence
It also maintains backwards compatibility with existing LTE networks and devices. LTE-Advance Pro and 5G
can use similar technology components to enhance radio capabilities.
5G is a new non-backwards compatible radio technology that can operate both below and above 6 Ghz
frequencies and provide even higher data rates and lower latency. LTE-Advance Pro operates below 6 GHz
and evolves in parallel to development work on 5G. The evolutionary paths of LTE-Advanced Pro and 5G.
This White paper focus on the key technical solution in LTE-Advanced Pro, as well as on the features needed
to optimize LTE networks to deliver new 5G devices.
As per 3GPP.
Figure-1:
Figure-2:

Defence
Multi-Gbps data rates with carrier aggregation evolution:
LTE started with 150 Mbps peak rate and 20 MHz bandwidth. In Release 10, the peak data rates were upgrade
by carrier aggregation.
Mainstream carrier aggregation in 2015 delivered up to 300 Mbps on 2x20 MHz are about to go into
commercial using 20+20+10 MHz, with peak data rates exceeding 370 Mbps.
3GPP R10 defines a maximum capability up to 5x20 MHz, which gives 1000 Mbps (1Gbps) with 2x2 MIMO
and 64 QAM and 8x8 MIMO.
The data rate can be increased still further with more spectrum and more antennas. A higher number of
antennas elements is feasible when using comparatively large antennas into small devices. For these, data
rates are more easily increased by using more spectrum. Release 13 makes this possible by enhancing carrier
aggregation to enable up to 32 component carriers.
In practice, the use of unlicensed spectrum illustrates carrier aggregation evolution.
Figure-3
Figure-4: LTE –Advance Pro data rates and bandwidth

Defence
V2V:

Defence
M2M:
D2D:
3Gpp has defined direct communication between two devices under the category of Device-to-Device (D2D)
communications. It can be used in several ways, V2V communication, for public safety, for social media and
for advertisements. Looking at vehicle communications, present day communication Equipment installed in
cars is used for remote car diagnostics, providing in car entertainment or fleet tracking.
5G is the fifth generation of wireless communications technologies supporting cellular data networks. 5G
communication requires the use of communications devices (mostly mobile phones) designed to support the
technology. It has many advanced features potential enough to solve many of the problems of our mundane
life. It is beneficial for the government, as it can make the governance easier; for the students, as it can make
available the advanced courses, classes, and materials online; it is easier for the common people as well, as it
can facilitate them the internet everywhere. So, this tutorial is divided into various chapters and describes the
5G technology, its applications, challenges, etc.
5G - Advancement
Application of 5G is very much equivalent to accomplishment of dream. It is integrated with beyond the limit
advance features in comparison to the previous technologies.

Defence
Advanced Features
In comparison to previous radio technologies, 5G has following advancement −
Practically possible to avail the super speed i.e. 1 to 10 Gbps.
Latency will be 1 millisecond (end-to-end round trip).
1,000x bandwidth per unit area.
Feasibility to connect 10 to 100 number of devices.
Worldwide coverage.
About 90% reduction in network energy usage.
Battery life will be much longer.
Whole world will be in wi fi zone.
5G - Advantages & Disadvantages
5th
generation technology offers a wide range of features, which are beneficial for all group of people including,
students, professionals (doctors, engineers, teachers, governing bodies, administrative bodies, etc.) and even
for a common man.

Defence
Important Advantages
There are several advantages of 5G technology, some of the advantages have been shown in the
above Ericsson image, and many others are described below −
High resolution and bi-directional large bandwidth shaping.
Technology to gather all networks on one platform.
More effective and efficient.
Technology to facilitate subscriber supervision tools for the quick action.
Most likely, will provide a huge broadcasting data (in Gigabit), which will support more than 60,000
connections.
Easily manageable with the previous generations.
Technological sound to support heterogeneous services (including private network).
Possible to provide uniform, uninterrupted, and consistent connectivity across the world.
Some Other Advantages for the Common People
Parallel multiple services, such as you can know weather and location while talking with other person.
You can control your PCs by handsets.
Education will become easier − A student sitting in any part of world can attend the class.
Medical Treatment will become easier & frugal − A doctor can treat the patient located in remote part of the
world.
Monitoring will be easier − A governmental organization and investigating offers can monitor any part of the
world. Possible to reduce the crime rate.
Visualizing universe, galaxies, and planets will be possible.

Defence
Possible to locate and search the missing person.
Possible, natural disaster including tsunami, earthquake etc. can be detected faster.
Disadvantages of 5G Technology
Though, 5G technology is researched and conceptualized to solve all radio signal problems and hardship of
mobile world, but because of some security reason and lack of technological advancement in most of the
geographic regions, it has following shortcomings −
Technology is still under process and research on its viability is going on.
The speed, this technology is claiming seems difficult to achieve (in future, it might be) because of the
incompetent technological support in most parts of the world.
Many of the old devices would not be competent to 5G, hence, all of them need to be replaced with new one —
expensive deal.
Developing infrastructure needs high cost.
Security and privacy issue yet to be solved.
5G - Challenges
Challenges are the inherent part of the new development; so, like all technologies, 5G has also big challenges
to deal with. As we see past i.e. development of radio technology, we find very fast growth. Starting from 1G to
5G, the journey is merely of about 40 years old (Considering 1G in 1980s and 5G in 2020s). However, in this
journey, the common challenges that we observed are lack of infrastructure, research methodology, and cost.
Still, there are dozens of countries using 2G and 3G technologies and don’t know even about 4G, in such a
condition, the most significant questions in everyone’s mind are −
How far will 5G be viable?
Will it be the technology of some of the developed countries or developing countries will also get benefit of
this?
To understand these questions, the challenges of 5G are categorized into the following two headings −
Technological Challenges

Defence
Common Challenges
Technological Challenges
Inter-cell Interference − This is one of the major technological issues that need to be solved. There is variations
in size of traditional macro cells and concurrent small cells that will lead to interference.
Efficient Medium Access Control − In a situation, where dense deployment of access points and user terminals
are required, the user throughput will be low, latency will be high, and hotspots will not be competent to cellular
technology to provide high throughput. It needs to be researched properly to optimize the technology.
Traffic Management − In comparison to the traditional human to human traffic in cellular networks, a great
number of Machine to Machine (M2M) devices in a cell may cause serious system challenges i.e. radio access
network (RAN) challenges, which will cause overload and congestion.
Common Challenges
Multiple Services − Unlike other radio signal services, 5G would have a huge task to offer services to
heterogeneous networks, technologies, and devices operating in different geographic regions. So, the
challenge is of standardization to provide dynamic, universal, user-centric, and data-rich wireless services to
fulfil the high expectation of people.

Defence
Infrastructure − Researchers are facing technological challenges of standardization and application of 5G
services.
Communication, Navigation, & Sensing − These services largely depend upon the availability of radio
spectrum, through which signals are transmitted. Though 5G technology has strong computational power to
process the huge volume of data coming from different and distinct sources, but it needs larger infrastructure
support.
Security and Privacy − This is one of the most important challenges that 5G needs to ensure the protection of
personal data. 5G will have to define the uncertainties related to security threats including trust, privacy,
cybersecurity, which are growing across the globe.
Legislation of Cyberlaw − Cybercrime and other fraud may also increase with the high speed and ubiquitous
5G technology. Therefore, legislation of the Cyberlaw is also an imperative issue, which largely is
governmental and political (national as well as international issue) in nature.
5Gtechnologyfeaturesoradvantages:
The 5G technology makes use of all the existing cellular wireless technologies(2G, 3G and 4G). Apart from
high throughput it provides following featutes to the users and providers of this technology.
• Better revenue for the service providers.
• Interoperability will become feasible and easier.
• Low battery power consumption.
• Better coverage and high data rates at the edge of cell.
• Multiple data transfer paths concurrently.
• More secure
• Flexible architecture based on SDR(Software Defined Radio).
• Higher system spectral efficiency
• Harmless to human health
• Cheaper fees due to lower costs of deployment infrastructure
• Better QoS(Quality of Service)
• Ultimate download and upload speed provides user great experience like broadband cable internet
• Most of the devices such as 5G dongle works on USB power and hence better in developing countries where
electric power cuts are very common.

Defence
Samir’s 5G-Presentation -2019-2020

Defence

Defence
Specification / Feature 5G Support
Bandwidth 1Gbps or higher
Frequency range 3 to 300 GHz

Defence
Standard(access
technologies) CDMA/BDMA
Technologies
Unified IP, seamless integration of broadband, LAN/PAN/WAN/WLAN and 5G
based technologies
Applications/Services
wearable devices, dynamic information access, HD streaming, smooth global
roaming
core network flatter IP network, 5G network interfacing (5G-NI)
Handoff vertical, horizontal
Peak Data Rate Approx. 10 Gbps
Cell Edge Data Rate 100 Mbps
Latency less than 1 ms
5GNR(NewRadio)architecture

Defence
5GNRNetworkInterfaces
5GNRnetworkinterfaces-Xn,NG,E1,F1,F2interfacetypesin5G:
This page on 5G NR network interfaces describes various 5G interfaces used in 5G architecture. It includes Xn
interface, NG interface, E1 interface, F1 interface and F2 interface used in 5G NR (New Radio) network
architecture. It covers functions and locations of these 5G NR interfaces used between 5G RAN and 5GC.
5G NR overall architecture is shown in the following figure-2. This is as defined in the 3GPP TS 38.300
specification. The 5G NR network composed of NG RAN (Next Generation Radio Access Network) and 5GC
(5G Core Network). As shown, NG-RAN composed of gNBs (i.e. 5G Base stations) and ng-eNBs (i.e. LTE
base stations).
NG-C: control plane interface between NG-RAN and 5GC.
• NG-U: user plane interface between NG-RAN and 5GC.
• gNB: node providing NR user plane and control plane protocol terminations towards the UE, and connected
via the NG interface to the 5GC. The 5G NR (New Radio) gNB is connected to AMF (Access and Mobility
Management Function) and UPF (User Plane Function) in 5GC (5G Core Network). The protocol layers are
mapped into three units viz. RRH (Remote Radio Head), DU (Distributed Unit) and CU (Central Unit) as shown
in the figure-2.
• ng-eNB: node providing E-UTRA user plane and control plane protocol terminations towards the UE and
connected via the NG interface to the 5GC.
5GNRXnInterface
• Location: Xn interface lies between NG-RAN Nodes viz. gNB & ng-eNB.
• Control Plane Functions are as follows:
-interface management and error handling (e.g. setup, reset, removal, configuration update)
-connected mode mobility management (handover procedures, sequence number status transfer, UE context
retrieval)
-support of RAN paging
-dual connectivity functions (secondary node addition, reconfiguration, modification, release, etc.)

Defence
• User Plane Functions are as follows:
-Data Forwarding
-Flow Control
• References: TS 38.420 to TS 38.424
5GNRNGInterface
• Location: Between 5G RAN and 5G Core Network. Both control plane and user plane lies between them and
hence there are two interfaces under NG interface viz. NG-C and NG-U. It is similar to LTE interfaces viz. S1-C
and S1-U respectively.
• Functions/Objectives:
-NG interface supports the exchange of signalling information between NG-RAN and 5GC.
-It defines inter connection of NG-RAN nodes with AMFs supplied by different manufacturers.
-It specifies the separation of NG interface Radio Network functionality and Transport Network functionality to
facilitate introduction of future technology.
• Capabilities:
-procedures to establish, maintain and release NG-RAN part of PDU sessions
-procedures to perform intra-RAT handover and inter-RAT handover
-the separation of each UE on the protocol level for user specific signalling management
-the transfer of NAS signalling messages between UE and AMF
-mechanisms for resource reservation for packet data streams
• References: From TS 38.410 to TS 38.414
5GNRE1Interface
• Location: From logical perspective, E1 interface is point-to-point interface between a gNB-CU-CP and a gNB-
CU-UP as shown in fig-2.
• Functions:
-E1 interface supports the exchange of signalling information between the endpoints.
-It separates Radio Network Layer and Transport Network Layer.
-It enables exchange of UE associated information and non-UE associated information.
5GNRF1Interface
• Location: Between gNB-CU and gNB-DU. It is also separated into F1-C and F1-U based on control plane and
user plane functionalities.
• Functions:
-F1 interface defines inter-connection of a gNB-CU and a gNB-DU supplied by different manufacturers.
-It supports control plane and user plane separation.
-It separates Radio Network Layer and Transport Network Layer.
-F1 interface enables exchange of UE associated information and non-UE associated information.

Defence
5GNRF2Interface
The protocols over Uu and NG interfaces are categorized into user plane protocols and control plane protocols.
User plane protocols implement actual PDU Session service which carries user data through the access
stratum. Control plane protocols control PDU Sessions and connection between UE and the network from
various aspects which includes requesting the service, controlling different transmission resources, handover
etc. The mechanism for transparent transfer of NAS messages is also included.
The NG-RAN consists of a set of gNBs connected to the 5GC through the NG interface. An gNB can support
FDD mode, TDD mode or dual mode operation. gNBs can be interconnected through the Xn interface. A gNB
may consist of a gNB-CU and one or more gNB-DU(s). A gNB-CU and a gNB-DU is connected via F1
interface. NG, Xn and F1 are logical interfaces.
5GC (5G Core) Network architecture is highly flexible, modular and scalable. It offers many functions including
network slicing to serve vivid customer requirements. It offers distributed cloud, NFV (Network functions
virtualization) and SDN (Software Defined Networking).

Defence
5GProtocolStack
The figure-5 below depicts 5G protocol stack mentioning 5G protocol layers mapped with OSI stack. As whown
5G protocol stack consists of OWA layer, network layer, Open transport layer and application layer.
OWA Layer: OWA layer is the short form of Open Wireless Architecture layer. It functions as physical layer and
data link layer of OSI stack.
Network Layer: It is used to route data from source IP device to the destination IP device/system. It is divided
into lower and upper network layers.
Open Transport Layer: It combines functionality of both transport layer and session layer.
Application Layer: It marks the data as per proper format required. It also does encryption and decryption of
the data. It selects the best wireless connection for given service.
Refer 5G protocol layers >> for more information on 5G protocol stack layers viz. layer-1 (i.e. PHYSICAL
Layer), layer-2 (i.e. MAC, RLC, PDCP) and layer-3 (i.e. RRC Layer).

Defence
5GNRRadioprotocolarchitecture
Following figure-6 depicts radio protocol architecture of 5G NR (New Radio) as defined in 3GPP TS 38.300.
Protocol layers at UE and gNB side are shown in the figure for both user plane and control plane
functionalities.
This interface lies between lower and upper parts of the 5G NR physical layer. It is also separated into F2-C
and F2-U based on control plane and user plane functionalities.
Lower5G Bands insub6GHz:
The table-1 below lists countrywise 5G band allocations across the world. These are lower 5G frequency
bands used below 6 GHz.
Country 5G Bands
Europe 3400 - 3800 MHz ( for trial )
China 3300 - 3600 MHz , 4400 - 4500 MHz, 4800 - 4990 MHz
Japan 3600 - 4200 MHz , 4400 - 4900 MHz
Korea 3400 - 3700 MHz
USA 3100 - 3550 MHz, 3700 - 4200 MHz
INDIA 3300 MHz and 3400 MHz
Ireland 3.4 - 3.8 GHz

Defence
Spain 3.6 - 3.8 GHz
5G bands in India are auctioned by government for telecom carrier operators to acquire in order to provide
service.
Higher 5G Frequency Bands in mmwave
The table-2 below lists countrywise 5G frequency band allocations across the world. These are higher 5G
millimeter wave bands used above 6 GHz.
Country 5G Frequency Bands
USA 27.5 - 28.35 GHz , 37 - 40 GHz
Korea 26.5 - 29.5 GHz
Japan 27.5 - 28.28 GHz
China 24.25 - 27.5 GHz, 37 - 43.5 GHz
Sweden 26.5 - 27.5 GHz
EU 24.25 - 27.5 GHz
At the time (i.e. 25th April 2017) when this page has been written, trial and testing was in progress before
commercial roll out of the 5G wireless technology. In addition to the above 5G bands other frequencies in
which 5G services will be provided include 600MHz, 700MHz, 800MHz, 900MHz, 1.5GHz, 2.1GHz, 2.3GHz,
2.6GHz etc. These frequencies are used for various applications including home and industry automation, IoT
(Internet of Things) etc. Refer following tutorial links to understand 5G and 5G millimeter wave technologies.
5Gmillimeterwavetutorial|what is5Gmillimeter wave
5G millimeter wave technology, 5G mm wave advantages and disadvantages and 5G millimeter wave frame
structure. It mentions links to 5G mm wave frequency band and 5G channel sounding.
About 5G: To achieve higher data rate requirement in the order of 10 Gbps, 5G technology has been
developed. The specifications are published in the 3GPP Release 15 and beyond. 5G has different frequency
ranges sub 6 GHz (5G macro optimized), 3-30 GHz (5G E small cells) and 30-100 GHz (5G Ultra Dense).
About millimeter wave: The frequency bands which lies between 30 GHz to 300 GHz is known as millimeter
wave. This is due to the fact that wavelength of electro-magnetic wave will be in millimeter range at these
frequencies. There are many advantages and disadvantages of mm wave.
Due to growth of large number of mobile data subscribers, need for larger bandwidth arises. The fact is
bandwidth is limited in the available mobile frequency spectrum which is below the mm wave band. Due to this
millimeter wave band has been explored as mobile frequency spectrum by operators due to its support for
larger bandwidth. Though penetration loss is higher at these mm wave frequencies as these frequencies can
not penetrate walls and certain objects in the buildings. Moreover mm wave frequencies get attenuated due to

Defence
rain. After careful inclusion of all these factors in the RF link budget calculation, mm wave can be strong future
for the mobile data broadband market.
About 5G millimeter wave: The millimeter wave frequencies which are used for 5G mobile technology is known
as 5G millimeter wave.
5G millimeter wave technology features
Following table mentions features of 5G millimeter wave technology.
Features Description
Data rate 10 Gbps or higher
Frequency
Bands
The bands are split into <40 GHz and >40GHz upto 100 GHz frequency
Bandwidths
• 10 subcarriers of 100 MHz each can provide 1GHz BW due to carrier aggregation at <40
GHz • 500 MHz to 2 GHz BW can be achieved without carrier aggregation at >40GHz
Distance
coverage 2 meters (indoor) to 300 meters (outdoor)
Modulation
types
CP-OFDMA <40GHz
SC >40GHz
Frame topology TDD
latency About 1 ms
MIMO type
Massive MIMO is supported. Antennas are physically small and hence there will be approx. 16
antenna array available in 1 square inch. Hence 5G mm wave compliant eNBs support 128 to
1000 antenna arrays. These are used to increase the capacity and coverage both.

Defence
For frequencies above 40 GHz, Single carrier modulation is used to permit higher PA efficiency and efficient
beamforming. It minimizes switching overhead too. In Null CP SC type, regular CPs are replaced with null CPs.
This provides constant envelope in the modulated waveform.
5G millimeter wave frame structure | 5G mm wave frame
The figure-1 depicts proposed 5G mm wave frame structure. As shown DL refers to downlink transmission
from eNB to UEs and UL refers to uplink transmission from UEs to eNB. As shown control and data planes are
separate, which helps in achieving lesser latency requirements. This is due to the fact that processing of
control and data parts can run in parallel.
SymbolTableornumerologyusedin5G
Following table mentions probable numerology for two FFT points used in 5G millimeter wave technology viz.
1024, 2048 and 4096.
FFT Size 1024 FFT Point (70 GHz) 2048 FFT Point (3 to 40GHz) 4096 FFT Point
Carrier Bandwidth 2000 MHz 200 MHz 200 MHz
Subcarrier spacing 1.5 MHz 120 KHz 60 KHz
Symbol Length 666.7 ns 8.335 µs 16.67 µs
Number of syms/frame 14 14 14
CP (Cyclic Prefix) duration 10.4 ns 0.6 µs 1 µs

Defence
Advantagesof5Gmillimeterwave
Following are the advantages/merits of the 5G millimeter wave. These benefits make 5G in millimeter wave as
one of the strong contender for the future of mobile wireless communication domain.
• Provides larger bandwidth and hence more number of subscribers can be accommodated.
• Due to less bandwidth in millimeter range, it is more favourable for smaller cell deployment.
• Coverage is not limited to line of sight as first order scatter paths are viable.
• channel sounding feature is employed to take care of different types of losses at mm wave frequencies so
that 5G network works satisfactorily. Channel sounding refers to measurement or estimation of channel
characteristics which helps in successful design, development and deployment of 5G network with necessary
quality requirements.
• Antenna size is physically small and hence large number of antennas are packed in small size. This leads to
use of massive MIMO in eNB/AP to enhance the capacity.
• Dynamic beamforming is employed and hence it mitigates higher path loss at mm wave frequencies.
• 5G millimeter wave networks support multi-gigabit backhaul upto 400 meters and cellular access upto 200-
300 meters.
Due to these benefits, 5G mm wave is suitable for mobile communication over sub-6GHz wireless
technologies.
Disadvantages of 5G mm wave
Following are the disadvantages/demerits of the 5G millimeter wave.
• Millimeter wave goes through different losses such as penetration, rain attenuation etc. This limits distance
coverage requirement of mm wave in 5G based cellular mobile deployment. Moreover path loss at mm is
proportional to square of the frequency. It supports 2 meters in indoors and about 200-300 meters in outdoors
based on channel conditions and AP/eNB height above the ground.
• Supports only LOS (Line of Sight) propagation. Hence coverage is limited to LOS.
• Foliage loss is significant at such mm wave frequencies.
• Power consumption is higher at millimeter wave due to more number of RF modules due to more number of
antennas. To avoid this drawback, hybrid architecture which has fewer RF chains than number of antennas
need to be used at the receiver. Moreover low power analog processing circuits are designed in mm wave
hardware.
These disadvantages need to be considered during 5G millimeter wave link budget calculation. This is very
much essential for successful 5G millimeter wave deployment.
This page covers 5G millimeter wave frequency bands. It mentions 5G bands and 5G mm wave bands. It
mentions all the millimeter wave frequency bands also.

Defence
MillimeterwaveFrequencyBands:
Above table mentions millimeter wave frequency bands.
5G Millimeter wave Frequency Bands
• As mentioned in the table millimeter wave uses frequencies from 30 GHz to 300 GHz in EM spectrum.
• 5G uses upto 100 GHz i.e. 5G millimeter wave frequency bands lies from 30 GHz to 100 GHz.
• The three popular bands with bandwidths are listed below.
5G millimeter wave frequency bands Bandwidth
28 GHz 500 MHz
38 GHz 1 GHz
72 GHz 2 GHz
• Upto 40 GHz, carriers are aggregated to achieve higher bandwidth of 1GHz.
• Above 40GHz, bandwidths from 500MHz to 2 GHz can be achieved without any carrier aggregation method.
Differencebetween4Gand5G|compare4gvs5gdifference
This page on the difference between 4G and 5G compare 4g and 5g technologies in order to derive 4g 5g
difference. The page also mentions 4g vs. 5g comparison table and difference between 4g and 5g network
architectures.
Introduction:
The telecommunication industry is seeing rapid growth in the last few decades. The wireless mobile
communication standards are the major contributors. This growth has seen many generations from 1G, 2G,
3G, 4G and 5G. Each of these generations have various wireless technologies, data rates, modulation
techniques, capacities and features compare to the other.
1G-FirstGenerationMobileCommunicationSystem
Data capacity: 2Kbps
Technology: Analog Wireless
Standard: AMPS

Defence
Multiplexing: FDMA
Switching type: Circuit
Service: Voice only
Main Network: PSTN
Handoff supported: Horizontal
Frequency: 800 to 900MHz
2G-SecondGenerationMobileCommunicationSystem
Technology: Digital Wireless
Standard: CDMA, TDMA, GSM
Multiplexing: TDMA, CDMA
Switching type: Circuit
Service: Voice and data
Main Network: PSTN
Handoff supported: Horizontal
Frequency: 850MHz to 1900MHz(GSM) and 825MHz to 849MHz (CDMA)
Following sections mention difference between 2.5G and 2.75G.
2.5G
Technology: GPRS
Standard: Supported TDMA/GSM
Switching type: Packet Switch
Service: MMS internet
Main Network: GSM TDMA
Frequency: 850MHz to 1900MHz
2.75G
Technology:EDGE
Standard: GSM,CDMA
Main Network: WCDMA
Frequency: 850MHz to 1900MHz
3G-ThirdGenerationMobileCommunicationSystem
Technology:Broadband/IP technology, FDD and TDD
Standard: CDMA,WCDMA,UMTS,CDMA2000
Multiplexing: CDMA
Switching type: Packet and Circuit Switch
Service:High speed voice, data and video Main Network: Packet Network
Handoff: Horizontal
Frequency: 1.6 to 2.5 GHz
Refer 2G vs 3G for difference between 2G and 3G.
3.5G
Data capacity: 2Mbps
Technology:GSM/3GPP
Standard: HSDPA/HSUPA

Defence
Multiplexing: CDMA
Service Type: High Speed Voice/Data/Video Main Network: GSM, TDMA
Handoff: Horizontal
3.75G
Data capacity: 30 Mbps
Standard:1XEVDO
Multiplexing: CDMA
Service: High speed internet/ Multi-media
Handoff type: Horizontal
4G|FourthGenerationMobileCommunicationSystem
This generation of systems are totally IP based technology with capacity of 100Mbps to 1Gbps. It is used for
both indoor and outdoor applications. The main function of 4G technology is to deliver high quality, high speed,
high capacity, low cost services. It is mainly used for voice, multimedia and internet over IP based traffic. The
technologies driving 4G growth are LTE and WiMAX. Refer difference between 3G and 4G wireless
technologies.
Following are the features of 4G Mobile WiMAX system.
• Standard: IEEE 802.16e
• Bandwidth: 5, 7, 8.75, 10 MHz
• FFT Size: 128, 512, 1024, 2048
• Subcarrier spacing: 90KHz for OFDM and 11.16KHz for OFDMA
• Data rate: About 60-70 Mbps as per mobile wimax 802.16e, 100 Mbps(Mobile subscribers) and 1GBPS
(Fixed subscribers) as per WiMAX Advanced(16m).
• DL/UL multiple Access: OFDMA
• Duplexing : FDD/TDD
• Subcarrier Mapping: PUSC, FUSC, AMC
• Modulation: BPSK, QPSK, 16QAM, 64QAM
• Channel Coding: CC, CTC
• DL MIMO 2-antenna, matrix A, 2-antenna, matrix B vertical encoding
• UL MIMO Collaborative SM for two MS with single transmit antenna
• HARQ with chase combining
Following are the features of 4G LTE system.
• Standard: 3GPP Release 9
• Bandwidth: supports 1.4MHz, 3.0MHz, 5MHz, 10MHz, 15MHz, 20MHz
• Data rate: 300 Mbps Downlink(DL) 4x4MIMO and 20MHz, 75 Mbps Uplink(UL)
• Theoretical Throughput: About 100Mbps for single chain(20MHz,100RB,64QAM), 400Mbps for 4x4 MIMO.
25% os this is used for control/signaling(OVERHEAD)
• Maximum No. of Layers: 2(category-3) and 4(category-4,5) in the downlink, 1 in the uplink
• Maximum No. of codewords: 2 in the downlink, 1 in the uplink
• Spectral Efficiency(peak,b/s/Hz): 16.3 for 4x4 MIMO in the downlink, 4.32 for 64QAM SISO case in the Uplink
• PUSCH and PUCCH transmission: Simultaneously not allowed
• Modulation schemes supported: QPSK, 16QAM, 64QAM
• Access technique: OFDMA (DL),DFTS-OFDM (UL)
• carrier aggregation: Not supported
• Applications: Mobile broadband and VOIP

Defence
5G|FifthGenerationMobileCommunicationSystem
There are different phases under which 5G NR (New Radio) will be deployed as per 3GPP specifications
published in the december 2017. There are two main modes viz. Non-Standalone (NSA) and Standalone (SA)
based on individual or combined RAT operation in coordination with LTE. In standalone mode, UE works by
5G RAT alone and LTE RAT is not needed. In non-standalone mode, LTE is used for control (C-Plane)
functions e.g. call origination, call termination, location registration etc. where as 5G NR will focuse on U-Plane
alone. The figure-1 depicts 5G NR architecture.
Following are the features of 5G wireless technology.
• Bandwidth: Supports 1Gbps or higher
• Frequency bands: Sub-1 GHz, 1 to 6 GHz, > 6 GHz in mm bands (28 GHz, 40 GHz), Refer 5G bands>>.
• Peak data rate: Approx. 1 to 10 Gbps
• Cell Edge Data rate: 100 Mbps
• End to End delay : 1 to 5 ms
• Refer 5G basic tutorial for more information on 5G wireless technology and its network architecture.
Differencebetween4gand5gnetworkarchitecture
As shown in the figure LTE SAE(System Architecture Evolution) consists UE, eNodeB and EPC(evolved
packet core). Various interfaces are designed between these entities which include Uu between UE and
eNodeB, X2 between two eNodeB, S1 between EPC and eNodeB. eNodeB has functionalities of both RNC
and NodeB as per previous UMTS architecture. The 4g network architecture contains the following network
elements.
• LTE EUTRAN (Evolved Universal Terrestrial Radio)
• LTE Evolved Packet Core.

Defence
EUTRAN (Evolved Universal Terrestrial Radio) consists of eNB (Base station). The LTE EPC architecture
consists of MME, SGW, PGW, HSS and PCRF.
LTE Advanced architecture for E-UTRAN consists of P-GW, S-GW, MME, S1-MME, eNB, HeNB, HeNB-GW,
Relay Node etc. LTE Advanced protocol stack consists of user plane and control plane for AS and NAS.
Refer LTE Advanced Architecture and Stack➤.

Defence
The figure depicts 5g network architecture. As shown in the figure, gNB node provides NR user plane and
control plane protocol terminations towards the UE (i.e. 5G terminal device such as smartphone, tablet, laptop
etc.) and it is connected via the NG interface to the 5GC. The ng-eNB node providing E-UTRA (i.e. LTE) user
plane and control plane protocol terminations towards the UE, and connected via the NG interface to the 5GC.
Here AMF stands for Access and Mobility Management Function and UPF stands for User Plane Function. The
figure depicts 5G network architecture as defined in the 3GPP TS 38.300 specification.
Let us compare 4G and 5G technologies with respect to various parameters in order to form 4g vs. 5g
comparison table as mentioned below.
Specifications 4G 5G
Full form Fourth Generation Fifth Generation
Peak Data Rate 1 Gbps 10 Gbps
Data Bandwidth 2Mbps to 1Gbps 1Gbps and higher as per need
Spectral Efficiency 30 b/s/Hz 120 b/s/Hz
TTI (Transmission
Time Interval) 1 ms Varying (100 µs (min.) to 4ms (max.) )
Latency 10 ms (radio) <1 ms (radio)
Mobility 350 Kmph 500 Kmph
Connection
Density 1000/Km2 1000000/Km2

Defence
Frequency Band 2 to 8 GHz 3 to 300 GHz
standards
Al access convergence including
OFDMA,MC-CDMA,network-
LMPS CDMA and BDMA
technologies
unified IP, seamless integration
of broadband LAN/WAN/PAN
and WLAN
Unified IP, seamless integration of broadband
LAN/WAN/PAN/WLAN and advanced technologies
based on OFDM modulation used in 5G
service
Dynamic information access,
wearable devices, HD streaming,
global roaming
Dynamic information access, werable devices, HD
streaming, any demand of users
Multiple Access CDMA CDMA,BDMA
Core network All IP network Flatter IP network, 5G network interfacing(5G-NI)
Handoff Horizontal and vertical Horizontal and vertical
Initiation from year-2010 year-2015
In order to understand difference between 4g and 5g technologies,
6GMobileCommunicationSystem
6G systems will have integration of 5G along with satellite network. Following are the satellite systems
developed in different countries:
• GPS (by USA)
• COMPASS (by China)
• Galileo (by EU)
• GLONASS (by Russia)
It supports local vocie coverage and other features.
7GMobileCommunicationSystem
The 7G network will be same as 6G. In addition 7G defines satellite functionalities in wireless mobile
communication. This will provide many features and take care of all the drawbacks of previous generation of
mobile wireless communication systems. The major factor here will be cost of phone call and other services. It
provides seamless movement of mobile phone from one country to the other. This will be major benefits for
frequent international travelers.
It also mentions 5G test equipments from Keysight technologies.
The 5G device development requires testing at various stages starting from design phase till the final
deployment phase. It involves tests at various protocol stack level of the 5G device. Following table lists out
main test cases required to be done at various phases of 5G product life cycle.
5G testing test cases

Defence
Transmitter
Conformance testing Power spectrum mask, transmit power vs time, CCDF, I/Q vs time
Receiver
Conformance testing EVM, channel response, spectral flatness
Interoperability
testing
This tests ensures that 5G devices from one vendor will work with 5G devices from the
other vendors in the network without any issues.
Network stability tests 5G system works without having any issues at long run during handover and other tests.
Inter-RAT tests
This test ensures 5G device works well across all the RATs (Radio Access Technologies)
for which it has been desiged for.
RF Related tests
Other than the above, RF tests for 5G device such as phase noise, 1dB compression, third
order intercept points, harmonics, spurious, noise figure, image rejection are only equally
important to be performed.
One can refer conformance documents and other test case documents published by respective 5G standard
bodies for more details.
Keysight 5G test equipments

Defence
The figure-1 depicts 5G test bed using Keysight equipments. Following table lists out all the 5G test
equipments.
Keysight 5G test equipment Description
M8190A Arbitrary Waveform Generator which generates baseband IQ data
E8267D
PSG signal generator, which takes IQ data as input and generates modulated
IF output.
N5183 MXG
Used to generate RF signal used as LO (Local Oscillator) input for both up
converter and Down converter
DSO-Z634A (63 GHz
Oscilloscope) Used as Oscilloscope, it analyzes the 5G signal in time domain
N9030A , N9040B Used as Signal Analyzer, used to analyze 5G signal in frequency domain

Defence
In addition to the above tools, 5G test bed requires, Waveform Creation Application Software and VSA
application. Waveform Creation allows user to configure 5G baseband parameters (i.e. PHY and MAC frame
related). VSA application allows user to analyze various baseband related parameters such as EVM, channel
response, IQ impairments, power spectrum, CCDF etc.
5GNRPhysicallayer|Physicallayerasper5GNRNewRadio
he processing of PDSCH channel through 5G NR physical layer and PUSCH channel through 5G NR physical
layer have been covered stepwise. This 5G physical layer description is as per 3GPP physical layer
specifications mentioned in TS 38.200 series of documents.
Introduction:
The 5th generation wireless access tachnology is known as NR (New Radio). It follows 3GPP series of
standards similar to GSM, CDMA and LTE. 3GPP organization has been developing specifications for 5G NR
since few years. First specifications have been published in Dec. 2017 which suppors NSA (Non Standalone)
where in 5G compliant UE relies on existing LTE for initial access and mobility. In June 2018, SA versions of
5G NR spefications have been finalized which works independent of LTE. There are three different use cases
of 5G NR technology viz. eMBB (Enhanced Mobile Broadband), mMTC (Massive machine type
communications) and URLLC (Ultra Reliable Low Latency Communication).
here are two main components in 5G NR network viz. UE (i.e. mobile subscriber) and gNB (i.e. base station).
gNBs are connected with 5G Core in the backend. The connection from gNB to UE is known as downlink
which uses PBCH, PDSCH and PDCCH channels for carrying different data/control informations. The
connection from UE to gNB is known as uplink which uses PRACH, PUSCH and PUCCH channels.
5GNRNumerology
5G NR Supports two frequency ranges FR1 (Sub 6GHz) and FR2 (millimeter wave range, 24.25 to 52.6 GHz).
NR uses flexible subcarrier spacing derived from basic 15 KHz subcarrier spacing used in LTE. Accordingly
CP length is choosen. This is shown in the table-1
μ Δf = 2μ.15 Cyclic Prefix
0 15 KHz Normal
1 30 KHz Normal
2 60 KHz Normal, Extended
3 120 KHz Normal
4 240 KHz Normal
5 480 KHz Normal
Table-1: μ, Subcarrier spacing, CP, PRBs
Both frequency ranges FR1 and FR2 use different 5G numerology as mentioned in the table-2. Subcarrier
Spacing of 15/30 KHz is supported for below 6 GHz 5G NR where as 60/120/240 KHz is supported for
mmwave bands. Maximum bandwidth of 100 MHz is supported in sub-6 GHz where as 400 MHz is supported
in mmwave frequency ranges. In LTE, maximum BW of 20 MHz was used.

Defence
Parameters Sub-6 GHz range mmWave range
Carrier aggregation upto 16 carriers
BW per carrier 5/10/15/20/25/40/50/60/80/100 MHz 50/100/200/400 MHz
Subcarrier spacing 15/30/60 KHz 60/120/240 KHz
Modulation Scheme DL/UL: 256 QAM
MIMO
DL: upto 8 layers,
UL: upto 4 layers
DL: upto 2 layers,
UL: upto 2 layers
Duplex mode TDD (focus), FDD TDD
Access scheme DL: CP-OFDM, UL:CP-OFDM, DFT spread OFDM
Table-2: 5G NR Sub-6 GHz and mmwave parameters as per 3GPP Rel.15
Subcarrier spacing (KHz) 15 30 60 120 240
Symbol duration (µs) 66.7 33.3 16.7 8.33 4.17
CP duration (µS) 4.7 2.3 1.2 (Normal CP), 4.13 (Extended CP) 0.59 0.29
Max. nominal system BW (MHz) 50 100 100 (sub-6 GHz), 200 (mmwave) 400 400
FFT size (max.) 4096 4096 4096 4096 4096
Symbols per slot 14 14 14 (normal CP), 12 (extended CP) 14 14
Slots per subframe 1 2 4 8 16
Slots per frame 10 20 40 80 160
Table-3: Subcarrier spacing, Number of OFDM symbols and slots

Defence
5GNRFrameStructure
A frame has duration of 10 ms which consists of 10 subframes having 1ms duration each similar to LTE
technology. Each subfame can have 2μ slots. Each slot typically consists of 14 OFDM symbols. The radio
frame of 10 ms are transmitted continuously as per TDD topology one after the other. Subframe is of fixed
duration (i.e. 1ms) where as slot length varies based on subcarrier spacing and number of slots per subframe.
As shown below, it is 1 ms for 15 KHz, 500 µs for 30 KHz and so on. Each slot occupies either 14 OFDM
symbols or 12 OFDM symbols based on normal CP and extended CP respectively.
5G NR supports Mini Slot concept which helps in achieving very low latency in data transmission. It supports 2,
4 or 7 OFDM symbols.

Defence
The figure depicts resource grid of 5G NR with symbols in time axis and subcarriers in frequency axis. 12
subcarriers form one PRB (Physical Resource Block). 5G NR supports 24 to 275 PRBs in a single slot.
Occupied BW of 34.56 MHz (minimum) and 396 MHz (maximum) can be achieved for 120 KHz subcarrier
spacing. One SS/PBCH Block occupies 4 OFDM Symbols in time domain and 24 PRBs in frequency domain.
5G NR SS consists of PSS and SSS as specified for LTE.
5GNRPhysicallayer
In 5G NR there are various physical channels in the downlink (from gNB to UE) and uplink (from UE to gNB).
Downlink channels: PDSCH, PDCCH, PBCH
Uplink channels: PRACH, PUSCH, PUCCH
There are specific physical signals present in both downlink and uplink for various purposes. Front loaded
DMRS (Demodulation Reference signal) is used for both PDSCH and PUSCH channels. We will consider
OFDM with CP for both downlink and uplink chain. Uplink also uses DFT Spread OFDM with CP for improved
coverage.

Defence
5GNRPhysicallayerprocessingofPDSCHchannel
The PDSCH channel is used to carry DL user data, UE specific upper layer informations (layer-2 and above),
system informations and paging. Let us understand PDSCH channel data (i.e. transport block) processing
through 5G NR physical layer modules or blocks. Transport block size calculation is mentioned in 3GPP TS
38.214(section 5.1.3.2). One can also refer transport block size calculation at TBS calculation page >>
➤As shown in the figure, CRC is added to each of the transport blocks to provide error detection.
➤This is following by LDPC base graph as per transport block size (small or large).
➤Now transport block is segmented into code blocks. CRC is appended to each of these code blocks.
➤Each of the code blocks are individually encoded using LDPC encoder, which are rate matched after
encoding process.
➤Code block concatenation is performed to form codewords for transmission over PDSCH channel. About 2
codewords are transmitted simultaneously on single PDSCH channel. Single codeword is used for 1 to 4 layers
where as 2 codewords are used for 5 to 8 number of layers.
➤All the codewords are scrambled and modulated to generate complex data symbols before layer mapping. It
uses QPSK, 16QAM, 64QAM and 256QAM modulation schemes.
➤The modulated data symbols are mapped to either 4 or 8 layers.
➤The layers are mapped with number of antenna ports reserved for PDSCH use and complex modulated data
symbols are mapped to RBs (Resource Blocks) in the resource grid as per subcarrier spacing. Antenna ports

Defence
range is {1000,...,1011}. DMRS values are inserted during resource element mapping used for channel
estimation and equalization at the UE receiver. OFDM signal is generated after RE (Resource Element)
mapping.
➤The downlink PDSCH is received by UE which consists of reverse modules of 5G NR physical layer in order
to decode the transport block back before passing the information to upper layers.
5GNRPhysicallayerprocessingofPUSCHchannel
PUSCH channel is used for transmission of UL SCH and layer-1 and layer-2 control information. Let us
understand PUSCH channel data (i.e. transport block) processing through 5G NR physical layer modules or
blocks. The procedure for UL transport block in PUSCH processing is same as described above. It uses
additional π/2-BPSK modulation scheme in addition to the one listed above in PDSCH processsing. It also
uses DMRS signals for channel estimation and equalization process to help in decoding process.
➤In addition to above blocks, the PUSCH processing uses transform precoding after layer mapping operation.
This is optional and UE implementation specific. DFT transform precoding is used for single layer
transmissions. PUSCH supports single codeword which can be mapped maximum upto 4 layers.
➤5G NR UE uses codebook based transmission and non codebook based transmissions.
➤In 5G NR mapping to resource grid is done frequency wise first before time in order to have easier decoding
proceess at the gNB receiver.
REFERENCES

Defence
5G NR physical layer (L1) specifications are defined in following 3GPP documents.
38.201 : General description
38.202 : Services provided by physical layer
38.211 : Physical channels and modulation
38.212 : Multiplexing and channel coding
38.213 : Physical layer procedures for control
38.214 : Physical layer procedures for data
38.215 : Physical layer measurements
5G NR Mini-slot basics including function of Mini-slot. The difference between slot and mini-slot in 5G NR is
also mentioned.
Introduction:
As shown in the figure-1, a frame in 5G NR consists of 10 ms duration. A frame consists of 10 subframes with
each having 1ms duration similar to LTE. Each subframe consists of 2μ
slots. Each slot can have either 14
(normal CP) or 12 (extended CP) OFDM symbols.
Slot is typical unit for transmission used by scheduling mechanism. NR allows transmission to start at any
OFDM symbol and to last only as many symbols as required for communication. This is known as "mini-slot"
transmission. This facilitates very low latency for critical data communication as well as minimizes interference
to other RF links. Mini-slot helps to achieve lower latency in 5G NR architecture. Table below mentions typical
fixed slots used in a 5G NR frame structure.
μ, (subcarrier spacing) Slots/slot Slots/subframe Slots/frame Slot duration
0 (15 KHz) 14 1 10 1 ms
1 (30 KHz) 14 2 20 500 µs
2 (60 KHz), normal CP 14 4 40 250 µs
2 (60 KHz), Extended CP 12 4 40 250 µs
3 (120 KHz) 14 8 80 125 µs

Defence
4 (240 KHz) 14 16 160 62.5 µs
Unlike slot, mini-slots are not tied to the frame structure. It helps in puncturing the exising frame without waiting
to be scheduled.
Differencebetweenslotandmini-slotin5GNR
➤As mentioned normal slot occupies either 14 (normal CP) or 12 (Extended CP) OFDM symbols. It enables
slot based scheduling. One slot is the possible scheduling unit and slot aggregation is also allowed. Slot length
scales with subcarrier spacing.
• Slot length = 1 ms/2μ,
➤Mini-slot occupies 2, 4 or 7 OFDM symbols. It enables non-slot based scheduling. It is minimum scheduling
unit used in 5G NR. As mentioned mini-slots can occupy as little as 2 OFDM symbols and are variable in
length. They can be positioned asynchronously with respect to the beginning of a standard slot.
5GNRMAClayer-architecture,channelmapping,procedures,header,subheaders
This page describes overview of 5G NR MAC layer. It covers 5G NR MAC functions, 5G NR MAC architecture,
5G NR MAC channel mapping, 5G NR MAC procedures and format of 5G NR MAC header and subheaders.
Introduction:
5G NR (New Radio) is the latest cellular wireless technology developed to deliver ten times faster data rate
compare to its previous LTE technology. It follows 3GPP specifications release 15 and above.
Following are the features of 5G NR technology.
• It works on two frequency bands viz. sub-6 GHz and millimeter wave (above 20 GHz).
• It supports massive MIMO with 64 to 256 antennas.
It offers 10 Gbps within 100 meters using 100MHz bandwith.

Defence
The figure-1 depicts 5G NR protocol stack showing position of MAC layer. As shown MAC layer provide
services to the upper layers and it expects some services from the physical layer>>. Physical layer offers
transport channels to MAC layer to support transport services for data transfer over radio interface. MAC layer
offers logical channels to RLC sublayer. The logical channels exist between MAC and PHY where as transport
channels exist between PHY and radio layer. Hence MAC is the interface between logical channels and PHY
transport channels.
The figure depicts data flow through various protocol layers of 5G NR stack.
5G NR MAC layer Architecture | 5G NR MAC layer functions
Following figure-2(a) and (b) depicts 5G NR MAC layer architecture for MCG (Master Cell Group) and SCG
(Secondary Cell Group).

Defence
Physical layer provides following services to the MAC sublayer.
• Data Transfer
• HARQ feedback signaling
• Scheduling Request signaling
• CQI (Channel Quality Indication) measurements
The MAC sublayer provides two main services to upper layers viz. data transfer and radio resource allocation.
The other functions of 5G NR MAC are as follows.
• Mapping between logical and transport channels (Both Downlink and Uplink).
• Multiplexing of MAC SDUs onto TBs (Transport Blocks) (In Uplink), SDUs belong to logical channels and
transport blocks belong to transport channels.
• Demultiplexing of MAC SDUs from TBs (In Downlink)
• Scheduling information reporting (In Uplink)
• Error correction through HARQ (In Downlink and Uplink)
• Logical Channel Prioritisation (In Uplink)
5G NR MAC channel mapping

Defence
The figure-3 depicts MAC logical channels and PHY layer transport channels used in 5G NR technology. They
have specific functions in the downlink or uplink. PDSCH, PBCH and PDCCH are used in the downlink where
as PUSCH, PUCCH and RACH are used in the uplink. The reference signals in the downlink are DMRS, PT-
RS, CSI-RS, PSS and SSS. The reference signals in the uplink are DMRS, PTRS and SRS.
The figure-4 depicts 5G NR channel mapping. It does mapping of logical channels to transport channels and
vice versa.
5GNRMACprocedures
Following table mentions different 5G NR MAC procedures. These procedures have their respective
functionality in the 5G NR MAC layer.
5G NR MAC
Procedures Description
Random Access
Procedure
Get the initial uplink grant for UE and helps in performing synchronization with the gNB (i.e.
network). It covers Random Access procedure initialization, Random Access Resource

Defence
selection, Random Access Preamble transmission, Random Access Response reception,
Contention Resolution and Completion of the Random Access procedure.
DL-SCH data
transfer It does everything needed to perform downlink data transfer.
UL-SCH data
transfer It does everything needed to perform uplink data transfer.
Scheduling
request (SR) It is used by UE to transmit request to gNB (i.e. network) to obtain UL grant.
PCH reception It helps in monitoring paging message in special time period.
BCH reception It carry basic informations regarding the 5G NR cell (e.g. MIB, SFN etc.).
DRX
(Discontinuous
Reception)
It helps in monitoring PDCCH as per special pattern in discontinuous manner. Due to this
discontinuous monitoring, energy consumption can be achieved.
Other procedures
The other 5G NR MAC procedures include transmission and reception without dynamic
scheduling, activation/deactivation of SCells, activation/deactivation of PDCP duplication,
BWP (Bandwidth Part) operation, handling of measurement gaps, handling of MAC CEs,
beam failure detection and recovery operation etc.
5GNRMACHeaderandsubheaders
A MAC PDU consists of one or more MAC sub-PDUs. Each MAC sub-PDU consists of one of the following
fields:
• A MAC subheader only (including padding)
• A MAC subheader and a MAC SDU
• A MAC subheader and a MAC CE (Control Element)
• A MAC subheader and padding
The MAC SDUs are of variable sizes. Each MAC subheader corresponds to either a MAC SDU, a MAC CE, or
padding

Defence
The figure-5 depicts 5G NR MAC PDU examples for downlink (DL) and uplink (UL). Following figure-6 depicts
MAC subheader types. Let us understand header and subheader fields and their respective meanings in the
5G system.

Defence
The MAC subheader consists of fields such as LCID, "L", "F" and "R".
• LCID field: LCID stands for Logical Channel ID. It identifies logical channel instance of corresponding MAC
SDU or type of corresponding MAC CE or padding. The values of LCID for DL-SCH and UL-SCH are
mentioned in the tables below. There is only one LCID field exists for one MAC subheader. LCID field has 6
bits in size.
• L-Field: "L" indicates length field of corresponding MAC SDU or variable sized MAC CE in units of bytes.
One "L-field" exists for one MAC subheader. More number of "L-fields" exist for subheaders corresponding to
fixed-sized MAC CEs and padding. The "L-field" size is indicated by F-field;
• F-field: It refers to length field size. It is one bit in size. There is one F field per MAC subheader except for
subheaders corresponding to fixed-sized MAC CEs and padding. The value 0 in F-field refers to 8 bits of
Length field. The value 1 in F-field refers to 16 bits of Length field.
• R: Reserved bit, set to zero.

Defence
LCID VALUES FOR DL-SCH AND UL-SCH
Table above mentions LCID values for DL-SCH channel where as table below mentions LCID values for UL-
SCH channel.

Defence
REFERENCES
• 3GPP TS 38.321 V15.2.0 (2018-06), Medium Access Control (MAC) protocol specification (Release 15)
• 3GPP TS 38.300 V15.2.0 (2018-06), NR; NR and NG-RAN Overall Description; Stage 2 (Release 15)
5GNRRLClayer|functions,modes,datastructure,RRCparameters
5G NR RLC layer including functions. It covers 5G NR RLC modes (TM mode, UM mode, AM mode), data
structures (TMD, UMD, AMD), RLC PDUs (TMD PDU, UMD PDU, AMD PDU), data transfers (TM, UM and
AM) and RRC parameters which defines RLC layer.
Introduction:
• RLC stands for Radio Link Control. 3GPP specifications TS 38.322 defines RLC protocol for UE and NR
radio interface.
• As shown it lies between MAC on lower side and PDCP on higher side of the stack.
• Like previous cellular standards such as WCDMA and LTE, this standard (5G NR) also supports RLC modes
viz. Transparent mode (TM mode), Unacknowledge Mode (UM mode) and Acknowledge mode (AM mode).
The figure-1 depicts 5G NR protocol stack showing position of RLC layer. As shown RLC layer provide
services to the upper layers and it expects some services from the MAC layer>> and PHY layer>>.

Defence
The figure depicts data flow through various protocol layers of 5G NR stack.
RLCModes|TMmode, UMmode,AMmode
RLC configuration does not depend on 5G NR numerologies and it is associated with logical channels. TM
mode is used for SRB0, paging and broadcast of system information. AM mode is used for SRBs. Either UM or
AM mode is used for DRBs. ARQ procedure is supported within RLC sublayer.
Functions of RLC sublayer are as follows.
• Transfer of upper layer PDUs
• Sequence numbering independent of the one in PDCP (UM and AM)
• Error Correction through ARQ (AM only)
• Segmentation (AM and UM) and re-segmentation (AM only) of RLC SDUs
• Reassembly of SDU (AM and UM)
• Duplicate Detection (AM only)
• RLC SDU discard (AM and UM)
• RLC re-establishment
• Protocol error detection (AM only)
RLC layer expects following services from lower layer (i.e. MAC layer).
• Data transfer
• Notification of transmission opportunity.

Defence
TM MODE AND TM DATA TRANSFER PROCEDURE
• A TM RLC entity uses logical channels viz. BCCH, DL CCCH, UL CCCH and PCCH to transmit or receive
RLC PDUs.
• A TM RLC entity uses TMD PDU to transmit/receice data PDUs.
• During transmission, TMD PDUs are formed from RLC SDUs. It does not segment RLC SDUs and does not
include any RLC headers in the TMD PDUs. During reception, TM RLC entity receives TMD PDUs and pass it
to upper layers.
UM MODE AND UM DATA TRANSFER PROCEDURE

Defence
It uses logical channels viz. DL DTCH or UL DTCH. It uses UMD PDU which can carry one complete RLC
SDU or one RLC SDU segment. Complete transmission and reception process is defined in 3GPP TS 38.322
document which is shown in the figure.
AM MODE AND AM DATA TRANSFER PROCEDURE
AM RLC entity uses DL/UL DCCH or DL/UL DTCH logical channels. It transmits and receiver AMD PDUs
which can carry either one complete RLC SDU or one RLC SDU segment. AM RLC entity transmits and
receives STATUS PDU as control PDU which is mentioned below. Complete transmitting side and receiving
side procedure is shown in the figure. The same has been described in detail in 38.322 document.
datastructures|TMD,UMD,AMD
RLC PDU is a bit string. RLC SDUs are bit strings which are byte aligned in length. Following are structures of
TMD, UMD and AMD.
TMD STRUCTURE

Defence
UMD STRUCTURE

Defence
AMD STRUCTURE
Here SI (Segmentation Info) field is of 2 bits in length. It can be interpreted as follows.
00 : Data field contains all bytes of an RLC SDU
01 : Data field contains the first segment of an RLC SDU.
10 : Data field contains the last segment of an RLC SDU.
11 : Data field contains neither the first nor last segment of an RLC SDU.
➤SN refers to Sequence number field. It can be 12 bits or 18 bits for AMD PDU. It can be 6 bits or 12 bits for
UMD PDU.
➤SO refers to Segment Offset which is about 16 bits in length.
➤D/C field indicates Data/Control Field. Value of "0" indicates it is control PDU where as value of "1" indicates
it is data PDU.
➤P field indicates polling bit of length equals 1 bit. Value of "0" indicates "status report not requested" where
as value of "1" indicates "status report is requested".
➤CPT field is 3 bits in size. value of "000" indicates it is "STATUS PDU" and value of "001" is reserved.
RRCparametersforRLC
Following RRC parameters are used to define RLC layer. The IE (Information Elements) are RLC-Bearerconfig
IE and RLC config IE.

Defence
REFERENCES
• 3GPP TS 38.322, V15.2.0 (2018-06), Radio Link Control (RLC) protocol specification (Release 15)
• 3GPP TS 38.331, V15.2.0 (2018-06), Radio Resource Control (RRC) protocol specification (Release 15)

Defence
5GNRPDCPlayer|functions,architecture,procedures,PDUformats
This page describes overview of 5G NR PDCP layer including functions. It covers PDCP architecture
(structure, entities), PDCP procedures for data transfer during transmit/receive operation, Data PDU and
Control PDU formats of PDCP layer etc.
Introduction:
• PDCP stands for Packet Data Convergence Protocol. 3GPP specifications TS 38.323 defines PDCP protocol.
• As shown it lies between RLC on lower side and RRC on higher side of the control protocol stack.
• In the data user plane it lies on the top as shown.
The figure-1 depicts 5G NR protocol stack showing position of PDCP layer. As shown PDCP layer provide
services to the upper layers (RRC or SDAP) and it expects some services from the RLC layer>>, MAC layer>>
and PHY layer>>.

Defence
The figure depicts data flow through various protocol layers of 5G NR stack. PDCP provides following services
to the upper layers.
• Transfer of user plane data and control plane data
• Header compression/decompression using ROHC
• Ciphering/Deciphering
• Integrity protection
PDCP expects following services supported from lower layers.
• Acknowledged data transfer service
• Unacknowledges data transfer service
5GNRPDCPlayerfunctions
Functions of PDCP layer are as follows.
• transfer of data (user plane or control plane)
• maintenance of PDCP SNs
• header compression and decompression using ROHC protocol
• ciphering and deciphering
• integrity protection and integrity verification
• timer based SDU discard
• for split bearers, routing is performed
• Activation/Deactivation of PDCP duplication
• reordering and in-order delivery
• out-of-order delivery
• duplicate discarding

Defence
PDCParchitecture(structure,entities)
• The architecture is based on radio interface protocol.
• PDCP sublayer is configured by RRC.
• It is used for RBs mapped on logical channels which include DCCH and DTCH.
• Each RB is associated with 1 PDCP entity. Each PDCP entity is associated with 1/2/4 RLC entities which
depends on RB characteristics or RLC modes. RB characteristics are uni-directional / bi-directional or
split/non-split.
• For non-split bearers , each PDCP entity is associated with 1 UM RLC entity/2 UM RLC entities/1 AM RLC
entity.
• For split bearers, each PDCP entity is associated with 2 UM RLC entities/4 UM RLC entities/2 AM RLC
entities(same direction).
PDCP entity:
• The PDCP entities are located in the PDCP sublayer. Several PDCP entities may be defined for a UE. Each
PDCP entity is carrying the data of one radio bearer.
• A PDCP entity is associated either to the control plane or the user plane depending on which radio bearer it is
carrying data for.

Defence
• The figure depicts functional view of PDCP entity used for the PDCP sublayer.
• The data can be either uncompressed PDCP SDU or compressed PDCP SDU. Uncompressed data is
associated with user plane or control plane. Compressed data is associated with user plane only.
• As per Plane, PDU can be of two types viz. control PDU or data PDU.
• Control PDU types include either PDCP status report or interspersed ROHC feedback.
PDCPProceduresfordatatransfer
• There are three main PDCP entity handling procedures viz. PDCP entity establishment, re-establishment and
release.
• After establishment, PDCP procedures are associated with either transmitting operation or receiving
operation.
• As shown during transmit operation, PDCP entity receives SDU from upper layer. On this received SDU
various operations are performed before it is given to lower layers. It is later passed to radio interface (Uu).
• When UE transmits NG-RAN receives and when NG-RAN transmits UE receives.
• Similar functionalities are performed when data PDU is received from lower layers.
• PDCP SDU size and PDCP control PDU size are both 9000 bytes (maximum).
• The length of PDCP SN is either 12 bits or 18 bits. It is configured by upper layers.
PDCPlayerdataPDUandcontrolPDUformats
• A PDCP PDU is a bit string that is byte aligned (i.e. multiple of 8 bits) in length.
• PDCP SDUs are bit strings that are byte aligned (i.e. multiple of 8 bits) in length.
• A compressed or uncompressed SDU is included into a PDCP Data PDU from the first bit onward.

Defence
Following figure depicts PDCP Data PDU format with 12 bits PDCP SN. This format is applicable for SRBs.
Following figure depicts PDCP Data PDU format with 12 bits PDCP SN. This format is applicable for UM DRBs
and AM DRBs.
Following figure depicts PDCP Data PDU format with 18 bits PDCP SN. This format is applicable for UM DRBs
and AM DRBs.

Defence
Following figure depicts PDCP Control PDU format which carries one PDCP status report. This format is
applicable for AM DRBs.
PDCP Control PDU format carrying one interspersed ROHC feedback is applicable for UM DRBs and AM
DRBs.
REFERENCES
• 3GPP TS 38.323, Packet Data Convergence Protocol (PDCP) specification (Release 15)
5G Core:

Defence
The 5G Session Management Function (SMF) is a fundamental element of the 5G Service-Based Architecture
(SBA). The SMF is primarily responsible for interacting with the decoupled data plane, creating updating and
removing Protocol Data Unit (PDU) sessions and managing session context with the User Plane Function
(UPF).
The Session Management Function within a 5G Service-Based Architecture:

Defence
Both the UE and the gNB employs the Next Generation Application Protocol (NGAP) to carry Non Access
Stratum (NAS) messages across the N1 or N2 reference interfaces in order to request a new session. The
Access and Mobility Management Function (AMF) receives these requests and handles anything to do with
connection or mobility management while forwarding session management requirements over the N11
interface to the SMF. The AMF determines which SMF is best suited to handle the connection request by
querying the Network Repository Function (NRF). That interface and the N11 interface between the AMF and
the specific SMF assigned by the NRF, use the Service Based Interface (SBI) message bus, to which all
Service-Base Application elements are connected. The SBI message bus employs RESTful API principles over
HTTP/2 -- web technologies that dramatically simplify and accelerate service deployments.
Basic SBI call flow for SMF registration and discovery, per 3GPP TS 23.502
Messages received over the N11 interface represent a trigger to add, modify or delete a PDU session across
the user plane. The SMF sends messages to the UPF over the N4 reference interface using the Packet
Forwarding Control Protocol (PFCP). Similar to OpenFlow, in nature, PFCP employs a well-known UDP port
(8805) and was originally defined in release 14 specifications to support Control and User Plane Separation
(CUPS).
During session establishment or modification, the SMF also interacts with the Policy Control Function (PCF)
over the N7 interface and the subscriber profile information stored within the Unified Data Management (UDM)
function (N10), which assumes the role previously performed by the HSS. Employing the SBI Message Bus,
the PCF provides the foundation of a policy framework which, along with the more typical QoS and charging
rules, includes Network Slice selection, which is regulated by the Network Slice Selection Function (NSSF).
Decoupling other control plane functions from the user plane, while (together with the AMF) assuming the
some of the functionality previously undertaken by the MME, the SMF performs the role of DHCP server and IP
Address Management (IPAM) system. Together with the UPF, the SMF maintains a record of PDU session
state by means of a 24bit PDU Session ID. The SMF sets configuration parameters in the UPF that define
traffic steering parameters and ensure the appropriate routing of packets while guaranteeing the delivery of
incoming packets, though a Downlink (DL) data notification. In 4G EPC architectures, this is a SGW to MME
message. The SMF is responsible for checking whether the UE requests are compliant with the user
subscription and for connectivity charging, which is achieved by interacting with a Charging Function (CHF)
defined within 3GPP TS 32.255.
To meet the architectural requirements of 5G, the SMF must be entirely designed and delivered as a Cloud-
Native network function, dynamically deployed and scaled-up on demand in a completely automated manner.
This is a particularly complex proposition when it comes to high-availability control components with
asynchronous call flows across geo-diverse infrastructures requiring long and short-lived state maintenance for

Defence
sessions traversing elements that might quiesce without notice. These functions must therefore employ
established design patterns for building and deploying massively scalable web applications while adapting to fit
the constraints of real-time communications networks. REST is inherently stateless and the 3GPP has defined
a Structured and Unstructured Data Storage Functions (UDSF), which can be used by any Network Function to
achieve stateless reliability and load distribution. However, a strong background in these design principles will
ultimately be required to deliver on a truly Cloud-Native 5G Session Management Function.
5G NR AMF Functions:
AMF stands for Access and Mobility Management Function. Following are the functions of 5G NR AMF node.
• Termination of RAN CP interface (N2)
• Termination of NAS (N1), NAS ciphering and integrity protection.
• Registration management.
• Connection management.
• Reachability management.
• Mobility Management.
• Lawful intercept (for AMF events and interface to LI System).
• Provide transport for SM messages between UE and SMF.
• Transparent proxy for routing SM messages.
• Access Authentication and Access Authorization
• Provide transport for SMS messages between UE and SMSF.
• Security Anchor Functionality (SEAF). It interacts with the AUSF and the UE, receives the intermediate key
that was established as a result of the UE authentication process. In the case of USIM based authentication,
the AMF retrieves the security material from the AUSF.
• Security Context Management (SCM). The SCM receives a key from the SEAF that it uses to derive access-
network specific keys.
• Location Services management for regulatory services.
• Provide transport for Location Services messages between UE and LMF as well as between RAN and LMF.
• EPS Bearer ID allocation for interworking with EPS.
• UE mobility event notification.
In addition to the above mentioned functions, AMF also support functionalities for non 3GPP access networks.
5G NR UPF Functions
UPF stands for User plane function. Following are the functions of 5G NR UPF node.
• Anchor point for Intra-/Inter-RAT mobility (when applicable).
• External PDU Session point of interconnect to Data Network.
• Packet routing & forwarding
• Packet inspection
• User Plane part of policy rule enforcement, e.g. Gating, Redirection, Traffic steering.
• Lawful intercept (UP collection).
• Traffic usage reporting.
• QoS handling for user plane, e.g. UL/DL rate enforcement, Reflective QoS marking in DL.
• Uplink Traffic verification (SDF to QoS Flow mapping).
• Transport level packet marking in the uplink and downlink.
• Downlink packet buffering and downlink data notification triggering.
• Sending and forwarding of one or more "end marker" to the source NG-RAN node.
5G NR SMF Functions
SMF stands for Session Management Function. Following are the functions of 5G NR SMF node.
• Session Management;
• UE IP address allocation and management;
• Selection and control of UP function;
• Configures traffic steering at UPF to route traffic to proper destination;
• Control part of policy enforcement and QoS;
• Downlink Data Notification.
5G NR PCF Functions

Defence
PCF stands for Policy Control Function. Following are the functions of 5G NR PCF node.
• Supports unified policy framework to govern network behaviour.
• Provides policy rules to Control Plane function(s) to enforce them.
• Accesses subscription information relevant for policy decisions in a Unified Data Repository (UDR).
5G NR UDM Functions
UDM stands for Unified Data Management. Following are the functions of 5G NR UDM node.
• Generation of 3GPP AKA Authentication Credentials.
• User Identification Handling
• Access authorization based on subscription data (e.g. roaming restrictions).
• UE's Serving NF Registration Management
• Support to service/session continuity e.g. by keeping SMF/DNN assignment of ongoing sessions.
• MT-SMS delivery support.
• Lawful Intercept Functionality
• Subscription management.
• SMS management.
5G NR DN Functions
DN stands for Data Network. Following are the functions of 5G NR DN node.
• Operator services, Internet access or other services
5G NR AUSF Functions
Following are the functions of 5G NR AUSF node.
• Supports Authentication Server Function (AUSF) as specified by SA WG3.
5G NR AF Functions
AF stands for Application Function. Following are the functions of 5G NR AF node.
• Application influence on traffic routing
• Accessing Network Exposure Function
• Interacting with the Policy framework for policy control
Reference: 3GPP specification TS 38.300, 3GPP TS 23.501
The challenge of policy and charging control in a 5G network
olicy and Charging Control plays a very critical role in the 5G ecosystem. It provides transparency and control
over the consumption of Network resources during realtime service delivery.
PCF (Policy Charging Function) governs the Control plane functions via Policy rules defined and User plane
functions via Policy enforcement. It works very closely with CHF (Charging Function) for Usage Monitoring.
Through PCF, Operators can manage & govern network behavior.

Defence
Policy Control in a 5G Network
Key aspects like QoS control, Traffic Steering/Routing, Application & its capabilities detection, Subscriber
Spending/Usage Monitoring, Interworking with IMS Nodes, Enabling differentiated Services, Gating Control,
Network slice enablement, Roaming support, etc. are supported by PCF.
Before we discuss more specifics about PCF, it will be a good idea to know about 5G Service Based
Architecture. You can refer to my other article 5G Network Architecture-A Beginners Guide to gain the
basic understanding.
Below is the simplified view of PCF and associated Network Functions in a typical 5G Network
Architecture:-
A simplified view of PCF in a 5G Network
AMF (Access and Mobility Management Function): It performs operations like Mobility Management,
Registration Management, Connection Management, UE based authentication, etc. Based on the Service
requested by Consumer, AMF selects the respective SMF for managing the user session context. When
compared with 4G EPC, it’s functionalities resembles with MME of 4G Network.

Defence
SMF (Session Management Function): Performs operations like Session Management, IP Address allocation
& management for UE, User plane selection & Packets routing by working closely with UPF, QoS & Policy
enforcement for Control Plane, used for Service registration/discovery/establishment, etc. When compared
with 4G EPC, it’s functionalities resembles with MME, SGW-C (Control Plane) and PGW-C (Control Plane) of
4G Network.
AF (Application Function): It performs operations like accessing Network Exposure Function for retrieving
resources, interaction with PCF for Policy Control, Applications Traffic Routing, Exposing services to End
users, etc. It exposes the Application layer for interacting with 5G Network resources. When compared with 4G
EPC, it’s functionalities resembles with AF of 4G Network.
NEF (Network Exposure Function): It exposes services and resources over APIs within and outside the 5G
Core. Services exposure by NEF is based on RESTful APIs over Service based interface bus. With the help of
NEF, 3rd party applications can also access the 5G services. It acts as a Security layer when outside
application tries to connect with the 5G Core Network functions.
NWDAF (Network Data Analytics Function): NWDAF is used for data collection and analytics for Centralized
as well as Edge computing resources. It provides network slice specific data analytics to PCF and NSSF which
in turn use this data for Policy decisions (PCF) and Slice selections (NSSF).
UDR (Unified Data Repository): It serves as a single repository of Subscription data, Application data, Policy
data by integrating with NF consumers (like NEF, AMF, PCF, etc.). We can store and retrieve the data via
UDR. It also notifies for the Subscription data changes.
UPF (User Plane Function): It performs User plane operations like maintaining PDU Session, Packet routing
& forwarding, Packet inspection, Policy enforcement for User plane, QoS handling, etc. When compared with
4G EPC, it’s functionalities resembles with SGW-U (Serving Gateway User Plane function) and PGW-U (PDN
Gateway User Plane function) of 4G Network.
CHF (CHarging Function): CHF is an integral entity in CCS (Converged Charging System) which provides
Account Balance Management function, Rating Function and Charging Gateway Function.
If compared with 4G EPC, CHF combines the functionality of OCF (Online Charging Function) and CDF
(Charging Data Function). Hence, CHF enables Online and Offline Charging by closely interfacing with SMF.
To understand more about Online Charging, please read Basics of Telecom Online Charging.
To understand more about Offline Charging, please read Basics of Telecom Offline Charging.
CHF plays a critical role in monitoring the Subscriber’s Usage consumption & Policy Counters by interacting
with PCF. Together with PCF, it provides Policy and Charging Control during service delivery.
Interworking of PCF with associated 5G Network Functions is shown as below:-

Defence
5G PCF Reference-based representation as per 3GPP
Let’s drill down to the individual interfaces:-
PCF – AF Interface: Application-level session information is exchanged between AF and PCF which includes
information like Bandwidth requirements for QoS, Identifying Application service providers & Applications,
Traffic routing based on Applications access, Identifying Application traffic for Charging & Policy control.
PCF – UDR Interface: PCF retrieves the policy/subscription/application specific data from UDR. Policy control
related subscription and application specific data gets provisioned into UDR. UDR can also generate
notifications based on the changes in the subscription information, as per Operator’s pricing model.
PCF – NWDAF Interface: The PCF shall be able to collect directly slice specific network status analytic
information from NWDAF. NWDAF provides network data analytics (i.e. load level information) to PCF on a
network slice level and the NWDAF is not required to be aware of the current subscribers using the slice. PCF
shall be able to use that data in its policy decisions.
PCF – NEF Interface: NEF exposes network function services and resources to the External world. In terms of
interaction with PCF, it exposes the capabilities of network functions for supporting Policy and Charging.
PCF – CHF Interface: This interface behaves the same as between PCRF and OCS in the 4G Network.
Through this integration, Operators can manage & control subscriber spending as well as usage control. CHF
stores the policy counter information against the subscriber pricing plan and notifies PCF whenever subscriber
breaches the policy thresholds based on the usage consumption. On receiving policy trigger information, PCF
then applies the policy decision by interacting with SMF (which inturn informs UPF for the policy enforcement).
Check the following interface for more understanding.
PCF – AMF Interface: AMF acts as a single entry point for the UE connection. PCF provides Access and
Mobility Management related policies for the AMF in order to trigger Policy rules on the UE or User-sessions.
PCF – SMF Interface: SMF receives Control plane info from NFs (like AMF, etc.) and User plane info from
UPF. Information like Subscription details, QoS, PDU Session level are present in SMF and it requests Usage
related information from UPF.
SMF triggers PCF to enforce Policy decisions once the Policy trigger related to Session Management is met.
Similarly, PCF provisions the policy and charging control decision on SMF.

Defence
PCF – SMF – UPF Interface: PCF and UPF don’t communicate directly with each other. They exchange policy
actions/enforcements via SMF.
SMF provisions the policy & threshold rules on UPF for Usage Control based on the static/dynamic policy rules
configured in PCF, pre-defined rules in SMF and/or Credit control triggers received from CHF. This relationship
is the same as in between PCRF and PCEF in 4G/3G networks.
High-Level PCF Call Flow for a Session-based 5G Service:-
PCF Call Flow for a Session-based 5G Service
A typical Policy & Charging Control flow is explained in the above figure. It explains how the Policy rules are
first configured for Monitoring and later how Policy gets enforced at the bearer due to Policy rules trigger.
As Operators are focusing on new partnerships and business use cases based on 5G capabilities, PCF (or
PCRF) continues to play a vital role in the Enablement, Control, and Monetization of advanced Digital
Services.
Glossary: 3GPP (3rd Generation Partnership Project), SBA (Service Based Architecture), UE (User
Equipment), UPF (User Plane Function), AMF (Access & Mobility Management Function), SMF (Session
Management Function), NEF (Network Exposure Function), PCF (Policy Control Function), CCS (Converged
Charging System), AF (Application Function), UDR (Unified Data Repository), CHF (CHarging Function), OCF
(Online Charging Function), CDF (Charging Data Function), NWDAF (Network Data Analytics Function), PCRF
(Policy & Charging Rules Function), BSS (Business Support System), OSS (Operations Support System), IMS
(IP Multimedia Subsystem), PCEF (Policy Control Enforcement Function), MME (Mobility Management Entity),
SGW (Serving Gateway), PGW (PDN Gateway), EPC (Evolved Packet Core), CN (Core Network), NFs
(Network Functions)

Defence
NRF — NF Repository Function
Service registration and discovery function so that Network Functions can discover each other.
Maintains NF profile and available NF instances
NEF — Network Exposure Function
NEF provides a mechanism for securely exposing services and features of the 5G core.
Exposes capabilities and events
Secure provision of information from an external application to 3GPP network
Translation of internal/external information
Control plane parameter provisioning
Packet Flow Description (PFD) management. A PFD is a tuple of protocol, server-side IP and port number.
NSSF — Network Slice Selection Function

Defence
Network Slice Selection Function
NSSF redirects traffic to a network slice. Network slices may be defined for different classes of subscribers
(see the above figure).
The NSSF performs the following functions:
Selecting of the Network Slice instances to serve the UE
Determining the allowed NSSAI
Determining the AMF set to be used to serve the UE

Defence
Subscription Permanent Identifier (SUPI)
The SUPI is a globally unique 5G Subscription Permanent Identifier allocated to each subscriber in the
5G System. It is defined in subclause 5.9.2 of 3GPP TS 23.501 [119].
The SUPI may contain:
- an IMSI as defined in subclause 2.1; or
- a NAI as defined in IETF RFC 4282 [53].
Subscription Concealed Identifier (SUCI)
The SUCI is a privacy preserving identifier containing the concealed SUPI. It is defined in
subclause 6.12.2 of 3GPP TS 33.501 [124].

Defence
SUCI
Mobile
Country Code
(MCC)
Mobile Network
Code
Routing
Indicator
3 digits 3 digits 4 digits
Protection
Scheme Id
0 - 15 values
Home Network
Public Key Id
FFS
Scheme Output
FFS
Figure 2.2B-1: Structure of SUCI
The SUCI is composed of the following parts:
1) Home Network Identifier, composed of two parts:
- Mobile Country Code (MCC), consisting of three decimal digits. The MCC identifies uniquely the
country of domicile of the mobile subscription;
- Mobile Network Code (MNC), consisting of three decimal digits. It contains two or three digits for 3GPP
network applications. The MNC identifies the home PLMN of the mobile subscription. The length of the
MNC (two or three digits) depends on the value of the MCC. A mixture of two and three digit MNC codes
within a single MCC area is not recommended and is outside the scope of this specification. If there are
only 2 significant digits in the MNC, one "0" digit shall be inserted at the left side to fill the 3 digits coding
of MNC;
2) Routing Indicator, consisting of four decimal digits. It contains 1 to 4 digits assigned by the
home network operator and provisioned in the USIM, that allow together with the MCC and MNC to route
network signalling with SUCI to AUSF and UDM instances capable to serve the subscriber. If there are
less than 4 digits in the Routing Indicator, one or more "0" digits shall be inserted at the left side to fill the
4 digits coding of Routing Indicator;
3) Protection Scheme Identifier, consisting in a value in the range of 0 to 15. It represents the null-
scheme or a non-null-scheme specified in Annex C of 3GPP TS 33.501 [124] or a protection scheme
specified by the HPLMN;
4) Home Network Public Key Identifier, consisting of FFS. It represents a public key provisioned by
the HPLMN. In case of null-scheme being used, this data field shall be set to null;
5) Scheme Output, consisting of FFS. It represents the output of a public key protection scheme
specified in Annex C of 3GPP TS 33.501 [124] or a protection scheme specified by the HPLMN.
Editor's Note: the composition of the Protection Scheme Id, Home Network Public Key Id and Scheme
Ouput is FFS.
Editor's note: Examples of SUCI will be described here.
5G Globally Unique Temporary UE Identity (5G-GUTI)
The purpose of the 5G-GUTI is to provide an unambiguous identification of the UE that does not reveal the UE
or the user's permanent identity in the 5G System (5GS). It also allows the identification of the Access and
Mobility Management Function (AMF) and network. It can be used by the network and the UE to establish the
UE's identity during signalling between them in the 5GS. See 3GPP TS 23.501 [119].
The 5G-GUTI has two main components:
- one that identifies the AMF(s) which allocated the 5G-GUTI; and

Defence
- one that uniquely identifies the UE within the AMF(s) that allocated the 5G-GUTI.
Within the AMF(s), the mobile shall be identified by the 5G-TMSI.
The Globally Unique AMF Identifier (GUAMI) shall be constructed from the MCC, MNC and AMF Identifier
(AMFI).
The AMFI shall be constructed from an AMF Region ID, an AMF Set ID and an AMF Pointer. The AMF Region
ID identifies the region, the AMF Set ID uniquely identifies the AMF Set within the AMF Region, and the AMF
Pointer identifies one or more AMFs within the AMF Set.
NOTE: When the UE is assigned a 5G-GUTI with an AMF Pointer value used by more than one
AMF, the AMFs need to ensure that the 5G-TMSI value used within the assigned 5G-GUTI is not
already in use within the AMF’s sharing that pointer value.
The 5G-GUTI shall be constructed from the GUAMI and the 5G-TMSI.
For paging purposes, the mobile is paged with the 5G-S-TMSI. The 5G-S-TMSI shall be constructed from the
AMF Set ID, the AMF Pointer and the 5G-TMSI.
The operator shall need to ensure that the combination of the AMF Set ID and AMF Pointer is unique within the
AMF Region and, if overlapping AMF Regions are in use, unique within the area of overlapping AMF Regions.
The 5G-GUTI shall be used to support subscriber identity confidentiality, and, in the shortened 5G-S-TMSI
form, to enable more efficient radio signalling procedures (e.g. paging and Service Request).
The format and size of the 5G-GUTI is therefore the following:
<5G-GUTI> = <GUAMI><5G-TMSI>,
where <GUAMI> = <MCC><MNC><AMF Identifier>
and <AMF Identifier> = <AMF Region ID><AMF Set ID><AMF Pointer>
MCC and MNC shall have the same field size as in earlier 3GPP systems.
5G-TMSI shall be of 32 bits length.
AMF Region ID shall be of 8 bits length.
AMF Set ID shall be of 10 bits length.
AMF Pointer shall be of 6 bits length.
Mapping between Temporary Identities for the 5GS and the E-UTRAN
This section provides information on the mapping of the temporary identities, e.g. for the construction of the
Tracking Area Update Request message in E-UTRAN.
In E-UTRAN:
<GUTI> = <MCC><MNC><MME Group ID><MME Code><M-TMSI>
Mapping from 5G-GUTI to GUTI
Introduction
This subclause addresses the case when a UE moves from an AMF to an MME.

Defence
2.10.2.1.2 Mapping in the UE
When a UE moves from 5GS to an E-UTRAN, the UE needs to map the 5G-GUTI to a GUTI.
The mapping of the 5G-GUTI to a GUTI shall be done as follows:
5GS <MCC> maps to E-UTRAN <MCC>
5GS <MNC> maps to E-UTRAN <MNC>
5GS <AMF Region ID> and 5GS <AMF Set ID> map to E-UTRAN <MME Group ID> and part of E-
UTRAN <MME Code> as follows:
- 8 bits of the 5GS <AMF Region ID> starting at bit 7 and down to bit 0 are mapped into bit 15
and down to bit 8 of the E-UTRAN <MME Group ID>;
- 8 bits of the 5GS <AMF Set ID> starting at bit 9 and down to bit 2 are mapped into bit 7 and
down to bit 0 of the E-UTRAN <MME Group ID>;
- 2 bits of the 5GS <AMF Set ID> starting at bit 1 and down to bit 0 are mapped into bit 7 and
down to bit 6 of the E-UTRAN <MME Code>;
5GS <AMF Pointer> maps to part of E-UTRAN <MME Code> as follows:
- 6 bits of the 5GS <AMF Pointer> starting at bit 5 and down to bit 0 are mapped into bit 5 and
down to bit 0 of the E-UTRAN <MME Code>.
5GS <5G-TMSI> maps to to E-UTRAN <M-TMSI>
Mapping in the old AMF
A new MME attempts to retrieve information regarding the UE, e.g. the IMSI, from the old AMF. In order to find
the UE context, the AMF needs to map the GUTI (sent by the MME) to create the 5G-GUTI and compare it
with the stored 5G-GUTI.
The AMF shall perform a reverse mapping to the mapping procedure specified in subclause 2.10.2.1.2
"Mapping in the UE".
Mapping from GUTI to 5G-GUTI
Introduction
This subclause addresses the case when a UE moves from an MME to an AMF (i.e. during a Registration
Update or an Initial Registration to an AMF).
Mapping in the UE
When the UE moves from the E-UTRAN to 5GS, the UE needs to map the GUTI to a 5G-GUTI to be sent to
the AMF.
The mapping of the GUTI to a 5G-GUTI shall be performed as follows:
E-UTRAN <MCC> maps to 5GS <MCC>
E-UTRAN <MNC> maps to 5GS <MNC>
E-UTRAN <MME Group ID> maps to 5GS <AMF Region ID> and part of 5GS <AMF Set ID> as follows:
- 8 bits of the E-UTRAN <MME Group ID> starting at bit 15 and down to bit 8 are mapped into bit
7 and down to bit 0 of the 5GS <AMF Region ID>;

Defence
- 8 bits of the E-UTRAN <MME Group ID> starting at bit 7 and down to bit 0 are mapped into bit 9
and down to bit 2 of the 5GS <AMF Set ID>;E-UTRAN <MME Code> maps to 5GS <AMF Set ID> and
5GS <AMF Pointer> as follows:
- 2 bits of the E-UTRAN <MME Code> starting at bit 7 and down to bit 6 are mapped into bit 1
and down to bit 0 of the 5GS <AMF Set ID>;
- 6 bits of the E-UTRAN <MMEC Code> starting at bit 5 and down to bit 0 are mapped into bit 5
and down to bit 0 of the 5GS <AMF Pointer >;
E-UTRAN <M-TMSI> maps to 5GS <5G-TMSI>
Mapping in the new AMF
In order to retrieve the UE's information, e.g. the IMSI, from the old MME, the new AMF shall perform a reverse
mapping to the mapping procedure specified in subclause 2.10.2.2.2 "Mapping in the UE". This is done in
order to be able to include the mapped GUTI in the corresponding message sent to the old MME. The old
MME compares the received GUTI with the stored values for identifying the UE.
Structure of the 5G-S-Temporary Mobile Subscriber Identity (5G-S-TMSI)
The 5G-S-TMSI is the shortened form of the 5G-GUTI to enable more efficient radio signalling procedures (e.g.
paging and Service Request). For paging purposes, the mobile is paged with the 5G-S-TMSI. The 5G-S-TMSI
shall be constructed from the AMF Set ID, the AMF Pointer and the 5G-TMSI:
<5G-S-TMSI> = <AMF Set ID><AMF Pointer><5G-TMSI>
See subclause 2.10.1 for these definitions and subclause 2.10.2 for the mapping
N3IWF FQDN
General
The N3IWF Fully Qualified Domain Name (N3IWF FQDN) shall be constructed using one of the following
formats, as specified in subclause 6.3.6 of 3GPP TS 23.501 [119]:
- Operator Identifier based N3IWF FQDN;
- Tracking Area Identity based N3IWF FQDN;
- the N3IWF FQDN configured in the UE by the HPLMN.
NOTE: The N3IWF FQDN configured in the UE can have a different format than those specified
in the following subclauses.
The Visited Country FQDN for N3IWF is used by a roaming UE to determine whether the visited country
mandates the selection of an N3IWF in this country. The Visited Country FQDN for N3IWF shall be constructed
as specified in subclause 28.3.2.2.4. The Replacement field used in DNS-based Discovery of regulatory
requirements shall be constructed as specified in subclause 28.3.2.2.5.
Editor's note: It is FFS whether N3IWF FQDN for emergency service is supported.
Operator Identifier based N3IWF FQDN
The N3IWF Fully Qualified Domain Name (N3IWF FQDN) contains an Operator Identifier that shall uniquely
identify the PLMN where the N3IWF is located. The N3IWF FQDN is composed of seven labels. The last three

Defence
labels shall be "pub.3gppnetwork.org". The third and fourth labels together shall uniquely identify the PLMN.
The first two labels shall be "n3iwf.5gc". The result of the N3IWF FQDN will be:
"n3iwf.5gc.mnc<MNC>.mcc<MCC>.pub.3gppnetwork.org"
In the roaming case, the UE can utilise the services of the VPLMN or the HPLMN. In this case, the Operator
Identifier based N3IWF FQDN shall be constructed as described above, but using the MNC and MCC of the
VPLMN or the HPLMN.
In order to guarantee inter-PLMN DNS translation, the <MNC> and <MCC> coding used in the "n3iwf.5gc.
mnc<MNC>.mcc<MCC>.pub.3gppnetwork.org" format of the Operator Identifier based N3IWF FQDN shall be:
- <MNC> = 3 digits
- <MCC> = 3 digits
If there are only 2 significant digits in the MNC, one "0" digit shall be inserted at the left side to fill the 3 digits
coding of MNC in the N3IWF FQDN.
As an example, the Operator Identifier based N3IWF FQDN for MCC 345 and MNC 12 is coded in the DNS as:
"n3iwf.5gc.mnc012.mcc345.pub.3gppnetwork.org".
Tracking Area Identity based N3IWF FQDN
The Tracking Area Identity based N3IWF FQDN is used to support location based N3IWF selection within a
PLMN.
The Tracking Area Identity based N3IWF FQDN shall be constructed respectively as:
"tac-lb<TAC-low-byte>.tac-hb<TAC-high-
byte>.tac.n3iwf.5gc.mnc<MNC>.mcc<MCC>.pub.3gppnetwork.org"
where
- the <MNC> and <MCC> shall identify the PLMN where the N3IWF is located and shall be encoded as
- <MNC> = 3 digits
- <MCC> = 3 digits
If there are only 2 significant digits in the MNC, one "0" digit shall be inserted at the left side to fill the 3
digits coding of MNC in the N3IWF FQDN.
- the <TAC>, together with the <MCC> and <MNC> shall identify the Tracking Area Identity the UE is
located in.
The TAC is a 16-bit integer. The <TAC-high-byte> is the hexadecimal string of the most significant byte
in the TAC and the <TAC-low-byte > is the hexadecimal string of the least significant byte. If there are
less than 2 significant digits in <TAC-high-byte> or <TAC-low-byte >, "0" digit(s) shall be inserted at the
left side to fill the 2 digit coding;
As examples,
- the Tracking Area Identity based N3IWF FQDN for the TAC H'0B21, MCC 345 and MNC 12 is coded in
the DNS as:
" tac-lb21.tac-hb0b.tac.n3iwf.5gc.mnc012.mcc345.pub.3gppnetwork.org"

Defence
Visited Country FQDN for N3IWF
The Visited Country FQDN for N3IWF, used by a roaming UE to determine whether the visited country
mandates the selection of an N3IWF in this country, shall be constructed as described below.
The Visited Country FQDN shall contain a MCC that uniquely identifies the country in which the UE is located.
The Visited Country FQDN is composed of seven labels. The last three labels shall be "pub.3gppnetwork.org".
The fourth label shall be "visited-country". The third label shall uniquely identify the MCC of the visited country.
The first and second labels shall be "n3iwf.5gc". The resulting Visited Country FQDN of N3IWF will be:
"n3iwf.5gc.mcc<MCC>.visited-country.pub.3gppnetwork.org"
The <MCC> coding used in this FQDN shall be:
- <MCC> = 3 digits
As an example, the Visited Country FQDN for MCC 345 is coded in the DNS as:
"n3iwf.5gc.mcc345.visited-country.pub.3gppnetwork.org".
Replacement field used in DNS-based Discovery of regulatory requirements
If the visited country mandates the selection of an N3IWF in this country, the NAPTR record(s) associated to
the Visited Country FQDN shall be provisioned with the replacement field containing the identity of the
PLMN(s) in the visited country which may be used for N3IWF selection.
The replacement field shall take the form of an Operator Identifier based N3IWF FQDN as specified in
subclause
For countries with multiple MCC, the NAPTR records returned by the DNS may contain a different MCC than
the MCC indicated in the Visited Country FQDN.
As an example, the NAPTR records associated to the Visited Country FQDN for MCC 345, and for MNC 012,
013 and 014, are provisioned in the DNS as:
n3iwf.5gc.mcc345.visited-country.pub.3gppnetwork.org
; IN NAPTR order pref. flag serviceregexp replacement
IN NAPTR 100 999 "" "" n3iwf.5gc.mnc012.mcc345.pub.3gppnetwork.org
PLMN level and Home NF Repository Function (NRF) FQDN
General
When an NF is instantiated, it may register with a PLMN level NF Repository Function (NRF). It may then
discover other NF instance(s) in the 5GC by querying the PLMN level NRF. The IP address of the PLMN level
NRF can be provisioned into the NF, or the NF can be pre-configured with the FQDN of the PLMN level NRF. If
the PLMN level NRF addresses and FDQN are not provisioned into the NF, the NF self-constructs the PLMN
level NRF FQDN as per the format specified in subclause 28.3.2.3.2.
For NF discovery across PLMNs, the NRF (e.g vNRF) shall self-construct the PLMN level NRF FQDN of the
target PLMN (e.g hNRF) as per the format specified in subclause 28.3.2.3.2, if the NRF has not obtained the
NRF FQDN of the target PLMN.

Defence
Format of NRF FQDN
The NRF FQDN shall be constructed by prefixing the Home Network Domain Name (see subclause 28.2) of
the PLMN in which the NRF is located with the label "nrf." as described below:
- nrf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
Network Slice Selection Function (NSSF) FQDN
28.3.2.4.1 General
For roaming service, the vNSSF may invoke the Nnssf_NSSelection_Get service operation from the hNSSF.
For routing of the HTTP/2 messages across the PLMN, the vNSSF self-constructs the FQDN of the hNSSF as
per the format specified in subclause 28.3.2.4.2. The Home Network is identified by the PLMN ID of the SUPI
provided to the vNSSF by the NF Service Consumer (e.g. the AMF).
28.3.2.4.2 Format of NSSF FQDN
The NSSF FQDN shall be constructed by prefixing its Home Network Domain Name (see subclause 28.2) with
the label "nssf." as described below:
- nssf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
28.3.2.5 AMF Name
The AMF Name FQDN shall uniquely identify an AMF.
The AMF Name FQDN shall be constructed as:
"<AMF-id>.amf.5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org"
where
- the <MNC> and <MCC> shall identify the PLMN where the AMF is located and shall be encoded as
- <MNC> = 3 digits
- <MCC> = 3 digits
If there are only 2 significant digits in the MNC, one "0" digit shall be inserted at the left side to fill the 3
digits coding of MNC in the AMF Name FQDN.
- the <AMF-id> shall contain at least one label.
As example,
- If <AMF-id> is amf1.cluster1.net2, the AMF Name FQDN for MCC 345 and MNC 12 as:
"amf1.cluster1.net2.amf.5gc.mnc012.mcc345.3gppnetwork.org"
Information for Network Slicing
General
In order to identify a Network Slice end to end, the 5GS uses information called S-NSSAI (Single Network Slice
Selection Assistance Information). See subclause 5.15.2 of 3GPP TS 23.501 [119].
An S-NSSAI is comprised of:
- A Slice/Service type (SST),

Defence
- A Slice Differentiator (SD), which is optional information that complements the Slice/Service type(s) to
differentiate amongst multiple Network Slices.
Format of the S-NSSAI
The structure of the S-NSSAI is depicted in Figure 28.4.2-1
24 bits
S-NSSAI
8 bits
SST SD
Figure 28.4.2-1: Structure of S-NSSAI
The S-NSSAI may include both the SST and SD fields (in which case the S-NSSAI length is 32 bits in total), or
the S-NSSAI may just include the SST field (in which case the S-NSSAI length is 8 bits only).
The SST field may have standardized and non-standardized values. Values 0 to 127 belong to the
standardized SST range and they are defined in 3GPP TS 23.501 [119]. Values 128 to 255 belong to the
Operator-specific range.
NF FQDN Format for Inter PLMN Routing
For routing HTTP/2 request messages to NF in a different PLMN, the FQDN of the target NF shall have the
Home Network Domain (see subclause 28.2) as the trailing part.
Summary:
LTE-Advanced Pro brings great enhancements in Radio performance on top of LTE-Advanced with Multi-Gbps
data rates, higher spectral efficiency and one-way latency below 1 ms. LTE-Advanced Pro also enables a
number of new application scenarios, including IOT optimization for the programmable world, vehicular
connectivity and public safety. LTE-Advanced Pro is supported by new features in 3GPP Release 14 and 5G is
supported in 3GPP Release 15.

Defence
Architecture of 5G:
AMF PCF
UE (R)AN UPF DN
N13
N7
N3 N6
N2 N4N1
AFN5SMFN11
N9
AUSF
N8N12
UDM
N10
N14 N15
NSSF
N22
Specs for 5G:
3GPP TS 22.168: "Earthquake and Tsunami Warning System (ETWS) requirements; Stage 1".
3GPP TS 22.268: "Public Warning System (PWS) Requirements".
3GPP TS 22.261: "Service requirements for next generation new services and markets".
3GPP TS 23.203: "Policies and Charging control architecture
3GPP TS 23.228: "IP Multimedia Subsystem (IMS)
3GPP TS 23.167: "3rd Generation Partnership Project; Technical Specification Group Services and Systems
Aspects; IP Multimedia Subsystem (IMS) emergency sessions".
3GPP TS 23.501: "System Architecture for the 5G System
3GPP TS 23.502: "Procedures for the 5G System
3GPP TS 24.501: "Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3".
3GPP TS 24.502: "Access to the 5G System (5GS) via non-3GPP access networks; Stage 3".
3GPP TS 29.500: "5G System; Technical Realization of Service Based Architecture; Stage 3".

Defence
3GPP TS 29.510: "5G System: Network function repository services; Stage 3".
3GPP TS 29.502: "5G System: Session Management Services: Stage 3".
3GPP TS 33.106: "Lawful Interception Requirements".
3GPP TS 33.501: "Security Architecture and Procedures for 5G System".
3GPP TS 37.340: "Evolved Universal Terrestrial Radio Access (E-UTRA) and NR; Multi-connectivity; Stage 2".
3GPP TS 37.340: "NR; Multi-connectivity; Overall description; Stage-2".
3GPP TS 38.101: "NR; User Equipment (UE) radio transmission and reception".
3GPP TS 38.133: "NR; Requirements for support of radio resource management".
3GPP TS 38.202: "NR; Physical layer services provided by the physical layer"
3GPP TS 38.304: "NR; User Equipment (UE) procedures in idle mode".
3GPP TS 38.306: "NR; User Equipment (UE) radio access capabilities".
3GPP TS 38.321: "NR; Medium Access Control (MAC) protocol specification".
3GPP TS 38.322: "NR; Radio Link Control (RLC) protocol specification".
3GPP TS 38.323: "NR; Packet Data Convergence Protocol (PDCP) specification".
3GPP TS 37.324: "NR; Service Data Protocol (SDAP) specification".
3GPP TS 38.331: "NR; Radio Resource Control (RRC); Protocol specification".
3GPP TS 38.401: "NG-RAN; Architecture description".
3GPP TS 38.410: "NG-RAN; NG general aspects and principles".
3GPP TS 38.420: "NG-RAN; Xn general aspects and principles".NG-AP:
5G NODES:
Authentication Server Function (AUSF)
Access and Mobility Management Function (AMF)
Data Network (DN), e.g. operator services, Internet access or 3rd party services
Unstructured Data Storage Function (UDSF)
Network Exposure Function (NEF)
NF Repository Function (NRF)
Network Slice Selection Function (NSSF)
Policy Control Function (PCF)
Session Management Function (SMF)
Unified Data Management (UDM)

Defence
Unified Data Repository (UDR)
User Plane Function (UPF)
Application Function (AF)
User Equipment (UE)
(Radio) Access Network ((R) AN)
5G-Equipment Identity Register (5G-EIR)
Security Edge Protection Proxy (SEPP
5G call model:
 Subscriber creation in AUSF/UDM.
 Provision & activation
 REGISTRATION in 5G network.
 Call establishment
5G-NG-RAN:
NG-C: control plane interface between NG-RAN and 5GC.
NG-U: user plane interface between NG-RAN and 5GC.
NG-RAN node: either a gNB or an ng-eNB.
# a gNB, providing NR user plane and control plane protocol terminations towards the UE; or
# an ng-eNB, providing E-UTRA user plane and control plane protocol terminations towards the UE.
N1: UE  AFM: NG-RAN
N2: R-AN  AMF: NG-RAN
N3: R-AN  UPF: NG-RAN
The gNBs and ng-eNBs are interconnected with each other by means of the Xn interface in 5G.

Defence
gNB
ng-eNB
NG
NG
NG
Xn
NG-RAN
5GC
AMF/UPF
gNB
ng-eNB
NG
NG
NGXn
AMF/UPF
Xn
Xn
NG NG
internet
gNB or ng-eNB
RB Control
Connection Mobility Cont.
Measurement
Configuration & Provision
Dynamic Resource
Allocation (Scheduler)
AMF
UPF
Inter Cell RRM
Radio Admission Control
NG-RAN 5GC
Mobility Anchoring
Idle State Mobility
Handling
NAS Security
SMF
UE IP address
allocation
PDU Session
Control
PDU Handling
Functional Split between NG-RAN and 5GC
* NR-RAN  UPF * NG-RAN  AMF
NG-U provides non-guaranteed delivery of user
plane PDUs between the NG-RAN node and the UPF.
User Plane PDUs
GTP-U
UDP
IP
Data Link Layer
Physical Layer
NG-AP
SCTP
IP
Data Link Layer
Physical Layer
NG-U Protocol Stack NG-C Protocol Stack
NG-C provides the following functions:

Defence
- NG interface management;
- UE context management;
- UE mobility management;
- Transport of NAS messages;
- Paging;
- PDU Session Management;
- Configuration Transfer;
- Warning Message Transmission
Xn interface:
Xn User Plane
The Xn User plane (Xn-U) interface is defined between two NG-RAN nodes. The user plane protocol stack on
the Xn interface is shown in Figure. The transport network layer is built on IP transport and GTP-U is used on
top of UDP/IP to carry the user plane PDUs.
Xn-U provides non-guaranteed delivery of user plane PDUs and supports the following functions:
- Data forwarding;
- Flow control.
User Plane PDUs
GTP-U
UDP
IP
Data Link Layer
Physical Layer
Xn-U Protocol Stack
Xn Control Plane:
The Xn control plane interface (Xn-C) is defined between two NG-RAN nodes. The control plane protocol stack
of the Xn interface is shown on Figure. The transport network layer is built on SCTP on top of IP. The
application layer signaling protocol is referred to as XnAP (Xn Application Protocol). The SCTP layer provides
the guaranteed delivery of application layer messages. In the transport IP layer point-to-point transmission is
used to deliver the signaling PDUs.
- Xn interface management;
- UE mobility management, including context transfer and RAN paging:
- Dual connectivity.

Defence
Xn-AP
SCTP
IP
Data Link Layer
Physical Layer
Xn-C Protocol Stack
Radio Protocol Architecture:
gNB
PHY
UE
PHY
MAC
RLC
MAC
PDCPPDCP
RLC
SDAPSDAP
User Plane Protocol Stack
5G Core:
gNB
PHY
UE
PHY
MAC
RLC
MAC
AMF
RLC
NAS NAS
RRC RRC
PDCP PDCP
QOS:-
The 5G QoS model is based on QoS Flows and supports both QoS Flows that require guaranteed flow bit rate
(GBR QoS Flows) and QoS Flows that do not require guaranteed flow bit rate (non-GBR QoS Flows). At NAS
level, the QoS flow is thus the finest granularity of QoS differentiation in a PDU session. A QoS flow is
identified within a PDU session by a QoS Flow ID (QFI) carried in an encapsulation header over NG-U.
The QoS architecture in NG-RAN, both for NR connected to 5GC and for E-UTRA connected to 5GC, is
depicted in the Figure and described in the following:

Defence
- For each UE, 5GC establishes one or more PDU Sessions;
- For each UE, the NG-RAN establishes one or more Data Radio Bearers (DRB) per PDU Session. The
NG-RAN maps packets belonging to different PDU sessions to different DRBs. Hence, the NG-RAN
establishes at least one default DRB for each PDU Session;
- NAS level packet filters in the UE and in the 5GC associate UL and DL packets with QoS Flows;
- AS-level mapping rules in the UE and in the NG-RAN associate UL and DL QoS Flows with DRBs.
UPFNBUE
PDU Session
Radio NG-U
NG-RAN 5GC
Radio Bearer NG-U Tunnel
QoS Flow
QoS Flow
Radio Bearer
QoS Flow
NG-RAN and 5GC ensure quality of service (e.g. reliability and target delay) by mapping packets to
appropriate QoS Flows and DRBs. Hence there is a 2-step mapping of IP-flows to QoS flows (NAS) and from
QoS flows to DRBs (Access Stratum).
At NAS level, a QoS flow is characterised by a QoS profile provided by 5GC to NG-RAN and QoS rule(s)
provided by 5GC to the UE. The QoS profile is used by NG-RAN to determine the treatment on the radio
interface while the QoS rules dictates the mapping between uplink User Plane traffic and QoS flows to the UE.
A QoS flow may either be "GBR" or "Non-GBR" depending on its profile. The QoS profile of a QoS flow
contains QoS parameters, for instance (see 3GPP TS 23.501 [3]):
- For each QoS flow:
- A 5G QoS Identifier (5QI);
- An Allocation and Retention Priority (ARP).
- In case of a GBR QoS flow only:
- Guaranteed Flow Bit Rate (GFBR) for both uplink and downlink;
- Maximum Flow Bit Rate (MFBR) for both uplink and downlink;
- Maximum Packet Loss Rate for both uplink and downlink.
- In case of Non-GBR QoS only:
- Reflective QoS Attribute (RQA): the RQA, when included, indicates that some (not necessarily all)
traffic carried on this QoS flow is subject to reflective quality of service (RQoS) at NAS.
In addition, an Aggregate Maximum Bit Rate is associated to each PDU session (Session-AMBR) and to each
UE (UE-AMBR). The Session-AMBR limits the aggregate bit rate that can be expected to be provided across
all Non-GBR QoS Flows for a specific PDU Session. The UE-AMBR limits the aggregate bit rate that can be
expected to be provided across all Non-GBR QoS Flows of a UE.
The 5QI is associated to QoS characteristics giving guidelines for setting node specific parameters for each
QoS Flow. Standardized or pre-configured 5G QoS characteristics are derived from the 5QI value and are not
explicitely signalled. Signalled QoS characteristics are included as part of the QoS profile. The QoS
characteristics consist for instance of (see 3GPP TS 23.501 [3]):
- Resource Type (GBR, delay critical GBR or Non-GBR);

Defence
- Priority level;
- Packet Delay Budget;
- Packet Error Rate;
- Averaging window;
- Maximum Data Burst Volume.
At Access Stratum level, the data radio bearer (DRB) defines the packet treatment on the radio interface (Uu).
A DRB serves packets with the same packet forwarding treatment. The QoS flow to DRB mapping by NG-RAN
is based on QFI and the associated QoS profiles (i.e. QoS parameters and QoS charateristics). Separate
DRBs may be established for QoS flows requiring different packet forwarding treatment, or several QoS Flows
belonging to the same PDU session can be multiplexed in the same DRB.
In the uplink, the NG-RAN may control the mapping of QoS Flows to DRB in two different ways:
- Reflective mapping: for each DRB, the UE monitors the QFI(s) of the downlink packets and applies the
same mapping in the uplink; that is, for a DRB, the UE maps the uplink packets belonging to the QoS flows(s)
corresponding to the QFI(s) and PDU Session observed in the downlink packets for that DRB. To enable this
reflective mapping, the NG-RAN marks downlink packets over Uu with QFI.
- Explicit Configuration: besides the reflective mapping, the NG-RAN may configure by RRC an uplink
"QoS Flow to DRB mapping".
- The UE shall always apply the latest update of the mapping rules regardless of whether it is performed
via reflecting mapping or explicit configuration.
In the downlink, the QFI is signalled by NG-RAN over Uu for the purpose of RQoS and if neither NG-RAN, nor
the NAS (as indicated by the RQA) intend to use reflective mapping for the QoS flow(s) carried in a DRB, no
QFI is signalled for that DRB over Uu. In the uplink, NG-RAN can configure the UE to signal QFI over Uu.
For each PDU session, a default DRB is configured. If an incoming UL packet matches neither an RRC
configured nor a reflective "QoS Flow ID to DRB mapping", the UE shall map that packet to the default DRB of
the PDU session.
Within each PDU session, it is up to NG-RAN how to map multiple QoS flows to a DRB. The NG-RAN may
map a GBR flow and a non-GBR flow, or more than one GBR flow to the same DRB, but mechanisms to
optimise these cases are not within the scope of standardization. The timing of establishing non-default DRB(s)
between NG-RAN and UE for QoS flow configured during establishing a PDU session can be different from the
time when the PDU session is established. It is up to NG-RAN when non-default DRBs are established.

Defence
gNBgNB AMF1AMF1 AMF2AMF2UEUE NG Setup Request
(List of supported S-NSSAIs)
NG Setup Response (List of supported S-
NSSAIs)
NG Setup Request
(List of supported S-NSSAIs)
NG Setup Response (List of supported S-NSSAIS)
Identify Slice policies
Identify CN Node
supporting
concerned Slice(s),
or select default CN
node
Initial UE Message
Validate UE rights
and Slice availability
RRC Connection Setup
(Temp ID or Assistance Info)
AMF instance selection
gNB AMF1 AMF2UE
NG Initial Cxt Setup Response
NG Initial Cxt Setup Request (S-NSSAI per PDU session)
Preconditions:
RRC Connection Establishment
CN Instance Selection
Provisional policies may be applied
UE slice access
confirmed, policies
updated if necessary
Network Slice-aware Initial Context Setup

Defence
gNB AMF1 AMF2UE
PDU Session Setup/Modify/Release Response
PDU Session Setup/Modify/Release Request (S-NSSAI per PDU session)
Precondition:
UE Context is established in NG RAN
NG RAN verifies PDU session
can be established for given
NW Slice (in case of
establishmnet/modify
Network Slice-aware PDU Session Setup/Modify/Release
gNB1 in Registration Area 1 AMFUE
Handover Required
UE in active mode with n slices
configured at NAS-level and with
m PDU Sessions active at AS level
gNB2 in Registration Area 2
Handover preparation from
gNB1 to gNB2 triggered
Handover Command
Handover Request (PDU
Session+ S-NSSAI List)
Handover Request Ack (list of
accepted and failed PDU
Session+ S-NSSAI)
Tracking Area Update (alignment of slices supported in the new RA between UE and network)
Handover Execution
Active mode CN involved mobility across different Registration Areas

Defence
1. NG-C: PDU session establishment req [NAS message]
5. NG-C: PDU session establishment ACK
AMFUE gNB UPF
2. RRC: DRB setup Req
[DRB parameters, NAS message]
4. RRC DRB setup complete
6. PDU data tunnel [QFI]6. User plane data over DRB [QFI]
3. UE establishes DRB
PDU session establishment
N4: UPF  SMF: NG-AP
N5: PCF  AF (IMS): diameter
N6: UPF  DATA NETWORK
N7: SMF  PCF: DIAMETER
N7r: hPCF  vPCF: DIAMETER
N8: AMF UDM: DIAMETER
N9: UPF  UPF: NG-AP
N10: SMF  UDM
N11: AMF  SMF
N12: AMF  AUSF
N13: AUSF  UDM
N14: AMF AMF
N15: AMF  PCF
N16: vSMF  hSMF
N22: AMF  NSSF
N24: vPCF  hPCF
N26: MME  AMF
N31: vNSSF  hNSSF
5G: Call Flow-

Defence
1) Non-Roaming 5G System Architecture in reference point representation2)2
AMF PCF
UE (R)AN UPF DN
N13
N7
N3 N6
N2 N4N1
AFN5SMFN11
N9
AUSF
N8N12
UDM
N10
N14 N15
NSSF
N22
2) non-roaming 5G System architecture for multiple PDU Session
PCF
UE (R)AN
UPF
DNN6
N2
N4
N1
AF
N5
DN
UPF
N4
N3
N3
AMF
SMF
N10
N11
N6
AUSF
N12
N13 UDM
N8
SMF N7
N10
N11
N7
N15
NSSF
N22
3) non-roaming 5G System architecture for concurrent access to two (e.g. local and central) data networks
(single PDU Session option)

Defence
AMF SMF
UE (R)AN UPF DN
N8
N11
N3 N6
N2 N4N1
AFN7
DN
N6
UPF
N4
N9
PCF N5
AUSF N13 UDM
N10N12
N15
NSSF
N22
4) Roaming 5G System architecture- local breakout scenario in service-based interface
NRFUDM
Npcf
Nnrf
PCF
Nudm
UE (R)AN UPF DN
N1 N2
N3 N6
AMF SMF
PCF
Namf Nsmf
Npcf
NRF
Nnrf
N4
AUSF
Nnef
Nausf
NEF
Nnef
NEF
VPLMN HPLMN
AF
NafNnssf
NSSF
vSEPP hSEPPN32
NSSF
Nnssf
5) Roaming 5G System architecture - local breakout scenario in reference

Defence
UDM
AMF vPCF
UE (R)AN UPF DN
N8
N3
N2
N4
N1
hPCF
N7
N6
VPLMN HPLMN
N24
SMFN11
AF
AUSF
N12
N13
N10
N15
N5
NSSF
N22
6) Roaming 5G System architecture-Home routed scenario in reference
UDM
AMF H-PCF
UE (R)AN UPF Data Network
N8
N16
N3 N9
N2
N4
N1
AFN5H-SMF N7
UPF N6
VPLMN HPLMN
N4
V-SMFN11
AUSFN12
N13
N10
V-PCF
N15
N24
V-NSSF
N22
H-NSSF
N31
7) NRF Roaming architecture in reference

Defence
vNRF
VPLMN
NF
VPLMN HPLMN
hNRFN27
HPLMN
NF
8) Data Storage & Data storage architecture
N18/NudsfAnyNF UDSF
Subscription Data
Policy Data
Structured Data
for exposure
Application Data
UDR
UDM
PCF
NEF
Data Access Provider
Nudr
9) Non-roaming architecture for 5G Core Network with non-3GPP access

Defence
Untrusted Non-
3GPP Access
UE
N3IWF
3GPP
Access
Data Network
HPLMN
Non-3GPP
Networks
UPF
N3 N6
Y1
Y2
AMF SMF
N2
N2
N4
N3
NWu
N11
N1
N1
10) LBO Roaming architecture for 5G Core Network with non-3GPP access - N3IWF in the VPLMN
Untrusted Non-
3GPP Access
UE
N3IWF
3GPP
Access
Data Network
VPLMN
Non-3GPP
Networks
UPF
N3 N6
Y1
Y2
AMF SMF
N2
N2
N4
N3
NWu
N11
N1
N1
11) Home-routed Roaming architecture for 5G Core Network with non-3GPP access - N3IWF in the same
VPLMN as 3GPP access

Defence
Untrusted Non-
3GPP AccessUE
3GPP Access
Data
Network
AMF
N2
N3
N2
N3
N3IWF
vSMF
UPF
Y1
Y2
hSMF
UPFN9
N4
N16N11
N1
NWu N1
VPLMN
Non-3GPP
Networks
HPLMN
N4
12) LBO Roaming architecture for 5G Core Network with non-3GPP access - N3IWF in the different PLMN
from the 3GPP
Untrusted Non-
3GPP Access
N3IWF
3GPP
Access
Data Network
VPLMN1
Non-3GPP
Networks
UPF
N3
N6
Y1
Y2
AMF SMF
N2
N4
N3
N11
N1
UPF
AMF
N2
Data Network
N6
SMF
N4
N11
UE
Nwu
N1VPLMN2
or HPLMN
13) Home-routed Roaming architecture for 5G Core Network with non-3GPP access - N3IWF in the different
VPLMN from the 3GPP

Defence
Untrusted Non-
3GPP AccessUE
3GPP Access
Data
Network
AMF
N2
N3
N3
N3IWF
vSMF
UPF
Y1
Y2
hSMF
UPF
N9
N4
N16
N11
N1
NWu
N1
VPLMN1
Non-3GPP
Networks
HPLMN
UPF
vSMF
N4
N11
AMF
N9
N4
N2
N16
VPLMN2
14) Home-routed Roaming architecture for 5G Core Network with non-3GPP access - N3IWF in HPLMN and
different PLMN in 3GPP

Defence
Untrusted Non-
3GPP AccessUE
3GPP Access
Data
Network
AMF
N2
N3
AMF
vSMF
UPF
Y1 Y2
hSMF /
SMF
UPF
N9
N4
N16
N11
N1
NWu
N1
VPLMN
Non-3GPP
Networks
HPLMN
N3IWF
N3
N4
N2
N11
15) Network Analytics architecture
NnwdafAny NF NWDAF
16) Interworking LTE—5G Non-roaming architecture for interworking between 5GS and EPC/E-UTRAN

Defence
UE
N26
S5-U
S5-C
S6a
S11
N1
N4
N7
U N2S1-U
S1-MME
HSS +
UDM
N11
N3
N15
N8
UE
N10
E-UTRAN
SGW
NG-RAN
AMFMME
PCF +
PCRF
SMF +
PGW-C
UPF +
PGW-U

Defence
17) Local breakout roaming architecture for interworking between 5GS and EPC/E-UTRAN
UPF +
PGW-U
UE
N26
S5-U
S5-C
S6a
S11
N1
N4
N7
U
N2S1-U
AMF
S1-MME
HSS +
UDM
SMF +
PGW-C
N11
N3
HPLMN
VPLMN N24
N15
N8
UE
E-UTRAN
N10
NG-RAN
MME
SGW
v-PCF +
v-PCRF
h-PCF +
h-PCRF
18) Home-routed roaming architecture for interworking between 5GS and EPC/E-UTRAN

Defence
UE
N26
S8-U
S8-C
S6a
S11
N1
N4
N7
U
N2
S1-U
S1-MME
HSS +
UDM
N9
N3
HPLMN
VPLMN
N24
N16
N8
UE
SGW
E-UTRAN
N10
N11
N4
v-PCF
N15
AMF
N10
MME
NG-RAN
RAN
h-PCF +
h-PCRF
SMF +
PGW-C
UPF +
PGW-U
UPF
v-SMF
19) Non-roaming architecture for interworking between 5GC via non-3GPP access and EPC/E-UTRAN

Defence
UE
S5-U
S5-C
S6a
S11
N1
N4
N7
U N2S1-U
S1-MME
HSS +
UDM
N11
N3
N15
N8
UE
N10
E-UTRAN
SGW
N3IWF
AMFMME
PCF +
PCRF
SMF +
PGW-C
UPF +
PGW-U
20) Local breakout roaming architecture for interworking between 5GC via non-3GPP access and
EPC/E-UTRAN

Defence
UPF +
PGW-U
UE
S5-U
S5-C
S6a
S11
N1
N4
N7
U
N2S1-U
AMF
S1-MME
HSS +
UDM
SMF +
PGW-C
N11
N3
HPLMN
VPLMN N24
N15
N8
UE
E-UTRAN
N10
N3IWF
MME
SGW
v-PCF +
v-PCRF
h-PCF +
h-PCRF
21) Home-routed roaming architecture for interworking between 5GC via non-3GPP access and EPC/E-
UTRAN

Defence
UE
S8-U
S8-C
S6a
S11
N1
N4
N7
U
N2
S1-U
S1-MME
HSS +
UDM
N9
N3
HPLMN
VPLMN
N7r
N16
N8
UE
SGW
E-UTRAN
N10
N11
N4
v-PCF
N15
AMF
N10
MME
N3IWF
RAN
h-PCF +
h-PCRF
SMF +
PGW-C
UPF +
PGW-U
UPF
v-SMF
22) Non-roaming architecture for interworking between ePDG/EPC and 5GS
UE
S2b-U
SWx
N1
N4
N7
N2
HSS +
UDM
N11
N3
N15
N8
UE
N10
ePDG NG-RAN
AMF
PCF +
PCRF
SMF +
PGW-C
UPF +
PGW-U
S2b-C
3GPP AAA
server
SWm
S6b

Defence
23) Local breakout roaming architecture for interworking between ePDG/EPC and 5GS
UPF +
PGW-U
UE
N1
N4
N7
N2
AMF
HSS +
UDM
SMF +
PGW-C
N11
N3
N24
N15
N8
NG-RAN
v-PCF +
v-PCRF
h-PCF +
h-PCRF
S2b-U
SWx
UE
N10
ePDG
S2b-C
3GPP AAA
proxy
SWm
S6b
3GPP AAA
server
SWd
HPLMN
VPLMN
24) Home-routed roaming architecture for interworking between ePDG/EPC and 5GS

Defence
UE
N1
N4
N7
N2
HSS +
UDM
N9
N3
N24
N16
N8
N11
N4
v-PCF
N15
AMF
NG-RAN
RAN
h-PCF +
h-PCRF
SMF +
PGW-C
UPF +
PGW-U
UPF
v-SMFS2b-U
SWx
UE
N10
ePDG
S2b-C
3GPP AAA
proxy
SWm
S6b
SWd
HPLMN
VPLMN
3GPP AAA
server
25) Non-roaming System Architecture for SMS over NAS 26) Non-roaming System Architecture for SMS
over NAS
UE
AMF
UDM
SMSF
(SMS Function)
N1
N20
N8
to/from
SMS-GMSC/IWMSC
SMS Router
to/from
SMS-GMSC/IWMSC
SMS Router
N21
to/from IP-SM-GW
to/from SGs MSC
AMF
UDMSMSF
UE
Namf
Nsmsf Nudm
N1
to/from
SMS-GMSC/IWMSC
SMS Router
to/from
SMS-GMSC/IWMSC
SMS Router
to/from
IP-SM-GW
to/from
SGs MSC

Defence
27) Roaming architecture for SMS over NAS 28) Roaming architecture for SMS over NAS
AMF
UDMSMSF
UE
Namf
Nsmsf Nudm
N1
to/from
SMS-GMSC/IWMSC
SMS Router
to/from
SMS-GMSC/IWMSC
SMS Router
VPLMN HPLMN
to/from
IP-SM-GW
to/from
SGs MSC
UE
AMF
UDM
SMSF
(SMS Function)
N1
N21
N20
N8
HPLMNVPLMN
to/from
SMS-GMSC/IWMSC
SMS Router
to/from IP-SM-GW
to/from SGs MSC
29) Non-roaming reference for Location Services 30) Non-roaming reference architecture for Location
Services
AMF
UDMLMF
Le
Le
Nlmf
Namf
NG-RANUE
N2
LCS
Client
vGMLC
LRF
Ngmlc
Nlmf Nudm
5GC
GMLC
LRF
UDM
AMF
LMF
NG
RAN
UE
External
ClientN2
NLs
NLg
NLh
Le
Le
N1
31)5GS Registration Management State models

Defence
RM-REGISTERED
Registration Accept
Deregistration
Registration Reject
Registration Reject Registration Update Accept
RM-DEREGISTERED
Figure: RM state model in UE
RM-REGISTERED
Registration Accept
Deregistration
Registration Reject
Registration Reject Registration Update Accept
RM-DEREGISTERED
Figure-RM state model in AMF
32)5GS Connection Management State models
CM-CONNECTED
AN signaling connection
established
(Initial NAS message)
AN signaling connection
released
CM-IDLE
Figure 5.3.3.2.4-1: CM state transition in UE
CM-CONNECTED
N2 Context established
N2 Context released
CM-IDLE
Figure 5.3.3.2.4-2: CM state transition in AMF

Defence
33) User plane Architecture for the Uplink Classifier
UE AN
DN
N1 N2 N4 N4
N4
N6
N6
DN
N9
N9
N3 UPF
Uplink Classifier
N11
AMF SMF
Local access to the same DN
UPF
PDU session
anchor 1
UPF
PDU session
anchor 2
34) Multi-homed PDU Session: service continuity case
UE AN DN
N1 N2 N4 N4
N4
N6
N6
N9
N9
N3
UPF
PDU session
anchor 1
UPF
Branching Point
N11
AMF SMF
UPF
PDU session
anchor 2
make-before-break
PSA relocation
35) Multi-homed PDU Session: local access to same DN
UE AN
DN
N1 N2 N4 N4
N4
N6
N6
DN
N9
N9
N3 UPF
Branching Point
N11
AMF SMF
Local access to the same DN
UPF
PDU session
anchor 1
UPF
PDU session
anchor 2
36) The principle for classification and User Plane marking for QoS Flows and mapping to AN
Resources

Defence
AN UPFUE
Data packets from applications
QoS rules
(mapping UL packets to QoS flows
and apply QoS flow marking)
Mapping QoS
flows
to AN
Resources
QoS Flow
(all packets marked with
the same QFI)
PDU Session
PDRs
(classify packets for
QoS flow marking
and other actions)
Application /Service Layer
AN Resources
37)

Defence
5QI
Value
Resource
Type
Default
Priority
Level
Packet
Delay
Budget
Packet
Error
Rate
Default
Maximum
Data Burst
Volume
(NOTE 2)
Default
Averaging
Window
Example Services
10 Delay
Critical
GBR
11 5 ms 10-5
160 B TBD Remote control
(see TS 22.261 [2])
11
NOTE 4
12 10 ms
NOTE 5
10-5
320 B TBD Intelligent transport
systems
12 13 20 ms 10-5
640 B TBD
16
NOTE 4
18 10 ms 10-4
255 B TBD Discrete
Automation
17
NOTE 4
19 10 ms 10-4
1358 B
NOTE 3
TBD Discrete
Automation
1
GBR
NOTE 1
20 100 ms 10-2
N/A TBD Conversational
Voice
2 40 150 ms 10-3
N/A TBD Conversational
Video (Live
Streaming)
3 30 50 ms 10-3
N/A TBD Real Time Gaming,
V2X messages
Electricity
distribution –
medium voltage,
Process automation
- monitoring
4 50 300 ms 10-6
N/A TBD Non-Conversational
Video (Buffered
Streaming)
65 7 75 ms
10-2
N/A TBD Mission Critical user
plane Push To Talk
voice (e.g., MCPTT)
66
20
100 ms
10-2
N/A TBD Non-Mission-Critical
user plane Push To
Talk voice
75 25 50 ms 10-2
N/A TBD V2X messages
E
NOTE 4
18 10 ms 10-4
255 B TBD Discrete
Automation
F
NOTE 4
19 10 ms 10-4
1358 B
NOTE 3
TBD Discrete
Automation
5 Non-GBR
NOTE 1
10 100 ms 10-6
N/A N/A IMS Signalling
6
60 300 ms 10-6
N/A N/A Video (Buffered
Streaming)
TCP-based (e.g.,
www, e-mail, chat,
ftp, p2p file sharing,
progressive video,
etc.)
7 N/A N/A Voice,

Defence
70 100 ms 10-3
Video (Live
Streaming)
Interactive Gaming
8
80 300 ms
10-6
N/A N/A
Video (Buffered
Streaming)
TCP-based (e.g.,
www, e-mail, chat,
ftp, p2p file
9 90 N/A N/A sharing,
progressive video,
etc.)
69 5 60 ms 10-6
N/A N/A Mission Critical
delay sensitive
signalling (e.g., MC-
PTT signalling)
70 55 200 ms 10-6
N/A N/A Mission Critical
Data (e.g. example
services are the
same as QCI 6/8/9)
79 65 50 ms 10-2
N/A N/A V2X messages
80 66 10 ms 10-6
N/A N/A Low Latency eMBB
applications
Augmented Reality
NOTE 1: a packet which is delayed more than PDB is not counted as lost, thus not included in the
PER.
NOTE 2: it is required that default Maximum Data Burst Volume is supported by a PLMN supporting
the related 5QIs.
NOTE 3: This Maximum Burst Size value is intended to avoid IP fragmentation on an IPv6 based,
IPSec protected, GTP tunnel to the 5G-AN node.
NOTE 4: A delay of 1 ms for the delay between a UPF terminating N6 and a 5G-AN should be
subtracted from a given PDB to derive the packet delay budget that applies to the radio
interface.
NOTE 5:The jitter for this service is assumed to be 20 msec as per TS 22.261 [2].

Defence
Scenarios for data forwarding between the SMF and UPF
Scenario description Data forwarding direction
1 Forwarding of user-plane packets
between the UE and the SMF e.g. DHCP
signalling.
UPF to SMF
SMF to UPF
2 Forwarding of packets between the SMF
and the external DN e.g. with DN-AAA
server
UPF to SMF
SMF to UPF
3 Forwarding of packets subject to
buffering in the SMF.
UPF to SMF
SMF to UPF
4 Forwarding of End Marker Packets
constructed by the SMF to a downstream
node.
SMF to UPF
1)5G Registration
New
AMF
AUSFSMF(R)ANUE
4 Namf_Communication_UEContextTransfer
1. Registration Request
PCF
2. AMF selection
Old
AMF
6. Identity Request
7. Identity Response
8. AUSF selection
9. Authentication/Security
11. Identity Request/Response
EIR
12. N5g-eir_EquipmentIdentityCheck_Get
13. UDM selection
15. PCF selection
16. Policy Association Establishment during Registration
22. Registration Accept
23. Registration Complete
UDM
18. Nsmf_PDUSession_UpdateSMContext /
Nsmf_PDUSession_ReleaseSMContext
10. Namf_Communication_
RegistrationCompleteNotify
5 Namf_Communication_UEContextTransfer response
N3IWF
19. N2 AMF Mobility Request
20. N2 AMF MobilityResponse
14c. Nudm_UCM_DeregistrationNotify
14a. Nudm_UECM_Registration
14b. Nudm_SDM_Get
14c. Nudm_SDM_Subscribe
14d. Nudm_SDM_Unsubscribe
17. Namf_EventExposure_Subscribe
21. AMF-Initiated Policy Association Termination

Defence
2) Registration with AMF re-allocation procedure
(R)AN
1. Initial UE message
Initial
AMF
NSSF
Target
AMF
7a. Namf_Communication_N1MessageNotify
4a. Nnssf_NSSelection_Get
4b. Nnssf_NSSelection_Get response
2. Optionally steps 4-9a of figure 4.2.2.2.2-1.
(A)
7b. N2 message
7c. N2 message
7a. Reroute NAS message
(B)
7b. Initial UE message
UDM
3a. Nudm_SDM_Get(Slice Selection Subscription data)
Nudm_SubscriberData_Get(slice specific info request)
3b. Nudm_SDM_Get response
5 Namf_Communication_RegistrationCompleteNotify
Old AMF
NRF
6b. Nnrf_NFDiscovery_Request Response
6a. Nnrf_NFDiscovery_Request
8. Steps 4-22 of figure 4.2.2.2.2-1 or
Steps 8-22 of figure 4.2.2.2.2-1
3) UE-initiated Deregistration

Defence
UE (R)AN AMF SMF UPFPCF
2. Nsmf_PDUSession_ReleaseSMContext Request
1. Deregistration Request
4. Nsmf_PDUSession_ReleaseSMContext Response
3a. N4 Session Release Request
3b. N4 Session Release Response
7. De-registration Accept
8. Signalling Connection Release
5a.Session Management Policy Termination
6a.AMF-initiated Policy Association Termination
UDM
5b.Nudm_SDM_Unsubscribe
6b.Nudm_SDM_Unsubscribe
5c. Nudm_UECM_Deregistration
4) Network-initiated Deregistration
UE (R)AN AMF SMF UPFPCF
1. Nudm_UECM_DeregistrationNotification
6. De-registration Accept
7. Signalling Connection Release
2. De-registration Request
3. Nudm_UECM_DeregistrationNotificationAck
UDM
4. Step 2 ~ step 5 of UE initiated De-registration in clause 4.2.2.3.2
3a. Nudm_SDM_Unsubscribe
5.AMF-initiated Policy Association Termination
5) UE Triggered Service Request procedure

Defence
1. Service Request
UE (R)AN AMF
UPF
(new I-UPF)
SMF
UPF
(PSA)
6a. N4 Session Establishment Request
4. Nsmf_PDUSession_UpdateSMContext Request
5. UPF selection
UPF
(old I-UPF) PCF AUSF
2. N2 message (Service Request)
3. Authentication/Security
6b. N4 Session Establishment Response
7a. N4 Session Modification Request
7b. N4 Session Modification Response
9. Buffered DL data forwarding
I-UPF is relocated
10. Buffered DL data forwarding
I-UPF is removed
11. Nsmf_PDUSession_UpdateSMContext Response
12. N2 Request
13. RRC connection reconfiguration
Uplink data (case: new I-UPF is inserted or I-UPF is relocated)
Downlink data
14. N2 Request Ack
15. Nsmf_PDUSession_ UpdateSMContext Request
Downlink data
I-UPF
Downlink data
No I-UPF
19. Nsmf_PDUSession_ UpdateSMContext Response
22a. N4 Session Modification Request or N4 Session Release Request
22b. N4 Session Modification Response or N4 Session Release Response
Uplink data (case: I-UPF is removed)
16. Session Management Policy Modification
6) Network Triggered Service Request

Defence
7) UE Configuration Update procedure for access and mobility management related parameters
UE (R)AN AMF UPFSMF
3a. Namf_Communication_N1N2MessageTransfer
6. Service Request Procedure
2b. Data Notification Ack
1. Downlink Data
2a. Data Notification
3b. Namf_Communication_N1N2MessageTransfer Response
3c. Failure indication
4b. Paging
4b. Paging
5.Namf_EventExposure_Notify
7. Downlink Data
4a.UP reactivation(Connected)
4c.NAS Notification
2c. Downlink Data

Defence
0. AMF decides update of UE configuration or need for re-registration
1. UE Configuration Update Command
AMFNG-RAN
2. UE Configuration Update Complete
3a. UE initiates Registration procedure in CM-CONNECTED state as described in clause 4.2.2.2
3b. AMF does not trigger AN Release procedure as described in
clause 4.2.6 in 23.502 and step 3c-3d is skipped
3c-3d. AMF triggers AN Release procedure as described in
clause 4.2.6 in 23.502 and step 3a is skipped
4. UE initiates Registration procedure after UE enters CM-IDLE state
UE SMF UDM
8) UE Configuration Update procedure for transparent UE Policy delivery
UE (R)AN AMF PCF
1a. Npcf_AM PolicyControl
Get Response
1b. Npcf_AM PolicyControl
UpdateNotify
2. Delivery of UE policies
3- Result of the delivery of UE policies
4- Namf_EventExposureNotify
Request
5- Namf_EventExposureNotify
Response
9) UE Reachability Notification Request Procedure

Defence
0a.Nudm_UECM_Registration()
0b.Nudm_SDM_Subscribe()
NFUDMAMF
2a. Namf_EventExposure_subscribe()
1. Request
3. Authorisation
Set URRP-AMF
4. N2 Notification procedure
2b. Namf_EventExposure_subscribe()
10) UE Activity Procedure
NFUDMAMF
2a. Namf_EventExposure_Notify
2b. Namf_EventExposure_Notify
1b. UE Notification
1b. RRC signalling
1a. NAS signalling
UE (R)AN
11) AN Release procedure
3. (R)AN Connection Release
1a. (R)AN Connection Release
1b. N2 UE Context Release Request
UPFAMF(R)ANUE
2. N2 UE Context Release Command
4. N2 UE Context Release Complete
SMF
5. Nsmf_PDUSession_UpdateSMContext
6b. N4 Session modification Response
7. Nsmf_ PDUSession_UpdateSMContext Ack
12) Feature specific UE/RAN Radio information and Compatibility Request

Defence
AMF
1. N2: Feature Specific UE/RAN information and Compatibility Request
UE (R)AN
2. RRC: UE Capability Enquiry
3. RRC: UE Capability Information
4. N2: Feature Specific UE/RAN information and Compatibility Response
5 N2 UE Capability Info Indication
13) UE-requested PDU Session Establishment for non-roaming and roaming with local breakout

Defence
AMF PCF UDM(R)ANUE
7b. Session Management Policy Establishment or Modification
10a. N4 Session Establishment/Modification Request
1. PDU Session Establishment Request
UPF SMF
10b. N4 Session Establishment/Modification Response
11. Namf_Communication_N1N2MessageTransfer
13. AN-specific resource setup (PDU Session Establishment Accept)
12. N2 PDU Session Request (NAS msg)
14. N2 PDU Session Request Ack
19. IPv6 Address Configuration
First Uplink Data
First Downlink Data
8. UPF selection
2. SMF selection
7a. PCF selection
DN
6. PDU Session authentication/authorization
3a. Nsmf_PDUSession_CreateSMContext Request
4a-4b. Registration/ Subscription retrieval/
Subscription for updates
20. Unsubscription / Deregistration
5. Nsmf_PDUSession_CreateSMContext Response
18. Nsmf_PDUSession_SMContextStatusNotify
14) UE-requested PDU Session Establishment for home-routed roaming scenarios

Defence
AMF H-PCF UDM(R)ANUE
3a. Nsmf_PDUSession_CreateSMContext Request
7. Registration / Subscription data retrieval/Subscribe
9b. Session Management Policy Establishment or Modification
1. PDU Session Establishment Request
V-UPF V-SMF
13. Nsmf_PDUSession_Create Response
16. RRC reconfiguration
15. N2 PDU Session Request
17. N2 PDU Session Request Ack
22. IPv6 Address Configuration
First Uplink Data
First Downlink Data
4. UPF
selection
H-UPF H-SMF
Visited PLMN Home PLMN
6. Nsmf_PDUSession_Create Request
First Downlink Data
10. UPF selection
9a. PCF selection
2. SMF Selection
8. PDU Session Authentication/ Authorization
3b. Nsmf_PDUSession_CreateSMContext Response
21. Nsmf_PDUSession_SMContextStatusNotify
24. Unsubscribe/Deregistration
23. Nsmf_PDUSession_Update Request
15) SMF selection for non-roaming and roaming with local breakout scenarios
16) Option 1 for SMF selection for home-routed roaming scenarios

Defence
AMF NRF
3. Nnrf_NFDiscovery_Request
4. Nnrf_NFDiscovery_Request response
1. Nnssf_NSSelection_Get
Serving PLMN
NSSF
2. Nnssf_NSSelection_Get response
AMF vNRF hNSSFhNRF
VPLMN HPLMN
vNSSF
17) Option 2 for SMF selection for home-routed roaming scenarios
vAMF
vNRF
hNRF
(3B)
(3A)
local NRF in
Home PLMN
3a. Nnrf_NFDiscovery_Request response
3b. Nnrf_NFDiscovery_Request response
3c. Nnrf_NFDiscovery_Request response
3d. Nnrf_NFDiscovery_Request response
3a. Nnrf_NFDiscovery_Request
3b. Nnrf_NFDiscovery_Request response
VPLMN HPLMN
18) PDU Session Establishment authentication/authorization by a DN-AAA server

Defence
3e. Nsmf_PDUSession_UpdateSMContext (N1 SM message)
3b. Namf_Communication_N1N2MessageTransfer
AMF(R)ANUE UPFSMF DN
2. Authentication/Authorization Request
3c. NAS SM Transport (Authentication Message)
3d. NAS SM Transport (Authentication Message)
4. Authentication/Authorization Response
3a. Authentication/Authorization Request
3f. Authentication/Authorization Response
1. N4 Session Establishment
5. Continuation of PDU session establishment as in Figure 4.3.2.2.1-1 or 4.3.2.2.2-1 up to completion of PDU
session establishment
6. Notification of IP Address allocation
19) UE or network requested PDU Session Modification (for non-roaming and roaming with local
breakout)

Defence
(R)AN AMF SMF UDMUPF
1d. QoS Update Trigger
PCF
1a. PDU Session Modification Request
1b. _Session Management PolicyModification
UE
1c.Nudm_SDM_Notification _
12. Session Management Policy Modification_
1a. Nsmf_PDUSession _UpdateSMContext
3a.Response of Nsmf _PDUSession _UpdateSMContext
4. N2 Session Request
5. AN-specific resource modification (including PDU Session Modification Command / Ack)
9 . N2 NAS uplink transfer
1e. N2 message(PDU session ID , SM information )
1e. Nsmf_PDUSession _Update SMContext
3b.Namf_Communication _N1N2MessageTransfer
6. N2 Session Response
8. PDU Session Modification Command Ack
7a. Nsmf_PDUSession_UpdateSMContext Request
7b. Nsmf_PDUSession_UpdateSMContext Response

Defence
20) UE or network requested PDU Session Modification (for home-routed roaming scenario)
UE (R)AN AMF V-SMF V-UPF H-SMF H-UPF UDM PCF
1a.PDU Session Modification Request
1a.Nsmf_PDUSession_Update SM context Request
1a.Nsmf_PDUSession_Update Request
1b.Session Management Policy Modification
1c.Nudm_SubscriptionData_UpdateNotification
1d.QoS Update Trigger1e.N2 message
3.Nsmf_PDUSession_Update Request
4a.Nsmf_PDUSession_UpdateSMContext Response
5.N2 Session Request
6.AN-specific resource modification
7.N2 Session Response
8.Nsmf_PDUSession_UpdateSMContext Request
9a.N4 Session Modification Request
9b.N4 Session Modification Response
15.Nsmf_PDUSession_Update Response
16a.N4 Session Modification Request
16b.N4 Session Modification Response
17.Session Management Policy Modification
10.Nsmf_PDUSession_UpdateSMContext Response
4b.Namf_Communication_N1N2MessageTransfer
2.Session Management Policy Modification
1a.Nsmf_PDUSession_Update Response
11.PDU Session Modification Command Ack
13.Nsmf_PDUSession_UpdateSMContext Request
14.Nsmf_PDUSession_UpdateSMContext Response
12.N2 NAS Uplink Transfer
1e.Nsmf_PDUSession_Update SM context Request
1e.Nsmf_PDUSession_Update Request
1e.Nsmf_PDUSession_Update Response
21) UE or network requested PDU Session Release for non-roaming and roaming with local breakout

Defence
(R)AN AMF SMF PCFUPF
1a. PDU Session Release Request
1b. Session Management Policy Termination
UE
1d. PDU Session Release Trigger
1a. Nsmf_PDUSession_UpdateSMContext
(PDU Session Release Request)
4. N2 Resource Release Request
5. AN-specific resource modification (including PDU Session Release Command)
6.N2 Resource Release Ack
7a. Nsmf_PDUSession_UpdateSMContext (N2 SM info)
3a. Nsmf_PDUSession_UpdateSMContext Response
3b. Namf_Communication_N1N2MessageTransfer
8.PDU Session Release Ack
9. N2 Uplink NAS transport
10a. Nsmf_PDUSession_UpdateSMContext (N1 SM information)
11. Nsmf_PDUSession_StatusNotifySMContext (Release)
1c. NSmf_PDUSession_ReleaseSMContext
3c. Nsmf_PDUSession_ReleaseSMContext Response
12. Session Management Policy Termination

Defence
22) UE or network requested PDU Session Release for home-routed roaming
(R)AN AMF V-SMF H-SMFV-UPF
1a. PDU Session Release Request
1c. Session Management Policy Termination
UE
1c. PDU Session Release Trigger
6. N2 Resource Release Request
7. AN-specific resource modification (including PDU Session Release Command / Ack)
8. N2 Resource Release Ack
PCFH-UPF
1a. Nsmf_PDUSession_Update Request
3a. Nsmf_PDUSession_Update Request
14. Nsmf_PDUSession_Update Response
1a. Nsmf_PDUSession_Update Response
1b. Nsmf_PDUSession_ReleaseSMContext Request
1b. Nsmf_PDUSession_Release Request
3b. Nsmf_PDUSession_Release Response
5c. Namf_Communication_N1N2MessageTransfer
5a. Nsmf_PDUSession_ReleaseSMContext Response
11. PDU Session Release Accept
15. Session Management Policy Termination
16a Nsmf_PDUSession_StatusNotify16b
Nsmf_PDUSession_S
MContextStatusNotify
23) Change of SSC mode 2 PSA for a PDU Session
UE (R)AN AMF UPF1 UPF2 SMF1
UL/DL Data
1. SMF determines
UPF relocation needs
to be performed
UL/DL Data
2. PDU Session Release procedure (with UPF1)
SMF2
3. PDU Session Establishment procedure (with UPF2)
24) Change of SSC mode 3 PDU Session Anchor with multiple PDU Sessions

Defence
UE (R)AN AMF UPF1 UPF2 SMF1
UL/DL Data
1. SMF determines
UPF/SMF relocation
needs to be performed
6. PDU Session release procedure (with UPF1)
5. UL/DL Data
4. UE-initiated PDU Session establishment procedure (with UPF2)
3. PDU Session
Modification Command
SMF2
2.Namf_Communication_N1N2MessageTransfer
25) Change of PDU Session Anchor with IPv6 Multi homed PDU Session

Defence
UE (R)AN AMF UPF1 UPF2 SMF
UL/DL Data
PCF
BP UPF
3. BP UPF Selection
8a. N2 Request
UL/DL Data
UL/DL Data
10. IPv6 Prefix Configuration
11. IPv6 Prefix Configuration
8b. N2 Response
16a. N2 Request
16b. N2 Response
1. SMF determines UPF
relocation needs to be
performed
2c. Session Management Policy Modification
9a. Nsmf_PDUSession_UpdteSMContext Request
13c. Session Management Policy Modification
9b. Nsmf_PDUSession_UpdteSMContext Response

Defence
26) Addition of additional PDU Session Anchor and Branching Point or UL CL
UE (R)AN SMF UPF
(Branching Point/
UL CL)
UPF
(PSA1)
UPF
(PSA2)
1. UE has an established PDU sessionwith PSA1
2. SMF establishes PSA2
3. SMF establishes Branching Pointor UL CL
4. SMF updatesPSA1 for downlink traffic
5. SMF updatesPSA2
Downlink PDU
Uplink PDUfor PSA1
6. SMF updates (R)AN
for uplink traffic
Uplink PDU for PSA1
8. SMF re-configures UE IPv6 prefix forPSA1
7.New UE IPv6 prefix assignment
First Uplink PDUfor PSA2
27) Removal of additional PDU Session Anchor and Branching Point or UL CL

Defence
UE (R)AN SMF UPF
(Branching Point /
UL CL)
UPF
(PSA1)
UPF
(PSA2)
1. UE has an established PDU session with Branching Point or UL CL, PSA1 and PSA2
5. SMF updates PSA2 for downlink traffic towards (R)AN
Downlink PDU
Uplink PDU for PSA2
4. SMF updates (R)AN for
uplink traffic towards PSA2
2. SMF re-configures UE IPv6 prefix @ PSA1 and @ PSA2
6. SMF releases PSA1
Downlink PDU
7. SMF releases Branching Point or UL CL
28) Change of additional PSA for a PDU Session in IPv6 multi-homing or UL CL case
UE (R)AN
UPF
(Branching point
/UL CL)
UPF
(PSA1)
UPF
(PSA2)
SMF
UL/DL Data
1. SMF determines to
perform PSA relocation
UPF
(PSA0)
2. SMF Establishes PSA2
4. New UE IPv6 prefix assignment for PSA2
5. SMF re-configures UE IPv6 prefix for PSA0
First UL Data for PSA2

Defence
29) Simultaneous change of Branching Point or UL CL and additional PSA for a PDU Session
E.g. NG-RAN initiates Xn based Inter 5G RAN handover
UE Source
(R)AN
SMF
Source
Branching
Point/
ULCL
Source
UPF
(PSA1)
Target
UPF
(PSA3)
Remote
UPF
(PSA2)
Target
(R)AN
UE has an established PDU session with Source Branching Point/Source ULCL , Source UPF and Remote UPF
2. SMF establishes Target UPF
3. SMF establishes Target Branching Point/
Target ULCL
4. SMF updates Remote UPF for downlink traffic
Uplink and downlink data
Uplink data
Downlink data
Forwarding of data
Downlink data
5. SMF updates Target UPF for downlink traffic
6. SMF updates Target
RAN for uplink traffic Uplink data
9. SMF releases Source UPF
10. SMF releases Source
Branching Point/Target
ULCL
1. Path Switch
Uplink and downlink data
Downlink data
Uplink data
Target
Branching
Point/
ULCL
7. New UE IPv6 prefix assigment
8. SMF Re-configures UE IPv6 prefix for PSA2
30) Processing AF requests to influence traffic routing

Defence
PCF(s) NEFSMF
1. Creation of the
AF request
AF
3. Npcf_PolicyAuthorization_Create/Update Response
2. Npcf_Policy Authorization_Create/Update Request
UPF
5. Npcf_SMPolicyControl_UpdateNotify
6. User Plane
Reconfiguration
4. Storing/Updating/Removing
the information for future PDU
sessions
31) Notification of user plane management event
AFSMF PCF NEFUPF
. ,
2. Nsmf_EventExposure_Notify
(Early Notification)
(Early Notification)
(Late Notification)
(Late Notification)
3. UPF addition, relocation or removal
1. AF notification trigger met
32) NEF Transferring an AF request to the relevant PCF
PCF BSF NEF
2. Nbsf_Management_Discovery request
4.Npcf_PolicyAuthorization_Create/Update/Delete Request
1. NEF receives
Npcf_PolicyAuthorizatio
n_Create/Update/Delete
Request from AF
3. Nbsf_Management_Discovery response

Defence
33) CN-initiated selective deactivation of UP connection of an existing PDU Session
UE NG-RAN AMF SMF
UPF
(N3 terminating)
1. SMF determines that
the UP connection of the
PDU session can be
deactivated.
6. N2 PDU Session Resource Release Command
7. RAN-specific resource release
8. N2 PDU Session Resource Release Response
9. Nsmf_PDUSession_UpdateSMContext
UPF
(to buffer)
When N3 terminating UPF is released
When N3 terminating UPF is not released
34) N4 Session Establishment procedure 35) N4 Session Modification procedure
UPF
2.N4 Session Establishment Request
SMF
3.N4 Session Establishment Response
1.Trigger to establish PDU
session or relocate UPF
4.Interaction with other
network function
UPF
2.N4 Session Modification Request
SMF
3.N4 Session Modification Response
1.Trigger to modify PDU
session
network function
36) N4 Session Release procedure

Defence
UPF
2.N4 Session Release Request
SMF
3.N4 Session Release Response
1.Trigger to release N4
session context
network function
37) N4 Session Level Reporting Procedure 38) N4 Association Setup Procedure
UPF
2. N4 Report
SMF
3. N4 Report ACK
1. Trigger to
report event
39) SMF initiated N4 association update procedure 40) UPF initiated N4 association update procedure
41) SMF initiated N4 association release procedure 42) UPF initiated N4 association release procedure
43) N4 report procedure 44) N4 PFD management Procedure
SMF
1. Trigger to provision or remove the set of
PDFs belonging to an Application ID
UPF
2. PFD management request
3. PFD management response
SMF
N4 Association Setup Request
UPF
N4 Association Setup Response
SMF
N4 Association Update Request
UPF
N4 Association Update Response
UPF
N4 Association Update Request
SMF
N4 Association Update Response
SMF
N4 Association Release Request
UPF
N4 Association Release Response
UPF
N4 Association Release Request
SMF
N4 Association Release Response
UPF
N4 Report
SMF
N4 Report ACK

Defence
45) SMF Pause of Charging procedure 46) Purge of subscriber data in AMF
SMF UPF
1. Data Notification
1. Data Notification
2. Trigger to
pause charging in
SMF
3 N4 Session Modify Request
4 N4 Session Modify Response
UDMAMF
3. Nudm_UECM_Deregistration request
4. Nudm_UECM_Deregistration response
1. Nudm_SDM_Unsubscribe request
2. Nudm_SDM_Unsubscribe response
47) Connection Resume procedure 48) N2 Notification procedure
NG-RAN Serving AMFUE
1. RRC message
RRC_CONNECTED
RRC_INACTIVE CM-CONNECTED
2. UE Context Retrieval
4. RRC message
CM-CONNECTED
3. N2 Path Switch
(clause 4.9.1.2.2)
AMF
1. UE State Transition
Notification Request
2. UE Notification
NG-RAN
3. Cancel UE State Notification
2b. UE Notification
49) Handover procedures: Xn based inter NG-RAN handover :- Xn based inter NG-RAN handover
without User Plane function re-allocation

Defence
TargetNG-
RAN
Source NG-
RAN
AMFUE
Handover preparation
UPF(s)
Handover Execution
Forwarding of data
1. N2 Path Switch Request
3. N4 Session
Modification Request
4. N4 Session
Modification Response
Downlink data
5. N3 End marker
5. N3 End marker
7. N2 Path Switch Request Ack
8. Release Resources
SMF(s)
2. Nsmf_PDUSession_UpdatSMContext Request
6. Nsmf_PDUSession_UpdatSMContext Response
9. Registration Procedure
50) Xn based inter NG-RAN handover with insertion of intermediate UPF
CP-MMTarget RAN AMFUE Source RAN
Handover preparation
Handover Execution
Forwarding of data
1. N2 Path Switch Request
9. N2 Path Switch Request Ack
10. Release Resources
Source UPF
Uplink data
I-UPF
UPF (PDU
Session Anchor)
SMF
3. N4 Session Establishment Request
4. N4 Session Establishment Response
5. N4 Session Modification Request
6. N4 Session Modification Response
Target UPF Selection
Downlink data
Uplink data
Downlink data
7. N9 End marker7. N3 End marker
7. N3 End marker

Defence
51)Xn based inter NG-RAN handover with re-allocation of intermediate UPF
CP-MMTarget RAN AMFUE Source RAN
Steps 1-4 from clause 4.9.1.2.3
Target UPF
UPF (PDU Session
Anchor)
SMF
11. N4 Session Release Request
12. N4 Session Release Response
Source UPF
6a. N4 Session Modification Response
Steps 7-11 from clause 4.9.1.2.3
H-SMF
5b. Nsmf_PDUSession_Update Request
6b. Nsmf_PDUSession_Update Response
52) Inter NG-RAN node N2 based handover:

Defence
2. T-AMF Selection
Downlink/uplink User Plane Data
T-NG-RAN T-UPF UPF (PSA)S-NG-RANUE
1. Handover Required
SMFS-AMF
Decision to trigger
a relocation via N2
S-UPFT-AMF
3. Namf_Communication_CreateUEContext Request
5. UPF selection
.6a. N4 Session Establishment Request
8. PDU Handover
Response supervision
9. Handover Request
10. Handover Request Acknowledge
11a.Nsmf_PDUSession_UpdateSMContext Request
11f. . Nsmf_PDUSession_UpdateSMContext Response
11b. N4 Session Modification Request
11c. N4 Session Modification Response
11d. N4 Session Modification Request
11e. N4 Session Modification Response
12. Namf_Communication_CreateUEContext Response
53) inter NG-RAN node N2 based handover, execution phase

Defence
T-NG-RANS-NG-RANUE S-AMF
2. Handover Command
1. Handover Command
T-UPF UPF (PSA)SMF S-UPFT-AMF
3a. Direct data forwarding
3b. Indirect data forwarding
Downlink User Plane data
Uplink User Plane data
5. Handover Notify
6a. Namf_Communication_N2InfoNotify
14a. UE Context Release Command
14b. UE Context Release Command Complete
.8a. N4 Session Modification request
9a N4 Session Modification Request
13a. N4 Session Release request
6b. Namf_Communication_N2InfoNotify Ack
UE synchronizes to new cell
4. Handover Confirm
6c. Nsmf_PDUSession_ReleaseSMContext Request
54) Handover of a PDU Session procedure from untrusted non-3GPP to 3GPP access (non-roaming
and roaming with local breakout)
Untrusted
Non-3GPP AccessUE N3IWF AMF SMF UPF PCFRAN
2. PDU session establishment procedure in clause 4.3.2.2.1
1. Registration via 3GPP access
3. Release of non-3GPP access resources using clause 4.12.7 steps 4 to 7, and
clause 4.3.4.2 step 7a
55) Handover of a PDU Session procedure from 3GPP to untrusted non-3GPP access (non-roaming
and roaming with local breakout)
Untrusted
Non-3GPP AccessUE N3IWF AMF SMF UPF PCFRAN
1. Registration via untrusted non-3GPP access
2. PDU session establishment procedure in clause 4.12.5
3. Release of 3G access resources using clause 4.3.4.2 step 3b, then from step 4
to step 7a
56) Handover of a PDU Session procedure from untrusted non-3GPP to 3GPP access (home routed
roaming)
The target AMF is in the PLMN of the N3IWF

Defence
Untrusted
Non-3GPP AccessUE N3IWF AMF V-SMF V-UPF H-SMFRAN
3. Release of non-3GPP access resourcesusing clause 4.12.7 steps 4 to 7, then clause 4.3.4.2 step 7a
H-UPF H-PCF
57) The target AMF is not in the PLMN of the N3IWF (i.e. N3IWF in HPLMN)
Source
AMF
UE
Target
AMF
Target
V-SMF
Target
V-UPF
H-SMFRAN
H-UPF H-PCF
Untrusted
Non-3GPP Access N3IWF
3. Release of non-3GPP access resources using
clause 4.12.7 from step 3 to step 12
58) Handover of a PDU Session procedure from 3GPP to untrusted non-3GPP access (home routed
roaming)
The selected N3IWF is in the registered PLMN
Untrusted
Non-3GPP AccessUE N3IWF AMF V-SMF V-UPF H-SMFRAN
3. Release of 3GPP access resources using clause 4.3.4.3 from step 5c to
step 10
H-UPF H-PCF
59) The UE is roaming and the selected N3IWF is in the home PLMN
Untrusted
Non-3GPP Access
UE N3IWF
Target
AMF
H-SMFRAN
H-UPF H-PCF
3. Release of V-SMF,V-UPF and 3GPP access resources using clause 4.3.4.3 from step 5c to step 10
Source
AMF
Source
V-SMF
Source
V-UPF
60) Location reporting procedures

Defence
AMF
1. Location Reporting Control
2. Location Report
NG-RAN
3. Cancel Location Reporting
61)5GS to EPS handover using N26 interface: 5GS to EPS handover for single-registration mode with
N26 interface
1. Handover required
3. Relocation request
4. Create session request
5. Create session response
9. Relocation response
6. Handover request
7. Handover request ACK
11a. Handover command
12b. Handover Notify
13. Modify bearer Request
UL data (prepared bearers)
14a. Modify bearer Request
DL data (prepared bearers)
16. Modify bearer Response
8. Create indirect data forwarding tunnel request/response
DL Data forwarding (Home routed roaming case)
2a. Nsmf_PDUSession_ContextRequest
17. Modify bearer Response
2b. Nsmf_PDUSession_ContextRsp
10b. N4 Session Modification
15. N4 Session Modification
11b. Handover command
12a. Handover Complete
19. PGW Initiated dedicated bearer activation
0. PDU Session and QoS flow setup in 5GS
18. TAU procedure
DL Data forwarding
12c. Relocation Complete Notification
12d. Relocation Complete Ack
20. Delete indirect data forwarding Tunnel request/response
21a. Delete indirect data forwarding tunnel Request/Response
21b. N4 Session Modification
10c. Nsmf_PDUSession_UpdateSMContext Response
DL Data forwarding (non-roaming or local breakout roaming case)
V-SMF V-UPFNG
RAN
AMF MME SGW
PGW-C+
SMF
E -
UTRAN
PGW-U+
UPF
UE
62) EPS to 5GS handover using N26 interface

Defence
Roaming
Scenario
UE E-UTRAN NG-RAN MME AMF V-SMF v-UPFS-GW SMF +
PGW-C
UPF +
PGW-U
v-PCF +
v-PCRF
1. Handover
initiation
2. Handover Required
3. Forward Relocation Request
UL and DL UP PDUs
8. N4 Session Establishment
9. Handover Request
14. Forward Relocation Response
15. Create Indirect Data Forwarding Tunnel Request/Response
10. Handover Request Ack
h-PCF +
h-PCRF
Roaming
Scenario
63) EPS to 5GS handover using N26 interface, execution phase
UE E-UTRAN NG-RAN MME AMF v-SMF v-UPFS-GW SMF +
PGW-C
UPF +
PGW-U
UL and DL UP PDUs
1. Handover Command
2. Handover from E-UTRAN Command
3. Handover to 5G-RAN Confirm
UL UP PDU
Transmission
via 5GS
available
DL UP PDUs
UP PDUs forwardedvia
tunnels for PDU forwarding
4. Handover Notify
5. Forward Relocation Complete Notification
7. Nsmf_PDUSession_UpdateSMContex Request
UL and DL UP PDUs
13. Resource Clean up in EPC by MME
Roaming
Scenario
v-PCF +
v-PCRF
h-PCF +
h-PCRF
Roaming
Scenario
12. EPS to 5GS Mobility Registration procedure
6. Forward Relocation Complete Notification Ack

Defence
64) Handover Cancel procedure
S-MME
/AMF
T-AMF/
MME
S-SGW(SGW-
C)/SMF
T-SMF/
SGW(SGW-C)
1. Handover Cancel
2. EPS: Relocation Cancel Request
5GS: Namf_Communication_ReleaseUEContext Request
4. EPS:Delete session Request/Response
5GS: Nsmf_PDUSession_UpdateSMContext request/response
5. Relocation cancel response
S--RAN
6. Handover Cancel ACK
7. Delete indirect data forwarding tunnel
UPF/
SGW-U
UE
8. Delete indirect data forwarding tunnel
Source RAN (e.g. E-UTRAN, NG-
RAN)Decides to cancel the handover
T-RAN
3. S1 Release Procedure Only if the target RAN is E-UTRAN
3. N2 Release Procedure Only if the target RAN is NG-RAN
4a. Release the the
corresponding resource
in the SGW-U/(T-UPF
and/or S-UPF)
65) 5GS to EPS Idle mode mobility using N26 interface
16. Update Location ACK
15. Nudm_UCM_DeregistrationNotification
UE eNB MME S-GW
2. TAU
request
NG-RAN AMF
P-GW-C/
SMF
P-GW-U/
UPF
4. Context
Request
5a.
Nsmf_PDUSession_ContextReq
uest
5b.
Nsmf_PDUSession_ContextRes
ponse
6. Context
Response
9.Create Session Request
10. Modify
bearer
request
Session
Modification12. Modify
bearer
response13. Create Session Response
17. TAU Accept
18. TAU Complete
19. P-GW initiated dedicated bearer setup, as needed
HSS/UDM
8. Authentication/Security 8. Authentication/Security
3. TAU request
7. Context Ack
1. TAU
trigger
14 .
11. N4
Update Location
66) EPS to 5GS Mobility Registration Procedure (Idle and Connected State) using N26 interface

Defence
UE MME AMF
PGW-C+
SMF
PGW-U+
UPF
PCF+
PCRF
1. Registration
is triggered
5. Context Request
6. Context Response
7. Authentication / Security
8. Context Acknowledge
17. Registration Accept
NG
RAN
3. AMF selection
HSS+
UDM
15. Cancel Location
16. Cancel Location Ack
18. Registration Complete
Old AMFN3IWF
9. step 11-12 of figure 4.2.2.2.2-1 in Registration Procedure
10a. Context Request
10b. Context Response
12b. N2 UE Context Release Command
13. Nudm_UECM_Deregistration Notification
12c. N2 Context Release Complete
11. step 13-14c of figure 4.2.2.2.2-1 in Registration Procedure
14. steps 16-20 of figure 4.2.2.2.2-1 in Registration Procedure
12a. Nudm_SDM_unubscribe
67) EPS bearer ID transfer
68) E-UTRAN Initial Attach
Target AMF PGW-C + SMF

Defence
UE eNodeB- -New MME
Old MME/SGSN/
AMF -Serving GW SMF +
PGW-C
UPF +
PGW-U
. 1. Attach Request
3. Create Session Response
PCF +
PCRF
UDM +
HSS
2. E-UTRAN Attach Figure 5.3.2-1 in TS 23.401 [13] Steps 2 to 14
4. E-UTRAN Attach Figure 5.3.2-1 in TS 23.401 [13] Steps 16 to 17
5 . RRC Connection Reconfiguration or
RRC Direct Transfer
6. E-UTRAN Attach Figure 5.3.2-1 in TS 23.401 [13] Steps 19 onwards
69) Mobility procedure from 5GS to EPS without N26 interface
11. Notify Request
12. Notify Response
0. UE is registered in 5GS
t
4. TAU Reject
5. Attach Request
6. Attach Request
9. Update Location Ack
NG RAN
new
MME
SGW
PGW-C+
SMFeNodeB
PGW-U+
UPF
UE
HSS+
UDM
1.Trigger to
startTAU
procedure
8. Update Location Request
old
AMF
2. TAU Request
3. TAU Reques
7. E-UTRAN Initial Attach Figure 5.3.2.-1, Steps 4-7, in TS 23.401
-24, in TS 23.401[x]10. E-UTRAN Initial Attach Figure 5.3.2.-1, Steps 12
14. PGW-C+SMF initiates release for transferred PDU Session
13. UE requested PDN Connectivity
70) Deregistration procedure for untrusted non-3gpp access

Defence
Untrusted
Non-3GPP
access
N3IWF AMF SMFUE
2. N2 UE Context Release Command
5. N2 UE Context Release Complete
3. IKE INFORMATIONAL EXCHANGE (Delete payload)
4. IKE INFORMATIONAL EXCHANGE
PCF UPF
1a. UE-Initiated Deregistration procedure Figure 4.2.2.3.2-1 steps from 1 to 7
1b. Network Initiated deregistration procedure Figure 4.2.2.3.3-1 steps from 1 to 6

Samir's whitepaper5g

More Related Content

What's hot

Similar to Samir's whitepaper5g

More from Samir Mohanty

Recently uploaded

Samir's whitepaper5g