on between the UE and the NG-RAN and an NGAP UE association between the access network and the AMF for 3GPP access. NR RRC protocol states consist of three states, where in addition to RRC_IDLE and RRC_CONNECTED states, a third state has been introduced, RRC_INACTIVE, as an intermediate state prior to transition to RRC_IDLE state in order to save UE power and to allow fast connection setup [3,16]. As shown in Fig. 1.81, in EPS, when a UE is in the RRC_CONNECTED state, the serving eNB evaluates the received signal strength measurements from the UE and initiates a hand- over procedure when the UE's received signal strength goes below a threshold. However, in the RRC_IDLE state, where the eNB is not aware of the UE's location, the UE decides whether to camp on the current cell or to reselect a neighboring target cell based on received signal strength measurements. This procedure is referred to as cell reselection. In EPS, the mobility procedures, that is, as handover in the RRC_CONNECTED state and cell reselection in the RRC_IDLE state, are not flexible, whereas in 5GS, the core network is able to flexibly control whether to perform a handover or cell reselection for a UE in CM- CONNECTED state [3,16]. In EPC, the location of a UE is tracked by the MME. The granularity of location tracking is different depending on the RRC state of the UE. In the RRC_CONNECTED state, the UE's location is tracked at the cell level, whereas in the RRC_IDLE state, its location is tracked at the tracking area level, which is a set of cells belonging to a paging group that simulta- neously transmit paging messages. Similarly, 5GC can track the location of a UE at the tracking area level in the CM-IDLE state, whereas the UE's location is known at the level of the serving cell to the core network in the CM-CONNECTED state. In 5GC, when a UE 166 Chapter 1 registers with the network over the 3GPP access, the AMF allocates a set of tracking areas in TAI list to the UE. The AMF takes into account various information (e.g., mobility pat- tern a