Content for  TS 23.401  Word version:  19.0.0

One of the triggers described in clause 5.3.3.0 for starting the TAU procedure occurs.

The UE initiates the TAU procedure by sending, to the eNodeB, a TAU Request (UE Core Network Capability, MS Network Capability, Preferred Network behaviour, Support for restriction of use of Enhanced Coverage, old GUTI, Old GUTI type, last visited TAI, active flag, signalling active flag, EPS bearer status, P-TMSI Signature, additional GUTI, eKSI, NAS sequence number, NAS-MAC, KSI, Voice domain preference and UE's usage setting, UE has UE Radio Capability ID assigned for the selected PLMN, Requested IMSI Offset, Release Request indication, Paging Restriction Information, Unavailability Period Duration, Start of Unavailability Period) message together with RRC parameters indicating the Selected Network and the old GUMMEI. An exception is that, if the TAU was triggered for load re-balancing purposes (see clause 4.3.7.3), the old GUMMEI is not included in the RRC parameters. The UE shall set the Old GUTI Type to indicate whether the Old GUTI is a native GUTI or is mapped from a P-TMSI and RAI. If the UE's TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI then the old GUTI indicates this valid GUTI. If the UE's TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and related RAI then these two elements are indicated as the old GUTI. Mapping a P-TMSI and RAI to a GUTI is specified in Annex H. When the UE is in connected mode (e.g. in URA_PCH) when it reselects to E-UTRAN, the UE shall set its TIN to "P-TMSI". If the UE holds a valid GUTI and the old GUTI indicates a GUTI mapped from a P-TMSI and RAI, then the UE indicates the GUTI as additional GUTI. If the old GUTI indicates a GUTI mapped from a P-TMSI and RAI, and the UE has a valid P-TMSI signature, the P-TMSI signature shall be included. The additional GUTI in the Tracking Area Update Request message allows the new MME to find any already existing UE context stored in the new MME when the old GUTI indicates a value mapped from a P-TMSI and RAI. Alternatively, when a UE only supports E-UTRAN, it identifies itself with the old GUTI and sets the Old GUTI Type to 'native'. The RRC parameter "old GUMMEI" takes its value from the identifier that is signalled as the old GUTI according to the rules above. For a combined MME/SGSN the eNodeB is configured to route the MME-code(s) of this combined node to the same combined node. This eNodeB is also configured to route MME-code(s) of GUTIs that are generated by the UE's mapping of the P-TMSIs allocated by the combined node. Such an eNodeB configuration may also be used for separate nodes to avoid changing nodes in the pool caused by inter RAT mobility. The last visited TAI shall be included in order to help the MME produce a good list of TAIs for any subsequent TAU Accept message. Selected Network indicates the network that is selected. Active flag is a request by UE to activate the radio and S1 bearers for all the active EPS Bearers by the TAU procedure when the UE is in ECM-IDLE state. Signalling active flag is a request by UE using Control Plane CIoT EPS Optimisation to maintain the NAS signalling connection after Tracking Area Update Procedure is completed in order to transmit pending Data using the Data Transport in Control Plane CIoT EPS Optimisation or NAS signalling. The EPS bearer status indicates each EPS bearer that is active in the UE. The TAU Request message shall be integrity protected by the NAS-MAC as described in TS 33.401. eKSI, NAS sequence number and NAS-MAC are included if the UE has valid EPS security parameters. NAS sequence number indicates the sequential number of the NAS message. KSI is included if the UE indicates a GUTI mapped from a P-TMSI in the information element "old GUTI". In the RRC connection establishment signalling associated with the TAU Request, the UE indicates its support of the CIoT EPS Optimisations relevant for MME selection. For UE using CIoT EPS Optimisation without any activated PDN connection, there is no active flag or EPS bearer status included in the TAU Request message. For a UE with a running Service Gap timer in the UE the UE shall not set the active flag and the signalling active flag in the TAU request message (see clause 4.3.17.9) except for network access for regulatory prioritized services like Emergency services or exception reporting. If the UE has any PDN connection of PDN Type "non-IP" or "Ethernet", the UE shall send the EPS bearer status in the TAU Request message. The UE sets the voice domain preference and UE's usage setting according to its configuration, as described in clause 4.3.5.9. The UE includes extended idle mode DRX parameters information element if it needs to enable extended idle mode DRX, even if extended idle mode DRX parameters were already negotiated before. The UE may include UE paging probability information if it supports the assignment of WUS Assistance Information from the MME to assist the eNodeB's Wake-Up Signal (WUS) group decision (see TS 36.300). If a UE includes a Preferred Network Behaviour, this defines the Network Behaviour the UE is expecting to be available in the network as defined in clause 4.3.5.10. If the UE supports RACS as defined in clause 5.11.3a, and if the UE is provisioned with a UE Radio Capability ID for use in the selected PLMN (i.e. PLMN-assigned for the specific PLMN or manufacturer-assigned), the UE includes a flag that indicates it has an assigned UE Radio Capability ID for use in the selected PLMN but the actual UE Radio Capability ID is provided to MME after security context is established in step 6 (see below). If a Multi-USIM UE wants to enter ECM-IDLE state it includes the Release Request indication and optionally provides Paging Restriction Information. If a Multi-USIM UE needs to modify the Paging Occasions in order to avoid paging collisions, it sends a Requested IMSI Offset to the MME, in order to signal an alternative IMSI as described in clause 4.3.33 In the case of satellite access for Cellular IoT, the MME may verify the UE location and determine whether the PLMN is allowed to operate at the UE location, as described in clause 4.13.4. If the UE receives a TAU Reject message with cause value indicating that the selected PLMN is not allowed to operate at the present UE location, the UE shall attempt to select a PLMN as specified in TS 23.122. If the UE is using a eNodeB that provides discontinuous coverage (e.g. for satellite access with discontinuous coverage), the UE may include an Unavailability Period Duration and Start of Unavailability Period, see clause 4.13.8.2.

The eNodeB derives the MME address from the RRC parameters carrying the old GUMMEI, the indicated Selected Network and the RAT (NB-IoT or WB-E-UTRAN). If that MME is not associated with that eNodeB or the GUMMEI is not available or the UE indicates that the TAU procedure was triggered by load re-balancing, the eNodeB selects an MME as described in clause 4.3.8.3 on "MME Selection Function". The eNodeB forwards the TAU Request message together with the CSG access mode, CSG ID, TAI+ECGI of the cell from where it received the message and with the Selected Network to the new MME. CSG ID is provided by RAN if the UE sends the TAU Request message via a CSG cell or a hybrid cell. CSG access mode is provided if the UE sends the TAU Request message via a hybrid cell. If the CSG access mode is not provided but the CSG ID is provided, the MME shall consider the cell as a CSG cell. For SIPTO at the Local Network with stand-alone GW architecture the eNodeB includes the Local Home Network ID in the Initial UE Message and in Uplink NAS Transport message if the target cell is in a Local Home Network. To assist Location Services, the eNodeB indicates the UE's Coverage Level to the MME. If the MME supports RACS, and the MME detects that the selected PLMN is different from the currently registered PLMN for the UE, the MME provides the UE Radio Capability ID of the newly selected PLMN in the UE context to the eNodeB as described in clause 5.11.3a.

The new MME differentiates the type of the old node, i.e. MME or SGSN, as specified in clause 4.3.19, uses the GUTI received from the UE to derive the old MME/S4 SGSN address, and sends a Context Request (old GUTI, complete TAU Request message, P-TMSI Signature, MME Address, UE validated, CIoT EPS Optimisation support indication) message to the old MME/old S4 SGSN to retrieve user information. UE Validated indicates that the new MME has validated the integrity protection of the TAU message, e.g. based on native EPS security context for the UE. To validate the Context Request the old MME uses the complete TAU Request message and the old S4 SGSN uses the P-TMSI Signature and responds with an appropriate error if integrity check fails in old MME/S4 SGSN. This shall initiate the security functions in the new MME. If the security functions authenticate the UE correctly, the new MME shall send a Context Request (IMSI, complete TAU Request message, MME Address, UE Validated) message to the old MME/S4 SGSN with the UE Validated set. If the new MME indicates that it has authenticated the UE or if the old MME/old S4 SGSN correctly validates the UE, then the old MME/old S4 SGSN starts a timer. If the UE with emergency bearers is not authenticated in the old MME/old S4 SGSN (in a network supporting unauthenticated UEs) the old MME/old S4 SGSN continues the procedure with sending a Context Response and starting the timer also when it cannot validate the Context Request. If a RLOS attached UE is not successfully authenticated in the old MME, the old MME continues the procedure with sending a Context Response and starting the existing timer also when it cannot validate the Context Request. If the new MME supports CIoT EPS Optimisation, CIoT EPS Optimisation support indication is included in the Context Request indicating support for various CIoT EPS Optimisations (e.g. support for header compression for CP CIoT EPS Optimisation, etc.).

If the Context Request is sent to an old MME the old MME responds with a Context Response (IMSI, MSISDN, ME Identity (IMEISV), MM Context, EPS Bearer Context(s), Serving GW signalling Address and TEID(s), ISR Supported, MS Info Change Reporting Action (if available), CSG Information Reporting Action (if available), UE Time Zone, UE Core Network Capability, UE Specific DRX Parameters, Remaining Running Service Gap timer, LTE-M UE Indication) message. If the new MME supports CIoT EPS Optimisation and the use of header compression has been negotiated between the UE and the old MME, the Context Response also includes the Header Compression Configuration which includes the information necessary for the ROHC channel setup but not the RoHC context itself. If the Context Request is sent to an old S4 SGSN the old S4 SGSN responds with a Context Response (MM Context, EPS Bearer Context(s), Serving-GW signalling Address and TEID(s), ISR Supported, MS Info Change Reporting Action (if available), CSG Information Reporting Action (if available), UE Time Zone, UE Core Network Capability, UE Specific DRX Parameters). If the source MME has not yet reported a non-zero MO Exception Data Counter to the PDN-GW, the Context Response also includes the MO Exception Data Counter as described in TS 29.274. The MM Context contains security related information as well as other parameters (including IMSI and ME Identity (if available)) as described in clause 5.7.2 (Information Storage for MME). The unused Authentication Quintets in the MM Context are also maintained in the SGSN. TS 33.401 gives further details on the transfer of security related information. If the MM Context received with the Context Response message did not include IMEISV and the MME does not already store the IMEISV of the UE, the MME shall retrieve the ME Identity (IMEISV) from the UE. The PDN-GW Address and TEID(s) (for GTP-based S5/S8) or GRE Keys (PMIP-based S5/S8 at the PDN-GW(s) for uplink traffic) and the TI(s), is part of the EPS Bearer Context. If the UE is not known in the old MME/old S4 SGSN or if the integrity check for the TAU Request message fails, the old MME/old S4 SGSN responds with an appropriate error cause. ISR Supported is indicated if the old MME/old S4 SGSN and associated Serving-GW are capable to activate ISR for the UE. If the UE receives emergency bearer services from the old MME/old S4 SGSN and the UE is UICCless, IMSI can not be included in the Context Response. For emergency attached UEs, if the IMSI cannot be authenticated, then the IMSI shall be marked as unauthenticated. Also, in this case, security parameters are included only if available. For a RLOS attached UE, the old MME includes an RLOS indication to the new MME. If the RLOS attached UE in the old MME does not have a USIM, IMSI can not be included in the Context Response. If the RLOS attached UE has USIM but the IMSI cannot be successfully authenticated, then the IMSI shall be marked as unauthenticated. Also, in this case, security parameters are included only if available. If SIPTO at the Local Network is active for a PDN connection in the architecture with stand-alone GW, the old MME/old S4 SGSN shall include the Local Home Network ID of the old cell in the EPS Bearer context corresponding to the SIPTO at the Local Network PDN connection. For UE using CIoT EPS Optimisation without any activated PDN connection, there is no EPS Bearer Context(s) included in the Context Response message. Based on the CIoT EPS Optimisation support indication, old MME only transfers the EPS Bearer Context(s) that the new MME supports. If the new MME does not support CIoT EPS Optimisation, EPS Bearer Context(s) of non-IP PDN connection are not transferred to the new MME. If the new MME does not support Ethernet PDN Type, EPS Bearer Context(s) of Ethernet PDN type are not transferred to the new MME. If the EPS Bearer Context(s) of a PDN connection has not been transferred, the old MME shall consider all bearers of that PDN connection as failed and release that PDN connection by triggering the MME requested PDN disconnection procedure specified in clause 5.10.3. The buffered data in the old MME is discarded after receipt of Context Acknowledgement. If the EPS Bearer Context(s) are to be transferred to the new MME, the old MME also includes the Serving-GW IP address and TEID for both S1-U and S11-U, if available. If the Old MME is aware the UE is a LTE-M UE, it provides the LTE-M UE Indication to the new MME. During inter PLMN mobility, the new MME shall delete the UE Radio Capability ID received from the old MME, unless the operator policy indicates that all UE Radio Capability IDs used in the old PLMN are also valid in the new PLMN.

If the integrity check of TAU Request message (sent in step 2) failed, then authentication is mandatory. The authentication functions are defined in clause 5.3.10 on "Security Function". Ciphering procedures are described in clause 5.3.10 on "Security Function". If GUTI allocation is going to be done and the network supports ciphering, the NAS messages shall be ciphered. If this TAU request is received for a UE which is already in ECM_CONNECTED state and the PLMN-ID of the TAI sent by the eNodeB in Step 3 is different from that of the GUTI, included in the TAU Request message, the MME shall delay authenticating the UE until after Step 21 (TAU Complete message). If the new MME is configured to allow emergency bearer services for unauthenticated UE the new MME behave as follows:

• where a UE has only emergency bearer services, the MME either skip the authentication and security procedure or accepts that the authentication may fail and continues the Tracking Area Update procedure; or
• where a UE has both emergency and non-emergency bearer services and authentication fails, the MME continues the Tracking Area Update procedure and deactivates all the non-emergency PDN connections as specified in clause 5.10.3.

If the new MME is configured to allow Restricted Local Operator Services, the new MME, based on local regulation and operator policy, may skip the authentication and security procedure, or may perform authentication if security parameters are available, or obtainable from HSS, and continues the Tracking Area Update procedure regardless of the authentication result. If the UE indicated it has a UE Radio Capability ID assigned for use in the selected PLMN in step 2, the MME may request the UE to provide the UE Radio Capability ID in Security Mode Command, if the MME needs to get the UE Radio Capability ID from the UE e.g. at inter-PLMN mobility. If enquired by the MME the UE shall include the UE Radio Capability ID in Security Mode Command Accept for the supported UE radio capabilities. In the case of satellite access for NB-IoT, if the UE indicated support for reporting its Coarse Location Information, the MME may request the UE to report its Coarse Location Information by setting the Coarse Location Information Request in the Security Mode Command message and the UE then reports its Coarse Location Information in the Security Mode Complete message. To perform UE location verification as described in clause 4.13.4, the MME provides the reported Coarse Location Information to the E-SMLC as described in clause 9.1.17 of TS 23.271.

The MME (if the MME has changed then it is the new MME) determines to relocate the Serving-GW. The Serving-GW is relocated when the old Serving-GW cannot continue to serve the UE. The MME (if the MME has changed then it is the new MME) may also decide to relocate the Serving-GW if a new Serving-GW is expected to serve the UE longer and/or with a more optimal UE to PDN-GW path, or if a new Serving-GW can be co-located with the PDN-GW. Selection of a new Serving-GW is performed according to clause 4.3.8.2 on "Serving-GW selection function". If the MME has changed the new MME sends a Context Acknowledge (Serving-GW change indication) message to the old MME/old S4 SGSN. Serving-GW change indication indicates a new Serving-GW has been selected. The old MME/old S4 SGSN marks in its UE context that the information in the GWs is invalid. And, if the old node is an MME, the old MME marks in its UE context that the information in the HSS is invalid. This ensures that the old MME/old S4 SGSN updates the GWs, and the old MME updates the HSS, if the UE initiates a TAU or RAU procedure back to the old MME/old S4 SGSN before completing the ongoing TAU procedure. If the security functions do not authenticate the UE correctly, then the TAU shall be rejected, and the new MME shall send a reject indication to the old MME/old S4 SGSN. The old MME/old S4 SGSN shall continue as if the Identification and Context Request was never received. ISR is not indicated in the Context Acknowledge as ISR is not activated due to the S-GW change. For UE using CIoT EPS Optimisation without any activated PDN connection, the steps 8, 9, 10, 11, 18 and 19 are skipped.

If the MME has changed the new MME verifies the EPS bearer status received from the UE with the bearer contexts received from the old MME/old S4 SGSN. If the MME has not changed the MME verifies EPS bearer status from the UE with the bearer contexts available in the MM context. The MME releases any network resources related to EPS bearers that are not active in the UE. If there is no bearer context at all, the MME rejects the TAU Request. If the MME selected a new Serving GW it sends a Create Session Request (IMSI, MSISDN, bearer contexts, MME Address and TEID, Type, the Protocol Type over S5/S8, RAT type, LTE-M RAT type reporting to PGW flag, Serving Network, UE Time Zone, MO Exception data counter) message per PDN connection to the selected new Serving GW. The PDN GW address and TFT (for PMIP-based S5/S8) are indicated in the bearer Contexts. Type indicates to the Serving GW to send the Modify Bearer Request to the PDN GW. The Protocol Type over S5/S8 is provided to Serving GW which protocol should be used over S5/S8 interface. RAT type indicates a change in radio access. If it is a mobility from a SGSN to a MME and if the MME supports location information change reporting, the MME shall include the User Location Information (according to the supported granularity) in the Create Session Request, regardless of whether location information change reporting had been requested in the previous RAT by the PDN GW. If it is an inter MME mobility and if the PDN GW requested location information change reporting, the MME includes the User Location Information IE in this message if it is different compared to the previously sent information. If the PDN GW requested User CSG information, the MME also includes the User CSG Information IE in this message. If Control Plane CIoT EPS Optimisation applies, the MME may also indicate S11-U tunnelling of NAS user data and send its own S11-U IP address and MME DL TEID for DL data forwarding by the SGW. The MME shall include the MO Exception data counter if it has received the counter for RRC cause "MO Exception data" in the Context Response message. If only the Control Plane CIoT EPS Optimisation is used, the MME shall include a Control Plane Only PDN Connection Indicator in Create Session Request. If the new MME receives the EPS bearer context with SCEF, then the new MME updates the SCEF as defined in TS 23.682. If the UE is using the LTE-M RAT type and the PDN-GW expects the LTE-M RAT type reporting as specified in clause 5.11.5, the MME also includes the LTE-M RAT type reporting to PGW flag to indicate to the Serving-GW to forward the LTE-M RAT type to the PDN-GW.

The Serving-GW informs the PDN-GW(s) about the change of for example the RAT type that e.g. can be used for charging, by sending the message Modify Bearer Request (Serving-GW Address and TEID, RAT type, Serving Network, PDN Charging Pause Support Indication) per PDN connection to the PDN-GW(s) concerned. User Location Information IE and/or UE Time Zone IE and/or User CSG Information IE and/or MO Exception data counter are also included if they are present in step 8. The Serving-GW and PDN-GW indicate each use of the RRC establishment cause "MO Exception Data" by the related counter on its CDR. If the Serving-GW has received the Control Plane Only PDN Connection Indicator in step 8, the Serving-GW indicates the use of CP only on its CDR. If LTE-M RAT type and the LTE-M RAT type reporting to PGW flag were received at step 8, the Serving-GW shall include the LTE-M RAT type in the Modify Bearer Request message to the PGW. Otherwise the Serving-GW includes RAT type WB-E-UTRAN.

If dynamic PCC is deployed, and RAT type information needs to be conveyed from the PDN-GW to the PCRF, then the PDN-GW shall send RAT type information to the PCRF by means of an IP-CAN Session Modification procedure as defined in TS 23.203.

The PDN-GW updates its bearer contexts and returns a Modify Bearer Response (MSISDN, Charging Id, PDN Charging Pause Enabled Indication (if PDN-GW has chosen to enable the function)) message. The MSISDN is included if the PDN-GW has it stored in its UE context. If there has been a RAT change towards E-UTRAN and location information change reporting is required and supported in the target MME, the PDN-GW shall provide MS Info Change Reporting Action in the Modify Bearer Response. If the Serving-GW is relocated, the PDN-GW shall send one or more "end marker" packets on the old path immediately after switching the path in order to assist the reordering function in the target eNodeB. If the Serving-GW has no downlink user plane established, the Serving-GW shall discard the "end marker" received from the PDN-GW and shall not send Downlink Data Notification. Otherwise the Serving-GW shall forward the "end marker" packets to the source eNodeB or source S4 SGSN.

The Serving-GW updates its bearer context. This allows the Serving-GW to route bearer PDUs to the PDN-GW when received from eNodeB. The Serving-GW returns a Create Session Response (Serving-GW address and TEID for user plane and control plane and PDN-GW TEIDs (for GTP-based S5/S8) or GRE keys (for PMIP-based S5/S8) for uplink traffic and control plane, MS Info Change Reporting Action) message to the new MME. If Control Plane CIoT EPS Optimisation applies and if the MME does not include Control Plane Only PDN Connection Indicator in the Create Session Request:

• If separation of S11-U from S1-U is required, the Serving-GW shall include the Serving-GW IP address and TEID for S11-U and additionally the Serving-GW IP address and TEID for S1-U in the Create Session Response.
• Otherwise, if separation of S11-U from S1-U is not required, the Serving-GW includes the Serving-GW IP address and TEID for S11-U in Create Session Response.

When the MME receives the Create Session Response message, the MME checks if there is a "Availability after DDN Failure" monitoring event or a "UE Reachability" monitoring event configured for the UE in the MME and in such a case sends an event notification (see TS 23.682 for further information).

The new MME verifies whether it holds subscription data for the UE identified by the GUTI, the additional GUTI or by the IMSI received with the context data from the old CN node. If there are no subscription data in the new MME for this UE, or for some network sharing scenario (e.g. GWCN) if the PLMN-ID of the TAI supplied by the eNodeB is different from that of the GUTI in the UE's context, then the new MME sends an Update Location Request (MME Identity, IMSI, ULR-Flags, MME Capabilities, Homogeneous Support of IMS Voice over PS Sessions, UE SRVCC capability, equivalent PLMN list, ME Identity (IMEISV)) message to the HSS. ULR-Flags indicates that update location is sent from an MME and the MME registration shall be updated in HSS. The HSS does not cancel any SGSN registration. The MME capabilities indicate the MME's support for regional access restrictions functionality. The inclusion of the equivalent PLMN list indicates that the MME supports the inter-PLMN handover to a CSG cell in an equivalent PLMN using the subscription information of the target PLMN. The "Homogenous Support of IMS Voice over PS Sessions" indication (see clause 4.3.5.8A) shall not be included unless the MME has completed its evaluation of the support of "IMS Voice over PS Session" as specified in clause 4.3.5.8. The ME Identity is included if step 5 caused the MME to retrieve the IMEISV from the UE. If the UE initiates the TAU procedure in a VPLMN supporting Autonomous CSG Roaming and the HPLMN has enabled Autonomous CSG Roaming in the VPLMN (via Service Level Agreement) and the MME needs to retrieve the CSG subscription information of the UE from the CSS, the MME initiates the Update CSG Location Procedure with CSS as described in clause 5.3.12. If the MME determines that only the UE SRVCC capability has changed, the MME sends a Notify Request to the HSS to inform about the changed UE SRVCC capability. If all the EPS bearers of the UE have emergency ARP value, the new MME may skip the update location procedure or proceed even if the update location fails. If the UE is RLOS attached, the new MME skips the Update Location procedure.

The HSS sends the message Cancel Location (IMSI, Cancellation Type) to the old MME with Cancellation Type set to Update Procedure.

If the timer started in step 4 is not running, the old MME removes the MM context. Otherwise, the contexts are removed when the timer expires. It also ensures that the MM context is kept in the old MME for the case the UE initiates another TAU procedure before completing the ongoing TAU procedure to the new MME. The old MME acknowledges with the message Cancel Location Ack (IMSI).

When old S4 SGSN receives the Context Acknowledge message and if the UE is in Iu Connected, the old S4 SGSN sends an Iu Release Command message to the RNC after the timer started in step 4 has expired.

The RNC responds with an Iu Release Complete message.

The HSS acknowledges the Update Location Request message by sending an Update Location Ack (IMSI, Subscription Data) message to the new MME. The Subscription Data may contain the CSG subscription data for the registered PLMN and for the equivalent PLMN list requested by MME in step 12. The subscription data may contain Enhanced Coverage Restricted parameter. If received from the HSS, MME stores this Enhanced Coverage Restricted parameter in the MME MM context. The subscription data may contain a Service Gap Time. If received from the HSS, the MME stores this Service Gap Time in the MME MM context for the UE and passes it to the UE in the Tracking Area Update Accept message. The subscription data may contain Subscribed Paging Time Window parameter that applies to the UEs on a specific RAT, e.g. NB-IoT. If received from the HSS, MME stores this Subscribed Paging Time Window parameter in the MME MM context. The subscription data may contain an indication that the UE is subscribed to receive time reference information in access stratum. If received from the HSS, and if supported by the MME, the MME stores this indication in the MME MM context. If the Update Location is rejected by the HSS, the new MME rejects the TAU Request from the UE with an appropriate cause. In such cases, the new MME releases any local MME EPS Bearer contexts for this particular UE, and additionally deletes the EPS bearer resources in the new Serving-GW by sending the Delete Session Request (Cause, Operation Indication) messages to the new Serving-GW. The Operation Indication flag shall not be set. Therefore, the new Serving-GW receiving this request shall not initiate a delete procedure towards the PDN-GW. If the UE initiates the TAU procedure at a CSG cell, the new MME shall check whether the CSG ID and associated PLMN is contained in the CSG subscription and is not expired. If the CSG ID and associated PLMN is not present or expired, the MME shall send a Tracking Area Update reject message to the UE with an appropriate cause value. The UE shall remove the CSG ID and associated PLMN from its Allowed CSG list if present. If the UE has ongoing emergency bearer services no CSG access control shall be performed. If all checks are successful then the new MME constructs a context for the UE.

If the MME has changed, when the timer started in step 4 expires the old MME/old S4 SGSN releases any local MME or SGSN bearer resources and additionally the old MME/old S4 SGSN deletes the EPS bearer resources by sending the Delete Session Request (Cause, Operation Indication) messages to the old Serving-GW if it received the Serving-GW change indication in the Context Acknowledge message in step 7. When the Operation Indication flag is not set, that indicates to the old Serving-GW that the old Serving-GW shall not initiate a delete procedure towards the PDN-GW. If ISR is activated the Cause indicates to the old S-GW that the old S-GW shall delete the bearer resources on the other old CN node by sending Delete Bearer Request message(s) to that CN node. If the MME has not changed, step 11 triggers the release of the EPS bearer resources at the old Serving-GW.

The Serving-GW acknowledges with Delete Session Response (Cause) messages. The Serving-GW discards any packets buffered for the UE.

If due to regional subscription restrictions or access restrictions (e.g. CSG restrictions) (received in update location procedure in step 17) the UE is not allowed to access the TA:

• The MME rejects the Tracking Area Update Request with an appropriate cause to the UE.
• For UEs with emergency EPS bearers, i.e. at least one EPS bearer has an ARP value reserved for emergency services, the new MME accepts the Tracking Area Update Request and deactivates all non-emergency PDN connections as specified in clause 5.10.3. If the Tracking Area Update procedure is initiated in ECM-IDLE state, all non-emergency EPS bearers are deactivated by the Tracking Area Update procedure without bearer deactivation signalling between the UE and the MME.

If the TAU request message includes Paging Restriction Information, the MME may accept or reject the Paging Restriction Information requested by the UE based on operator policy. If the MME rejects the Paging Restriction Information, the MME removes any stored Paging Restriction Information from the UE context and discards the UE requested Paging Restriction Information. If the MME accepts the Paging Restriction Information from the UE, the MME stores the Paging Restriction Information from the UE in the UE context and then enforces it in the Network Triggered Service Request procedure as described in clause 5.3.4.3. The MME informs the UE about the acceptance/rejection of the requested Paging Restriction Information in the TAU Accept message. If the TAU Request message does not include any Paging Restriction Information, the MME shall delete any stored Paging Restriction Information for this UE and stop restricting paging accordingly. If the TAU Request message includes a Release Request indication, the MME does not activate the user plane setup procedure in the subsequent steps and triggers the S1 release procedure as described in clause 5.3.5 after the completion of TAU procedure. The MME sends a TAU Accept (GUTI, TAI list, EPS bearer status, NAS sequence number, NAS-MAC, IMS Voice over PS session supported, Emergency Service Support indicator, LCS Support Indication, Supported Network Behaviour, Service Gap Time, Enhanced Coverage Restricted, Indication of support of 15 EPS bearers per UE, PLMN-assigned UE Radio Capability ID, indication for PLMN-assigned UE Radio Capability ID deletion, Accepted IMSI Offset, Connection Release Supported, Paging Cause Indication for Voice Service Supported, Reject Paging Request Supported, Paging Restriction Supported, Paging Timing Collision Control Supported, Paging Restriction Information acceptance/rejection, Forbidden TAI(s), Enhanced Discontinuous Coverage Support, Return To Coverage Notification Not Required, Unavailability Period Duration, Start of Unavailability Period, Maximum Time Offset) message to the UE. If the active flag is set the MME may provide the eNodeB with Handover Restriction List. GUTI is included if the MME allocates a new GUTI. If the active flag is set in the TAU Request message the user plane setup procedure can be activated in conjunction with the TAU Accept message. If the DL Data Buffer Expiration Time for the UE in the MME has not expired, the user plane setup procedure is activated even if the MME did not receive the active flag in the TAU Request message. If the new MME receives the Downlink Data Notification message or any downlink signalling message while the UE is still connected, the user plane setup procedure may be activated even if the new MME did not receive the active flag in the TAU Request message. The procedure is described in detail in TS 36.300. The message sequence should be the same as for the UE triggered Service Request procedure specified in clause 5.3.4.1 from the step when MME establishes the bearer(s). The MME indicates the EPS bearer status IE to the UE. The UE removes any internal resources related to bearers that are not marked active in the received EPS bearer status. If the EPS bearer status information was in the TAU Request, the MME shall indicate the EPS bearer status to the UE. Handover Restriction List is described in clause 4.3.5.7 "Mobility Restrictions". The MME sets the IMS Voice over PS session supported as described in clause 4.3.5.8. For UE using CIoT EPS Optimisation without any activated PDN connection, there is no EPS bearer status included in the TAU Accept message. The MME indicates the CIoT EPS Optimisations it supports and prefers in the Supported Network Behaviour information as defined in clause 4.3.5.10. If there is a Service Gap timer running for the UE in the MME, and the active flag or the signalling active flag is received in the TAU Request message, the MME shall ignore the active flag and signalling active flag and not perform any of the actions related to these flags except if the TAU Request message has been received when the UE has a PDN connection for emergency bearer services established or is establishing a PDN connection for emergency bearer services or if the UE is configured to use high priority access (AC 11-15) in selected PLMN. The MME shall include the Service Gap Time in the TAU Accept message if the UE has indicated Service Gap Control capability and either if Service Gap Time was received in step 17 from HSS in the subscription information or if the Service Gap Time in the subscription information has been updated by HSS User Profile management (i.e. the Insert Subscriber Data procedure in clause 5.3.9.2). If the UE included support for restriction of use of Enhanced Coverage in step 1, the MME sends Enhanced Coverage Restricted parameter to the eNodeB in the S1-AP message as defined in clause 4.3.28. The MME also sends the Enhanced Coverage Restricted parameter to the UE in the TAU Accept message. UE shall store Enhanced Coverage Restricted parameter and shall use the value of Enhanced Coverage Restricted parameter to determine if enhanced coverage feature should be used or not. If the MME successfully obtained Header Compression Configuration parameters in step 5 it indicates the continued use of previous negotiated configuration to the UE in the Header Compression Context Status for each EPS Bearer of the UE. When Header Compression Context Status indicates that the previous negotiated configuration can no longer be used for some EPS bearers, the UE shall stop performing header compression and decompression, when sending or receiving data using Control Plane CIoT EPS Optimisation on these EPS bearers. If the MME did not receive the Voice Support Match Indicator in the MM Context, then the MME may send a UE Radio Capability Match Request to the eNodeB as described in clause 5.3.14. If the MME hasn't received Voice Support Match Indicator from the eNodeB then, based on implementation, MME may set IMS Voice over PS session supported Indication and update it at a later stage. After step 12, and in parallel to any of the preceding steps, the MME shall send a Notify Request (Homogeneous Support of IMS Voice over PS Sessions) message to the HSS:

• If the MME has evaluated the support of IMS Voice over PS Sessions, see clause 4.3.5.8, and
• If the MME determines that it needs to update the Homogeneous Support of IMS Voice over PS Sessions, see clause 4.3.5.8A.

The Emergency Service Support indicator informs the UE that Emergency bearer services are supported. LCS Support Indication indicates whether the network supports the EPC-MO-LR and/or CS-MO-LR as described in TS 23.271. Indication for support of 15 EPS bearers per UE indicates the network support for up to 15 EPS bearers per UE as defined in clause 4.12. If the UE included extended idle mode DRX parameters information element, the MME includes extended idle mode DRX parameters information element if it decides to enable extended idle mode DRX with Paging Time Window length assigned considering Subscribed Paging Time Window (if available) and the local policy. Additionally, for a UE using an eNodeB that provides discontinuous coverage (e.g. for satellite access with discontinuous coverage), the MME may consider Unavailability Period Duration and/or Start of Unavailability Period as described in clause 4.13.8.2 when determining idle mode DRX parameters. If the UE provided the UE paging probability information in Step 2, the MME takes it into account when generating the WUS Assistance Information. If the MME has determined WUS Assistance Information for the UE, the MME shall send the WUS Assistance Information to the UE (see TS 36.300). When receiving the TAU Accept message and there is no ISR Activated indication the UE shall set its TIN to "GUTI". For a S-GW change, ISR Activated is never indicated by the MME as it needs a RAU with the same S-GW first to activate ISR. For an MME change, ISR is not activated by the new MME to avoid context transfer procedures with two old CN nodes. If the TAU procedure is initiated by manual CSG selection and occurs via a CSG cell, the UE upon receiving the TAU Accept message shall add the CSG ID and associated PLMN to its Allowed CSG list if it is not already present. Manual CSG selection is not supported if the UE has emergency bearers established. If the user plane setup is performed in conjunction with the TAU Accept message and the TAU is performed via a hybrid cell, then the MME shall send an indication whether the UE is a CSG member to the RAN along with the S1-MME control message. Based on this information, the RAN may perform differentiated treatment for CSG and non-CSG members. If the UE receives a Service Gap Time in the TAU Accept message, the UE shall store this parameter and apply Service Gap Control (see clause 4.3.17.9). If the UE has indicated support for dual connectivity with NR in the TAU Request and the UE is not allowed to use NR as Secondary RAT, the MME indicates that to the UE in the TAU Accept message. If the user plane setup is performed and if RACS is supported and MME has UE Radio Capability ID in UE context, valid for the PLMN the UE is currently in, it signals the UE Radio Capability ID to the eNodeB as defined in clause 5.11.3a. If the eNodeB does not have mapping between the specific UE Radio Capability ID and the UE radio capabilities, it shall use the procedure described in TS 36.413 to retrieve the mapping from the Core Network. When the UE supports RACS, and the MME needs to configure the UE with a UE Radio Capability ID, and the MME already has the UE radio capabilities for the UE, the MME may provide the UE with the UE Radio Capability ID for the UE radio capabilities the UCMF returns to the MME for this UE. If the UE had included a UE Specific DRX parameter for NB-IoT in the Tracking Area Update Request, the MME includes the Accepted NB-IoT DRX parameter. If the UE provided a Requested IMSI Offset in step 2, but the network prefers a different value, the MME provides the UE with an Accepted IMSI Offset different from the one provided in step 2. Otherwise the value of the Accepted IMSI Offset the MME sends is the value of the Requested IMSI Offset sent by the UE in step 2. The MME stores the value of the alternative IMSI derived (see clause 4.3.33) from the Accepted IMSI Offset provided to the UE in the UE context. If a Multi-USIM UE does not provide a Requested IMSI Offset in step 1, the MME erases any alternative IMSI value in the UE context. If the Multi-USIM UE has indicated one or more Multi-USIM specific Capabilities are supported in the UE Core Network Capability in step 2, the MME shall indicate whether the corresponding one or more Multi-USIM specific features described in clause 4.3.33 are supported based on network capability and preference by the network (based on local network policy) by providing one or more of the Connection Release Supported, Paging Cause Indication for Voice Service Supported, Reject Paging Request Supported, Paging Restriction Supported and Paging Timing Collision Control Supported indications. The MME shall only indicate Paging Restriction Supported together with either Connection Release Supported or Reject Paging Request Supported. The UE shall only use Multi-USIM specific features that the MME indicated as being supported. In the case of Emergency attached UE, the MME shall not indicate support for any Multi-USIM feature to the UE. If the MME receives multiple TAIs from E-UTRAN in step 3 and determines that some, but not all, TAIs in the received list of TAIs are forbidden by subscription or by operator policy, the MME shall include the forbidden TAI(s) in the TAU Accept message. If both UE and network support discontinuous coverage, the MME provides the Enhanced Discontinuous Coverage Support indication as described in clause 4.13.8.1. For a UE using an eNodeB that provides discontinuous coverage (e.g. for satellite access with discontinuous coverage), the MME may provide Return To Coverage Notification Not Required, which requests the UE in ECM_IDLE state to not perform the TAU procedure when it returns to coverage, and/or provide the UE with an Unavailability Period Duration and/or Start of Unavailability Period if available, as described in clause 4.13.8.2. The MME may also provide a Maximum Time Offset as described in clause 4.13.8.6. If supported by the MME and if the UE is subscribed to receive time reference information, then the MME provides the Time Reference Information Distribution Indication to the eNodeB.

If GUTI was included in the TAU Accept, or the MME indicates an Accepted IMSI Offset to the UE in step 20, the UE acknowledges the received message by returning a TAU Complete message to the MME. When the "Active flag" is not set in the TAU Request message and the Tracking Area Update was not initiated in ECM-CONNECTED state, the new MME releases the signalling connection with UE, according to clause 5.3.5. For a UE using Control Plane CIoT EPS Optimisation, when the "Signalling active flag" is set, the new MME shall not release the NAS signalling connection with the UE immediately after the TAU procedure is completed. In the case of a rejected tracking area update operation, due to regional subscription, roaming restrictions or access restrictions (see TS 23.221 and TS 23.008) the new MME should not construct an MM context for the UE. In the case of receiving the subscriber data from HSS, the new MME may construct an MM context and store the subscriber data for the UE to optimise signalling between the MME and the HSS. A reject shall be returned to the UE with an appropriate cause and the S1 connection shall be released. Upon return to idle, the UE shall act according to TS 23.122. The new MME shall determine the Maximum APN restriction based on the received APN Restriction of each bearer context in the Context Response message and then store the new Maximum APN restriction value. The bearer contexts shall be prioritized by the new MME. If the new MME is unable to support the same number of active bearer contexts as received from old MME/SGSN, the prioritisation is used to decide which bearer contexts to maintain active and which ones to delete. In any case, the new MME shall first update all contexts in one or more P-GWs and then deactivate the bearer context(s) that it cannot maintain as described in the clause "MME Initiated Dedicated Bearer Deactivation Procedure". This shall not cause the MME to reject the tracking area update. The new MME shall not deactivate emergency service related EPS bearers, i.e. EPS bearers with ARP value reserved for emergency services. If the tracking area update procedure fails a maximum allowable number of times, or if the MME returns a Tracking Area Update Reject (Cause) message, the UE shall enter EMM-DEREGISTERED state. If the new MME identifies that the RAT type has changed, the MME checks the subscription information to identify for each APN whether to maintain the PDN connection, disconnect the PDN connection with a reactivation request, or, disconnect the PDN connection without reactivation request. If the MME decides to deactivate a PDN connection it performs MME-initiated PDN Connection Deactivation procedure after the tracking area update procedure is completed but before the S1/RRC interface connection is released. Existing ESM cause values as specified in TS 24.301 (e.g. #39, "reactivation requested"; #66 "Requested APN not supported in current RAT and PLMN combination"; and for a dedicated bearer, possibly #37 "EPS QoS not accepted") are used to cause predictable UE behaviour. If all the PDN connections are disconnected and the UE does not support "attach without PDN connectivity", the MME shall request the UE to detach and reattach.

The timer setting by the old S4 SGSN or MME in step 4 (as in clause 5.3.3.1) shall ensure that the buffered data in the old Serving-GW can be forwarded before the old Serving-GW resource is released.

DL data is being buffered in the old Serving-GW and the DL Data Expiration Time has not expired, therefore the old MME/old S4-SGSN indicates Buffered DL Data Waiting in the Context Response. This triggers the new MME to setup the user plane and invoke data forwarding. For Control Plane CIoT EPS Optimisation, if the DL data is buffered in the old Serving-GW, and when the Buffered DL Data Waiting is indicated, the new MME shall setup the S11 user plane with the new Serving-GW and invoke data forwarding. If the DL data is buffered in the old MME and the DL Data Expiration Time has not expired, the old MME shall discard the buffered DL data.

The user plane is setup. These procedure steps are defined in clause 5.3.4.1, steps 4-7 and steps 8-12 respectively in the UE Triggered Service Request procedure. For Control Plane CIoT EPS Optimisation, steps 11 and 12 are skipped.

Since it was indicated in step 5 that buffered DL data is waiting, the new MME sets up forwarding parameters by sending Create Indirect Data Forwarding Tunnel Request (target eNodeB addresses and TEIDs for forwarding) to the Serving-GW. The Serving-GW sends a Create Indirect Data Forwarding Tunnel Response (target Serving-GW addresses and TEIDs for forwarding) to the target MME. For Control Plane CIoT EPS Optimisation, the new MME sets up forwarding parameters by sending Create Indirect Data Forwarding Tunnel Request (target MME address and TEID for forwarding) to the Serving-GW. Upon receipt of the Create Indirect Data Forwarding Tunnel Response message the new MME starts a timer for release of resources if resources for indirect forwarding were allocated in the new S-GW. Indirect forwarding may be performed via a Serving-GW which is different from the Serving-GW used as the anchor point for the UE.

This procedure step is defined in clause 5.3.3.1, step 7. In addition the new MME includes the F-TEID where buffered DL data should be forwarded and a Forwarding indication in the Context Acknowledge message. The F-TEID is the F-TEID for the indirect forwarding received from step 13 or it may be the F-TEID of the eNodeB (when eNodeB supports forwarding).

A Modify Bearer Request( F-TEID ) is sent to the old Serving-GW. The F-TEID is the Forwarding F-TEID where the buffered DL data shall be forwarded.

The old Serving-GW forwards its buffered data towards the received F-TEID in step 15. The buffered DL data is sent to the UE over the radio bearers established in step 11. For Control Plane CIoT EPS Optimisation, the buffered DL data is sent to the new MME from the new Serving-GW and is sent to the UE as described in steps 12-14 of clause 5.3.4B.3.

As steps 15-16, 18-19 in clause 5.3.3.1.

If indirect forwarding was used, then the expiry of the timer at the new MME started at step 13 triggers the new MME to send a Delete Indirect Data Forwarding Tunnel Request message to the new S-GW to release temporary resources used for indirect forwarding that were allocated at step 13.