Content for  TS 24.501  Word version:  19.0.0

When the UE needs to access the 5GS, the UE not operating as an IAB-node (see TS 23.501), not acting as a 5G ProSe layer-2 UE-to-network relay UE (see TS 23.304) whose access attempt is triggered by a 5G ProSe layer-2 remote UE, and not acting as an NCR-MT node (see TS 38.300), first performs access control checks to determine if the access is allowed. Access control checks shall be performed for the access attempts defined by the following list of events:

1. the UE is in 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication over 3GPP access and an event that requires a transition to 5GMM-CONNECTED mode occurs; and
2. the UE is in 5GMM-CONNECTED mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication and one of the following events occurs:
   1. 5GMM receives an MO-IMS-registration-related-signalling-started indication, an MO-MMTEL-voice-call-started indication, an MO-MMTEL-video-call-started indication or an MO-SMSoIP-attempt-started indication from upper layers;
   2. 5GMM receives a request from upper layers to send a mobile originated SMS over NAS unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
   3. 5GMM receives a request from upper layers to send an UL NAS TRANSPORT message for the purpose of PDU session establishment unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
   4. 5GMM receives a request from upper layers to send an UL NAS TRANSPORT message for the purpose of UE-requested PDU session modification procedure unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
   5. 5GMM receives a request to re-establish the user-plane resources for an existing PDU session;
   6. 5GMM is notified that an uplink user data packet is to be sent for a PDU session with suspended user-plane resources;
   7. 5GMM receives a request from upper layers to send a mobile originated location request unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode or 5GMM-IDLE mode with suspend indication to 5GMM-CONNECTED mode;
   8. 5GMM receives a request from upper layers to send a mobile originated signalling transaction towards the PCF by sending an UL NAS TRANSPORT message including a UE policy container (see TS 24.587 and TS 24.554) unless the request triggered a service request procedure to transition the UE from 5GMM-IDLE mode to 5GMM-CONNECTED mode; and
   9. 5GMM receives an indication from lower layers of the RAN timing synchronization status change, and decides to transition the UE from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-CONNECTED mode as specified in subclause 5.3.1.4.

When the NAS detects one of the above events, the NAS needs to perform the mapping of the kind of request to one or more access identities and one access category and lower layers will perform access barring checks for that request based on the determined access identities and access category. To determine the access identities and the access category for a request, the NAS checks the reason for access, types of service requested and profile of the UE including UE configurations, against a set of access identities and access categories defined in TS 22.261, namely:

1. a set of standardized access identities;
2. a set of standardized access categories; and
3. a set of operator-defined access categories, if available.

For the purpose of determining the applicable access identities from the set of standardized access identities defined in TS 22.261, the NAS shall follow the requirements set out in:

1. subclause 4.5.2 and the rules and actions defined in Table 4.5.2.1, if the UE is not operating in SNPN access operation mode over 3GPP access; or
2. subclause 4.5.2A and the rules and actions defined in Table 4.5.2A.1, if the UE is operating in SNPN access operation mode over 3GPP access.

In order to enable access barring checks for access attempts identified by lower layers in 5GMM-CONNECTED mode with RRC inactive indication, the UE provides the applicable access identities to lower layers. For the purpose of determining the applicable access category from the set of standardized access categories and operator-defined access categories defined in TS 22.261, the NAS shall follow the requirements set out in:

1. subclause 4.5.2 and the rules and actions defined in Table 4.5.2.2, if the UE is not operating in SNPN access operation mode over 3GPP access; or
2. subclause 4.5.2A and the rules and actions defined in Table 4.5.2A.2, if the UE is operating in SNPN access operation mode over 3GPP access.

When the UE needs to initiate an access attempt in one of the events listed in subclause 4.5.1, the UE shall determine one or more access identities from the set of standardized access identities, and one access category from the set of standardized access categories and operator-defined access categories, to be associated with that access attempt. The set of the access identities applicable for the request is determined by the UE in the following way:

1. for each of the access identities 1, 2, 3, 11, 12, 13, 14 and 15 in Table 4.5.2.1, the UE shall check whether the access identity is applicable in the selected PLMN, if a new PLMN is selected, or otherwise if it is applicable in the RPLMN or equivalent PLMN; and
2. if none of the above access identities is applicable, then access identity 0 is applicable.

The UE uses the MPS indicator bit of the 5GS network feature support IE or the Priority indicator IE to determine if access identity 1 is valid. Processing of the MPS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message is described in subclause 5.5.1.2.4 and subclause 5.5.1.3.4. Processing of the MPS indicator bit of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message is described in subclause 5.4.4.3. When the UE is neither in the HPLMN (if the EHPLMN list is not present or is empty) nor in an EHPLMN (if the EHPLMN list is present) nor in a visited PLMN of the home country, and the USIM file EFUAC_AIC indicates the UE is configured for access identity 1, then the UE shall not consider access identity 1 to be valid, until the UE receives the MPS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message or of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message being set to "Access identity 1 valid" from the RPLMN or from an equivalent PLMN. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, the contents of the USIM file EFUAC_AIC as specified in TS 31.102 and the rules specified in Table 4.5.2.1 are used to determine the applicability of access identity 1. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, and the USIM file EFUAC_AIC does not indicate the UE is configured for access identity 1, the UE uses the MPS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message or of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message to determine if access identity 1 is valid. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, and the USIM file EFUAC_AIC indicates the UE is configured for access identity 1, the MPS indicator bit of the 5GS network feature support IE and the Priority indicator IE are not applicable. When the UE is not in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, the contents of the USIM file EFUAC_AIC are not applicable. The UE uses the MCS indicator bit of the 5GS network feature support IE or of the Priority indicator IE to determine if access identity 2 is valid. Processing of the MCS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message is described in subclause 5.5.1.2.4 and subclause 5.5.1.3.4. Processing of the MCS indicator bit of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message is described in subclause 5.4.4.3. When the UE is neither in the HPLMN (if the EHPLMN list is not present or is empty) nor in an EHPLMN (if the EHPLMN list is present) nor in a visited PLMN of the home country, and the USIM file EFUAC_AIC indicates the UE is configured for access identity 2, the UE shall not consider access identity 2 to be valid , until the UE receives the MCS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message or of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message being set to "Access identity 2 valid" from the RPLMN or from an equivalent PLMN. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, the contents of the USIM file EFUAC_AIC as specified in TS 31.102 and the rules specified in Table 4.5.2.1 are used to determine the applicability of access identity 2. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, and the USIM file EFUAC_AIC does not indicate the UE is configured for access identity 2, the UE uses the MCS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message or of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message to determine if access identity 2 is valid. When the UE is in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, and the USIM file EFUAC_AIC indicates the UE is configured for access identity 2, the MCS indicator bit of the 5GS network feature support IE and the Priority indicator IE is not applicable. When the UE is not in the HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present) or in a visited PLMN of the home country, the contents of the USIM file EFUAC_AIC are not applicable. The UE checks the conditions specified in subclause 4.4.3.1.1 of TS 23.122 to determine if access identity 3 is valid, and the applicability of access identity 3. When the UE is in its HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present), the contents of the USIM file EFACC as specified in TS 31.102 and the rules specified in Table 4.5.2.1 are used to determine the applicability of access classes 11 and 15. When the UE is not in its HPLMN (if the EHPLMN list is not present or is empty) or in an EHPLMN (if the EHPLMN list is present), access classes 11 and 15 are not applicable. When the UE is in the HPLMN or in a visited PLMN of the home country, the contents of the USIM file EFACC as specified in TS 31.102 and the rules specified in Table 4.5.2.1 are used to determine the applicability of access classes 12 - 14. When the UE is neither in the HPLMN nor in a visited PLMN of the home country, access classes 12-14 are not applicable. In order to determine the access category applicable for the access attempt, the NAS shall check the rules in Table 4.5.2.2, and use the access category for which there is a match for barring check. If the access attempt matches more than one rule, the access category of the lowest rule number shall be selected. If the access attempt matches more than one operator-defined access category definition, the UE shall select the access category from the operator-defined access category definition with the lowest precedence value (see subclause 4.5.3).

When the UE needs to initiate an access attempt in one of the events listed in subclause 4.5.1, the UE shall determine one or more access identities from the set of standardized access identities, and one access category from the set of standardized access categories and operator-defined access categories, to be associated with that access attempt. The set of the access identities applicable for the request is determined by the UE in the following way:

1. for each of the access identities 1, 2, 11, 12, 13, 14 and 15 in Table 4.5.2A.1, the UE shall check whether the access identity is applicable in the selected SNPN, if a new SNPN is selected, or otherwise if it is applicable in the RSNPN or equivalent SNPN; and
2. if none of the above access identities is applicable, then access identity 0 is applicable.

The contents of the unified access control configuration in the "list of subscriber data" stored in the ME (see TS 23.122), if an entry of "list of subscriber data" is selected, or in the USIM (see TS 31.102), if the PLMN subscription is selected, and the rules specified in Table 4.5.2A.1 are used to determine the applicability of access identity 1 in the SNPN. When the contents of the unified access control configuration in the "list of subscriber data" stored in the ME (see TS 23.122), if an entry of "list of subscriber data" is selected, or in the USIM (see TS 31.102), if the PLMN subscription is selected, do not indicate the UE is configured for access identity 1 for the SNPN, the UE uses the MPS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message and the MPS indicator bit of the Priority indicator IE in the CONFIGURATION UPDATE COMMAND message to determine if access identity 1 is valid. The contents of the unified access control configuration in the "list of subscriber data" stored in the ME (see TS 23.122), if an entry of "list of subscriber data" is selected, or in the USIM (see TS 31.102), if the PLMN subscription is selected, and the rules specified in Table 4.5.2A.1 are used to determine the applicability of access identity 2 in the SNPN. When the contents of the unified access control configuration in the "list of subscriber data" stored in the ME (see TS 23.122), if an entry of "list of subscriber data" is selected, or in the USIM (see TS 31.102), if the PLMN subscription is selected, do not indicate the UE is configured for access identity 2 for the SNPN, the UE uses the MCS indicator bit of the 5GS network feature support IE in the REGISTRATION ACCEPT message to determine if access identity 2 is valid. The contents of the unified access control configuration in the "list of subscriber data" stored in the ME (see TS 23.122), if an entry of "list of subscriber data" is selected, or in the USIM (see TS 31.102), if the PLMN subscription is selected, and the rules specified in Table 4.5.2A.1 are used to determine the applicability of access classes 11 to 15 in the SNPN. In order to determine the access category applicable for the access attempt, the NAS shall check the rules in Table 4.5.2A.2, and use the access category for which there is a match for barring check. If the access attempt matches more than one rule, the access category of the lowest rule number shall be selected. If the access attempt matches more than one operator-defined access category definition, the UE shall select the access category from the operator-defined access category definition with the lowest precedence value (see subclause 4.5.3).