In a 5G network, mobility management is not only about following a phone as it moves from one cell to another. It is the control logic that tells the 5G Core whether a UE is registered, reachable, connected, idle, allowed to access service, or restricted by location and subscription policy. Without this layer, the network would not know when to keep user context, when to release signaling resources, when to page the device, or which identity should be used during registration and security procedures.

The 5G Core uses AMF, NAS signaling, UE Context, temporary identifiers, concealed subscription identifiers and mobility restriction rules to make movement manageable. A UE may turn on in the morning, register with the network, stay idle for long periods, become connected again when data service is needed, and move across tracking areas during the day. The network must support all of this while protecting air-interface resources, N2 signaling resources and user privacy.

Registration Defines Network Reachability

Registration management describes whether a UE has registered with the 5G Core. The two key states are RM-DEREGISTERED and RM-REGISTERED. In the deregistered state, the UE is not registered to the core network. AMF does not know where the UE is, does not keep a usable UE Context for it, and cannot treat the device as reachable.

Once the UE completes registration successfully, it enters the registered state. At this point, the UE can access 5GC services, and AMF has enough information to know the user’s location at the required level and maintain UE Context. This does not always mean the UE is actively sending user data. It simply means the UE has a valid relationship with the core network.

The transition is straightforward. A newly powered device starts from the deregistered state. If the registration procedure is accepted, the UE becomes registered. If registration is rejected, or the network initiates deregistration, the UE remains or returns to the deregistered state. This state model is similar in spirit to the 4G EMM registered and deregistered logic, but it is handled within the 5G Core architecture.

Connection State Saves Resources

Connection management explains whether the UE currently has an active signaling relationship with the network. The two main states are CM-IDLE and CM-CONNECTED. In the idle state, the UE is not actively connected through N2 signaling, and AMF does not maintain the same active connection resources that it would keep during connected operation.

In the connected state, AMF knows the UE location more precisely, and the UE can access 5GC services through an established connection. The network may also create or maintain relevant UE Context for service handling. When the UE has no active service demand, the network can release N2 connection resources and move the UE back toward idle operation.

This design protects network efficiency. If every registered UE stayed fully connected all day, radio resources, N2 signaling and user-plane preparation would be wasted. A better approach is to keep the UE registered, but release active connection resources when they are not needed. When the user later starts browsing, streaming, calling or using an application, the UE can trigger a Service Request or related procedure and return to connected operation.

A practical analogy is hotel check-in. Registration is like checking into the hotel and creating the guest record. Connection is like actively using room resources such as lights, air conditioning or elevator access. The guest remains checked in even when the room resources are not actively used. In the same way, a UE can remain registered while its active connection is released to save resources.

UE Context Holds Key Data

UE Context is the information AMF keeps after the UE becomes registered. It gives the network the working data needed to manage access, security, location, subscription restrictions and mobility behavior. This context is not a single field; it is a collection of identifiers, capabilities, location information and policy-related parameters.

Important UE Context elements include SUPI, PEI, GPSI, subscribed UE-AMBR, 5GMM capability, selected PCF information, forbidden area lists, service area restrictions and mobility management context. The MM Context may also include access type, NAS security mode, UE security capability, allowed NSSAI, last registration TAI, RM state, registration area and current user location information.

These fields help the network answer several operational questions. Who is the subscriber? What equipment is being used? Which access type is involved? Which security algorithms are supported? Which slices can the UE access? Where did the UE last register? Which areas are allowed or restricted? The answers guide registration handling, service access, paging, mobility updates and policy control.

Identifiers Protect User Privacy

5G mobility management depends heavily on identity design. The network must identify the subscriber and equipment, but it should avoid exposing permanent identifiers over the air whenever possible. This is why 5G uses several related identifiers for different purposes.

SUPI is the permanent subscription identifier. Its most common form is IMSI, while another form uses NAI for non-3GPP access. PEI identifies the equipment and is usually related to IMEI or IMEISV. GPSI is a public subscription identifier, often represented by MSISDN, while another format can use an external identifier such as username@realm.

Temporary identities reduce exposure of permanent information. 5G-GUTI is a globally unique temporary identity assigned by AMF. It combines the AMF-related identifier, known as GUAMI, with 5G-TMSI. 5G-S-TMSI is part of the 5G-GUTI and is used for paging. This separation is important because paging should not expose the subscriber’s permanent identity.

SUCI is especially important for 5G security. It is a concealed subscription identifier generated by encrypting SUPI-related information. In 4G, IMSI could be obtained in some identity procedures, which created privacy risk over the air interface. In 5G, registration should use 5G-GUTI when available. If no 5G-GUTI exists, SUCI is used instead. Plain IMSI should not be used as the registration identity.

SUCI is created with asymmetric encryption. The UE uses a public key stored in the USIM or available to the device to conceal the subscription identity. The concealed identifier is then passed through the access and core network toward the home network, where the private key is used to recover the SUPI. Routing Indicator helps the core network route the signaling message toward the correct home network functions even though part of the identity is concealed.

Restrictions Control Service Areas

Mobility management also includes restrictions. Not every UE can access every radio technology, every tracking area or every service area. The 5G Core uses mobility restriction rules to control where and how a UE may use network services.

A Registration Area is a set of tracking areas assigned to the UE. Within this area, service is not restricted, and the UE does not need to update registration for every small movement. RAT restriction comes from subscription data and can prevent a UE from using a certain radio access technology, such as 5G. A Forbidden Area is a set of areas where 5G service access is not allowed for that UE.

Service Area Restriction can define allowed and not-allowed areas. In allowed areas, the UE can access 5G service. In not-allowed areas, service access is blocked or limited according to the policy. These restrictions are useful for subscription control, roaming control, private network planning, service segmentation and regulatory requirements.

Together, registration management, connection management, UE Context, secure identifiers and mobility restrictions form the mobility foundation of the 5G Core. The goal is not simply to know where a device is. The real goal is to keep the device reachable when needed, protect network resources when idle, preserve identity privacy, and enforce access rules according to subscription and location.

FAQ

Why does 5G separate registration from connection?

The separation allows the UE to remain known to the core network without keeping active signaling resources all the time. This improves efficiency when many devices are registered but not continuously using service.

Why is 5G-S-TMSI used for paging?

5G-S-TMSI is derived from the temporary identity structure, so it supports paging without exposing permanent subscription information over the radio interface.

What makes SUCI different from SUPI?

SUPI is the permanent subscription identity, while SUCI is a concealed form used to protect that permanent identity during procedures where a temporary identity is unavailable.

Why does AMF need UE Context?

AMF needs UE Context to manage security, access type, registration state, location information, allowed slices, service restrictions and mobility-related decisions for the UE.

How do mobility restrictions affect service access?

Mobility restrictions determine whether a UE can use certain areas or radio technologies based on registration area, forbidden area, service area policy and subscription data.