Closed Access Group Identifier

Description

The Closed Access Group Identifier (CAG-ID) is a fundamental identifier introduced in 3GPP Release 16 to support Closed Access Groups (CAGs) in 5G networks. A CAG represents a group of cells within a Public Land Mobile Network (PLMN) to which access is restricted to a specific set of subscribers, typically used for non-public network (NPN) deployments such as private campus networks, factories, or enterprise environments. The CAG-ID is defined in 3GPP TS 23.003 and is unique within the scope of a single PLMN, meaning the same CAG-ID value may be reused in different PLMNs without conflict.

Architecturally, the CAG-ID is broadcast by cells belonging to the CAG via System Information Block Type 1 (SIB1) in the radio access network. The CAG-ID is a 32-bit identifier, allowing for a large number of distinct closed access groups per PLMN. When a User Equipment (UE) attempts to access a cell, it reads the broadcast CAG-ID and compares it against its own subscription data, which includes a list of allowed CAG-IDs stored in the UE's SIM/USIM or provisioned via the network. If the UE's subscription includes the broadcast CAG-ID, access is granted; otherwise, the UE is denied access to that cell. This mechanism ensures that only authorized devices can connect to the restricted cells.

The CAG-ID is used in both the control plane and user plane procedures. In the control plane, during initial access or handover, the UE includes the CAG-ID in the RRC connection setup request or RRC reconfiguration complete message, allowing the network to verify the UE's authorization. In the core network, the Access and Mobility Management Function (AMF) retrieves the UE's subscription information from the Unified Data Management (UDM) and checks whether the CAG-ID is included in the allowed CAG list. If not, the AMF rejects the registration or service request. The CAG-ID is also used in mobility management to ensure that the UE only hands over to cells within its allowed CAGs.

In terms of deployment, CAGs are typically used for non-public networks that are hosted by a public PLMN. This allows enterprises to leverage the public network infrastructure while maintaining strict access control for their private resources. The CAG-ID enables the network to differentiate between public users and private users, ensuring that only authorized devices can access the private network's services. This is particularly important for mission-critical applications, industrial IoT, and campus networks where security and isolation are paramount.

The CAG-ID is defined in several 3GPP specifications, including TS 24.501 (Non-Access Stratum protocol for 5G System), TS 38.304 (NR User Equipment procedures in idle mode), and TS 38.331 (NR Radio Resource Control protocol). These specifications detail the encoding, transmission, and usage of the CAG-ID across different layers of the protocol stack. The identifier has been maintained consistently across Releases 16, 17, 18, and 19, with no changes to its definition, reflecting its stability and fundamental role in 5G non-public network support.

Purpose & Motivation

The CAG-ID was introduced to address the growing demand for private and non-public networks in 5G, particularly in enterprise, industrial, and campus environments. Before Release 16, 5G networks primarily supported public access, and there was no standardized way to restrict access to a specific group of cells for a defined set of subscribers. Enterprises requiring private networks had to rely on isolated deployments or proprietary solutions, which lacked integration with public networks and were costly to maintain.

The CAG-ID solves this by providing a standardized identifier that allows a public PLMN to host multiple closed access groups, each with its own set of authorized subscribers. This enables a single network infrastructure to serve both public users and private users, with strict access control. The CAG-ID ensures that only devices with the correct subscription can access the private cells, preventing unauthorized access and ensuring data isolation.

Furthermore, the CAG-ID facilitates seamless mobility between public and private networks. A UE can move between public cells and its private CAG cells without losing connectivity, as long as it is authorized for both. This is crucial for applications like smart factories, where workers and machines need to roam between different areas while maintaining secure access to private resources. The CAG-ID also supports network slicing and QoS differentiation, allowing private networks to have dedicated resources and performance guarantees.