Skip to content

SMS over NAS — Short Messages Carried on NAS

Difficulty: Intermediate / Estimated study time: 25 min / Prerequisites: Registration, Paging / Main players: SMSF, AMF, UDM / Main interfaces: N1(NAS), SBI(Nsmsf / Namf)

Learning objectives

After reading this chapter, you will be able to:

  • Explain that SMS over NAS is "a scheme that carries SMS on NAS (control-plane) messages."
  • Explain why SMS needs neither the QoS Flow/IMS of VoNR and is self-contained within NAS (N1) alone.
  • Diagram the flow in which the UE negotiates the availability of SMS over NAS at Registration and the AMF selects and registers an SMSF.
  • Explain the difference between the Call Flows of MO-SMS (send) and MT-SMS (receive) (MT wakes the UE with Paging).
  • Explain that the SMSF bridges to the SMSC/IP-SM-GW to accomplish the actual delivery.

Prerequisites

What you'll learn in this chapter

  • Why — why SMS needs a dedicated way to be carried, and why it is carried on NAS
  • Basic Concept — the idea of "SMS as an envelope that rides along on control messages"
  • Architecture — the 5GC players involved in SMS over NAS
  • Procedure — Call Flow — negotiation at Registration → MO-SMS (send) → MT-SMS (receive)
  • The difference between MO and MT — what is symmetric and what is asymmetric between send and receive
  • Comparison with EPC / Release differences / Trouble Shooting / FAQ / Practice

Why — why SMS needs a dedicated way to be carried

SMS still plays an important role as a basic service that delivers authentication codes (one-time passwords) and various notifications even in situations where voice calls or data communication are unavailable. That is precisely why 5G also needs a reliable means of carrying SMS.

What makes this tricky is that 5G voice (VoNR) presumes a heavy mechanism of IMS + a dedicated QoS Flow. If SMS too required the same foundation (an IMS PDU Session / QoS Flow), it could end up meaning that SMS cannot be sent while not a single data PDU Session is established. But SMS is a service you want to deliver even "right after registration, before any data connection exists."

So 5G prepared a scheme that carries SMS not on the user plane (PDU Session/QoS Flow) but on the control-plane NAS (N1) messages. This is SMS over NAS. As long as the UE is registered with the 5GC, it can send and receive SMS with just the NAS exchanges with the AMF — no data PDU Session and no IMS required.

Overview

SMS over NAS is realized through the cooperation of the following main players.

  1. UE — sends and receives SMS as the contents (payload) of NAS messages
  2. AMF — the termination of NAS (N1). It extracts the SMS inside the NAS delivered from the UE and relays it to the SMSF (and vice versa)
  3. SMSF (SMS Function) — the core NF that handles SMS send/receive. It bridges between the AMF and the SMSC/IP-SM-GW (details in SMSF)
  4. UDM — holds SMS subscription information and is the registration target for the SMSF at Registration

SMS is carried in the flow: "negotiate at registration so that SMS over NAS can be used, and at send/receive time ride along on NAS and pass via AMF⇔SMSF." Unlike VoNR, the biggest distinguishing feature is that neither adding a QoS Flow nor SIP registration to IMS is required.

Basic Concept — a beginner-friendly explanation

SMS over NAS can be likened to "an envelope that rides along on control messages."

  • Everyday data communication (web, video) flows along the "cargo road" that is the user plane
  • SMS is a small envelope. Rather than building a dedicated cargo road (PDU Session), it is delivered by riding along on the control-purpose courier (NAS) that the UE and 5GC are already exchanging
  • The one that sorts these hitchhiking envelopes is the SMSF. It passes the arrived envelope to the SMSC (the SMS depot)

Whereas a phone call (VoNR) needed to "lay a dedicated lane and call the dispatch center (IMS)," SMS gets by with just adding one envelope to the existing courier. That is why, even without a data connection, SMS is delivered as long as you are registered.

Column: What does riding along on NAS (Non-Access Stratum) mean?

NAS is the layer of control messages (registration, authentication, session management, etc.) exchanged between the UE and the 5GC (AMF) (N1(NAS)). In SMS over NAS, the contents of the SMS (the SMS messages of the RP/CP layers) are carried wrapped as a Container inside these NAS messages. From the UE's viewpoint, SMS flows riding on the NAS exchange with the AMF, and the AMF extracts only that SMS part and passes it to the SMSF.

The important point is that the AMF does not interpret the SMS contents; it merely extracts it from the NAS container and relays it to the SMSF. The processing of the SMS itself (handing it over to the SMSC, etc.) is handled by the SMSF (SMSF).

Architecture

graph LR
    UE["UE"] -- "SMS embedded in N1(NAS)" --> AMF["AMF
(NAS termination / relay)"] AMF -- "SBI(Nsmsf)" --> SMSF["SMSF
(SMS processing)"] SMSF -- "SBI(Nudm)" --> UDM["UDM
(SMS subscription info)"] AMF -- "SMSF registration" --> UDM SMSF -- "to SMSC/IP-SM-GW" --> SMSC["SMSC / IP-SM-GW"]

How to read the diagram: the UE's SMS arrives at the AMF as the contents of a NAS (N1) message. The AMF extracts the SMS part and relays it to the SMSF over SBI(Nsmsf). The SMSF hands it over to the SMSC/IP-SM-GW to accomplish delivery. At Registration, the AMF performs SMSF registration to the UDM, and the SMSF retrieves the SMS subscription information from the UDM. Note the point that none of the SMF/UPF/PCF or QoS Flow of VoNR appears, and it is self-contained within the control plane (NAS + SBI).

Network Function

NF Role Information held APIs used APIs provided Related interfaces Impact on failure
UE Sends/receives SMS as NAS contents N1(NAS) The UE cannot send/receive SMS
AMF NAS termination. Extracts SMS and relays to SMSF UE context (SMS support capability) Nsmsf_SMService Namf_Communication (N1N2, etc.) N1, SBI SMS NAS relay impossible
SMSF Processes SMS send/receive, relays to SMSC SMS context, SMS subscription info Nudm (subscription info) Nsmsf_SMService SBI SMS over NAS unavailable
UDM Holds SMS subscription info, SMSF registration target SMS subscription data, SMSF registration Nudm_UECM / Nudm_SDM SBI SMS subscription check / SMSF registration impossible

About the SBI service names

The service provided by the SMSF is Nsmsf_SMService (Activate / Deactivate / UplinkSMS, etc.; the individual operations are to be confirmed), specified in TS 29.540 (see SMSF). The specific SBI service name, operations, ports, etc. that the AMF uses for SMSF relay — anything without confirmation — are marked to be confirmed.

Interface

Interface Both ends Transport Protocol Port Procedure used
N1(NAS) UE ⇔ AMF — (over the air, transparent through RAN on N2) NAS(5GMM/5GSM) + SMS Container Transport of SMS (ride-along)
SBI(Nsmsf) AMF ⇔ SMSF TCP SBI(HTTP/2/TLS) implementation-dependent SMS relay (Nsmsf_SMService)
SBI(Nudm) SMSF/AMF ⇔ UDM TCP SBI(HTTP/2/TLS) implementation-dependent SMS subscription info retrieval / SMSF registration

For details, see the Interface Dictionary.

Procedure — Call Flow

SMS over NAS is understood through three parts: (A) the SMS over NAS negotiation at Registration → (B) MO-SMS (send) → (C) MT-SMS (receive).

(A) Negotiation at Registration

sequenceDiagram
    participant UE
    participant AMF
    participant UDM
    participant SMSF

    Note over UE,SMSF: Negotiate SMS over NAS availability during Registration
    UE->>AMF: Registration Request ("SMS over NAS request")
    AMF->>UDM: Retrieve subscription info (check SMS support)
    UDM-->>AMF: SMS subscription present
    AMF->>SMSF: Nsmsf SMS Activate (create SMSF context)
    SMSF->>UDM: Retrieve SMS subscription data / SMSF registration
    SMSF-->>AMF: Activate response (SMS over NAS available)
    AMF-->>UE: Registration Accept ("SMS over NAS allowed")

Explanation of the steps:

  1. In the Registration Request, the UE indicates that it "wants to use SMS over NAS" (capability negotiation).
  2. The AMF queries the UDM for subscription information and confirms whether the UE has an SMS subscription.
  3. If there is an SMS subscription, the AMF selects an SMSF, Activates the SMSF context over Nsmsf, and the SMSF retrieves the SMS subscription data from the UDM (SMSF registration is also performed at the same time).
  4. The AMF returns "SMS over NAS available" to the UE in the Registration Accept. From then on, the UE can send and receive SMS over NAS.

(B) MO-SMS (send: UE→network)

sequenceDiagram
    participant UE
    participant AMF
    participant SMSF
    participant SMSC as SMSC/IP-SM-GW

    UE->>AMF: NAS (Uplink NAS Transport, SMS embedded)
    AMF->>SMSF: Nsmsf_SMService UplinkSMS (extract SMS and relay)
    SMSF->>SMSC: SMS forward (delivery request)
    SMSC-->>SMSF: Acceptance/delivery result
    SMSF-->>AMF: Response (delivery report, etc.)
    AMF-->>UE: NAS (Downlink NAS Transport, response embedded)

Explanation of the steps: The UE sends the SMS to the AMF as the contents of a NAS message (Uplink NAS Transport, etc.). The AMF extracts the SMS part and relays it to the SMSF over Nsmsf, and the SMSF hands it to the SMSC/IP-SM-GW to request delivery. The delivery result (delivery report) returns to the UE over NAS in the reverse direction.

(C) MT-SMS (receive: network→UE)

sequenceDiagram
    participant SMSC as SMSC/IP-SM-GW
    participant SMSF
    participant AMF
    participant UE

    SMSC->>SMSF: SMS arrives (for UE)
    SMSF->>AMF: Hand over MT-SMS via Nsmsf
    alt UE is CM-IDLE
        AMF->>UE: Paging
        UE->>AMF: Service Request (connection resume)
    end
    AMF->>UE: NAS (Downlink NAS Transport, SMS embedded)
    UE-->>AMF: NAS (delivery confirmation)
    AMF-->>SMSF: delivery report
    SMSF-->>SMSC: delivery-complete notification

Explanation of the steps: The UE-bound SMS arriving from the SMSC/IP-SM-GW is received by the SMSF and handed over to the AMF. If the UE is CM-IDLE (idle), the AMF first wakes the UE with Paging, and after the UE returns to the connected state with a Service Request, the AMF delivers the SMS to the UE as the contents of NAS (Downlink NAS Transport). The delivery confirmation returns over NAS, and the delivery-complete is notified from SMSF→SMSC.

The biggest difference between MO and MT is Paging

Sending (MO) starts from a state where the UE can already send NAS (connected), so Paging is unnecessary. Receiving (MT) is an incoming from the network, and if the UE is idle it must be woken first. This is the same structure as VoNR's MT call.

Signal Flow

Signal Purpose Source Destination Key IEs Result
Registration Request Request to use SMS over NAS UE AMF "SMS supported/requested" Negotiation starts
Nsmsf SMS Activate Create SMSF context AMF SMSF SUPI, access type SMSF registration / becomes available
Uplink NAS Transport(SMS) Send SMS over NAS (MO) UE AMF SMS Container(RP/CP) AMF extracts SMS
Nsmsf_SMService UplinkSMS Relay SMS to SMSF AMF SMSF SMS payload Delivery request to SMSC
Downlink NAS Transport(SMS) Deliver SMS over NAS (MT) AMF UE SMS Container(RP/CP) UE receives SMS
delivery report Delivery result notification SMSF AMF/SMSC Delivery status MO/MT complete

About IE names and Container details

The container that wraps SMS inside NAS and the IE names (Uplink/Downlink NAS Transport's Payload container type=SMS, etc.) are specified in the TS 24.501 family, but the specific IE names and section numbers are to be confirmed (do not assert by conjecture). Representative names are used here to illustrate the concept.

The difference between MO and MT (send and receive)

Aspect MO-SMS (send) MT-SMS (receive)
Origin UE (originating) SMSC/IP-SM-GW (terminating)
Paging Unnecessary (UE can already send) Necessary if CM-IDLE (Paging)
Flow UE→AMF→SMSF→SMSC SMSC→SMSF→AMF→UE
Commonalities Both ride along on NAS, the SMSF relays, no QoS Flow/IMS needed Same as left

Comparison with EPC

  • In 4G/EPC: SMS was provided by schemes such as SMS over SGs (MME⇔MSC) and SMS in MME / SGd (via IP-SM-GW). Control was handled mainly by the MME or the MSC (see also the comparison table in SMSF).
  • In 5G: the SMSF exclusively handles SMS over NAS, the AMF does the NAS relay, and the SMSF bridges to the SMSC/IP-SM-GW. The idea of "carrying SMS on the control plane (NAS)" is shared with SMS over SGs, etc., but the difference is that in 5GC, following the SBA, the role has been organized into a dedicated NF, the SMSF (the exact correspondence is to be confirmed).
Generation SMS provisioning scheme
4G/EPC SMS over SGs (MME⇔MSC) / SMS in MME・SGd (via IP-SM-GW)
5G SMS over NAS (the SMSF processes SMS over NAS, the AMF relays)

Release differences

  • Rel-15: SMS over NAS and the SMSF were defined as base functions.
  • Rel-16 onward: the presence and details of extensions are to be confirmed against each TS (not asserted in this chapter).

Trouble Shooting

Symptom Presumed cause What to check Logs/Packets Direction of remedy
Cannot send SMS (MO) SMS over NAS not allowed Whether it was allowed in Registration Accept AMF logs, NAS Check subscription (UDM) / SMSF selection
SMS not delivered (MT) SMSF registration inconsistency Whether the UDM's SMSF registration is correct UDM/SMSF logs Check SMSF registration / subscription info
Not delivered to an idle UE Paging does not occur / fails Whether there is a Paging response N2 Paging, RAN Check Paging / reachability
Only some are delivered Problem on the SMSC/IP-SM-GW side Connectivity from SMSF to SMSC SMSF↔SMSC trace Check SMSC connection settings / to be confirmed

3GPP Specification

  • 3GPP TS 23.501 — 5G architecture. The positioning of SMSF/SMS over NAS (section number to be confirmed)
  • 3GPP TS 23.502 — SMS-related procedures (SMSF selection at registration, MO/MT-SMS. Section numbers to be confirmed)
  • 3GPP TS 24.501 — NAS (5GS) protocol. SMS transport via NAS Transport / SMS Container (section numbers to be confirmed)
  • 3GPP TS 29.540 — Specification of Nsmsf (SMService) (individual section numbers to be confirmed)

FAQ

Q. Does SMS require IMS or a QoS Flow like VoNR? A. No. Because SMS over NAS rides SMS along on the control plane (NAS), it needs neither SIP registration to IMS nor a dedicated QoS Flow. Even without a data PDU Session, it can send and receive as long as it is registered with the 5GC.

Q. Does the AMF read the contents of the SMS? A. No. The AMF merely extracts the SMS part from the NAS container and relays it to the SMSF; the processing of the SMS itself (handing it over to the SMSC, etc.) is handled by the SMSF.

Q. Why is Paging sometimes needed for receiving (MT)? A. Because an incoming is network-originated, and if the UE is CM-IDLE (a power-saving standby) it cannot immediately receive NAS. It is first woken with Paging, returned to the connected state with a Service Request, and then the SMS is delivered. Sending (MO) does not need this because the UE can already send.

Q. When does SMS over NAS become available? A. From the moment the UE requests it within Registration, the SMS subscription is confirmed at the UDM and SMSF registration is done, and the AMF allows it in the Registration Accept.

Summary

  • SMS over NAS is a scheme that carries SMS as the contents of NAS (control-plane) messages between UE⇔AMF⇔SMSF.
  • Unlike VoNR, it needs neither IMS nor a dedicated QoS Flow, and as long as it is registered with the 5GC, it can send and receive SMS even without a data connection.
  • At Registration, the availability of SMS over NAS is negotiated, and the AMF selects the SMSF and registers it to the UDM.
  • MO-SMS goes UE→AMF→SMSF→SMSC, and MT-SMS goes in the reverse direction, and MT is preceded by Paging if CM-IDLE.
  • The AMF merely relays as the NAS termination; the SMS processing and the bridging to the SMSC are handled by the SMSF (details).

Practice — comprehension check and exercises

Comprehension check

Q1. Why does SMS over NAS, unlike VoNR, need neither IMS nor a QoS Flow?

Because it carries SMS by riding it along on the control plane (NAS) rather than the user plane (PDU Session/QoS Flow). Since NAS is already usable as long as the UE is registered with the 5GC, it needs neither SIP registration to IMS nor a dedicated QoS Flow. It can deliver SMS even right after registration when there is no data connection.

Q2. To use SMS over NAS at Registration, what do the AMF, UDM, and SMSF do?

The AMF receives the SMS request in the Registration Request, confirms the SMS subscription at the UDM, selects an SMSF, and Activates the context over Nsmsf. The SMSF retrieves the SMS subscription data from the UDM, and SMSF registration is performed to the UDM. The AMF returns availability in the Registration Accept.

Q3. What is the biggest difference between MO-SMS and MT-SMS?

The need for Paging. MO (send) does not need it because the UE can already send NAS, but MT (receive) is network-originated, and if the UE is CM-IDLE it is first woken via PagingService Request before delivery.

Exercises

  • Draw the Call Flows of MO-SMS and MT-SMS side by side and illustrate where they are symmetric and where they are asymmetric (the presence or absence of Paging).
  • Summarize in a table the division of roles between SMS over NAS (5G) and SMS over SGs (4G), as pairs of responsible NF (SMSF↔MME/MSC) and carrying layer (NAS↔SGs) (avoid asserting the correspondence, and clearly note the items to be confirmed).

Next Step

  • VoNR — voice in the same Level4. Contrast with the mechanism that, unlike SMS, requires IMS + a QoS Flow
  • Emergency — the special handling of emergency calls (unregistered UE, priority)
  • SMSF — dig deeper into the role of the core NF for SMS processing
  • Registration — go back to the registration procedure where the SMS over NAS negotiation happens and deepen your understanding