Interworking of Untrusted Non-3GPP Networks and the 5G Core Network - Wipro

The PDU session establishment procedure involves the following steps:

UE sends a PDU Session Establishment request to the N3IWF using the NAS signalling IPsec SA and the N3IWF transparently forwards it to the AMF in a NAS UL message.
In the 5GCN, procedures similar to the PDU session establishment in a 3GPP access are executed (as shown in Figure 7).
AMF sends N2 PDU Session Resource Setup Request message to N3IWF to establish the WLAN resources for this PDU session. The message includes the QoS profiles and associated QFIs, PDU Session ID, UL GTPU Tunnel Info and NAS PDU Session Establishment Accept.
N3IWF determines the number of IPsec Child SAs to establish and the QoS profiles associated with each IPsec Child SA based on its own policies, configuration and QoS profiles received.
N3IWF sends an IKE Create Child SA request to establish the first IPsec Child SA for the PDU session. It includes the QFIs, PDU Session ID and UP IP address associated with the Child SA and optionally a DSCP value and a Default Child SA indication.
UE sends an IKE Create Child SA response on accepting the IKE Create Child SA request.
N3IWF establishes additional IPsec Child SAs as determined with each one associated with one or more QFI(s) and with a UP IP address.
After the establishment of all IP Child SAs, the N3IWF forwards the PDU Session Establishment Accept message to the UE via the signalling IPsec SA which enables start of UL data.
The N3IWF also sends a N2 PDU Session Resource Setup Response to AMF including DL GTPU Tunnel info which further executes procedures similar to the PDU session establishment in a 3GPP access (as shown in Figure 7) and enables start of DL data.

PDU sessions over the 3GPP access may be served by SMFs different from the SMF serving the PDU sessions over the non-3GPP access.

PDU session deactivation

The deactivation of the UP connection of an existing PDU session causes the corresponding NWu connection (i.e., IPsec Child SAs and N3 tunnel) to be deactivated. The UP connection of different PDU sessions can be deactivated independently when a UE is in CM-CONNECTED state. If a PDU session is an always-on PDU session, the SMF should not deactivate a UP connection of this PDU session due to inactivity. Release of PDU Sessions over the non-3GPP access does not imply the release of N2 connection.

Paging is not supported with untrusted WLAN. Hence when the AMF receives a message corresponding to a PDU session for a UE in CM-IDLE state for non-3GPP access, a network triggered service request procedure may be performed over 3GPP access irrespective of UE state for 3GPP access. A network triggered Service Request procedure over non-3GPP access may also be performed for a UE in CM-IDLE state for 3GPP access and CM-CONNECTED state for Non-3GPP access in AMF when paging over 3GPP access is not performed.

Multiple PDU Sessions over 3GPP and non-3GPP access

A UE registered simultaneously over a 3GPP access and an untrusted WLAN may have multiple PDU sessions over both the access with each PDU session active in only one of the access. When the UE transitions to CM-IDLE in either of the access the UE may move the PDU Sessions in the corresponding access to the target access based on UE policies. The UE may need to initiate a registration procedure in the target access for the handover and then initiates the PDU session establishment with the PDU session IDs of the PDU sessions moved. The core network maintains the PDU Sessions but deactivates the N3 user plane connection for such PDU Sessions. Based on the implementation the UE may initiate a Deregistration procedure in the access that has no PDU Sessions.

Multi-Access PDU Session

3GPP Release 16 supports Access Traffic Steering, switching and splitting (ATSSS) that allows a ,multi-access PDU session where a PDU session with multiple packet flows may select 3GPP access or untrusted WLAN for each packet flow or a packet flow may be switched between 3GPP access and untrusted WLAN or a packet flow can be split across 3GPP access and untrusted WLAN. The PDU session establishment procedure contains additional information and user plane establishment to achieve the same.

User Plane

After the completion of PDU session establishment and user plane IPsec Child SAs are established between the UE and N3IWF, the UE can send uplink and downlink traffic for the session with various QoS flows over the untrusted WLAN network using the established IPsec Child SAs and the associated GTPU tunnel between the N3IWF and UPF.

Uplink Traffic

When the UE must transmit a UL PDU, it shall determine the QFI associated with the PDU using the QoS rules of the corresponding PDU session and shall encapsulate the PDU inside a GRE packet with the QFI value in the header of the GRE packet. The UE shall forward the GRE packet to N3IWF via the IPsec Child SA associated with the QFI by encapsulating the GRE packet into an IPsec packet in tunnel mode with source address as UE IP address and destination address as UP IP address associated with the Child SA.

When the N3IWF receives the UL PDU, it shall decapsulate the IPsec header and GRE header and determine the GTPU tunnel ID corresponding to the PDU session. The N3IWF shall encapsulate the UL PDU inside a GTPU packet with the QFI value in the header of the GTPY packet and shall forward the GTPU packet to the UPF via N3.

Downlink Traffic

When the N3IWF receives a DL PDU via N3 from the UPF, the N3IWF shall decapsulate the GTPU header and use the QFI and the identity of the PDU session in the GTPU header to determine the IPsec Child SA to use for sending the DL PDU over NWu to the UE.

The N3IWF shall encapsulate the DL PDU inside a GRE packet with the QFI value in the header of the GRE packet. The N3IWF may also include a Reflective QoS Indicator (RQI) in the GRE header which shall be used by the UE to enable reflective QoS. The N3IWF shall forward the GRE packet with DL PDU to the UE via the IPsec Child SA associated with the QFI by encapsulating the GRE packet into an IP packet in tunnel mode with source address as the UP IP address associated with the Child SA and destination address as the address of the UE.

QoS

For a UE accessing the 5GCN through the untrusted WLAN, the N3IWF supports QoS differentiation and mapping of QoS flows to non-3GPP access resources. A QoS flow is controlled by the SMF and can be preconfigured or established via the UE requested PDU session establishment or modification procedure. The N3IWF shall determine the number of user plane IPsec Child SAs to establish and the QoS profiles associated with each Child SA based on local policies, configuration and the QoS profiles received from the network. The N3IWF shall then initiate IPsec SA creation procedure towards the UE to establish Child SAs associating to the QoS flows of the PDU session. The QoS functionalities of the UE, N3IWF and UPF are specified in Figure 9.