5G NAS Registration Request Message

The Registration Request is the first NAS message a UE sends to the 5G Core network. It initiates the 5GS registration procedure that includes authentication, security activation and session management.

Key Facts. Registration Request

Message name: Registration Request
Protocol: NAS (Non-Access Stratum) — 5GMM (5GS Mobility Management)
Direction: Uplink. UE → AMF
3GPP specification: TS 24.501 (NAS for 5GS)
Sub-protocol: 5GMM (5GS Mobility Management)
Encoding: TLV binary

What is a Registration Request?

The Registration Request is the first NAS message sent by a 5G UE to the AMF (Access and Mobility Management Function) when it needs to register with the 5G Core network. It is the 5G equivalent of the LTE Attach Request and is defined in 3GPP TS 24.501 as part of the 5GMM (5GS Mobility Management) protocol. The message is transported inside the RRC layer's RRCSetupComplete message over the NR air interface, meaning it is sent as soon as the SRB1 radio bearer is established.

The Registration Request serves multiple purposes depending on the registration type. For initial registration, the UE registers for the first time or after deregistration, and the AMF allocates a new 5G-GUTI. For mobility registration updating, the UE informs the AMF that it has moved to a new registration area. For periodic registration updating, the UE re-registers at intervals controlled by timer T3512 to indicate it is still reachable. For emergency registration, the UE can register for emergency services even without a valid USIM or when normal registration is restricted.

Registration types

Type value	Name	Description
001	Initial registration	First-time registration or re-registration after deregistration. The AMF allocates a 5G-GUTI, establishes a security context, and may trigger PDU session establishment.
010	Mobility registration updating	The UE has moved to a new registration area (set of Tracking Areas). The AMF updates the UE's location and may re-allocate a 5G-GUTI.
011	Periodic registration updating	Triggered by timer T3512 expiry. Indicates to the AMF that the UE is still reachable. No location change is implied.
100	Emergency registration	Allows emergency service access without a valid subscription or USIM. Authentication may be skipped and a limited context is created.

Key Information Elements

IE name	Type	Purpose
5GS registration type	Mandatory	Indicates the type of registration: initial (001), mobility updating (010), periodic updating (011), or emergency (100).
ngKSI	Mandatory	NAS key set identifier in 5G. Identifies the security context. Set to 111 (no key available) for initial registration without a cached context.
5GS mobile identity	Mandatory	UE identity: SUCI (Subscription Concealed Identifier) for initial registration, 5G-GUTI if previously registered, or IMEI/PEI for emergency.
UE security capability	Optional	Lists supported 5G NAS security algorithms: 5G-EA0–5G-EA3 (ciphering) and 5G-IA1–5G-IA3 (integrity protection).
Requested NSSAI	Optional	Network Slice Selection Assistance Information. Contains S-NSSAI values (SST and optional SD) indicating which network slices the UE wants to use.
Last visited registered TAI	Optional	The Tracking Area Identity where the UE was last registered. Helps the AMF determine if inter-AMF mobility occurred.
5GS update type	Optional	Indicates if the UE requests SMS over NAS, NG-RAN radio capability update, or combined registration for EPS and 5GS.
UE status	Optional	Indicates the UE's EPS and 5GS registration status. Used during interworking between EPC and 5GC to convey whether the UE has an active EPS context.

Registration flow

UE → AMF: Registration Request

Carried in RRCSetupComplete (dedicatedNAS-Message). Contains 5GS registration type, 5GS mobile identity (SUCI or 5G-GUTI), ngKSI, UE security capability, and optional IEs such as requested NSSAI.

AMF → UE: Authentication Request

The AMF initiates 5G-AKA or EAP-AKA' authentication. Contains RAND, AUTN, and the ngKSI for the new security context. The UE validates AUTN and computes RES*.

UE → AMF: Authentication Response

Contains RES* (authentication response). The AMF (via AUSF/UDM) compares RES* with XRES* to verify the UE's identity. If verification succeeds, the security context is established.

AMF → UE: Security Mode Command

Activates NAS ciphering and integrity protection. Specifies the selected 5G NAS security algorithms (e.g., 5G-EA1/5G-IA2 for SNOW-based ciphering and AES-based integrity).

UE → AMF: Security Mode Complete

Confirms NAS security activation. From this point, all NAS messages are integrity protected and optionally ciphered using the negotiated algorithms.

AMF → UE: Registration Accept

Completes the registration. Contains the assigned 5G-GUTI, registration area (TAI list), allowed NSSAI, T3512 value (periodic registration timer), and network feature support indicators.

UE → AMF: Registration Complete

Sent when the AMF assigned a new 5G-GUTI. Acknowledges reception and confirms the UE has stored the new identity. The UE is now registered and can request PDU sessions.

Common Registration Reject causes

Cause #	Name	Meaning
#3	Illegal UE	The SUPI is not known in the UDM or authentication failed permanently. The UE should not reattempt registration with this USIM.
#5	PEI not accepted	The permanent equipment identifier (IMEI/IMEISV) is rejected by the network. The device is blacklisted or not authorized.
#11	PLMN not allowed	The UE's subscription does not allow registration on this PLMN. Common in roaming scenarios with restricted agreements.
#15	No suitable cells in tracking area	No cells in the tracking area can provide the required service for this UE. May be related to CAG (Closed Access Group) restrictions.
#69	Non-3GPP access to 5GCN not allowed	The UE is not authorized to access the 5G Core through non-3GPP access (e.g., WLAN). Only NR access is permitted.
#71	ngKSI already in use	The NAS key set identifier provided by the UE conflicts with an existing security context. The UE should retry with a different ngKSI or perform a fresh authentication.
#72	Non-3GPP access to EPC not allowed	The UE cannot access EPC via non-3GPP access. This cause is used during interworking between 5GC and EPC.
#73	Serving network not authorized	The serving network (identified by PLMN ID) is not authorized in the UE's home network. The AUSF/UDM rejects the serving network's request.

How to decode a Registration Request

Open the decoder

Go to the HiCellTek L3 Decoder and select 5G NR.

Paste NAS hex frame

Select the NAS 5GS channel and paste the hex, extract it from Wireshark, QMDL tools, or the dedicatedNAS-Message in RRCSetupComplete.

Analyze the IEs

Click Decode. Inspect 5GS registration type, 5GS mobile identity (SUCI/5G-GUTI), ngKSI, UE security capability and requested NSSAI.

Decode Registration Request now →

Frequently Asked Questions

What is the Registration Request message in 5G NAS?

The Registration Request is the first 5G NAS (Non-Access Stratum) message sent by the UE to the AMF (Access and Mobility Management Function) to register with the 5G Core network. It is defined in 3GPP TS 24.501 as part of the 5GMM (5GS Mobility Management) protocol. The Registration Request carries the UE's identity (SUCI, 5G-GUTI, or IMEI), the requested registration type (initial, mobility, periodic, or emergency), the UE's security capabilities, and optionally the requested NSSAI (Network Slice Selection Assistance Information) for network slicing.

What are the different 5G registration types?

There are four registration types defined in TS 24.501: (1) Initial registration, the UE registers for the first time or after being deregistered; the AMF allocates a 5G-GUTI and establishes a security context. (2) Mobility registration updating, the UE has moved to a new registration area and needs to update its location with the AMF. (3) Periodic registration updating, the UE re-registers periodically (controlled by timer T3512) to inform the network it is still reachable. (4) Emergency registration, allows the UE to register for emergency services without a valid USIM or when normal registration is not possible.

What causes Registration Reject in 5G and what are common 5GMM cause codes?

The AMF sends Registration Reject when the UE cannot be registered. Common 5GMM cause codes include: #3 (Illegal UE), identity not authorized; #5 (PEI not accepted), the permanent equipment identifier is rejected; #11 (PLMN not allowed), subscription does not permit this network; #15 (No suitable cells in tracking area); #69 (Non-3GPP access to 5GCN not allowed); #71 (ngKSI already in use), security context conflict; #72 (Non-3GPP access to EPC not allowed); #73 (Serving network not authorized). These cause codes help field engineers diagnose why a UE fails to register on a 5G network.

How do I decode a 5G NAS Registration Request message?

To decode a Registration Request: (1) Open the HiCellTek online decoder at /en/decoder/. (2) Select 5G NR. (3) Choose the NAS 5GS channel. (4) Paste the hexadecimal NAS frame, you can extract it from Wireshark, a QMDL log parser, or from the dedicatedNAS-Message IE inside an RRCSetupComplete or RRCReconfiguration message. (5) Click Decode. The decoder will display all information elements including 5GS registration type, 5GS mobile identity (SUCI/5G-GUTI), UE security capability, requested NSSAI, and any optional IEs.