Initial Registration¶

Learning objectives¶

After reading this page, you will be able to:

• Explain the Why (why a UE must register with the network) as the prerequisite for incoming calls, outgoing calls, and data communication.
• Explain, in order, the broad steps of Initial Registration (registration request → identity verification → security establishment → subscriber data retrieval → registration accept).
• Follow the Call Flow of Initial Registration in the order the actors appear: UE / (R)AN / AMF / AUSF / UDM.
• Explain what the key Messages and key IEs — Registration Request / Authentication / Security Mode / Registration Accept, etc. — are for.
• Explain the 5GMM state transitions (DEREGISTERED → REGISTERED-INITIATED → REGISTERED) with a diagram.
• Use Wireshark Display Filters to analyze the registration procedure's packets (the structure of NAS nested inside NGAP).
• Isolate typical registration failures, such as authentication failure, GUTI mismatch, NG Setup not established, and unprovisioned subscribers.
• Contrast the differences between the 4G (EPC) Attach procedure and 5G Initial Registration.

Prerequisites¶

It will go more smoothly if you understand the following first. If you are not there yet, start from the Curriculum.

• SBA / NF (the ideas of Service Based Architecture and Network Function) → NF Dictionary
• N1 / N2 (the UE⇔AMF and gNB⇔AMF interfaces) → N1 / N2
• NAS / NGAP (the control protocol carried over N1, and the radio-node control protocol on N2) → Protocol Dictionary
• The roles of the main NFs → AMF / AUSF / UDM

What you'll learn in this chapter¶

This chapter is limited to Initial Registration. It is the procedure by which a UE registers with the network for the first time after being powered on.

• Mobility Registration Update (registration update across serving areas)
• Periodic Registration Update (periodic registration update)

are out of scope for this chapter. These are separate Registration types; they share much in common but branch differently. They will be covered in future chapters (see Next Step).

Why — why registration is necessary¶

Let's start from the Why (why it is needed). Merely powering on a UE leaves it a "terminal that does not exist" as far as the network is concerned. In this state, none of the following is possible.

• Cannot receive calls — the network does not know which area the UE is in, so it cannot tell where to page it.
• Cannot originate calls — there is no foundation (security, context) on which to send control signaling.
• Cannot do data communication — the prerequisites for setting up a PDU Session are not in place.

Registration is the procedure by which the UE declares "I am here; please let me use the network," and the network establishes the following.

1. Grasping the serving area — which area (TA: Tracking Area) the UE is in.
2. Grasping the state — whether it is registered, and whether it is connected or idle.
3. Grasping the capabilities — which security algorithms and slices the UE can use.
4. Identity verification (authentication) — confirming it is not an impersonation.
5. Security establishment — sharing keys to encrypt and integrity-protect subsequent signaling.

Only when these are in place does the foundation for all subsequent procedures — incoming calls, outgoing calls, and data communication — come into being.

Overview¶

In Initial Registration, the following broad flow takes place.

After power-on, the UE sends a registration request (Registration Request) to the AMF via the gNB (base station) → the AMF coordinates with AUSF/UDM to perform identity verification (authentication) → NAS security is established → subscriber data is retrieved from the UDM → and finally the AMF returns a registration accept (Registration Accept) to the UE and assigns a 5G-GUTI. The UE returns Registration Complete, and it is done.

flowchart LR
    UE([UE]) -->|1.Registration Request| AMF[AMF]
    AMF -->|2.Authentication| AUTH{AUSF / UDM}
    AMF -->|3.Establish Security| UE
    AMF -->|4.Retrieve subscriber data| UDM[UDM]
    AMF -->|5.Registration Accept| UE

Basic Concept — a beginner-friendly explanation¶

To understand initial registration, grasp three keywords.

1. 5GMM state (the registration state)¶

5GMM = 5G Mobility Management (5G's mobility management). Regarding registration, a UE has mainly two states.

• 5GMM-DEREGISTERED (not registered) — a state where, from the network's viewpoint, it "is not there."
• 5GMM-REGISTERED (registered) — a state where serving area, state, and keys are established and services can be used.

Initial Registration is the procedure that transitions from DEREGISTERED → REGISTERED (details in State Machine).

2. Identifiers (the names that represent the UE)¶

3. NAS and NGAP (the two protocols that carry the registration)¶

• NAS (Non-Access Stratum) — control messages exchanged directly between the UE and the AMF (Registration Request, etc.). The gNB does not look inside; it just carries them. → N1
• NGAP (NG Application Protocol) — the control protocol between the gNB and the AMF. It puts NAS messages into NGAP messages and carries them. → N2

In other words, the registration request has the structure "the gNB delivers the NAS (the letter) to the AMF by putting it into NGAP (the envelope)." This nesting structure becomes important in Packet Analysis.

Architecture¶

The elements involved in Initial Registration and the interfaces that connect them.

flowchart LR
    UE([UE]) ---|"N1 (NAS)"| AMF
    UE -.RRC.- RAN["(R)AN / gNB"]
    RAN ---|"N2 (NGAP)"| AMF[AMF]
    AMF ---|"N12"| AUSF[AUSF]
    AMF ---|"N8"| UDM[UDM]
    AUSF ---|"N13"| UDM
    AMF ---|"N15"| PCF[PCF]

The role of each element is as follows.

• UE — the terminal requesting registration. It generates NAS and responds to authentication.
• (R)AN / gNB — the radio access. It puts the UE's NAS onto NGAP and relays it to the AMF, and performs AMF selection.
• AMF — the command center of registration. It terminates N1 (NAS) / N2 (NGAP) and orchestrates authentication, security, subscriber data retrieval, and registration accept.
• AUSF — the authentication server. It executes the 5G-AKA authentication processing (with the AMF via N12, and with the UDM via N13). Based on the HE AV received from the UDM, it derives HXRES* / KSEAF (it is not the entity that generates the AV itself. TS 33.501 §6.1.3.2).
• UDM — subscriber data management. The UDM/ARPF generates authentication vectors (AV) (TS 33.501 §6.1.3.2), and is also the source of subscriber data (N8/N13).
• PCF (Policy Control Function, conditional) — provides Access & Mobility policy (N15). An optional step in this chapter.

For the details of the interfaces, see the Interface Dictionary.

Network Function (the NFs that appear)¶

Interface / Protocol¶

The interfaces and protocols used in this procedure.

For the details of protocols, see the Protocol Dictionary; for the list of interfaces, see the Interface Dictionary.

Procedure — Call Flow¶

This is the heart of this page. The main steps of Initial Registration, conforming to 3GPP TS 23.502 §4.2.2.2.2 (General Registration), are shown in a Mermaid sequenceDiagram.

sequenceDiagram
    autonumber
    participant UE
    participant RAN as (R)AN / gNB
    participant AMF
    participant AUSF
    participant UDM
    participant PCF

    Note over UE,RAN: RRC connection establishment (radio side, outline)
    UE->>RAN: Carry Registration Request (NAS)
    Note right of RAN: TS 24.501 §5.5.1
    RAN->>AMF: Put NAS onto Initial UE Message (NGAP)
    Note right of RAN: Perform AMF selection

    opt New registration / 5G-GUTI unknown or invalid
        AMF->>UE: Identity Request (NAS)
        UE->>AMF: Identity Response (SUCI)
    end

    AMF->>AUSF: Nausf_UEAuthentication_Authenticate (start authentication)
    AUSF->>UDM: Nudm_UEAuthentication_Get (request AV)
    UDM-->>AUSF: Generate HE AV (UDM/ARPF): RAND, AUTN, XRES*, KAUSF
    Note right of AUSF: AUSF derives HXRES*/KSEAF (TS 33.501 §6.1.3.2)
    AUSF-->>AMF: Authentication challenge (RAND, AUTN)
    AMF->>UE: Authentication Request (RAND, AUTN)
    UE->>AMF: Authentication Response (RES*)
    AMF->>AUSF: Request RES* verification
    AUSF-->>AMF: Authentication success + KSEAF
    Note over UE,AUSF: 5G-AKA / TS 33.501 §6.1

    AMF->>UE: Security Mode Command (NAS)
    UE->>AMF: Security Mode Complete (NAS)
    Note over UE,AMF: NAS security established / TS 24.501 §5.4.2

    AMF->>UDM: Nudm_UECM_Registration (AMF registration)
    AMF->>UDM: Nudm_SDM_Get (retrieve subscriber data)
    UDM-->>AMF: Access & Mobility Subscription Data
    AMF->>UDM: Nudm_SDM_Subscribe (subscribe to change notifications)

    opt Conditional (configuration/situation dependent)
        AMF->>PCF: Npcf_AMPolicyControl_Create (AM policy)
        PCF-->>AMF: AM Policy
    end

    AMF->>RAN: Initial Context Setup Request (NGAP)
    AMF->>UE: Registration Accept (NAS: 5G-GUTI, allowed NSSAI)
    UE->>AMF: Registration Complete (NAS)
    Note over UE,AMF: Registration complete / 5GMM-REGISTERED

Step-by-step explanation (numbers correspond to the diagram above)¶

1. UE→(R)AN: establish an RRC connection (radio-side outline) and carry the Registration Request (NAS).
2. (R)AN→AMF: the gNB puts the NAS onto an Initial UE Message (NGAP) and sends it. At the same time it performs AMF selection (choosing an appropriate AMF).
3. (Only for new registration / when the GUTI is unknown or invalid) AMF→UE Identity Request / UE→AMF Identity Response (SUCI). When the 5G-GUTI is valid, this identity request may be omitted (it varies with conditions = situation dependent).
4. Authentication (5G-AKA): retrieve the authentication vector via AMF→AUSF Nausf_UEAuthentication_Authenticate and AUSF→UDM Nudm_UEAuthentication_Get. Perform challenge/response via AMF→UE Authentication Request (RAND, AUTN) and UE→AMF Authentication Response (RES*). When the 5G-GUTI is valid and the security context can be reused, authentication can sometimes be omitted (omission depends on conditions = situation dependent).
5. Security establishment: AMF→UE Security Mode Command / UE→AMF Security Mode Complete. This encrypts and integrity-protects the subsequent NAS.
6. UDM coordination: AMF→UDM Nudm_UECM_Registration (records with the UDM which AMF this UE is registered to), Nudm_SDM_Get (retrieves subscriber data), Nudm_SDM_Subscribe (subscribes to notifications of data changes).
7. (Optional/conditional) AMF→PCF Npcf_AMPolicyControl_Create to retrieve AM policy (configuration/situation dependent).
8. Accept: AMF→(R)AN Initial Context Setup Request (NGAP) to establish the UE context, and AMF→UE Registration Accept (NAS) to notify of the 5G-GUTI assignment and allowed NSSAI.
9. Complete: UE→AMF Registration Complete (NAS). This is a confirmation that the procedure has completed; the UE's transition to 5GMM-REGISTERED occurs at the moment the Registration Accept is received (TS 24.501 §5.5.1.2.4).

Reference: TS 23.502 §4.2.2.2.2 (the overall General Registration procedure), TS 24.501 §5.5.1 (the NAS-side Registration procedure).

Signal Flow¶

The key Messages organized in a table. The IEs are made consistent with the Message Dictionary.

For the detailed IEs and reference specs of each Message, see the Message Dictionary.

State Machine¶

The 5GMM state transitions on the UE side (basis: TS 24.501 §5.1.3).

stateDiagram-v2
    [*] --> DEREGISTERED
    DEREGISTERED --> REGISTERED_INITIATED: Send Registration Request
    REGISTERED_INITIATED --> REGISTERED: Receive Registration Accept
    REGISTERED_INITIATED --> DEREGISTERED: Receive Registration Reject / T3510 expiry
    REGISTERED --> DEREGISTERED: De-registration / registration lapse
    REGISTERED --> [*]

• 5GMM-DEREGISTERED — not registered. Sending a Registration Request from here starts the transition.
• 5GMM-REGISTERED-INITIATED — a transient state after sending the registration request, waiting for a response. It succeeds with Registration Accept, or returns to DEREGISTERED on Registration Reject / timer expiry (e.g. T3510).
• 5GMM-REGISTERED — registration complete. Services are available.

For the details of timers, see the Timer Dictionary.

Packet Analysis (Wireshark)¶

The key points when analyzing Initial Registration with Wireshark.

Key Display Filters¶

Points to note when decoding (key IEs)¶

• 5GS registration type — the kind, such as initial / mobility updating. For Initial Registration it is initial registration.
• 5GS mobile identity — whether it is SUCI or 5G-GUTI. On the first attempt, SUCI is present.
• UE security capability — the encryption/integrity algorithms the UE supports.
• RAND / AUTN (inside Authentication Request) — the random value and authentication token of the authentication challenge.
• 5G-GUTI (inside Registration Accept) — the temporary ID assigned by the AMF.

The structure of NAS nested inside NGAP¶

Inside an NGAP message (e.g. Initial UE Message) there is a NAS-PDU, and inside that is the 5GS NAS (Registration Request). In the packet detail pane it is displayed hierarchically as follows.

NGAP-PDU
 └─ InitialUEMessage
     └─ NAS-PDU
         └─ 5GS NAS Message
             └─ Registration Request

Configuration¶

The structural-level key points of the configuration for making Initial Registration work. Specific values and vendor-specific details (Cisco, etc.) are implementation dependent, and no fictitious values are written here.

On the AMF side (e.g. Open5GS / free5GC AMF configuration)¶

• PLMN ID (MCC/MNC) — identifies which operator's network it is.
• GUAMI (Globally Unique AMF Identifier) — uniquely identifies the AMF and is the basis for 5G-GUTI assignment.
• TAI / TAC (Tracking Area) — the area to serve. It must match the TA of the gNB.
• PLMN Support / S-NSSAI (supported slices) — the basis for determining the allowed NSSAI.

Provisioning subscriber information (UDM/UDR)¶

• Registration of the subscriber (SUPI/IMSI) is required on the UDM/UDR side.
• Provisioning of the authentication information (long-term keys such as K, OPc) is required. Without this, authentication (5G-AKA) will not work.
• Registration of subscription data (Access & Mobility Subscription Data, allowed slices, etc.).

Trouble Shooting¶

Isolating typical registration failures. For the details of Cause values, see the Cause Dictionary.

Comparison with EPC¶

A comparison so that those experienced with 4G (EPC) can bridge to 5G.

Release differences¶

The main topics related to registration. Uncertain items are marked to be confirmed and not asserted.

• Rel-15 — the basic 5GC procedures were established. The foundations of Initial Registration / 5G-AKA / SUCI / SBA were specified.
• Rel-16 — the generation in which extensions to network-slice-related registration/selection and security enhancements advanced (the extent to which specific features were woven into the registration procedure is to be confirmed).
• Rel-17 — functional extensions continued (the specifics of the impact on the registration procedure are to be confirmed).
• Rel-18 (5G-Advanced) — further extensions (the specific registration-related differences are to be confirmed).

3GPP Specification¶

FAQ¶

Summary¶

• Initial Registration is the procedure that transitions the UE from 5GMM-DEREGISTERED → REGISTERED and builds the foundation for incoming calls, outgoing calls, and data communication.
• The broad flow is registration request → authentication (5G-AKA) → security establishment → subscriber data retrieval → registration accept.
• The command center is the AMF, authentication is by AUSF/UDM, and subscriber data is from the UDM.
• The registration request is carried by the gNB to the AMF with NAS put onto NGAP (a nested structure).
• The real name SUPI is concealed on the air as SUCI, and after registration the 5G-GUTI is used (privacy protection).
• The basis is TS 23.502 §4.2.2.2.2 / TS 24.501 §5.5.1 and §5.1.3 / TS 33.501 §6.

Practice — comprehension check and exercises¶

Comprehension check¶

Exercises¶

Problem: Reorder the following 9 main Initial Registration steps into the correct order.

A. Security Mode Command / Complete
B. Registration Request (carried in Initial UE Message)
C. Registration Complete
D. Authentication Request / Response (5G-AKA)
E. Registration Accept (5G-GUTI assignment)
F. Identity Request / Response (when the GUTI is unknown)
G. Nudm_UECM_Registration / Nudm_SDM_Get
H. Initial Context Setup Request
I. Npcf_AMPolicyControl_Create (conditional)

Next Step¶

The next steps to deepen your understanding.

• Authentication chapter (the details of 5G-AKA / EAP-AKA')
• Security chapter (NAS security and the key hierarchy KSEAF/KAMF)
• PDU Session chapter (establishing the pipe for data communication)
• Mobility Registration Update chapter (the registration update out of scope of this chapter = the equivalent of 4G's TAU) / Periodic Registration Update chapter (periodic registration update = liveness check)
• Related NFs: AMF / AUSF / UDM
• Related Interfaces: N1 / N2
• Dictionaries: Message Dictionary / Timer Dictionary / Cause Dictionary / Protocol Dictionary / NF Dictionary / Interface Dictionary