SMS over NAS — Short Messages Carried on NAS¶
Learning objectives¶
After reading this chapter, you will be able to:
- Explain that SMS over NAS is "a scheme that carries SMS on NAS (control-plane) messages."
- Explain why SMS needs neither the QoS Flow/IMS of VoNR and is self-contained within NAS (N1) alone.
- Diagram the flow in which the UE negotiates the availability of SMS over NAS at Registration and the AMF selects and registers an SMSF.
- Explain the difference between the Call Flows of MO-SMS (send) and MT-SMS (receive) (MT wakes the UE with Paging).
- Explain that the SMSF bridges to the SMSC/IP-SM-GW to accomplish the actual delivery.
Prerequisites¶
- Registration (Initial Registration) — the SMS over NAS availability negotiation and SMSF registration happen here
- Paging — the mechanism to wake a CM-IDLE UE for MT-SMS
- Service Request — the UE responds to Paging and returns to the connected state
- Supplementary: SMSF / AMF / UDM / N1(NAS)
What you'll learn in this chapter¶
- Why — why SMS needs a dedicated way to be carried, and why it is carried on NAS
- Basic Concept — the idea of "SMS as an envelope that rides along on control messages"
- Architecture — the 5GC players involved in SMS over NAS
- Procedure — Call Flow — negotiation at Registration → MO-SMS (send) → MT-SMS (receive)
- The difference between MO and MT — what is symmetric and what is asymmetric between send and receive
- Comparison with EPC / Release differences / Trouble Shooting / FAQ / Practice
Why — why SMS needs a dedicated way to be carried¶
SMS still plays an important role as a basic service that delivers authentication codes (one-time passwords) and various notifications even in situations where voice calls or data communication are unavailable. That is precisely why 5G also needs a reliable means of carrying SMS.
What makes this tricky is that 5G voice (VoNR) presumes a heavy mechanism of IMS + a dedicated QoS Flow. If SMS too required the same foundation (an IMS PDU Session / QoS Flow), it could end up meaning that SMS cannot be sent while not a single data PDU Session is established. But SMS is a service you want to deliver even "right after registration, before any data connection exists."
So 5G prepared a scheme that carries SMS not on the user plane (PDU Session/QoS Flow) but on the control-plane NAS (N1) messages. This is SMS over NAS. As long as the UE is registered with the 5GC, it can send and receive SMS with just the NAS exchanges with the AMF — no data PDU Session and no IMS required.
Overview¶
SMS over NAS is realized through the cooperation of the following main players.
- UE — sends and receives SMS as the contents (payload) of NAS messages
- AMF — the termination of NAS (N1). It extracts the SMS inside the NAS delivered from the UE and relays it to the SMSF (and vice versa)
- SMSF (SMS Function) — the core NF that handles SMS send/receive. It bridges between the AMF and the SMSC/IP-SM-GW (details in SMSF)
- UDM — holds SMS subscription information and is the registration target for the SMSF at Registration
SMS is carried in the flow: "negotiate at registration so that SMS over NAS can be used, and at send/receive time ride along on NAS and pass via AMF⇔SMSF." Unlike VoNR, the biggest distinguishing feature is that neither adding a QoS Flow nor SIP registration to IMS is required.
Basic Concept — a beginner-friendly explanation¶
SMS over NAS can be likened to "an envelope that rides along on control messages."
- Everyday data communication (web, video) flows along the "cargo road" that is the user plane
- SMS is a small envelope. Rather than building a dedicated cargo road (PDU Session), it is delivered by riding along on the control-purpose courier (NAS) that the UE and 5GC are already exchanging
- The one that sorts these hitchhiking envelopes is the SMSF. It passes the arrived envelope to the SMSC (the SMS depot)
Whereas a phone call (VoNR) needed to "lay a dedicated lane and call the dispatch center (IMS)," SMS gets by with just adding one envelope to the existing courier. That is why, even without a data connection, SMS is delivered as long as you are registered.
Column: What does riding along on NAS (Non-Access Stratum) mean?
NAS is the layer of control messages (registration, authentication, session management, etc.) exchanged between the UE and the 5GC (AMF) (N1(NAS)). In SMS over NAS, the contents of the SMS (the SMS messages of the RP/CP layers) are carried wrapped as a Container inside these NAS messages. From the UE's viewpoint, SMS flows riding on the NAS exchange with the AMF, and the AMF extracts only that SMS part and passes it to the SMSF.
The important point is that the AMF does not interpret the SMS contents; it merely extracts it from the NAS container and relays it to the SMSF. The processing of the SMS itself (handing it over to the SMSC, etc.) is handled by the SMSF (SMSF).
Architecture¶
graph LR
UE["UE"] -- "SMS embedded in N1(NAS)" --> AMF["AMF
(NAS termination / relay)"]
AMF -- "SBI(Nsmsf)" --> SMSF["SMSF
(SMS processing)"]
SMSF -- "SBI(Nudm)" --> UDM["UDM
(SMS subscription info)"]
AMF -- "SMSF registration" --> UDM
SMSF -- "to SMSC/IP-SM-GW" --> SMSC["SMSC / IP-SM-GW"]
How to read the diagram: the UE's SMS arrives at the AMF as the contents of a NAS (N1) message. The AMF extracts the SMS part and relays it to the SMSF over SBI(Nsmsf). The SMSF hands it over to the SMSC/IP-SM-GW to accomplish delivery. At Registration, the AMF performs SMSF registration to the UDM, and the SMSF retrieves the SMS subscription information from the UDM. Note the point that none of the SMF/UPF/PCF or QoS Flow of VoNR appears, and it is self-contained within the control plane (NAS + SBI).
Network Function¶
| NF | Role | Information held | APIs used | APIs provided | Related interfaces | Impact on failure |
|---|---|---|---|---|---|---|
| UE | Sends/receives SMS as NAS contents | — | — | — | N1(NAS) | The UE cannot send/receive SMS |
| AMF | NAS termination. Extracts SMS and relays to SMSF | UE context (SMS support capability) | Nsmsf_SMService | Namf_Communication (N1N2, etc.) | N1, SBI | SMS NAS relay impossible |
| SMSF | Processes SMS send/receive, relays to SMSC | SMS context, SMS subscription info | Nudm (subscription info) | Nsmsf_SMService | SBI | SMS over NAS unavailable |
| UDM | Holds SMS subscription info, SMSF registration target | SMS subscription data, SMSF registration | — | Nudm_UECM / Nudm_SDM | SBI | SMS subscription check / SMSF registration impossible |
About the SBI service names
The service provided by the SMSF is Nsmsf_SMService (Activate / Deactivate / UplinkSMS, etc.; the individual operations are to be confirmed), specified in TS 29.540 (see SMSF). The specific SBI service name, operations, ports, etc. that the AMF uses for SMSF relay — anything without confirmation — are marked to be confirmed.
Interface¶
| Interface | Both ends | Transport | Protocol | Port | Procedure used |
|---|---|---|---|---|---|
| N1(NAS) | UE ⇔ AMF | — (over the air, transparent through RAN on N2) | NAS(5GMM/5GSM) + SMS Container | — | Transport of SMS (ride-along) |
| SBI(Nsmsf) | AMF ⇔ SMSF | TCP | SBI(HTTP/2/TLS) | implementation-dependent | SMS relay (Nsmsf_SMService) |
| SBI(Nudm) | SMSF/AMF ⇔ UDM | TCP | SBI(HTTP/2/TLS) | implementation-dependent | SMS subscription info retrieval / SMSF registration |
For details, see the Interface Dictionary.
Procedure — Call Flow¶
SMS over NAS is understood through three parts: (A) the SMS over NAS negotiation at Registration → (B) MO-SMS (send) → (C) MT-SMS (receive).
(A) Negotiation at Registration¶
sequenceDiagram
participant UE
participant AMF
participant UDM
participant SMSF
Note over UE,SMSF: Negotiate SMS over NAS availability during Registration
UE->>AMF: Registration Request ("SMS over NAS request")
AMF->>UDM: Retrieve subscription info (check SMS support)
UDM-->>AMF: SMS subscription present
AMF->>SMSF: Nsmsf SMS Activate (create SMSF context)
SMSF->>UDM: Retrieve SMS subscription data / SMSF registration
SMSF-->>AMF: Activate response (SMS over NAS available)
AMF-->>UE: Registration Accept ("SMS over NAS allowed")
Explanation of the steps:
- In the Registration Request, the UE indicates that it "wants to use SMS over NAS" (capability negotiation).
- The AMF queries the UDM for subscription information and confirms whether the UE has an SMS subscription.
- If there is an SMS subscription, the AMF selects an SMSF, Activates the SMSF context over Nsmsf, and the SMSF retrieves the SMS subscription data from the UDM (SMSF registration is also performed at the same time).
- The AMF returns "SMS over NAS available" to the UE in the Registration Accept. From then on, the UE can send and receive SMS over NAS.
(B) MO-SMS (send: UE→network)¶
sequenceDiagram
participant UE
participant AMF
participant SMSF
participant SMSC as SMSC/IP-SM-GW
UE->>AMF: NAS (Uplink NAS Transport, SMS embedded)
AMF->>SMSF: Nsmsf_SMService UplinkSMS (extract SMS and relay)
SMSF->>SMSC: SMS forward (delivery request)
SMSC-->>SMSF: Acceptance/delivery result
SMSF-->>AMF: Response (delivery report, etc.)
AMF-->>UE: NAS (Downlink NAS Transport, response embedded)
Explanation of the steps: The UE sends the SMS to the AMF as the contents of a NAS message (Uplink NAS Transport, etc.). The AMF extracts the SMS part and relays it to the SMSF over Nsmsf, and the SMSF hands it to the SMSC/IP-SM-GW to request delivery. The delivery result (delivery report) returns to the UE over NAS in the reverse direction.
(C) MT-SMS (receive: network→UE)¶
sequenceDiagram
participant SMSC as SMSC/IP-SM-GW
participant SMSF
participant AMF
participant UE
SMSC->>SMSF: SMS arrives (for UE)
SMSF->>AMF: Hand over MT-SMS via Nsmsf
alt UE is CM-IDLE
AMF->>UE: Paging
UE->>AMF: Service Request (connection resume)
end
AMF->>UE: NAS (Downlink NAS Transport, SMS embedded)
UE-->>AMF: NAS (delivery confirmation)
AMF-->>SMSF: delivery report
SMSF-->>SMSC: delivery-complete notification
Explanation of the steps: The UE-bound SMS arriving from the SMSC/IP-SM-GW is received by the SMSF and handed over to the AMF. If the UE is CM-IDLE (idle), the AMF first wakes the UE with Paging, and after the UE returns to the connected state with a Service Request, the AMF delivers the SMS to the UE as the contents of NAS (Downlink NAS Transport). The delivery confirmation returns over NAS, and the delivery-complete is notified from SMSF→SMSC.
The biggest difference between MO and MT is Paging
Sending (MO) starts from a state where the UE can already send NAS (connected), so Paging is unnecessary. Receiving (MT) is an incoming from the network, and if the UE is idle it must be woken first. This is the same structure as VoNR's MT call.
Signal Flow¶
| Signal | Purpose | Source | Destination | Key IEs | Result |
|---|---|---|---|---|---|
| Registration Request | Request to use SMS over NAS | UE | AMF | "SMS supported/requested" | Negotiation starts |
| Nsmsf SMS Activate | Create SMSF context | AMF | SMSF | SUPI, access type | SMSF registration / becomes available |
| Uplink NAS Transport(SMS) | Send SMS over NAS (MO) | UE | AMF | SMS Container(RP/CP) | AMF extracts SMS |
| Nsmsf_SMService UplinkSMS | Relay SMS to SMSF | AMF | SMSF | SMS payload | Delivery request to SMSC |
| Downlink NAS Transport(SMS) | Deliver SMS over NAS (MT) | AMF | UE | SMS Container(RP/CP) | UE receives SMS |
| delivery report | Delivery result notification | SMSF | AMF/SMSC | Delivery status | MO/MT complete |
About IE names and Container details
The container that wraps SMS inside NAS and the IE names (Uplink/Downlink NAS Transport's Payload container type=SMS, etc.) are specified in the TS 24.501 family, but the specific IE names and section numbers are to be confirmed (do not assert by conjecture). Representative names are used here to illustrate the concept.
The difference between MO and MT (send and receive)¶
| Aspect | MO-SMS (send) | MT-SMS (receive) |
|---|---|---|
| Origin | UE (originating) | SMSC/IP-SM-GW (terminating) |
| Paging | Unnecessary (UE can already send) | Necessary if CM-IDLE (Paging) |
| Flow | UE→AMF→SMSF→SMSC | SMSC→SMSF→AMF→UE |
| Commonalities | Both ride along on NAS, the SMSF relays, no QoS Flow/IMS needed | Same as left |
Comparison with EPC¶
- In 4G/EPC: SMS was provided by schemes such as SMS over SGs (MME⇔MSC) and SMS in MME / SGd (via IP-SM-GW). Control was handled mainly by the MME or the MSC (see also the comparison table in SMSF).
- In 5G: the SMSF exclusively handles SMS over NAS, the AMF does the NAS relay, and the SMSF bridges to the SMSC/IP-SM-GW. The idea of "carrying SMS on the control plane (NAS)" is shared with SMS over SGs, etc., but the difference is that in 5GC, following the SBA, the role has been organized into a dedicated NF, the SMSF (the exact correspondence is to be confirmed).
| Generation | SMS provisioning scheme |
|---|---|
| 4G/EPC | SMS over SGs (MME⇔MSC) / SMS in MME・SGd (via IP-SM-GW) |
| 5G | SMS over NAS (the SMSF processes SMS over NAS, the AMF relays) |
Release differences¶
- Rel-15: SMS over NAS and the SMSF were defined as base functions.
- Rel-16 onward: the presence and details of extensions are to be confirmed against each TS (not asserted in this chapter).
Trouble Shooting¶
| Symptom | Presumed cause | What to check | Logs/Packets | Direction of remedy |
|---|---|---|---|---|
| Cannot send SMS (MO) | SMS over NAS not allowed | Whether it was allowed in Registration Accept | AMF logs, NAS | Check subscription (UDM) / SMSF selection |
| SMS not delivered (MT) | SMSF registration inconsistency | Whether the UDM's SMSF registration is correct | UDM/SMSF logs | Check SMSF registration / subscription info |
| Not delivered to an idle UE | Paging does not occur / fails | Whether there is a Paging response | N2 Paging, RAN | Check Paging / reachability |
| Only some are delivered | Problem on the SMSC/IP-SM-GW side | Connectivity from SMSF to SMSC | SMSF↔SMSC trace | Check SMSC connection settings / to be confirmed |
3GPP Specification¶
- 3GPP TS 23.501 — 5G architecture. The positioning of SMSF/SMS over NAS (section number to be confirmed)
- 3GPP TS 23.502 — SMS-related procedures (SMSF selection at registration, MO/MT-SMS. Section numbers to be confirmed)
- 3GPP TS 24.501 — NAS (5GS) protocol. SMS transport via NAS Transport / SMS Container (section numbers to be confirmed)
- 3GPP TS 29.540 — Specification of Nsmsf (SMService) (individual section numbers to be confirmed)
FAQ¶
Q. Does SMS require IMS or a QoS Flow like VoNR? A. No. Because SMS over NAS rides SMS along on the control plane (NAS), it needs neither SIP registration to IMS nor a dedicated QoS Flow. Even without a data PDU Session, it can send and receive as long as it is registered with the 5GC.
Q. Does the AMF read the contents of the SMS? A. No. The AMF merely extracts the SMS part from the NAS container and relays it to the SMSF; the processing of the SMS itself (handing it over to the SMSC, etc.) is handled by the SMSF.
Q. Why is Paging sometimes needed for receiving (MT)? A. Because an incoming is network-originated, and if the UE is CM-IDLE (a power-saving standby) it cannot immediately receive NAS. It is first woken with Paging, returned to the connected state with a Service Request, and then the SMS is delivered. Sending (MO) does not need this because the UE can already send.
Q. When does SMS over NAS become available? A. From the moment the UE requests it within Registration, the SMS subscription is confirmed at the UDM and SMSF registration is done, and the AMF allows it in the Registration Accept.
Summary¶
- SMS over NAS is a scheme that carries SMS as the contents of NAS (control-plane) messages between UE⇔AMF⇔SMSF.
- Unlike VoNR, it needs neither IMS nor a dedicated QoS Flow, and as long as it is registered with the 5GC, it can send and receive SMS even without a data connection.
- At Registration, the availability of SMS over NAS is negotiated, and the AMF selects the SMSF and registers it to the UDM.
- MO-SMS goes UE→AMF→SMSF→SMSC, and MT-SMS goes in the reverse direction, and MT is preceded by Paging if CM-IDLE.
- The AMF merely relays as the NAS termination; the SMS processing and the bridging to the SMSC are handled by the SMSF (details).
Practice — comprehension check and exercises¶
Comprehension check¶
Q1. Why does SMS over NAS, unlike VoNR, need neither IMS nor a QoS Flow?
Because it carries SMS by riding it along on the control plane (NAS) rather than the user plane (PDU Session/QoS Flow). Since NAS is already usable as long as the UE is registered with the 5GC, it needs neither SIP registration to IMS nor a dedicated QoS Flow. It can deliver SMS even right after registration when there is no data connection.
Q2. To use SMS over NAS at Registration, what do the AMF, UDM, and SMSF do?
The AMF receives the SMS request in the Registration Request, confirms the SMS subscription at the UDM, selects an SMSF, and Activates the context over Nsmsf. The SMSF retrieves the SMS subscription data from the UDM, and SMSF registration is performed to the UDM. The AMF returns availability in the Registration Accept.
Q3. What is the biggest difference between MO-SMS and MT-SMS?
The need for Paging. MO (send) does not need it because the UE can already send NAS, but MT (receive) is network-originated, and if the UE is CM-IDLE it is first woken via Paging → Service Request before delivery.
Exercises¶
- Draw the Call Flows of MO-SMS and MT-SMS side by side and illustrate where they are symmetric and where they are asymmetric (the presence or absence of Paging).
- Summarize in a table the division of roles between SMS over NAS (5G) and SMS over SGs (4G), as pairs of responsible NF (SMSF↔MME/MSC) and carrying layer (NAS↔SGs) (avoid asserting the correspondence, and clearly note the items to be confirmed).
Next Step¶
- VoNR — voice in the same Level4. Contrast with the mechanism that, unlike SMS, requires IMS + a QoS Flow
- Emergency — the special handling of emergency calls (unregistered UE, priority)
- SMSF — dig deeper into the role of the core NF for SMS processing
- Registration — go back to the registration procedure where the SMS over NAS negotiation happens and deepen your understanding