### :school: TEEP 2024_RT LAB_ORAN DPDK

#### :book: Milestone 1: Understanding and Learning Basic Knowledge about 5G & 5GC

:::success
List the essential information of this chapter.
1. know 5gc module how the functions.
2. 5G protocol stack
3. 5G call flow
:::

---

### 1. know 5gc module how the functions.

The 5G core network structure adopts a service-oriented approach, making use of cloud-native and virtualized network functions. This note aims to provide you with a summary of the 5G core network.

**Overall Architecture**
Following is the overal NR Network illustrated based on 3GPP 23.501. The diagram is based mainly on Figure 4.2.3-1 and Figure 4.2.3-2 of 23.501.

**Components of the Network**
There are so many components and functionality. Some of Key components include the Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), and Network Repository Function (NRF). The architecture enables network slicing, end-to-end QoS, and efficient resource management.

Followings are the name of each network component. This is the list of the component that are likely to be commonly used in most of the networks.

**Interfaces between Components**
Followings are the reference point definition specified in 23.501 - 4.2.7. A reference point is a conceptual point of interaction between two network functions or components.

N1: Reference point between the UE and the AMF.
N2: Reference point between the RAN and the AMF.
N3: Reference point between the RAN and the UPF.
N4: Reference point between the SMF and the UPF.
N6: Reference point between the UPF and a Data Network.
N9: Reference point between two UPFs.
N5: Reference point between the PCF and an AF.
N7: Reference point between the SMF and the PCF.
N8: Reference point between the UDM and the AMF.
N10: Reference point between the UDM and the SMF.
N11: Reference point between the AMF and the SMF.
N12: Reference point between AMF and AUSF.
N13: Reference point between the UDM and Authentication Server function the AUSF.
N14: Reference point between two AMFs.
N15: Reference point between the PCF and the AMF in the case of non-roaming scenario, PCF in the visited network and AMF in the case of roaming scenario.
N16: Reference point between two SMFs, (in roaming case between SMF in the visited network and the SMF in the home network).
N16a: Reference point between SMF and I-SMF.
N17: Reference point between AMF and 5G-EIR.
N18: Reference point between any NF and UDSF.
N19: Reference point between two PSA UPFs for 5G LAN-type service.
N22: Reference point between AMF and NSSF.
N23: Reference point between PCF and NWDAF.
N24: Reference point between the PCF in the visited network and the PCF in the home network.
N26: Reference point between MME (4G) and AMF
N27: Reference point between NRF in the visited network and the NRF in the home network.
N28: Reference point between PCF and CHF.
N29: Reference point between NEF and SMF.
N30: Reference point between PCF and NEF.
N31: Reference point between the NSSF in the visited network and the NSSF in the home network.
N32: Reference point between SEPP in the visited network and the SEPP in the home network.
N33: Reference point between NEF and AF.
N34: Reference point between NSSF and NWDAF.
N35: Reference point between UDM and UDR.
N36: Reference point between PCF and UDR.
N37: Reference point between NEF and UDR.
N38: Reference point between I-SMFs.
N40: Reference point between SMF and the CHF.
N50: Reference point between AMF and the CBCF.
N51: Reference point between AMF and NEF.
N52: Reference point between NEF and UDM.
N55: Reference point between AMF and the UCMF.
N56: Reference point between NEF and the UCMF.
N57: Reference point between AF and the UCMF.
N41: Reference point between AMF and the CHF in HPLMN.
N42: Reference
N58: Reference point between AMF and the NSSAAF.
N59: Reference point between UDM and the NSSAAF.

**Design Philosophy of 5G Core network**
Initially, one might perceive the 5G core as overly intricate and seemingly over-engineered. However, there is a specific design rationale behind this architecture.

* **Flexibility**: The 5G core network was designed with flexibility in mind, allowing network operators to deploy new services and features quickly and efficiently. This is achieved through the use of network slicing, which enables the creation of virtual networks that can be tailored to specific applications or user groups, providing customized service levels and performance guarantees.
* **Scalability**: The 5G core network is designed to be highly scalable, allowing network operators to easily add new users, devices, and services to the network. This is achieved through the use of virtualization, which enables network functions to be separated from the underlying hardware and deployed as software instances. This allows network operators to scale their networks more easily and reduce costs.
* **Virtualization**: The 5G core network is designed with virtualization in mind, which allows network functions to be separated from the underlying hardware and deployed as software instances. This enables network operators to deploy and manage network services more efficiently, reduce costs, and scale their networks more easily.
* **Automation**: The 5G core network architecture is highly automated, with many of the network functions being automated and managed through software. This automation allows network operators to provision, configure, and manage their networks more efficiently, reducing operational costs and improving network performance.
* **Security**: Security is a fundamental design philosophy of the 5G core network architecture. The network is designed with built-in security features such as mutual authentication, encryption, and secure transport protocols to protect against cyber attacks and ensure the privacy and integrity of user data.
* **Cloud-native**: The 5G core network architecture is designed to be cloud-native, with network functions deployed as software containers that can run on public, private, or hybrid cloud environments. This allows network operators to take advantage of the scalability and cost-efficiency of cloud computing while maintaining control over their networks.
### 2. 5G protocol stack

NR Radio Protocol Stack Architecture is almost same as LTE Radio Protocol Stack Architecture. If you are already familiar with LTE protocol stack or general concept of radio protocol stack, you would not need to spend too much time in reading this page. Just take a brief look at the various figures / diagrams shown in this page would be enough. If you are new to the concept of LTE/NR radio protocol stack, I would suggest you to go through this page whenever you have chance and try to form your own big picture.

I would not describe much details on each component of the protocol stack in this page. It is too much to describe everything in a single page. The purpose of this page is to provide you with some big picture or intuitive understanding of the radio protocol stack. Most of the fundamental idea in this page comes from 3GPP 38.300.

As in LTE / WCDMA, NR radio protocol stack has two different stack depending on the type of data that is processed by the stack. If the data is Signaling message, it goes through the C-plane stack and if it is user data, it goes through U-Plane stack. Both U-Plane and C-Plane is made up of a common structure : PHY <-> MAC <-> RLC <-> PDCP, but the components sitting on top of PHY/MAC/RLC/PDCP gets different between C-Plane and U-Plane. In case of U-Plane, a layer called SDAP is sitting at the top of the radio stack and the SDP is connected to UPF (User Plane Function). In case of C-Plane, the two layers RRC and NAS are sitting at the top of the stack. NAS layer gets connected to AMF (Access and Mobility Management Function).

What I've mentioned can be described in a block diagram as shown below.


Now let's look just one step further into the protocol stack. Take a look at the L2 (layer 2) structure of the NR U-Plane radio protocol. The structure of L2 downlink stack can be illustrated as shown below. Except the new layer called SDAP, you would notice that the overall structure is almost identical to LTE L2 structure. NR support carrier aggregation from the beginning, data for each carrier is processed separately for each carrier in SDAP, PDCP, RLC and multiplexed/scheduled in the common MAC layer. This is also same as LTE Rel 10 or higher.


Following is L2 structure of NR U-Plane Uplink radio protocol. Basic structure is same as downlink structure except that Uplink does not support carrier aggregation.


### 3. 5G call flow

**5G Stand Alone Registration**

5G Stand Alone, also referred to as Option 2, involves the 5G User Equipment (UE), gNB, and the 5G Core Network. In this discussion, we'll explore the registration process in 5G SA, focusing on the messages exchanged between the UE and gNB, as well as between the gNB and the 5G Core AMF. In simple terms, in 5G SA, what we call "Registration" is similar to the "Attach" process in 4G LTE.

**5G SA Call Flow**

At high level, 5G SA Registration call flow includes following Steps and shown in following figure:

* Achieving DL/UL sync via SSB decode and RACH Procedure
* SRB0 establishment with RRC Connection Request
* Contention Resolution and SRB1 establishment with RRC setup
* Registration Request
* NAS Procedures like UE Identity transfer, Authentication and Security
* AS UE Capability transfer and AS security
* SRB2 and DRB establishment
* Registration Complete and PDU session Establishment


* Cell Search and Downlink Synchronization: Cell search is the procedure by which a UE acquires time and frequency synchronization with a cell, decode the Cell ID and PBCH (MIB) information.
* Uplink Synchronization:
* UE can achieve UL synchronization can by RACH Procedure. All RACH access related parameters UE can retrieve from System Information#1. For RACH procedure, UE select a random preamble (msg#1), this preamble is referenced with the RAP ID. UE also starts a timing T300 to await the RRC Setup message from the gNB.
* gNB detect the RACH Msg#1 and send a DCI Format 1_0 with CRC scrambled by a the RA-RNTI corresponding to the RACH transmission. This DCI contains Frequency and Time resource assignment, and MCS for Msg#2 RAR sent on PDSCH.
* UE tries to DCI Format 1_0 with CRC scrambled by the corresponding RA-RNTI and MAC transport block in a corresponding PDSCH having RAR Msg#2 information including timing advance, uplink grant and the Temporary C-RNTI assignment.
* RRC Connection Request: RRC Connection request is considered as Msg#3 and it includes ue-Identity, establishment Cause. The ue-identity can be a Random number between 0 and 2^39-1 and will be used to contention resolution by UE while decoding Msg#4 RRC connection setup. RRC Connection Request is sent on the UL grant provides in Msg#2 from the gNB and over SRB0 on UL common control Channel(UL_CCCH).
* RRC setup: The RRC Setup message is sent to setup SRB1, contention resolution and the master cell configuration. The UE stops the timer T300 as it has received the RRC Setup message. It carries following information elements.
* radioBearerConfig {srb-ToAddModList},
* masterCellGroup { cellGroupId, rlc-BearerToAddModList, mac-CellGroupConfig, physicalCellGroupConfig}
* RRC setup Complete + Registration Request: The UE sends the RRC Setup Complete message with a “Registration Request” in the dedicatedNAS-Message. It also carries the information about selectedPLMN-Identity, registeredAMF, snssai-list. Registration request also carries UE network capability information. The gNB selects the Access and Mobility Function (AMF) for this session and allocate RAN UE NGAP ID to the UE. The AMF will use this id to address the UE context on the gNB.
* Initial UE Message: The gNB sends the Initial UE Message to the selected AMF. The message carries the “Registration Request” message received from the UE in the RRC Setup Complete message. The “RAN UE NGAP ID” and the “RRC Establishment Cause” are also included in the message.
* UE NAS Identity Transfer: UE Identity transfer is a conditional. If there is a change in last AMF selected by gNB and SUCI is not provided by the UE nor retrieved from the old AMF then Identity Request procedure is initiated by AMF sending an Identity Request message to the UE requesting the SUCI. The UE responds with Identity Response including the SUCI. The UE derives the SUCI by using the provisioned public key of the HPLMN.
* Authentication and NAS Security: The Core network performs Authentication procedure for the UE is legitimate and legally authorized to get service from the network. The detailed authentication procedure can be read from this post. The AMF signals the selected NAS security algorithm to the UE and requests the IMEISV from the UE as part of NAS security mode command. UE respond with completion of the NAS security procedure and contains the IMEISV in security mode complete.
* INITIAL CONTEXT SETUP REQUEST: The AMF allocates an “AMF UE NGAP ID“. The gNB will use this id to address the UE context on the AMF. AMF sends an INITIAL CONTEXT SETUP REQUEST message to gNB to start the initial context establishment process. The message typically contains the Registration Accept NAS message. The message carries one or more PDU Session setup requests. The message also carries the “AMF UE NGAP ID”, “UE Aggregate Maximum Bit Rate“, UE security capabilities and security key.
* AS UE Capability Transfer and AS Security: gNB can enquire the UE capability with UE capability enquiry and Information. After receiving from UE capability gNB update these capability to AMF. The gNB sends a Security Mode Command message to the UE to notify the UE to start the integrity protection and encryption process. After that, downstream encryption is started. The UE derives the key according to the integrity protection and encryption algorithm indicated by the Security Mode Command message, and then replies the Security Mode Complete message to the gNB. After that, the upstream encryption is started.
* SRB2 and DRB establishment: The gNB issues an RRC Reconfiguration message to the UE to establish SRB2 and DRB. After the After SRB2 and DRB are successfully established, the UE replies to the gNB with an RRC Reconfiguration Complete message. The gNB signals the successful setup DRB with INITIAL CONTEXT SETUP RESPONSE message to the AMF
* Registration Complete and PDU session Establishment: UE send Registration Complete and PDU session establishment request to AMF. PDU session establishment is similar to PDN Connectivity Request message in LTE. AMF sends a PDU SESSION RESOURCE SETUP REQUEST message to gNB carrying the list of PDU sessions that need to be established, the list of QoS Flows for each PDU session, and the quality attributes of each QoSFlow. The gNB maps the QoS Flow to the QoS Flow according to the quality attributes of the QoS Flow. gNB send NAS PDU session establishment accept.

### Reference
https://www.sharetechnote.com/html/5G/\
https://www.ericsson.com/en/core-network/5g-core
https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3144
https://www.3gpp.org/dynareport/38300.htm