Fact-checked by Grok 2 weeks ago

Mobility management

Mobility management in refers to the set of protocols, procedures, and entities that enable mobile devices to maintain continuous and seamless delivery while moving within or across wireless networks. It encompasses tracking the of users, managing handovers between cells or networks, and supporting and to ensure uninterrupted access to services like voice calls, messaging, and data. The primary objectives are to minimize service disruptions, optimize network resources, and provide efficient routing of communications to mobile subscribers. This is achieved through collaboration between , radio access networks, and core network elements, such as the Mobility Management Entity () in systems. Mobility management has evolved from early cellular systems to support advanced features in and networks, addressing increasing demands for high-speed mobility and diverse access technologies.

Fundamentals

Definition and objectives

Mobility management encompasses the set of network protocols and procedures designed to track the location of () in mobile networks, maintain seamless connectivity as the moves, and minimize service disruptions during transitions between cells or networks. In earlier generations (/), it operates across circuit-switched and packet-switched domains; in and , mobility management is handled entirely in the packet-switched domain to ensure that services such as voice calls, data sessions, and messaging remain uninterrupted, regardless of the 's . This involves the 's at varying levels of , from broad areas in idle to precise cell-level tracking in active , thereby enabling efficient delivery of incoming traffic and resource handling. The primary objectives of mobility management include efficient to support ongoing sessions, reduction of signaling overhead through optimized procedures that limit unnecessary interactions, and provision of (QoS) guarantees across cell transitions. It supports both idle and active states of the : in idle mode, the focus is on low-overhead updates and reachability via paging to conserve and resources; in active mode, it prioritizes maintenance and execution to prevent or delays. These goals collectively aim to balance with , adapting to varying mobility patterns while adhering to bearer-level QoS parameters such as allocation and retention priority () and guaranteed bit rate (). Key components provide an overview of the foundational mechanisms without specifying detailed implementations: location registration allows the to periodically inform the network of its position within defined areas like tracking areas, handover initiation coordinates transfers between serving nodes to sustain active connections, and paging locates idle for incoming sessions by broadcasting queries across registered areas. In network architectures, mobility management integrates with core elements such as the Mobile Switching Center () in / systems for circuit-switched handling and location tracking via visitor location registers, and the Mobility Management Entity () in Evolved Packet Systems for packet-switched mobility, , and coordination with gateways for bearer management.

Historical evolution

Mobility management originated in the first-generation () analog cellular systems of the 1980s, exemplified by the (), which primarily supported voice services through basic handoff procedures to maintain connections during movement between cells. These early systems lacked formalized location tracking, relying instead on signal strength measurements by mobile stations and base stations to initiate hard handoffs, often resulting in brief call interruptions without support for idle-mode mobility or global . The transition to second-generation () digital networks in the , led by the (GSM) standardized by the (ETSI), introduced structured location management to enable efficient paging and . GSM defined location areas—groups of cells monitored by mobile stations for periodic location updates—and temporary mobile subscriber identities (TMSI) to enhance privacy by anonymizing permanent identifiers during signaling. These features addressed the limitations of by supporting global and reducing signaling overhead for voice-centric services across denser deployments. Third-generation (3G) systems, such as Universal Mobile Telecommunications System (UMTS) developed under the 3rd Generation Partnership Project () starting in the early 2000s, extended mobility management to packet-switched data with the introduction of routing areas for more granular tracking in GPRS/EDGE contexts, alongside combined location and routing area updates to optimize signaling. This evolution, specified in 3GPP Release 99, facilitated seamless transitions between - and packet-switched domains, supporting emerging applications and higher data rates while managing increased network complexity. Fourth-generation (4G) Long-Term Evolution (LTE), introduced in the 2010s via Releases 8–10, refined idle-mode through tracking areas that aggregated cells for reduced update frequency, complemented by X2 interfaces for direct inter-eNodeB s and S1 interfaces for involving the core network, enabling faster and more efficient transitions in all-IP environments. The advent of fifth-generation () networks from the 2020s, outlined in Release 15 onward, integrates network slicing for tailored profiles across diverse services and support for to reduce , with later enhancements in Release 18 (as of 2024) introducing an /ML framework for the NG-RAN, including optimizations for , and Release 19 studies on -based enhancements for high- scenarios (ongoing as of November 2025). Over these generations, standards bodies like for and for subsequent evolutions have progressively tackled challenges from voice-only circuits to streams, escalating bit rates from kilobits per second to gigabits, and accommodating denser deployments through scalable signaling and predictive mechanisms.

Location management

Registration and update procedures

In mobile networks, registration and update procedures enable () to inform the network of its presence and location changes, ensuring efficient and service continuity. These procedures form the core of location management in protocols, evolving from circuit-switched mechanisms in early generations to integrated packet-switched approaches in modern systems. The primary types of registration include initial attach, periodic location updates, and updates due to changes in service areas. Initial attach occurs when the powers on, inserts a , or enters a new (PLMN), allowing the to establish a non-access stratum () security context and register with the access and mobility management function (AMF) in or equivalent entities in prior generations. Periodic location updates are triggered by timer expiry, such as T3512 in (default 54 minutes) or T3212 in /, to confirm reachability and prevent implicit deregistration. Updates for service area changes, often called mobility registration updates, activate when the reselects a cell in a new location area () or tracking area (), ensuring the network maintains an accurate position without unnecessary paging overhead. Update procedures vary by network generation and domain. In circuit-switched domains of /, location area updates (LAU) involve the UE sending a LOCATION UPDATING REQUEST message to the mobile switching center/visitor location register (/VLR), which may trigger and temporary mobile subscriber identity (TMSI) reallocation before responding with a LOCATION UPDATING ACCEPT. For packet-switched domains, area updates (RAU) use a ROUTING AREA UPDATE REQUEST to the serving GPRS support node (SGSN), updating the routing area identity (RAI) and potentially reallocating a packet TMSI (P-TMSI). In / systems, these consolidate into unified registration updates via (RRC) signaling: the UE encapsulates a REGISTRATION REQUEST NAS message in an RRC setup complete to the eNodeB/gNodeB, which forwards it to the mobility management entity () or AMF via S1/N2 interfaces; the network responds with REGISTRATION ACCEPT, including a TA list and restarted timers. Triggers for these procedures encompass timer expiry (e.g., T3312 for RAU periodicity), cell reselection crossing area boundaries, and power-on events initiating IMSI attach or GPRS attach. In connected mode, cell reselection may invoke implicit updates to avoid explicit signaling, reducing during active sessions. Signaling overhead from frequent updates poses challenges, particularly in dense networks, where techniques like enlarging tracking area sizes minimize location update frequency at the cost of broader paging scopes. Optimizations include implicit context updates during RRC-connected mobility and timer-based suppression of redundant requests, as specified in releases to balance update load and reachability. Error handling ensures robustness, with detach procedures addressing failures. -initiated detach sends a DEREGISTRATION REQUEST (or equivalent in older systems), prompting the network to release resources and acknowledge, transitioning the to a deregistered state. Network-initiated detach, triggered by issues like unauthorized access or slice unavailability, uses a DEREGISTRATION REQUEST with causes (e.g., #10 for implicit deregistration), followed by reattachment attempts after timers like T3346 expire. Registration rejections, due to congestion (#22) or invalid identity (#9), clear context and invoke back-off timers (e.g., T3247 for 30-60 minutes) before retrying initial attach.

Paging mechanisms

Paging mechanisms in mobility management enable the network to locate and notify (UE) in idle or inactive states for incoming calls, data sessions, or system information updates. The process begins when the (CN) or (RAN) initiates paging upon receiving downlink traffic for a UE whose is known only at a coarse , such as a tracking area. The paging message is broadcast over the paging control channel (PCCH) across multiple cells within the designated paging area, containing the UE's (e.g., S-TMSI or 5G-S-TMSI) to alert the specific device. Upon detecting its during a occasion, the UE responds by initiating a procedure to re-establish connection, transitioning to RRC_CONNECTED state or resuming from inactive mode. This reactive location finding contrasts with proactive UE-initiated updates, ensuring efficient resource use while minimizing unnecessary signaling. Paging areas form a hierarchical structure to balance signaling overhead, , and UE battery life. At the finest level, paging can target individual cells, but to reduce broadcast load in dense networks, larger aggregates like tracking areas () in RRC_IDLE mode or RAN notification areas () in RRC_INACTIVE mode are used. A TA comprises multiple cells, and the network pages all cells within the UE's last registered TA, which serves as the scope for paging operations. In , RNAs allow more granular RAN-level management, potentially spanning fewer cells than TAs for faster localization in inactive UEs. This hierarchy starts from cell-level for high-precision needs and scales to TA/RNA levels, optimizing trade-offs where smaller areas reduce paging delay but increase frequent updates, while larger areas conserve battery at the cost of higher broadcast traffic. Optimizations enhance paging efficiency, particularly for power-constrained . Discontinuous reception (DRX) cycles allow to monitor paging occasions () periodically rather than continuously; the calculates its paging () and using formulas based on its identity and DRX value, such as SFN mod T = (T div N) * ( mod N) for determination and i_s = floor( / N) mod Ns for subframe indexing, where T is the DRX cycle length, N is the number of per cycle, and Ns is the number of per . Group paging, introduced in Release 17 via paging early indication (PEI), divides sharing the same into subgroups, reducing false wake-ups and achieving saving gains of up to 16% in low group paging rate scenarios through sub-group notifications before full paging. Location prediction algorithms further refine targeting by forecasting positions from mobility history; history-based models using Markov chains or (e.g., stochastic corrections on past trajectories) predict likely cells, minimizing broadcast scope and search costs in predictive schemes. In , paging differs by UE state. For RRC_IDLE mode, CN-initiated paging occurs across the entire TA to notify the UE of downlink data or system changes, prompting transition to RRC_CONNECTED via . In RRC_INACTIVE mode, RAN-initiated paging targets the RNA, enabling quicker resumption of suspended connections without full CN involvement, reducing for frequently accessed UEs while maintaining context retention for efficiency. This state-specific approach supports diverse traffic patterns, with inactive paging leveraging anchor points like the last serving gNB for localized broadcasts. Performance metrics evaluate paging effectiveness, focusing on success rate, delay, and signaling load. Paging success rate measures the proportion of initiated pages resulting in response, typically tracked via counters like successful paging procedures at the AMF. Delay encompasses time from initiation to response, influenced by DRX cycle and area size, often under 100-500 ms in optimized . Signaling load, a key overhead indicator, is commonly modeled as the product of density and paging rate divided by area coverage, e.g., paging load = (number of UEs / area size) × paging rate, where higher loads risk occasion overflows and discards, monitored through metrics like discarded paging records ratio (discarded / total received). These ensure scalability, with optimizations like PEI improving load by lowering unnecessary transmissions.

Identity and security in mobility

Temporary identifiers

Temporary identifiers, also known as pseudonymous or temporary mobile subscriber identities, are allocated by the network to () in mobile systems to obscure the permanent subscriber identity, such as the (IMSI), during communication over the radio interface. These identifiers enhance by minimizing the transmission of the IMSI, which could otherwise be intercepted by unauthorized parties, while also reducing signaling overhead due to their compact format. In / systems like and , the primary temporary identifier is the Temporary Mobile Subscriber Identity (TMSI), a 32-bit value assigned by the Visitor Location Register (VLR) to a visiting subscriber. The TMSI is valid within a specific location area and is used in place of the IMSI for most signaling procedures after initial authentication. In packet-switched domains, such as the General Packet Radio Service (GPRS), the Packet-TMSI (P-TMSI) serves a similar role, functioning as a 32-bit temporary identifier allocated by the Serving GPRS Support Node (SGSN) for data sessions. Evolving to later generations, the Globally Unique Temporary Identity () in and its counterpart, the 5G-GUTI in , provide network-wide temporary identifiers that are unambiguous across the entire system, comprising components like the (MME) or Access and Mobility Management Function (AMF) identifier and a UE-specific part. These identifiers ensure continuity during mobility events without revealing the permanent identity. Assignment of temporary identifiers occurs primarily during the initial network attach procedure or a Location Area Update (LAU), where the network generates and delivers the identifier to the in a ciphered message to prevent interception. Reallocation happens periodically or triggered by events like LAU to a new location area, IMSI attach, or explicit reallocation commands, ensuring the identifier remains fresh and tied to the current ciphering context for added security against tracking. For instance, in , the VLR includes the new TMSI in the Location Update Accept message, encrypted with the ongoing session keys. The key benefits of these temporary identifiers include providing against passive eavesdroppers on the air interface, as the IMSI is rarely transmitted after initial registration, thereby protecting user location and . Additionally, their fixed 32-bit length (for TMSI and P-TMSI) results in shorter over-the-air messages compared to the variable-length IMSI (typically 15 digits), which reduces signaling load and battery consumption on the . However, security implications arise from potential TMSI re-use attacks, where an adversary correlates the same identifier across sessions or locations if reallocation is infrequent, enabling tracking despite pseudonymity. Mitigation strategies include periodic refresh through explicit reallocation procedures and ensuring random, unpredictable values for new identifiers, as specified in standards to limit exposure windows. In practice, networks are recommended to reassign TMSIs at least on every location update or at configurable intervals to counter such vulnerabilities.

Authentication during mobility events

In mobile networks, authentication during mobility events verifies the legitimacy of (UE) while integrating with procedures such as location updates and handovers to maintain without interrupting service. These events trigger challenge-response mechanisms to confirm the UE's credentials against home network records, preventing unauthorized access as the UE transitions between serving nodes. The process relies on pre-shared secrets stored in the UE's subscriber identity module and the network's authentication center, ensuring both and of signaling during movement. In and systems, the Home Location Register/ Center (HLR/) generates authentication vectors upon request from the Visitor Location Register/Serving GPRS Support Node (VLR/SGSN) during location updates or initial mobility registration. For (), vectors consist of triplets including a 128-bit random (), a 32-bit signed response (SRES) computed by the mobile station using the A3 , and a 64-bit cipher key (Kc) derived via the A8 for subsequent . In (), quintuplets extend this with , an expected response (XRES) up to 128 bits, 128-bit cipher key (CK), 128-bit key (IK), and an authentication token (AUTN) containing sequence number and for network verification. These vectors support the and Key () protocol, where the VLR/SGSN challenges the UE with (and AUTN in 3G), the UE responds with its computed RES/SRES, and matching confirms authenticity before key activation for ciphering and protection over radio bearers. During handovers in 2G/3G, authentication is typically avoided for latency reasons by forwarding existing security contexts and keys from the source to target node, but re-authentication occurs if vectors are exhausted or upon explicit triggers like inter-system handovers. Key management derives session keys directly from vectors: enables A5 ciphering algorithms in , while CK and support f8 for confidentiality and f9 for integrity in , protecting mobility-related signaling such as handover commands. Temporary identifiers like Temporary Mobile Subscriber Identity (TMSI) serve as inputs to initiate these procedures, concealing the permanent (IMSI) during challenges. The Evolved Packet System AKA (EPS-AKA) in 4G LTE evolves this framework, with the Home Subscriber Server (HSS) providing authentication vectors to the for use in tracking area updates and attach procedures tied to . Vectors include , AUTN, XRES*, CK, and , where the UE's Universal Subscriber Identity Module (USIM) verifies AUTN and derives RES* for mutual challenge-response. The master key KASME (256 bits) is then computed from CK, , serving network identity, , and sequence number using a , serving as the root for subordinate keys like KeNB for , NASenc for non-access stratum encryption, and NASint for integrity. In handovers, keys are refreshed via next hop (NH) parameters over X2 or S1 interfaces without full re-authentication, deriving new KeNB from prior KASME and a counter to maintain during intra-LTE . Early / systems exhibited gaps, as the could not fully verify the network, exposing risks like false attacks during s or updates. addresses these through enhanced 5G-AKA with explicit and the Subscription Concealed Identifier (SUCI), which encrypts the Subscription Permanent Identifier (SUPI) using public-key methods before transmission in initial messages for location registration or signaling, mitigating IMSI exposure. Re-authentication triggers include entry into via combined attach/location update procedures, periodic tracking area updates (e.g., every 30 minutes to hours configurable by network), or key expiry during prolonged mobility, ensuring fresh vectors and keys from the Unified Data Management/Authentication Server (UDM/AUSF) to counter desynchronization or replay attacks.

Handover procedures

Intra-network handovers

Intra-network handovers enable seamless mobility for () within the same , ensuring continuity of service without changing the network type or (). These handovers are essential for maintaining connection quality as the moves between cells served by the same core network, minimizing disruptions in voice, data, or multimedia sessions. Unlike inter-network transitions, intra-network handovers focus on optimizing and signal quality within a unified , such as a single operator's or infrastructure. Key types of intra-network handovers vary by generation and domain. In and circuit-switched networks, hard handovers predominate, where the connection to the source cell is released before establishing the link to the target cell, potentially causing a brief interruption. In code-division multiple access (CDMA) systems, soft handovers allow the UE to maintain simultaneous connections to multiple cells, combining signals for diversity gain before dropping the weaker link, which reduces the risk of call drops. In LTE networks, handovers follow a make-before-break approach using hard handover principles, where the target cell is prepared and data forwarding ensures minimal , though the radio link is briefly interrupted. The intra-network handover procedure typically involves several coordinated steps to transfer the UE's context efficiently. The process begins with the UE sending measurement reports to the source base station (e.g., eNodeB in LTE), detailing signal quality metrics from neighboring cells based on configured events. The source base station then decides on the , prepares the target cell by allocating resources, and transfers the UE's context—including security keys, bearer information, and quality-of-service parameters—via direct interfaces like X2 in LTE or through the core network if direct links are unavailable. Upon receiving the command, the UE detaches from the source and attaches to the target cell, completing the with path switch updates to the core network for routing continuity. Handovers are triggered by specific conditions to preempt degradation in . Primary triggers include signal strength thresholds, such as LTE's A3 event, where the neighbor cell's (RSRP) exceeds the serving cell's by a predefined (hysteresis margin), ensuring proactive . Load balancing serves as a network-initiated , redistributing UEs from congested cells to underutilized ones to optimize usage and throughput across the network. In packet-switched domains, intra-network handovers preserve the UE's and session continuity through mechanisms like GTP tunneling and data forwarding from source to target base stations, avoiding reconfiguration of ongoing IP flows. Conversely, circuit-switched handovers in legacy / networks reassign dedicated channels without IP considerations, focusing instead on maintaining fixed bearer paths, which can introduce higher due to circuit reconfiguration. Performance metrics emphasize low interruption to support real-time applications, with LTE targeting handover latency below 50 ms to minimize user-perceived delays. Handover failure rates, critical for reliability, are often modeled based on signal-to-interference-plus-noise ratio (SINR) margins at the target cell; for instance, the failure probability during handover execution can be approximated using the outage probability under log-normal shadowing as P_{\text{fail}} = Q\left( \frac{\gamma - \mu_{\text{SINR}}}{\sigma} \right), where Q(\cdot) is the Gaussian Q-function, \gamma is the minimum SINR threshold for successful attachment, \mu_{\text{SINR}} is the mean SINR at handover boundary, and \sigma is the shadowing standard deviation (typically 8 dB). These intra-handovers generally occur within defined registration areas, avoiding immediate location updates to the core network.

Inter-network handovers

Inter-network handovers, also known as vertical handovers, enable seamless mobility between disparate network technologies or operators, such as transitions from to or across different radio access technologies (RATs). These handovers are critical in heterogeneous environments where devices must switch between cellular generations to maintain connectivity, often involving inter-RAT (IRAT) measurements to assess signal quality and reselection algorithms to decide the target network. Unlike intra-network handovers, vertical handovers require coordination across core network elements to handle protocol differences and ensure service continuity. The procedure for vertical handovers typically begins with preparation phases, including dual connectivity setups where the device maintains simultaneous links to source and target networks for smoother transitions. In contexts, this involves anchor point relocation, such as migrating the serving gateway (S-GW) to align with the new , which minimizes data path disruptions during the handover execution. Measurements from the source network trigger the process, followed by signaling exchanges via interfaces like the S1 in to reconfigure bearers and update location information in the mobility management entity (). Success criteria include low handover failure rates, often below 1% in optimized deployments, as defined in specifications. Key challenges in inter-network handovers include (QoS) mapping between differing RAT capabilities, where parameters like and throughput must be renegotiated to avoid service degradation—for instance, a voice call from to may experience brief interruptions due to codec mismatches. spikes can arise from extended signaling delays across network boundaries, potentially exceeding 100 ms in suboptimal conditions, while spectrum differences between technologies (e.g., licensed vs. unlicensed bands) complicate interference management and power control. is briefly invoked during these events to verify the device's identity across networks, ensuring secure key derivation without halting the handover. In networks, intra-RAT inter-network handovers (e.g., between gNBs of different operators) leverage the interface for direct communication between gNBs, enabling faster context transfers and reduced core network involvement compared to earlier generations. Inter-RAT handovers involve core network coordination. Conditional mechanisms further enhance reliability by pre-configuring target cells and allowing the device to execute the switch based on radio conditions, mitigating ping-pong effects and improving success rates to over 99% in lab tests. In Release 18 (as of 2024), further enhancements include L1/L2 triggered mobility for near-zero interruption times in Advanced networks. These advancements are outlined in Release 15 and beyond, with IRAT procedures specifying blind and compressed mode operations for measurement accuracy during transitions.

Roaming support

Domestic roaming processes

Domestic roaming processes enable subscribers to access services from partner networks within their home country when the home network's coverage is unavailable, ensuring continuity without service interruption. These processes rely on established agreements and standardized procedures between operators sharing the same national and regulatory framework. Unlike international , domestic processes emphasize seamless integration to mimic home network experience, often included in plans without extra cost to users, supported by regulatory mandates. Bilateral contracts form the foundation of domestic roaming, outlining terms for service access, quality, and settlement between operators. These agreements typically cover number portability to allow subscribers to retain their numbers across networks and ensure service continuity, such as voice, data, and , without reconfiguration. For instance, operators negotiate interconnection points and to support portability , enabling calls and messages to route correctly regardless of the serving network. Such contracts are essential for smaller operators or MVNOs to leverage larger networks' infrastructure for nationwide coverage. In / networks, key procedures involve management through Visitor Location Register (VLR) and Home Location Register (HLR) interactions. When a () enters a partner network's area, it initiates a location update request to the serving Mobile Switching Center (), which forwards it to the VLR. The VLR then queries the HLR in the for subscriber and profile data, including IMSI and subscriptions. Upon verification, the HLR updates the subscriber's and sends necessary parameters back to the VLR, enabling automatic redirection of incoming calls and messages via global title translation. This process ensures minimal , with the old VLR (if applicable) forwarding any pending data to the new VLR for seamless . Analogous processes apply in / networks using elements like /HSS (LTE) or AMF/UDM (); see modern enhancements for details. Charging and billing in domestic roaming integrate with centralized hubs or direct bilateral systems for efficient settlement. Operators use roaming hubs—interconnected platforms like those supporting (BCE)—to exchange usage data in or near- formats, facilitating debit from subscriber accounts without batch processing delays common in international scenarios. For prepaid users, charging applies rules to deduct balances instantly during sessions, while postpaid billing aggregates usage across networks via standardized records. This setup minimizes disputes through automated validation of inter-operator tariffs. User equipment behavior during domestic roaming follows Public Land Mobile Network (PLMN) selection and reselection rules defined in 3GPP standards. In automatic mode, the UE prioritizes its home PLMN (HPLMN) or equivalent upon power-on or signal loss, scanning for available networks and selecting the strongest signal from the operator's preferred list or any viable domestic PLMN if the HPLMN is unavailable. Reselection occurs periodically or on signal degradation, evaluating criteria like signal quality and access technology, while avoiding forbidden PLMNs unless in limited service. Manual mode allows user override to choose a specific domestic partner, bypassing automatic priorities for that session. These rules promote attachment to the best available coverage within the country. Regulations enforce domestic roaming to achieve seamless national coverage, preventing coverage gaps. In the United States, the (FCC) mandates automatic voice and data agreements on reasonable, nondiscriminatory terms, eliminating home market exclusions and requiring providers to negotiate commercially viable deals for access outside licensed areas. Similarly, in the , early directives like the Decision (1999) and Directive (2002) permitted or required national to support rollout in underserved areas, promoting and uniform across member states, though ex ante has diminished with market maturity. These frameworks ensure operators collaborate for ubiquitous connectivity.

International roaming agreements

International roaming agreements enable mobile subscribers to access services across national borders through bilateral or multilateral contracts between operators, standardized by organizations like the GSMA to ensure interoperability and service continuity. The GSMA's IR.21 (Roaming Database, Structure and Updating) serves as a core framework, providing a standardized mechanism for operators to exchange essential roaming data, including network configurations, TADIG codes, contact information, and technical details for various network types such as terrestrial, non-terrestrial, and M2M dedicated integrated systems. This reduces implementation time and supports charging and settlement processes, facilitating reliable global connectivity for users traveling internationally. In the EU, the Roaming Regulation was extended until 2032, ensuring continued "Roam Like at Home" with no extra charges for intra-EU roaming, subject to fair use policies, as confirmed in the 2025 review. To verify interoperability before activating agreements, the GSMA's International Roaming Expert Group (IREG) conducts testing via a structured three-stage outlined in IR.23. Stage 1 involves interface self-certification for protocols like , , , and GTP; Stage 2 covers exchange of numbering data, operational procedures, and fault reporting; and Stage 3 tests end-to-end functionality and performance. This process ensures that networks from different operators can seamlessly interwork, minimizing service disruptions in scenarios. Signaling procedures between the (HPLMN) and visited network (VPLMN) rely on established protocols to manage location updates, service provisioning, and billing. Traditional circuit-switched roaming uses SS7 signaling with the Mobile Application Part () for mobile-specific operations, such as subscriber and profile retrieval from the home location register (HLR). In packet-switched and IMS-based environments, SIP signaling supports VoLTE and data services, while handles modern and policy control in / contexts. is adapted for visited networks by querying the home network's keys via or messages. Key challenges in these agreements include regulatory variances across jurisdictions, which impose differing requirements on data privacy, spectrum usage, and fees, complicating negotiations and compliance. differences further hinder accurate billing, as call detail must align with local times for fair , often leading to disputes. Fraud prevention is paramount, with schemes like roaming recharge—where fraudsters exploit rate by recharging in low-cost areas for high-value international use—causing significant loss; operators mitigate this through monitoring and GSMA-recommended blacklisting of suspicious numbers. The evolution of international roaming has progressed from 2G's voice-focused services, reliant on SS7/MAP for basic connectivity, to 's emphasis on high-speed data roaming with enhanced via the Security Edge Protection (SEPP) to address legacy vulnerabilities. support, standardized by GSMA's SGP.22 and integrated into 5G ecosystems, allows remote provisioning of roaming profiles, eliminating physical swaps and enabling seamless transitions across networks. Performance metrics highlight areas for improvement: field studies indicate roaming success rates where download speeds degrade compared to home networks in approximately 39% of cases, upload speeds in 59%, and in 62%, often due to suboptimal agreements. International latency typically incurs additional delays of 60 ms or more from cross-border signaling, impacting real-time applications.

Registration areas

Circuit-switched areas

In circuit-switched mobility management, a constitutes a geographical grouping of cells served by a single within a . This area is uniquely identified by the , which combines the , Mobile Network Code (MNC), and a 16-bit Location Area Code (LAC). The LAC, encoded as a fixed-length 2-octet value ranging from 0000 to FFFE in hexadecimal (with 0000 and FFFF reserved), distinguishes the LA from others in the same PLMN. The forms the foundational for key procedures in the Circuit-Switched () domain of and networks, specifically Location Area Updates (LAU) and paging. During LAU, a () registers its presence upon entering a new LA, enabling the Visitor Location Register (VLR) associated with the to maintain accurate location records without necessitating updates for movements within the same LA. This mechanism supports efficient call routing and service delivery for voice-centric operations. For incoming calls or other CS services, the network initiates paging by broadcasting messages across all cells in the MS's registered LA, allowing the device to respond and establish a connection while minimizing unnecessary signaling outside the known area. LA sizing involves a critical between signaling overheads: smaller LAs (e.g., encompassing 10-100 cells) increase the frequency of LAU procedures as MSs cross boundaries more often, but reduce paging load by limiting broadcast scope; conversely, larger LAs decrease updates at the cost of higher paging traffic. Operators configure LA sizes based on factors like subscriber density and terrain, typically balancing these costs to optimize network efficiency in or rural deployments. In terms of evolution, in systems are statically defined during network planning, with fixed boundaries tied to coverage. Later releases introduce greater flexibility through dynamic paging areas, where the network can adjust the effective paging scope within or across based on real-time conditions, enhancing adaptability for mobility without altering core LA structures.

Packet-switched areas

In packet-switched networks such as those introduced by the General Packet Radio Service (GPRS) and Enhanced Data rates for GSM Evolution (), the Routing Area (RA) serves as a fundamental unit for managing data mobility. An RA is defined as a geographical area comprising one or more cells within which a () can move freely without needing to update its serving GPRS Support Node (SGSN), thereby maintaining an active packet-switched (PS) session. Each RA is a of a Location Area (LA) from the circuit-switched () domain and is identified by a Routing Area Identity (RAI), which includes the (MCC), Mobile Network Code (MNC), Location Area Code (LAC), and Routing Area Code (RAC). The RAC, a one-octet fixed-length code, uniquely identifies the RA within its encompassing LA. The primary for handling mobility within PS domains is the Routing Area Update (RAU), which occurs when an MS detects a change in the RAI broadcast by the network, such as upon entering a new RA while in PS-IDLE or PS-CONNECTED state. During a PS attach, the MS registers its location at the RA level, enabling the network to route packet data efficiently to the MS without requiring CS domain involvement for data-only devices. If the RA change involves a different SGSN, the includes context transfer and potential updates to the Home Location Register (HLR). This independence allows data sessions to persist seamlessly across RAs, supporting continuous IP connectivity for applications like web browsing or in early mobile data environments. A key advantage of RA-based mobility is the reduction in unnecessary CS signaling overhead, particularly for () focused solely on packet data services. By decoupling PS tracking from CS location updates, the system avoids triggering Location Area Updates (LAU) for movements that do not affect voice services, thereby optimizing network resources and minimizing battery drain on data-centric devices. However, the structural overlap between and —where each RA is confined to a single LA—introduces limitations, especially in Universal Mobile Telecommunications System (UMTS) deployments. When an MS crosses LA boundaries, it necessarily enters a new RA, often necessitating combined RAU/LAU procedures to synchronize both domains, particularly if the Gs links the MSC/VLR and SGSN for dual-mode operation. This coupling can increase signaling load and complexity compared to fully independent PS mobility.

Evolved areas in 4G/5G

In LTE networks, the (TA) serves as a fundamental unit for location management in idle mode, consisting of a group of cells under one or more eNodeBs that enables the (MME) to track (UE) without requiring constant updates. Each TA is uniquely identified by a (TAI), which combines the (MCC), Mobile Network Code (MNC), and Tracking Area Code (TAC) to facilitate paging and mobility procedures. The MME assigns a (TAL) to the UE during attachment or tracking area updates, allowing the device to roam across multiple TAs without triggering an update, thereby optimizing signaling overhead in high-mobility environments. Building on , introduces refinements to concepts for enhanced efficiency in all-IP architectures, including UE-specific TALs that enable targeted paging by the Access and Mobility Management Function (AMF) based on the UE's patterns and last known location. Additionally, the RAN Notification Area () supports the RRC_INACTIVE state, defining a RAN-controlled set of cells or RAN areas where UEs can move without notifying the core network, preserving context at the last serving gNB for rapid resumption of connections. RNA updates occur periodically or upon leaving the configured area, integrating with boundaries to minimize core network involvement while enabling features like small data transmission. Enhancements in these networks include dynamic TA reconfiguration, where the MME or AMF reallocates TALs during tracking area updates, GUTI reallocation, or handovers to adapt to UE mobility, network load, or radio access technology changes, such as support for narrowband IoT. In 5G, artificial intelligence and machine learning (AI/ML) further optimize area prediction by analyzing UE trajectories to proactively adjust TALs or RNAs, reducing update frequency and paging signaling as studied in 3GPP Release 18 for air interface enhancements. Compared to earlier and in pre-4G systems, and their lists are typically larger and more flexible, encompassing multiple cells to decrease location update rates in scenarios with frequent handovers, while enabling overlapping configurations for seamless idle-mode mobility. This evolution supports reduced core network signaling in high-speed or dense deployments, foundational to prior area concepts but tailored for packet-switched dominance.

Modern enhancements

Mobility in LTE networks

Mobility management in networks, part of the Evolved Packet System (EPS), relies on key entities such as the Mobility Management Entity (MME) for core network control and the evolved Node B (eNB) for radio access mobility, primarily facilitated through the X2 interface between eNBs. The MME handles signaling for (UE) attachment, authentication, and location tracking, while eNBs manage direct handovers to minimize core involvement and reduce latency. This architecture supports seamless transitions across cells, enabling high-speed data services in urban and mobile environments. In idle mode, employs Tracking Area Updates () to maintain location at a granular level without excessive signaling. When a moves to a new Tracking Area () not included in its assigned TA List, it initiates a procedure by sending a TAU Request to the via the serving eNB, updating its location and potentially receiving a refreshed TA List for camping without further updates. Paging for incoming calls or data occurs over the entire TA List, allowing the network to reach the efficiently across multiple , which optimizes battery life and reduces overhead compared to cell-level tracking in prior systems. In connected mode, is achieved through handovers, where the source eNB measures signal quality and prepares the target eNB via X2 or S1 interfaces, followed by a path switch to redirect downlink traffic from the Serving Gateway (SGW) to the target eNB. This procedure ensures low interruption times, typically under 50 ms, supporting (VoLTE) continuity by preserving IMS bearers during intra-LTE transitions, thus maintaining real-time voice sessions without fallback to circuit-switched networks. LTE introduces significant mobility improvements over 3G systems, including reduced end-to-end latency to 20-50 ms, enabling faster handovers and responsive applications. The always-on data capability in RRC connected mode allows persistent connectivity without frequent state transitions, minimizing signaling storms during mobility. Carrier aggregation further enhances performance by combining multiple frequency bands, supporting seamless handover across aggregated carriers in high-mobility scenarios like vehicular travel. From Release 8 (Rel-8) to Rel-15, mobility enhancements progressively address Heterogeneous Networks (HetNets), incorporating and macro overlays. Rel-8 establishes baseline intra-LTE and TAU procedures, while Rel-10 introduces for inter-eNB . Subsequent releases, such as Rel-12 and Rel-13, optimize load balancing and dual connectivity in HetNets to handle dense deployments, significantly improving success rates in urban settings. Rel-15 includes support for high-speed up to 500 km/h in applicable scenarios and enhances integration with non-3GPP accesses. These evolutions pave the way for extensions in later releases.

Mobility in 5G networks

In 5G networks, mobility management is anchored in the architecture, where the Access and Mobility Management Function (AMF) serves as the central entity responsible for registration, connection management, and mobility handling for (UE). The AMF replaces the Mobility Management Entity () from , enabling a more modular and service-based architecture that supports seamless transitions across access networks. Handovers in 5G occur primarily through the Next Generation (NG-RAN), utilizing the NG Application Protocol (NGAP) for N2-based procedures between gNBs or between NG-RAN nodes and the AMF, ensuring continuity during inter-node mobility without core network involvement in many cases. This design future-proofs the system for ultra-reliable low-latency communications (URLLC) by decoupling and functions, allowing efficient during movement. Key innovations in mobility include network slicing tailored to specific mobility profiles, which allows operators to provision logical networks with customized policies for different types, such as high-mobility vehicular users or stationary devices. For low-latency applications, edge relocation procedures enable the dynamic migration of user plane functions (UPF) closer to the UE's location, minimizing during handovers in scenarios. Additionally, predictive handover mechanisms leverage (ML) algorithms to anticipate UE movement based on historical data and radio measurements, optimizing trigger timing and target selection to reduce failure rates and latency. These features, integrated via the AMF and session management function (SMF), enhance overall network efficiency and support diverse service requirements. In idle and inactive modes, introduces the RAN Notification Area (), a configurable set of cells or tracking areas where the monitors for paging without frequent registration updates; if the moves outside the , it performs an RNA update procedure to notify the network, balancing power consumption and . Paging is enhanced through in the NG-RAN, where directional beams are used to deliver paging messages efficiently in millimeter-wave deployments, improving coverage and reducing battery drain compared to broadcasting. This beam-based approach, combined with the RRC_INACTIVE state, allows quick resumption of connections for s that were previously active, minimizing signaling overhead. 5G addresses mobility challenges for massive IoT deployments by supporting optimized procedures for low-power wide-area (LPWA) devices, such as extended discontinuous reception (eDRX) and mobility restrictions that limit unnecessary handovers for stationary or slow-moving sensors, enabling scalability to millions of connections per cell. For (V2X) communications, 5G provides enhanced sidelink and network-assisted mobility, including mode switching between direct (PC5) and interfaces to maintain connectivity at high speeds, with low-latency handovers tailored for cooperative intelligent transport systems. From 3GPP Release 15 onward, dual connectivity options like NR Dual Connectivity (EN-DC) allow non-standalone (NSA) deployments where serves as the master node and NR as the secondary, facilitating smooth mobility integration by leveraging 's coverage for control signaling while boosting throughput with data bearers. This builds on foundations as a baseline for initial rollouts, enabling inter-RAT handovers with minimal disruption. Subsequent releases further refine these mechanisms for standalone () operations and advanced scenarios: Rel-17 introduces conditional handovers and enhanced mobility for (XR) services, while Rel-18 specifies / integration for predictive mobility optimization in NG-RAN and support for non-terrestrial networks (NTN).

References

  1. [1]
    Mobility Management | FTA - Federal Transit Administration
    Jul 7, 2025 · Mobility management is an innovative approach for managing and delivering coordinated transportation services to customers.Missing: authoritative | Show results with:authoritative
  2. [2]
    Mobility Management - EPOMM
    Mobility Management (MM) is a concept to promote sustainable transport and manage the demand for car use by changing travellers' attitudes and behaviour.Missing: authoritative sources
  3. [3]
    Mobility Management - SWARCO
    Mobility management is an instrument for the targeted organization and control of transportation and mobility in a specific region, city or organization.Missing: authoritative | Show results with:authoritative
  4. [4]
    [PDF] ETSI TS 123 002 V18.0.0 (2024-04)
    [86]. 3GPP TS 29.272: "Evolved Packet System (EPS); Mobility Management Entity (MME) and. Serving GPRS Support Node (SGSN) related interfaces based on Diameter ...
  5. [5]
    https://www.sciencedirect.com/science/article/pii/S0140366416301323
  6. [6]
    https://www.etsi.org/deliver/etsi_ts/123000_123099/123002/18.00.00_60/ts_123002v180000p.pdf
  7. [7]
    [PDF] Wireless Cellular Networks: 1G and 2G
    One BSC can control multiple BTS. ➢ Allocates radio channels among BTSs. ➢ Manages call handoffs between BTSs. ➢ Controls handset power levels.Missing: mechanism | Show results with:mechanism
  8. [8]
    2g - Global System for Mobile Communication (GSM) - ETSI
    The overall GSM network architecture is described in 3GPP TS 23.002 and a complete list of Technical Specifications for GSM systems is given in 3GPP TS 41.101.Missing: body | Show results with:body
  9. [9]
    GSM Specifications - 3GPP
    This article describes how the original GSM Specifications were drafted and published when they were the sole property of ETSI, long before the creation of 3GPP ...
  10. [10]
    [PDF] ETSI TS 123 060 V3.6.0 (2001-01)
    Figure 8: Control Plane MS - 3G-SGSN. Legend: - UMTS Mobility Management and Session Management (GMM/SM): GMM supports mobility management functionality such ...
  11. [11]
    5G System Overview - 3GPP
    Aug 8, 2022 · 3GPP defines not only the air interface but also all the protocols and network interfaces that enable the entire mobile system: call and session ...
  12. [12]
    The 3rd Generation Partnership Project (3GPP)
    The 5G and LTE-Advanced ecosystem will allow for global network evolution, at the appropriate pace for the market need and the local state of readiness. The ...
  13. [13]
    https://www.3gpp.org/technologies/5g-system-overview
  14. [14]
    [PDF] ETSI TS 124 501 V16.12.0 (2022-07)
    Mar 5, 2022 · The present document may refer to technical specifications or reports using their 3GPP identities. These shall be interpreted as being ...
  15. [15]
    [PDF] ETSI TS 124 008 V16.7.0 (2021-04)
    Apr 9, 2021 · The present document may refer to technical specifications or reports using their 3GPP identities. These shall be interpreted as being ...
  16. [16]
    [PDF] Mobility Management in Emerging Ultra-Dense Cellular Networks
    Bigger TA size reduces signaling overhead of TAU at the expense of larger paging domain, ultimately resulting in higher paging-based downlink signaling load at.
  17. [17]
    [PDF] TS 138 304 - V15.1.0 - 5G; NR - ETSI
    This document specifies 5G User Equipment (UE) procedures in idle mode and in RRC Inactive state, produced by ETSI 3GPP.
  18. [18]
    [PDF] 5G NR Power Saving Enhancements in Release 17
    Dec 1, 2022 · As observed, by only using PEI a UE power saving gain of 16% can be achieved in high SINR conditions and low group paging rate. A similar gain ...
  19. [19]
    (PDF) Location prediction algorithms for mobile wireless systems
    Predicting the location of a mobile wireless user is an inherently interesting and challenging problem. Location prediction has received increasing interest ...
  20. [20]
    [PDF] 5G performance measurements (3GPP TS 28.552 version 16.9.0 ...
    This document is a technical specification for 5G management, orchestration, and performance measurements, produced by the 3GPP.
  21. [21]
    (PDF) Intelligent Paging Strategies for Third Generation Mobile ...
    PDF | Location management procedures, in conjunction with the millions of users expected to subscribe to third generation mobile telecommunication.
  22. [22]
    [PDF] ETSI TS 123 003 V17.9.0 (2023-04)
    Structure of the S-Temporary Mobile Subscriber Identity (S-TMSI) ... 3GPP TS 51.011: " Specification of the Subscriber Identity Module - Mobile Equipment (SIM -.
  23. [23]
    [PDF] ETSI TS 123 003 V9.1.0 (2010-01)
    The P-TMSI and NRI are defined elsewhere in this specification. In the case of a combined MME-SGSN node, the NRI of the SGSN part and the MME code of the ...
  24. [24]
    [PDF] ETSI TS 123 003 V16.5.0 (2021-01)
    2.10 5G Globally Unique Temporary UE Identity (5G-GUTI). 2.10.1 Introduction. The purpose of the 5G-GUTI is to provide an unambiguous identification of the UE ...
  25. [25]
    [PDF] ETSI TS 124 008 V11.9.0 (2014-01)
    Feb 9, 2016 · The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or. GSM identities. These ...
  26. [26]
    [PDF] CHANGE REQUEST 1 4.1.1 - 3GPP
    4.4), the TMSI reallocation may be part of the location updating procedure. The TMSI allocated is then contained in the LOCATION UPDATING ACCEPT message ...
  27. [27]
    Analysis of privacy in mobile telephony systems
    Jul 5, 2016 · The use of TMSIs avoids the exposure of the long-term unique identity (IMSI) and hence aims to provide third-party anonymity and unlinkability ...
  28. [28]
    [PDF] Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using ...
    Feb 24, 2019 · According to the 3GPP standard, it is permissible for a network provider to send out a paging_imsi message in the following two cases: A. When a ...
  29. [29]
    [PDF] Protecting the 4G and 5G Cellular Paging Protocols against Security ...
    Comparison of our P-TMSI refresh solution with other defenses to prevent TMSI correlation attacks. We assume a 20 minute time-period (937 paging cycles) for ...
  30. [30]
    [PDF] HandOver Document for - 3GPP
    After successful completion of the update location update procedure, the serving network is identical with the visited network. After an inter-network handover ...
  31. [31]
    Handover Summary for 2G, 3G, LTE, 5G & 6G - telecomHall Forum
    Sep 25, 2024 · Hard Handover: Like in 2G, but less frequent due to the soft handover approach. Handover in 4G/LTE: Its use hard handover, similar to GSM ...What are the types of Handover in all mobile technologies? - RANWhy is there hard handover in LTE and no soft handover? - RANMore results from www.telecomhall.net
  32. [32]
    [PDF] ETSI TS 123 009 V3.6.0 (2001-03)
    There are two types of handover in UMTS: soft handover and hard handover. The first one is fully performed within. UTRAN, without involving the core network.
  33. [33]
    Multi Cell : LTE to LTE Handover - 4G | ShareTechnote
    Behind the scenes, however, inter-eNB handovers involve additional network-side steps, such as X2 or S1 signaling to transfer the UE's context and a Path Switch ...
  34. [34]
    Handover in LTE along with in-depth call flow understanding
    Jul 4, 2025 · There are three types of Handovers in LTE: Intra-Frequency Handover-Occurs between cells operating on the same carrier frequency. It is ...
  35. [35]
    A survey on the handover management in 5G-NR cellular networks
    Jun 22, 2023 · On the other hand, if the network decides to initiate handover for some purposes such as load balancing, the handover will be a network- ...<|separator|>
  36. [36]
    [PDF] TS 123 402 V9.11.0 (2012-01) - ETSI
    ... handover that IP address preservation based on. NBM management can be provided. IP address preservation for session continuity based on HBM may take place if ...
  37. [37]
    [PDF] Circuit-switched fallback. - Qualcomm
    In the first phase, currently under way, all voice traffic is handled by legacy Circuit-Switched (CS) networks, while data traffic is handled by LTE Packet- ...
  38. [38]
    [PDF] LTE Standards Evolution towards an All Business Connected ...
    handover (with data forwarding between source and target eNBs), thus its average interruption time is about 50ms. In Release 14, the interruption time is ...
  39. [39]
    Reduction of Outage Probability due to Handover by Mitigating Inter ...
    Aug 1, 2014 · A fast and seamless handover poses twin challenges for LTE networks to address, especially at high data rates. Hard handover (HHO), where a ...
  40. [40]
    Roaming for Mobile Wireless Services | Federal Communications ...
    Jun 6, 2019 · Roaming allows mobile wireless customers to automatically receive service when they are outside of the area covered by their provider's network.Missing: bilateral contracts
  41. [41]
    bilateral or multilateral roaming agreement Definition - Law Insider
    bilateral or multilateral roaming agreement means one or more commercial or technical agreements among roaming providers that allow the virtual extension of ...
  42. [42]
    LTE International Roaming Whitepaper - Huawei Carrier
    Roaming is allowed among networks that have the same network standards and only usable in areas or countries where operators have signed a roaming agreement.3. Roaming Networking Mode · 3.2 Grx/ipx-Based... · 5 Roaming ServiceMissing: domestic | Show results with:domestic
  43. [43]
    [PDF] ETSI TS 122 101 V8.11.0 (2009-03)
    3GPP TS 22.066: "Support of Mobile Number Portability (MNP); Service description; Stage 1" ... based, wireless and wireline), and for service continuity between ...
  44. [44]
    [PDF] ETSI TS 123 012 V10.1.0 (2011-06)
    This procedure is used when an MS registers with a Visitor Location Register. The VLR provides its address to the HLR. The VLR may also allocate an optional ...Missing: domestic | Show results with:domestic
  45. [45]
    Billing and Charging Evolution & TAP - Syniverse
    Apr 7, 2025 · BCE supports real-time and near-real-time billing and charging ... billing models which include both domestic and international roaming.
  46. [46]
    Roaming Policy & Charging – Mobileum - Active Intelligence
    Increase outbound roaming revenue with optimized charging rules; Apply real-time policy adjustments to ensure billing accuracy; Lower operational overhead ...
  47. [47]
    inside TS 23.122: PLMN Selection Process - Tech-invite
    There are two modes for PLMN selection, automatic and manual. These are described in clauses 4.4.3 below and illustrated in Figure 2a to Figure 2b in clause 5.Missing: rules domestic behavior
  48. [48]
    [PDF] ETSI TS 123 122 V17.6.0 (2022-05)
    PLMN selection and roaming ... The present document defines the PLMN selection for a multi mode MS that supports both 3GPP and 3GPP2 systems.Missing: domestic | Show results with:domestic
  49. [49]
    https://www.syniverse.com/blog/monetization/exploring-the-key-differences-between-bce-and-tap-proving-out-why-mobile/
  50. [50]
    None
    ### Summary of EU Regulations on National/Domestic Roaming for Seamless Coverage
  51. [51]
    https://www.tech-invite.com/3m23/toc/tinv-3gpp-23-122_f.html
  52. [52]
    Demystifying Roaming: A Practical Guide to IR.21 and 5G SA Settings
    May 29, 2025 · This document sets out a standard mechanism through which operators share roaming data with each other, reducing the time and effort required to ensure ...
  53. [53]
    IR.23 Organization of GSM International Roaming v8.0 - GSMA
    Feb 20, 2025 · This document defines a methodology for testing international roaming, using a three-stage approach: interface self-certification, data ...Missing: IREG interoperability
  54. [54]
    [PDF] ETSI TS 129 002 V3.8.0 (2001-03)
    Generation Partnership Project (3GPP). The present document specifies the Mobile Application Part (MAP), the requirements for the signalling system and.Missing: GSMA | Show results with:GSMA
  55. [55]
    [PDF] cross-country study on - international roaming charges
    making a call on roaming. They include accounting, payments, revenue assurance and fraud prevention, SIM detection among others. Fixed costs include staff ...
  56. [56]
    11 ways that mobile network operators pay for telecom fraud - GSMA
    Jul 2, 2021 · Roaming Fraud Roaming fraud is a special case where the victim's cell phone or stolen SIM cards are used to make exactly these expensive calls.
  57. [57]
    Securing the 5G Era - GSMA
    5G standards development has adopted 'Secure by Design' principles, leading to: Use of Mutual Authentication. Confirming sender and receiver have an established ...Missing: early | Show results with:early
  58. [58]
    [PDF] Roaming Performance Study (Smart 2018/0011) Final Report
    In the context of the review of the EU Roaming Regulation, this document presents results of a study on roaming performance assessment by field measurements on ...<|control11|><|separator|>
  59. [59]
    [PDF] roaming-tmc-2021.pdf - Vaibhav Bajpai
    Feb 16, 2021 · This results in additional latency penalties of 60 ms or more, depending on geographical distance. This leads to worse browsing performance, ...Missing: success rates
  60. [60]
    [PDF] ETSI TS 123 003 V15.9.0 (2020-07)
    - Location Area Code (LAC) is a fixed length code (of 2 octets) identifying a location area within a PLMN. This part of the location area identification can ...
  61. [61]
    Location Update versus Paging Trade-Off in Cellular Networks
    The optimal size is the size that provides the best paging versus location update cost tradeoff and, as a result, minimizes the signaling load in the network.
  62. [62]
    [PDF] TSGR#5(99)492 - 3GPP
    Paging area: A "paging area" is the geographical region in which a User Equipment will be paged as a part of incoming call establishment. A paging area may ...
  63. [63]
    [PDF] ETSI TS 123 003 V3.15.0 (2006-09)
    ... 3GPP TS 24.008 and GSM 11.11). - Routing Area Code (RAC) which is a fixed length code (of 1 octets) identifying a routing area within a location area. Page ...<|control11|><|separator|>
  64. [64]
    [PDF] ETSI TS 123 221 V5.9.0 (2004-03)
    1a) The format of the UMTS Location Area Identifier and UMTS TMSI shall not prevent a dual mode GSM-UMTS mobile which was last location updated over the GSM ...
  65. [65]
    [PDF] ETSI TS 123 236 V17.0.0 (2022-04)
    When the SGSN receives a Routing Area Update Request (combined RA/LA updating), it checks if the particular UE shall be moved (i.e. it has a Gs association with ...
  66. [66]
    [PDF] ETSI TS 123 401 V16.10.0 (2021-04)
    Mar 4, 2021 · This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to ...
  67. [67]
    https://www.3gpp.org/ftp/tsg_ran/tsg_ran/tsgr_05/Docs/Pdfs/RP-99492.pdf
  68. [68]
    None
    Below is a merged and comprehensive summary of the RAN Notification Area (RNA) in 5G, its purpose for the RRC_INACTIVE state, and its relation to Tracking Areas. To retain all information in a dense and organized manner, I will use a combination of narrative text and a table in CSV format for detailed comparisons and specifics. The response consolidates all provided segments while avoiding redundancy and ensuring clarity.
  69. [69]
    Learning-Based Tracking Area List Management in 4G and 5G ...
    Aug 1, 2020 · The last stage identifies UE profiles and performs the allocation of the TAL by using a neural network. The goodness of each technique has been ...
  70. [70]
    AI standard for 5G RAN: what, why, and how - Ericsson
    Nov 7, 2023 · 3GPP, the standards organization for mobile networks, has tackled this problem by working to specify new procedures that can support AI/ML in 5G RAN systems.
  71. [71]
    LTE Tracking Area Update vs. UMTS Location/Routing Area Update
    Nov 1, 2009 · The first difference to the LAU and RAU of UMTS is that the mobile can have a list of several valid tracking areas and an update only has to be ...Missing: Comparison | Show results with:Comparison
  72. [72]
    MME Administration Guide, StarOS Release 21.27 - Mobility ... - Cisco
    Jun 30, 2022 · The MME resides in the EPC control plane and manages session states, authentication, paging, mobility with 3GPP, 2G and 3G nodes, roaming, and other bearer ...
  73. [73]
    [PDF] TS 123 401 - V8.15.0 - LTE - ETSI
    Tracking Area list management comprises the functions to allocate and reallocate a Tracking Area Identity list to the. UE. All the tracking areas in a Tracking ...
  74. [74]
    LTE: Tracking Area (TA) and Tracking Area Update (TAU) - Netmanias
    Aug 30, 2013 · This list shows the tracking areas where the LTE network believes a UE is located and within which a UE can travel without TAU. In the example ...
  75. [75]
    [PDF] TS 136 413 - V8.7.0 - LTE - ETSI
    Figure 8.4.4.2-1: Path switch request: successful operation. The eNB initiates the procedure by sending the PATH SWITCH REQUEST message to the MME. If the E ...
  76. [76]
    Handover in LTE along with in-depth call flow understanding
    Jul 4, 2025 · An S1-Based Handover is used when the X2 interface is not available or cannot be used (e.g., in inter-vendor or inter-operator deployments). In ...
  77. [77]
    LTE Network Latency compared with 2G, 3G & WiFi - CableFree
    4G/LTE: LTE offers significantly lower latency, typically between 20–50 ms, with LTE-Advanced deployments achieving as low as 10–20 ms in optimal conditions.
  78. [78]
    [PDF] ETSI TR 136 932 V15.0.0 (2018-09)
    3GPP TR 36.932 version 15.0.0 Release 15. 8. Capability and performance requirements ... Mobility enhancements for higher speeds (e.g. 50-80 km/h) in small ...