GNSS, Location Verification & Tracking Areas in 5G NTN

Introduction

Registration is the NAS procedure by which a UE makes itself known to the 5G core — it authenticates, is assigned a Registration Area, and becomes reachable for paging and callable for sessions. In NTN it is the moment where the network pins a UE that could be anywhere under a country-sized beam to a specific, lawful place: a fixed Tracking Area, a country, and a permitted operator.

It happens right after the UE has selected a cell and completed random access and RRC setup: the very first uplink NAS message the UE sends (Registration Request) rides inside RRCSetupComplete. From then on, mobility (Tracking Area Updates), reachability (paging), charging and lawful intercept all hang off the location established here — which is why getting NTN registration right is a regulatory concern, not just a connectivity one.

Because registration is a defined signalling exchange — connect, send the NAS request, authenticate, receive accept — a failure lives in one identifiable step. In NTN the extra failure modes cluster around location: a missing GNSS fix, a wrong fixed-TA selection, or a location the network cannot verify. Walking the steps tells you which of those bit you.

Why NTN registration is needed

Concretely, registration exists so the core can answer three questions it cannot answer from the cell alone in NTN: where is this UE (which fixed Tracking Area and country), who may serve it (which PLMN holds the licence there), and how do we reach it later (which Registration Area to page across). Terrestrial 5G reads all three off the tiny cell the UE camped on. An NTN beam is too big for that, so registration must fold in the UE's GNSS position — and, because the answer has legal weight, must be able to verify that position rather than trust it blindly.

Why an NTN UE must have GNSS

In terrestrial 5G a phone never needs to know where it is to attach. In NTN it does — GNSS support is a baseline requirement for an NR-NTN UE, not an optional extra. There are three independent reasons, and any one of them would be enough on its own.

The first two reasons are physical. The satellite is hundreds to thousands of kilometres away and moving fast, so the round-trip delay is enormous and the Doppler shift is large. Rather than have the network chase these, the UE computes its own timing advance and Doppler pre-compensation from "where the satellite is" (ephemeris, from SIB19) minus "where I am" (GNSS). Without a position fix the UE simply cannot line up its uplink. The third reason is regulatory and topological: because one beam spans huge areas, the UE's location is what decides which Tracking Area, which PLMN, and which country it should be treated as being in.

The big-footprint problem

A terrestrial macro cell is a few kilometres across, so the long-standing simplification "one cell belongs to one Tracking Area Code (TAC), in one country, under one operator" holds effortlessly. An NTN beam can be tens to hundreds of kilometres across. A single satellite cell can therefore straddle many Tracking Areas, and near borders it can cover parts of several countries at once. That is a genuine problem, not a cosmetic one:

• Registration: the core uses the TAC a UE reports to decide the Registration Area and where to page it. If a giant cell advertised a single TAC, that TAC would be meaningless as a location.
• Regulatory / lawful: spectrum licences, lawful intercept and emergency services are national. The network must know which country a UE is really in — "somewhere under this beam" is not an acceptable answer.
• Operator selection: different operators may hold the rights in different countries under the same footprint, so which PLMN a UE may use depends on where it physically sits.

So NTN cannot keep the naive "cell = TAC = country" mapping. The fix is to make Tracking Areas stay tied to geography even when the radio cell that serves them is enormous and, for LEO, moving.

Keeping Tracking Areas geographic

The mechanism is to decouple the fixed geographic Tracking Area from the moving radio cell. An NTN cell can broadcast multiple TACs — a list, one per fixed geographic Tracking Area that currently falls under its footprint. The UE then uses its GNSS position to decide which of those fixed areas it is actually in, and treats that fixed TA (and its country) as its location. Registration and paging are anchored to the fixed geographic area, not to whichever satellite cell happens to be overhead.

The consequence for mobility is subtle but important. With earth-moving beams, a stationary UE will see the broadcast TAC list change as satellites pass, because a different cell now covers its patch of ground. If the UE registered on the raw cell TAC, it would fire spurious Registration updates every time a satellite handed off — churn for a UE that never moved. By pinning itself to a fixed geographic TA using GNSS, the UE only performs a mobility Registration / Tracking Area Update when it genuinely crosses a fixed-TA boundary, not every time the sky changes. Conversely, a UE that does drift across a fixed-TA border (even slowly) will register even if its serving cell never changed. This is defined across TS 23.501 / TS 23.502, with the idle-mode location handling in TS 38.304.

The registration flow, step by step

NTN registration is the ordinary 5G registration procedure with location folded in. Walk the phases in order; the first that misbehaves is your root cause.

Step 1 — GNSS fix and fixed-TA selection

Before any signalling, the UE acquires a GNSS position, reads the broadcast TAC list and geographic mapping (from SIB19 and SIB1), and decides which fixed Tracking Area — and therefore which country and permitted PLMN — it is physically in. That chosen TAI is what it will register against, regardless of which raw cell is overhead.

Step 2 — Connection and NAS Registration Request

The UE runs random access and RRC setup, then sends its NAS Registration Request (with its 5G-S-TMSI or SUCI and the selected TAI) piggybacked in RRCSetupComplete. The gNB forwards it to the AMF as an Initial UE Message. This uplink RRC rides on PUSCH; the setup that precedes it uses the RACH chain (Msg2 RAR on PDSCH ← DCI format 1_0 / RA-RNTI, Type1-PDCCH CSS), with NTN's GNSS-plus-ephemeris timing pre-compensation so the messages land in-window despite the long round trip.

Step 3 — Authentication, security and (optional) location verification

The AMF runs authentication (5G-AKA) and NAS security setup. In NTN it may additionally invoke network-verified UE location (see below), corroborating the UE-reported GNSS position with RAN assistance before it trusts the claimed TAI/country.

Step 4 — Registration Accept and reachability

The AMF returns a Registration Accept carrying a fresh 5G-GUTI and the TA list (Registration Area) the UE will be paged across; the UE confirms with Registration Complete. From here the UE is reachable, and it will only re-register (a Tracking Area Update) when its GNSS position crosses out of that fixed-TA-based Registration Area — not merely because a satellite handed off.

Representative UE NAS/RRC log (NTN registration) — illustrative, values vary by vendor/build:

PLMN and country selection

The same location fix protects operator and country selection. Because a beam can reach across a national border, a UE could otherwise camp on a cell that is, at its position, actually licensed to serve a different country — a regulatory violation, even if the radio is perfectly good. The NTN UE uses its GNSS location to avoid selecting a cell/PLMN that does not correspond to the country it is physically in. In practice the network broadcasts the mapping between geographic areas and the PLMNs/TACs valid there, and the UE cross-checks its own position before treating a cell as a candidate. This is why location, not just signal strength, gates suitability in NTN.

Network-verified UE location

All of the above trusts the UE to report where it is — and for charging, lawful intercept and regulatory compliance that trust cannot be blind. So NTN supports network-verified UE location: the network (the AMF, working with the RAN) can independently verify the UE-reported GNSS position rather than accepting it at face value. If the reported location cannot be verified or is inconsistent, the network can refuse service or restrict it, because getting the country wrong has legal consequences an operator cannot accept.

Discontinuous coverage and power saving

A sparse LEO constellation — especially early IoT deployments — may not have a satellite overhead at all times, so coverage of a given spot comes and goes. Rather than let a UE burn power blindly searching during a gap, NTN can give it satellite-assistance information (ephemeris and coverage/availability data) so it knows when the next satellite will be visible. The UE can then sleep through the gap and wake up in time for the next pass — a large battery win for a fixed sensor that would otherwise scan a dead sky. Rel-17 provides partial support for discontinuous coverage; it is enhanced substantially in Rel-18. See ntn-evolution for how this and the wider NTN feature set grow release over release.

Summary

The fastest way to root-cause an NTN registration failure is to remember that in NTN the cell no longer implies location — the UE's GNSS fix does — and then walk the phases in order. Fix & TA-select → Connect & Request → Authenticate & Verify → Accept: if the UE never registers at all, suspect a missing GNSS fix or a failed SIB19/SIB1 decode. If it registers in the wrong place, suspect fixed-TA selection or the geographic-to-TAC mapping. If it is refused after authenticating, suspect network-verified location or a PLMN/country mismatch. If a stationary UE churns with repeated TAUs, suspect a TA list built on raw cell TACs rather than fixed geographic TAs.

The unifying idea is that NTN reattaches Tracking Areas, countries and operator rights to geography using two things the UE always has — a GNSS position and a cell that broadcasts a set of geographically-mapped TACs — and then, because the answer carries legal weight, lets the network verify it. Isolating the broken phase turns a vague "NTN attach failure" into a specific, testable hypothesis.

Interview quickfire