3GPP TS 23.502
Procedures for the 5G System (5GS) — Stage 2
V18.6.0 (2024-06) 23-Series Procedures 1. Scope
▶Defines the detailed signaling procedures for the 5G System including registration, authentication, PDU session management, service request, handover, and deregistration. Each procedure involves multiple NFs communicating over SBI (HTTP/2) and reference points (N1/N2/N3/N4).
2. Registration Procedure
▶
Initial Registration (Simplified):
UE gNB AMF AUSF UDM
── ─── ─── ──── ───
│ │ │ │ │
│──Registration──▷│ │ │ │
│ Request │──NGAP Init──▷│ │ │
│ (SUCI,5G-GUTI │ UE Message │ │ │
│ Requested │ │ │ │
│ NSSAI) │ │ │ │
│ │ │──Nausf_UEAuth─▷│ │
│ │ │ Authenticate │──Nudm_UEAuth▷│
│ │ │ │◁────────────│
│ │ │◁──Auth Vec───│ │
│ │ │ │ │
│◁──Auth Request─────────────── │ (5G-AKA or │ │
│ │ │ EAP-AKA') │ │
│──Auth Response─────────────── ▷│ │ │
│ │ │ │ │
│ │ │──── NAS Security Mode ────▷│
│◁── NAS SMC ────────────────── │ (ciphering + integrity │
│──── NAS SMP ──────────────── ▷│ algorithm negotiation) │
│ │ │ │ │
│ │ │──Nudm_SDM───────────────── ▷│
│ │ │ (get subscription data) │
│ │ │◁──────────────────────────│
│ │ │ │ │
│◁──Registration─────────────── │ │ │
│ Accept │ │ │ │
│ (5G-GUTI, │ │ │ │
│ Allowed NSSAI)│ │ │ │
│ │ │ │ │
| Step | Interface | Protocol | Security Action |
|---|---|---|---|
| 1. Registration Request | N1 (UE→AMF) | NAS 5G-MM | SUCI sent (encrypted SUPI) |
| 2. NGAP Initial UE | N2 (gNB→AMF) | NGAP/SCTP | IPsec protected |
| 3. Authentication | SBI (AMF→AUSF→UDM) | HTTP/2 | mTLS + OAuth token |
| 4. NAS SMC | N1 (AMF→UE) | NAS 5G-MM | Algorithm negotiation, ABBA |
| 5. Registration Accept | N1 (AMF→UE) | NAS 5G-MM | Integrity + ciphering active |
3. Authentication Procedure
▶
5G-AKA Authentication:
UE AMF/SEAF AUSF UDM/ARPF
── ──────── ──── ────────
│ │ │ │
│ │──Nausf_UEAuth──── ▷│ │
│ │ (SUCI/SUPI) │──Nudm_UEAuth──── ▷│
│ │ │ │
│ │ │ ┌─────────────┐ │
│ │ │ │ Generate: │ │
│ │ │ │ RAND, AUTN, │ │
│ │ │ │ XRES*, HXRES*│ │
│ │ │ │ K_AUSF │ │
│ │ │ └─────────────┘ │
│ │ │◁──5G HE AV────────│
│ │ │ (RAND,AUTN, │
│ │◁──5G SE AV────────│ HXRES*,K_SEAF) │
│ │ (RAND,AUTN, │ │
│ │ HXRES*,K_SEAF) │ │
│ │ │ │
│◁──Auth-Req────────────│ │ │
│ (RAND, AUTN) │ │ │
│ │ │ │
│ ┌─────────────┐ │ │ │
│ │ Verify AUTN │ │ │ │
│ │ Compute RES* │ │ │ │
│ └─────────────┘ │ │ │
│ │ │ │
│──Auth-Resp────────── ▷│ │ │
│ (RES*) │ │ │
│ │ verify HXRES* │ │
│ │ = SHA256(RES*) │ │
│ │ │ │
│ │──Nausf_UEAuth──── ▷│ │
│ │ Confirm (RES*) │ verify XRES*=RES* │
│ │◁──Success─────────│ │
│ │ (K_SEAF) │ │
Key derivation chain: K (USIM) → CK,IK → K_AUSF → K_SEAF → K_AMF → K_NASenc, K_NASint → K_gNB → K_RRCenc, K_RRCint, K_UPenc, K_UPint
4. PDU Session Management
▶4.1 PDU Session Establishment
▶
PDU Session Establishment:
UE gNB AMF SMF PCF UPF DN
── ─── ─── ─── ─── ─── ──
│ │ │ │ │ │ │
│──PDU Est─▷│──NGAP──▷│ │ │ │ │
│ Request │ │──Nsmf──▷│ │ │ │
│ (S-NSSAI,│ │ Create │ │ │ │
│ DNN) │ │ SMCtx │──Npcf──▷│ │ │
│ │ │ │ SMPolicy│ │ │
│ │ │ │◁───────│ │ │
│ │ │ │ │ │ │
│ │ │ │──N4 Session Establishment──▷│
│ │ │ │ (PDR, FAR, QER, URR) │
│ │ │ │◁── N4 Session Est. Resp ───│
│ │ │ │ │ │ │
│ │ │◁────── │ │ │ │
│ │◁── N2 ─│ PDU Ses │ │ │ │
│ │ Setup │ Accept │ │ │ │
│◁── NAS ─│ Req │ │ │ │ │
│ PDU Ses │ │ │ │ │ │
│ Accept │ │ │ │ │ │
│ │ │ │ │ │ │
│ │── N3 GTP-U Tunnel Established ──────▷│ │
│ │ (TEID allocated, QFI mapped) │──N6───▷│
│ │ │ │ │ │ │
| Message | Key IEs | Security Check |
|---|---|---|
| PDU Session Establishment Request | PDU Session ID, S-NSSAI, DNN, PDU Session Type | NAS integrity verified, slice authorization |
| Nsmf_PDUSession_CreateSMContext | SUPI, PDU Session ID, S-NSSAI, DNN | OAuth token validates AMF→SMF service access |
| N4 Session Establishment | PDR (Source IF, UE IP), FAR (Destination IF, GTP params) | PFCP association verified, Node ID checked |
| N2 PDU Session Resource Setup | GTP-U TEID, QoS Profile, UP Security Policy | IPsec on N2, UP security mode indicated |
4.2 PDU Session Modification
▶| Trigger | Initiator | Key Actions |
|---|---|---|
| QoS change | SMF (PCF-triggered) | N4 Session Modification (update QER/PDR), N2 resource modification |
| UPF relocation | SMF | New N4 session at target UPF, N9 tunnel setup, old session release |
| UE-requested | UE via NAS | PDU Session Modification Request → SMF validates against policy |
| AN release | gNB/AMF | N3 tunnel suspended, N4 buffering rules activated |
4.3 PDU Session Release
▶| Release Type | Trigger | Cleanup Actions |
|---|---|---|
| UE-initiated | NAS PDU Session Release Request | SMF→UPF: N4 Session Deletion, TEID freed, IP released |
| Network-initiated | SMF policy / inactivity timer | NAS Release Command, N2 resource release, N4 cleanup |
| AMF-initiated | Deregistration / AMF failure | SMF notified, all N4 sessions cleaned, TEIDs freed |
5. Service Request Procedure
▶
UE-triggered Service Request (CM-IDLE → CM-CONNECTED):
UE gNB AMF SMF UPF
── ─── ─── ─── ───
│ │ │ │ │
│──Service Req──▷│──NGAP Init──▷│ │ │
│ (NAS, integ │ UE Message │ │ │
│ protected) │ │ │ │
│ │ │ Verify NAS │ │
│ │ │ integrity │ │
│ │ │ │ │
│◁── NAS SMP ────────────────── │ │ │
│ │ │ │ │
│ │ │──Nsmf_PDU───▷│ │
│ │ │ UpdateSMCtx │ │
│ │ │ │──N4 Mod Req─▷│
│ │ │ │ (activate │
│ │ │ │ buffered │
│ │ │ │ DL data) │
│ │ │ │◁── N4 Resp──│
│ │ │◁────────────│ │
│ │◁── N2 ──────│ │ │
│ │ PDU Sess │ │ │
│ │ Resource │ │ │
│ │ Setup │ │ │
│ │ │ │ │
│◁═══ User Plane Data ════════════════════════════▷│ │
│ (GTP-U tunnel re-established) │ │
6. Handover Procedures
▶| Handover Type | Path | Key Security Actions | GTP Impact |
|---|---|---|---|
| Xn Handover | Source gNB → Target gNB (direct) | NH/NCC key derivation for new K_gNB; AS security re-established | N3 tunnel path switch; indirect forwarding via N9 optional |
| N2 Handover | Source gNB → AMF → Target gNB | New K_gNB derived at AMF; AMF may change; NAS security maintained | N3 TEID update at UPF; N4 modification to redirect |
| Inter-AMF | Source AMF → Target AMF | Security context transfer; new K_AMF derived if different SEAF | SMF updated with new AMF; N4 sessions maintained |
| 4G↔5G | eNB/MME ↔ gNB/AMF | Mapped security context; ABBA prevents bidding-down | GTP-C (S10/N26) creates/updates bearer/session |
Xn Handover — Key Derivation:
Security context:
K_gNB (source) ──▷ NH (Next Hop) ──▷ K_gNB* (target)
Key chain:
K_AMF → K_gNB → NH₁ → K_gNB* (target) → NH₂ → ...
NCC (Next-hop Chaining Counter) tracks key freshness
Prevents key reuse across handovers
7. Deregistration
▶| Type | Initiator | Actions |
|---|---|---|
| UE-initiated | UE (power off, SIM removal) | NAS Deregistration Request → AMF releases all PDU sessions, notifies SMF, deletes security context |
| Network-initiated | AMF (subscription revoked, ODB) | NAS Deregistration Request to UE → cleanup all sessions, purge context from UDM |
| Implicit | AMF (mobile reachable timer) | No NAS exchange → AMF deletes context after timer expiry |
8. Security Implications per Procedure
▶| Procedure | Attack Vector | Protection |
|---|---|---|
| Registration | SUPI interception, rogue AMF, replay | SUCI encryption, mutual auth (AKA), NAS SQN-based replay protection |
| Authentication | AUSF impersonation, AV theft, key compromise | SBI mTLS, key separation (K_AUSF/K_SEAF/K_AMF), home control |
| PDU Session Est. | Unauthorized DNN/slice access, QoS manipulation | Subscription check, NSSAA, PCF policy enforcement, N4 PFCP auth |
| Service Request | Replay of service request, fake paging | NAS integrity with fresh keys, paging restrictions |
| Handover | Key reuse, bidding-down to 4G, GTP redirect | NH/NCC chain, ABBA parameter, N3/N9 IPsec |
| Deregistration | Forced deregistration DoS | NAS integrity verification required before accepting |