4.1 General

24.0083GPPCore network protocolsMobile radio interface Layer 3 specificationRelease 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

This clause describes the procedures used for mobility management for non-GPRS services and for GPRS-services at the radio interface (Reference Point Um and Uu).

The main function of the Mobility Management sublayer is to support the mobility of user terminals, such as informing the network of its present location and providing user identity confidentiality.

A further function of the MM sublayer is to provide connection management services to the different entities of the upper Connection Management (CM) sublayer (see 3GPP TS 24.007 [20]).

There are two sets of procedures defined in this chapter:

– MM procedures for non-GPRS services (performed by the MM entity of the MM sublayer); and

– GMM procedures for GPRS services (performed by the GMM entity of the MM sublayer), see 3GPP TS 24.007 [20].

All the MM procedures described in this clause can only be performed if a RR connection has been established between the MS and the network. Else, the MM sublayer has to initiate the establishment of a RR connection (see 3GPP TS 44.018 [84] subclause 3.3 and 3GPP TS 25.331 [23c]).

In A/Gb mode, the GMM procedures described in this clause, use services provided by the RR sublayer without prior RR connection establishment.

In Iu mode: all the GMM procedures described in this clause can only be performed if a PS signalling connection has been established between the MS and the network. Else, the GMM sublayer has to initiate the establishment of a PS signalling connection (see 3GPP TS 25.331 [23c]).

GMM procedures are mandatory and applicable only for GPRS MSs and networks supporting those MSs. For GPRS MSs which are IMSI attached for both GPRS and non-GPRS services, some MM procedures are replaced by GMM combined procedures provided that the network operates in network operation mode I, i.e. is supporting combined GMM procedures. GMM combined procedures are not applicable for the GPRS MS operation mode C but are mandatory for the GPRS MS operation modes A and B and networks supporting network operation mode I, see 3GPP TS 23.060 [74].

4.1.1 MM and GMM procedures

4.1.1.1 Types of MM and GMM procedures

Depending on how they can be initiated, three types of MM procedures can be distinguished:

1) MM common procedures:

A MM common procedure can always be initiated whilst a RR connection exists. The procedures belonging to this type are:

Initiated by the network:

– TMSI reallocation procedure;

– authentication procedure;

– identification procedure;

– MM information procedure;

– abort procedure.

However, abort procedure is used only if an MM connection is being established or has already been established i.e. not during MM specific procedures or during IMSI detach procedure, see subclause 4.3.5.

Initiated by the mobile station:

– IMSI detach procedure (with the exceptions specified in subclause 4.3.4).

2) MM specific procedures:

A MM specific procedure can only be initiated if no other MM specific procedure is running or no MM connection exists. The procedures belonging to this type are:

– normal location updating procedure;

– periodic updating procedure;

– IMSI attach procedure; and

– eCall inactivity procedure.

3) MM connection management procedures:

These procedures are used to establish, maintain and release a MM connection between the mobile station and the network, over which an entity of the upper CM layer can exchange information with its peer. A MM connection establishment can only be performed if no MM specific procedure is running. More than one MM connection may be active at the same time.

Depending on how they can be initiated, three types of GMM procedures can be distinguished:

1) GMM common procedures:

In Iu mode, a GMM common procedure can always be initiated whilst a PS signalling connection exists.

The procedures belonging to this type are:

Initiated by the network when a GMM context has been established:

– P-TMSI (re-) allocation;

– GPRS authentication and ciphering;

– GPRS identification;

– GPRS information.

2) GMM specific procedures:

Initiated by the network and used to detach the IMSI in the network for GPRS services and/or non-GPRS services and to release a GMM context:

– GPRS detach.

Initiated by the MS and used to attach or detach the IMSI in the network for GPRS services and/or non-GPRS services and to establish or release a GMM context:

– GPRS attach and combined GPRS attach;

– GPRS detach and combined GPRS detach;

– eCall inactivity procedure.

Initiated by the MS when a GMM context has been established:

– normal routing area updating and combined routing area updating;

– periodic routing area updating.

3) GMM connection management procedures (Iu mode only):

Initiated by the MS and used to establish a secure connection to the network and/or to request the resource reservation for sending data:

Service Request.

The Service Request procedure can only be initiated if no MS initiated GMM specific procedure is ongoing.

4.1.1.1.1 Integrity Checking of Signalling Messages in the Mobile Station (Iu mode only)

In Iu mode only, integrity protected signalling is mandatory with one exception regarding emergency calls (see subclause 4.1.1.1.1a). In Iu mode only, all layer 3 protocols shall use integrity protected signalling once the security mode procedure has been successfully activated in the network and the MS. Integrity protection of all layer 3 signalling messages is the responsibility of lower layers. It is the network which activates integrity protection. This is done using the security mode control procedure (3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).

The supervision that integrity protection is activated shall be the responsibility of the MM and GMM layer in the MS (see 3GPP TS 33.102 [5a]). In order to do this, the lower layers shall provide the MM and GMM layer with an indication on when the integrity protection is activated in the MS (i.e. one indication to the MM layer when a security mode control procedure for the CS domain is processed successfully and one indication to the GMM layer when a security mode control procedure for the PS domain is processed successfully).

The CS and PS domains in the network and the MM and GMM layers in the MS, are not aware of whether integrity protection has been started in the lower layers by the other domain. It is mandatory for the network to initiate one security mode control procedure for the CS domain and one for the PS domain.

Except the messages listed below, no layer 3 signalling messages shall be processed by the receiving MM and GMM entities or forwarded to the CM entities, unless the network has activated the integrity protection for that domain.

– MM messages:

– AUTHENTICATION REQUEST

– AUTHENTICATION REJECT

– IDENTITY REQUEST

– LOCATION UPDATING ACCEPT (at periodic location update with no change of location area or temporary identity, and, any Per MS T3212 value is not changed)

– LOCATION UPDATING REJECT (if the cause is not #25)

– CM SERVICE ACCEPT, if the following two conditions apply:

– no other MM connection is established; and

– the CM SERVICE ACCEPT is the response to a CM SERVICE REQUEST with CM SERVICE TYPE IE set to ’emergency call establishment’

– CM SERVICE REJECT (if the cause is not #25)

– ABORT

– GMM messages:

– AUTHENTICATION & CIPHERING REQUEST

– AUTHENTICATION & CIPHERING REJECT

– IDENTITY REQUEST

– ATTACH REJECT (if the cause is not #25)

– ROUTING AREA UPDATE ACCEPT, if any of the following conditions applies:

– the MS performs periodic routing area updating with:

– no change in routing area or temporary identities;

– no change in T3312 extended value;

– no change in Network feature support value; and

– extended DRX parameters IE not included.

– the GMM entity in the MS has received an ATTACH ACCEPT message with neither ciphering nor integrity protection applied in response to an ATTACH REQUEST message with attach type set to "emergency attach"; or

– the MS has performed intersystem change from S1 mode to Iu mode with a PDN connection for emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode.

– ROUTING AREA UPDATE REJECT (if the cause is not #25)

– SERVICE REJECT (if the cause is not #25)

– DETACH ACCEPT (for non power-off)

– ATTACH ACCEPT, if the ATTACH ACCEPT is the response to an ATTACH REQUEST with attach type set to "emergency attach".

– SERVICE ACCEPT, if any of the following conditions applies:

– the GMM entity in the MS has received an ATTACH ACCEPT message with neither ciphering nor integrity protection applied in response to an ATTACH REQUEST message, with attach type set to "emergency attach"; or

– CC messages:

– all CC messages, if the following two conditions apply:

– no other MM connection is established; and

– the MM entity in the MS has received a CM SERVICE ACCEPT message with no ciphering or integrity protection applied as response to a CM SERVICE REQUEST message, with CM SERVICE TYPE set to ‘Emergency call establishment’ sent to the network;

– the MM connection was established locally due to the SRVCC handover of a PDN connection for emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode or for which integrity protection has not been activated while in Iu mode; or

– the MM connection was established locally due to the 5G-SRVCC handover from NG-RAN to UTRAN of an emergency PDU session for which the "null integrity protection algorithm" 5G-IA0 has been used while in N1 mode.

– SM messages:

– all SM messages, if any of the following conditions applies:

Once integrity protection is activated, the receiving layer 3 entity in the MS shall not process any layer 3 signalling messages unless they have been successfully integrity checked by the lower layers. If any signalling messages, having not successfully passed the integrity check, are received, then the lower layers in the MS shall discard that message (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). If any layer 3 signalling message is received, in either PS or CS domains, as not integrity protected even though the integrity protection has been activated in the MS by that domain in the network, then the lower layers shall discard this message (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]).

Integrity checking on the network side is performed by the RNC and is described in 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111].

4.1.1.1.1a Integrity protection for emergency call (Iu mode only)

The network should initiate the security mode procedure for an emergency call, in the same way as it would for any other call except in the cases defined in sub-clause "Security Procedures Not Applied" in 3GPP TS 33.102 [5a].

For the establishment of a MM connection for an emergency call when no other MM connection is established (e.g. for an emergency call initiated without a SIM/USIM no other MM connections can exist) the decision on whether or not to apply the security procedures shall be made by the network as defined in the subclause "Emergency Call Handling" in 3GPP TS 33.102 [5a]. If the MM connection was established locally due to the SRVCC handover of a PDN connection for emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode or for which integrity protection has not been activated while in Iu mode, the network need not apply the security procedures for this call. If the MM connection was established locally due to the 5G-SRVCC handover from NG-RAN to UTRAN of an emergency PDU session for which the "null integrity protection algorithm" 5G-IA0 has been used while in N1 mode, the network need not apply the security procedures for this call.

For an attach for emergency bearer services, (e.g. initiated without a SIM/USIM) the decision on whether or not to apply the security procedures shall be made by the network as defined in the subclause "Emergency Call Handling" in 3GPP TS 33.102 [5a]. After intersystem change from S1 mode to Iu mode with a PDN connection for emergency bearer services for which the "null integrity protection algorithm" EIA0 has been used while in S1 mode, the network need not apply the security procedures for this connection.

For an initial registration for emergency services, (e.g. initiated without a SIM/USIM) the decision on whether or not to apply the security procedures shall be made by the network as defined in the clause J.2 of 3GPP TS 33.501 [170]. After 5G-SRVCC handover from NG-RAN to UTRAN with an emergency PDU session for which the "null integrity protection algorithm" 5G-IA0 has been used while in N1 mode, the network need not apply the security procedures for this connection.

4.1.1.2 MM-GMM co-ordination for GPRS MS’s

4.1.1.2.1 GPRS MS operating in mode A or B in a network that operates in mode I

If the network operates in mode I, GPRS MSes that operate in mode A or B and wish to be or are simultaneously IMSI attached for GPRS and non-GPRS services, shall use the combined GPRS attach and the combined and periodic routing area updating procedures instead of the corresponding MM specific procedures IMSI attach and normal and periodic location area updating.

A GPRS MS operating in mode A or B in a network that operates in mode I, shall perform the combined GPRS attach or routing area update procedure regardless the value of the ATT flag.

If a GPRS MS is operating in mode A or B in a network that operates in mode I the IMSI detach shall be performed by the GMM using the combined GPRS detach procedure.

A GPRS MS operating in mode A or B in a network that operates in mode I, shall perform the combined GPRS detach procedure regardless the value of the ATT flag.

A GPRS MS operating in mode A or B in network that operates in mode I, shall use the combined GMM specific procedures in place of the MM specific procedures unless the re-activation of the MM specific procedures is explicitly described, so all conditions describing when to trigger an MM specific procedure listed in subclauses 4.3 and 4.4 shall not apply.

A GPRS MS operating in mode A or B in a network that operates in mode I should not use any MM timers relating to MM specific procedures, (e.g. T3210, T3211, T3212, T3213) unless the re-activation of the MM specific procedures is explicitly described. If the MM timers are already running, the MS should not react on the expiration of the timers.

NOTE 1: Whenever GMM performs a combined GMM procedure, a GPRS MS enters the MM state MM LOCATION UPDATING PENDING in order to prevent the MM from performing a location area updating procedure.

If the authentication procedure is performed by MM and the authentication is rejected by the network (i.e. upon receive of AUTHENTICATION REJECT), the MS shall in addition set the GPRS update status to GU3 ROAMING NOT ALLOWED and shall, if available, delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number stored. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed. The MS shall abort any GMM procedure and shall enter state GMM-DEREGISTERED. If S1 mode is supported in the MS, the MS shall handle the EMM parameters EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the EPS authentication is not accepted by the network.

If the PS or CS domain is barred because of domain specific access control, a GPRS MS operating in mode A or B in a network that operates in mode I shall act as if in network operation mode II and access to the barred domain shall be stopped entirely. If the MS detects that a domain is barred, this shall not trigger any MM or GMM specific procedure.

A GPRS MS operating in mode A or B in a network that operates in mode I shall perform a normal location updating procedure (in order to remove the Gs association in the MSC/VLR) when the following conditions are fulfilled:

– the GPRS MS has camped on a cell where the PS domain is barred and the CS domain is unbarred; and

– T3312, T3311, T3302, or T3330 expires; and

– for the last attempt to update the registration of the location area a combined GMM procedure was performed.

Additionally the MS shall treat the expiry of T3312 when the PS domain changes from barred to unbarred, analogous to the descriptions for the cases when the timer expires out of coverage or in a cell that does not support GPRS (see subclause 4.7.2.2).

If timer T3312 expires and both the PS and CS domain are barred, then a GPRS MS operating in mode A or B in a network that operates in mode I shall treat the expiry of T3312 when the GPRS MS detects that the PS or CS domain becomes unbarred, analogous to the descriptions for the cases when the timer expires out of coverage (see subclause 4.7.2.2).

If the PS domain is barred and timer T3312 expires during an ongoing CS connection, then a GPRS MS operating in mode A or B in a network that operates in mode I shall treat the expiry of T3312 when the MM state MM-IDLE is entered, analogous to the descriptions for the cases when the timer expires out of coverage or in a cell that does not support GPRS (see subclause 4.7.2.2), or in a cell where the PS domain is barred.

A GPRS MS operating in mode A or B in a network that operates in mode I shall perform a combined routing area update procedure indicating "combined RA/LA updating with IMSI attach" (in order to establish the Gs association in the MSC/VLR) when the following conditions are fulfilled:

– the GPRS MS detects that CS or PS domain or both change from barred to unbarred;

– as a result of the change of the domain specific barring status, both domains are unbarred; and

– for the last attempt to update the registration of the location area an MM specific procedure was performed (see subclause 4.7.5.2.1) or for the last attempt to update the registration of the routing area a normal routing area update was performed.

A GPRS MS operating in mode A or B on a PLMN which is part of "forbidden PLMNs for GPRS service" list in a network that is operating in mode I shall act as if in network operation mode II and proceed with appropriate MM procedures.

4.1.1.2.2 GPRS MS operating in mode A or B in a network that operates in mode II

If the network operates in mode II, a GPRS MS that operates in mode A or B and wishes to be or is simultaneously IMSI attached for GPRS and non-GPRS services, shall use the MM specific procedures listed in subclauses 4.3 and 4.4 and the GMM specific procedures listed in subclauses 4.7.3, 4.7.4 and 4.7.5. The applicability of periodic location updating is further specified in subclause 4.4.2 and the periodic routing area updating is specified in subclause 4.7.2.2. If the GPRS MS, which operates in mode A or B, wishes to be IMSI attached for GPRS and "SMS-only service"or is simultaneously IMSI attached for GPRS and non-GPRS services in order to obtain GPRS services and "SMS-only service", then the GPRS MS shall first complete the GMM specific procedure before performing the MM specific procedures. If this GPRS MS receives in the ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message the Additional network feature support IE indicating "SMS via GPRS supported", then the GPRS MS shall not perform the MM specific procedure until a new ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message indicating "SMS via GPRS not supported" or the GPRS MS does not wish to be IMSI attached only for GPRS and "SMS-only service".

If the authentication procedure is performed by MM and the authentication is rejected by the network (i.e upon receive of AUTHENTICATION REJECT), the MS shall in addition set the GPRS update status to GU3 ROAMING NOT ALLOWED and shall, if available, delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number stored. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed. The MS shall abort any GMM procedure and shall enter state GMM-DEREGISTERED. If S1 mode is supported in the MS, the MS shall handle the EMM parameters EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the EPS authentication is not accepted by the network.

If the PS or CS domain is barred because of domain specific access control, a GPRS MS operating in mode A or B in a network that operates in mode II shall use the MM specific procedures or GMM specific procedures, respectively, in the domain which is unbarred. If the MS detects that a domain changes from barred to unbarred, it shall behave as specified in subclauses 4.3.4.4, 4.4.4.9, 4.5.1.2, 4.7.3.1.5, 4.7.4.1.4, 4.7.5.1.5, and 4.7.13.5.

4.1.1.2A Coordination between GMM and EMM

See subclause 5.1.4 in 3GPP TS 24.301 [120].

4.1.1.2B Coordination between GMM and 5GMM

See subclause 5.1.5 in 3GPP TS 24.501 [167].

4.1.1.3 Core Network System Information for MM (Iu mode only)

In the network broadcast system information some of the system information is used by MM.

At reception of new system information, the RRC layer in the MS delivers the contents of the CN common system information and the CS domain specific system information to the MM layer in the MS.

The Core Network system information is included in specific information elements within some RRC messages sent to MS (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). In the Core Network system information the Common system information part and the CS domain specific system information part contains settings of parameters controlling MM functionality. No MM messages contain the Core Network System Information.

4.1.1.4 Core Network System Information for GMM (Iu mode only)

4.1.1.4.1 General

In the network broadcast system information some of the system information is used by GMM.

At reception of new system information, the RRC layer in the MS delivers the contents of the CN common system information and the PS domain specific system information to the GMM layer in the MS.

The Core Network system information is included in specific information elements within some RRC messages sent to MS (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]). In the Core Network system information the Common system information part and the PS domain specific system information part contains settings of parameters controlling GMM functionality. No GMM messages contain the Core Network System Information.

4.1.1.4.2 Control of Network Mode of Operation I

The behaviour of the MS with respect to NMO I is determined by the combination of PS domain specific system information IE as defined in subclause 10.5.1.12.3 and the setting of the parameter "NMO_I_Behaviour" in the NAS configuration Management Object as specified in 3GPP TS 24.368 [135] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [112]:

– if the parameter "NMO_I_Behaviour" in the NAS configuration Management Object is set to the value of "1", the bit 2 "NMO I" of system information as described in figure 10.5.1.12.3/table 10.5.1.12.3 is applied; or

– if the parameter "NMO_I_Behaviour" in the NAS configuration Management Object is set to the value of zero or is not provisioned, the bit 1 "NMO" of system information as described in figure 10.5.1.12.3/table 10.5.1.12.3 is applied.

4.1.1.5 Access class control

The network can restrict the access for certain groups of mobile stations. These groups are also known as access classes.

The restriction can apply for access to both domains (common access class control or EAB, depending on EAB configuration) or to one domain only (domain specific access control) (see 3GPP TS 23.122 [14]).

Additionally, the network can alleviate the access restriction in both domains or domain specifically, and allow restricted mobile stations to respond to paging messages or to perform generic location updating, or GPRS attach or routing area updating procedure.

A network operator can also restrict some MSs to access the network for location registration, although via common access class control or domain specific access class control the MSs are permitted to access the network for other purposes. Therefore, for each access to the network the mobile station shall determine from the information received via the system information broadcast whether access is allowed or not:

– For paging response the mobile station shall evaluate the control information for common access control (as specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and 3GPP TS 25.331 [23c]), the control information for EAB (as specified in 3GPP TS 44.018 [84], and 3GPP TS 25.331 [23c]), domain specific access control (as specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]), and the specific control information for paging response (as specified in 3GPP TS 25.331 [23c]; see "Paging Permission with Access Control").

– For generic location updating, GPRS attach and routing area updating procedures the mobile station shall evaluate the control information for:

– common access control (as specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and 3GPP TS 25.331 [23c]);

– domain specific access control (as specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]);

– specific control information for location registration (as specified in 3GPP TS 25.331 [23c]; see "Paging Permission with Access Control"); and

– EAB as specified for A/Gb mode in 3GPP TS 44.018 [84], and for Iu mode in 3GPP TS 25.331 [23c].

The same control information shall also be taken into account, when the present document requires the mobile station to initiate a generic location updating, or GPRS attach or routing area updating procedure when it detects that a domain changes from barred to unbarred (see e.g. subclauses 4.1.1.2.1 and 4.1.1.2.2).

– For GPRS attach and routing area updating procedures in Iu mode, the mobile station shall evaluate the control information for:

– ACDC if the mobile station supports ACDC (as specified in 3GPP TS 25.331 [23c]).

The same control information shall also be taken into account, when the present document requires the mobile station to initiate a GPRS attach or routing area updating procedure in Iu mode when it detects that PS domain changes from barred to unbarred (see e.g. subclauses 4.1.1.2.1 and 4.1.1.2.2).

– For all other purposes the mobile station shall evaluate the control information for common access control as specified in 3GPP TS 44.018 [84], 3GPP TS 44.060 [76], and 3GPP TS 25.331 [23c], the control information for EAB (as specified in 3GPP TS 44.018 [84], and 3GPP TS 25.331 [23c]), domain specific access control (as specified in 3GPP TS 44.018 [84] and 3GPP TS 25.331 [23c]) and in Iu mode for PS domain if the mobile station supports ACDC, the control information for ACDC (as specified in 3GPP TS 25.331 [23c]).

4.1.1.6 Specific requirements for MS configured to use timer T3245

The following requirement applies for an MS that is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]):

When the MS adds a PLMN identity to the "forbidden PLMN list" or the "forbidden PLMNs for GPRS service" list or sets the SIM/USIM as invalid for non-GPRS services or GPRS services or both, and timer T3245 is not running, the MS shall start timer T3245 with a random value, uniformly drawn from the range between 12h and 24h.

Upon expiry of the timer T3245, the MS shall erase the "forbidden PLMN list" and the "forbidden PLMNs for GPRS service" list and set the SIM/USIM to valid for non-GPRS services and GPRS services. When the lists are erased, the MS performs a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

If the MS is switched off when the timer T3245 is running, the MS shall behave as follows when the MS is switched on and the SIM/USIM in the MS remains the same:

– let t1 be the time remaining for T3245 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the MS will follow the behaviour as defined in the paragraph above upon expiry of the timer T3245. If the MS is not capable of determining t, then the MS shall restart the timer with the value t1.

4.1.1.6A Specific requirements for the MS when receiving non-integrity protected reject messages

This subclause specifies the requirements for an MS that is not configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) and receives a LOCATION UPDATING REJECT, CM SERVICE REJECT, ABORT, ATTACH REJECT, ROUTING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with specific MM or GMM causes.

NOTE 1: Additional MS requirements for this case, requirements for other MM or GMM causes, and requirements for the case when the MS receives a successfully integrity checked reject message are specified in subclauses 4.4.4.7, 4.5.1.1, 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4.

The present subclause is applicable to A/Gb mode and Iu mode. In A/Gb mode,

– for the CS domain, as integrity protection is not supported, all messages received by the MS are considered to be received "before the network has activated the integrity protection"; and

– for the PS domain, if integrity protection is not required (see subclause 4.7.1.2a.), all messages received by the MS are considered to be received "before the network has activated the integrity protection".

The MS may maintain a list of PLMN-specific attempt counters and a list of PLMN-specific PS-attempt counters. The maximum number of possible entries in each list is implementation dependent.

Additionally, the MS may maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events and one counter for "SIM/USIM considered invalid for GPRS services" events.

If the MS maintains the above lists of attempt counters and the event counters, a MS supporting N1 mode, shall store them in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of power saving mode.

The MS may also maintain a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services". If the MS is in a location area which is included in the list of "forbidden location areas for non-GPRS services", the MS shall not initiate any MM procedure. If the MS is in a location area which is included in the list of "forbidden location areas for GPRS services", the MS shall not initiate any GMM, SM, SMS or SS procedure for GPRS services.

If the MS receives a LOCATION UPDATING REJECT message without integrity protection with MM cause value #2, #3, #6, #11, #12, #13 or #15 before the network has activated the integrity protection for the CS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and take the following actions:

1) if the MM cause value received is #3 or #6, and

a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall:

i) delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2);

delete the list of equivalent PLMNs;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events;

store the current LAI in the list of "forbidden location areas for roaming"; and

search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or

ii) proceed as specified in subclause 4.4.4.7 and;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and

b) else the MS shall proceed as specified in subclause 4.4.4.7;

2) if the MM cause value received is #2, and

a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall:

delete the list of equivalent PLMNs;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events;

if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows:

if the current LAI is already included in the list of "forbidden location areas for GPRS services" or the MS is not operating in MS operation mode A or B, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for non-GPRS services"; and

attempt to select a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121], different from the cell where the LOCATION UPDATING REJECT was received; or

NOTE 2: The cell on which the reject was received could still be a suitable cell.

ii) proceed as specified in subclause 4.4.4.7 and;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and

b) else the MS shall proceed as specified in subclause 4.4.4.7;

3) if the MM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in subclause 4.4.4.7;

4) if the MM cause value received is #11 and the MS is in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present):

the MS shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2). Additionally, the MS shall store the current LAI in the list of "forbidden location areas for roaming"; and

the MS shall search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; and

5) if the MM cause value received is #11 and if the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), in addition to the MS requirements specified in subclause 4.4.4.7,

– if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific attempt counter for the PLMN.

If the MS receives a CM SERVICE REJECT or ABORT message with MM cause value #6 without integrity protection before the network has activated the integrity protection for the CS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and

a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall:

i) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively with the exception that the MS shall not consider the SIM/USIM as invalid for non-GPRS services and;

delete the list of equivalent PLMNs;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events;

reset the location update attempt counter;

store the current LAI in the list of "forbidden location areas for roaming"; and

search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or

ii) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively and;

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection;

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and

b) else the MS shall proceed as specified in subclause 4.5.1.1 or 4.3.5.2 respectively.

If the MS receives an ATTACH REJECT or ROUTING AREA UPDATE REJECT message without integrity protection with GMM cause value #3, #6, #7, #8, #11, #12, #13, #14 or #15 before the network has activated the integrity protection for the PS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and shall take the following actions:

6) if the GMM cause value received is #3, #6, or #8, and

a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall:

i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number;

delete the list of equivalent PLMNs;

increment the counter for "SIM/USIM considered invalid for GPRS services" events;

if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, set the update status to U3 ROAMING NOT ALLOWED, delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. In Iu mode, the MS shall increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection. In A/Gb mode, the MS shall increment the counter for "SIM/USIM considered invalid for non-GPRS services" events;

if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt counter or the routing area updating attempt counter, respectively;

if S1 mode is supported by the MS, handle the EMM parameters attach attempt counter or tracking area updating attempt counter, EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when an EPS attach or tracking area update procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection;

store the current LAI in the list of "forbidden location areas for roaming" and enter the state GMM-DEREGISTERED.LIMITED-SERVICE; and

search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121]; or

ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;

increment the counter for "SIM/USIM considered invalid for GPRS services" events; and

if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value:

in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection

in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and

b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;

7) if the GMM cause value received is #7, and

a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall:

i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number;

delete the list of equivalent PLMNs;

increment the counter for "SIM/USIM considered invalid for GPRS services" events;

– if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt counter or the routing area updating attempt counter, respectively;

enter the state GMM-DEREGISTERED.LIMITED-SERVICE;

if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows:

if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services"; and

attempt to select a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121], different from the cell where the ATTACH REJECT or ROUTING AREA UPDATING REJECT was received; or

NOTE 3: The cell on which the reject was received could still be a suitable cell.

ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; and

increment the counter for "SIM/USIM considered invalid for GPRS services" events; and

b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;

8) if the GMM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4;

9) if the GMM cause value received is #11 or #14 and the MS is in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present):

– the MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number. The MS shall delete the list of equivalent PLMNs. Additionally, if a GPRS attach or the routing area updating procedure was performed, the MS shall reset the GPRS attach attempt counter or the routing area updating attempt counter respectively;

– for GMM cause value #11, the MS shall store the current LAI in the list of "forbidden location areas for roaming", and enter the state GMM-DEREGISTERED.LIMITED-SERVICE;

– for GMM cause value #14, the MS shall enter the state GMM-DEREGISTERED.LIMITED-SERVICE. If the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows:

– if S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter or tracking area updating attempt counter as specified in 3GPP TS 24.301 [120] for the case when the procedure is rejected with the EMM cause with the same value without integrity protection; and

– the MS shall search for a suitable cell in another location area or in another tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].

10) if the GMM cause value received is #11 and the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4:

– Furthermore, if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific attempt counter for the PLMN.

11) if the GMM cause value received is #14 and the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, and 4.7.5.2.4:

– Furthermore, if the MS maintains a list of PLMN-specific PS-attempt counters and the PLMN-specific PS-attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific PS-attempt counter for the PLMN.

– If the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows:

If the MS receives a SERVICE REJECT message without integrity protection with GMM cause value #3, #6, #7, #8, #11, #12, #13 or #15 before the network has activated the integrity protection for the PS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and proceed as specified under items 6, 7, 8, 9 and 10 above.

Upon expiry of timer T3247, the MS shall:

– erase the list of "forbidden location areas for regional provision of service" and the list of "forbidden location areas for roaming";

– set the SIM/USIM to valid for non-GPRS services, if

– the MS does not maintain a counter for "SIM/USIM considered invalid for non-GPRS services" events; or

– the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and this counter has a value less than an MS implementation-specific maximum value.

– set the SIM/USIM to valid for GPRS services, if

– the MS does not maintain a counter for "SIM/USIM considered invalid for GPRS services" events; or

– the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and this counter has a value less than an MS implementation-specific maximum value.

– erase the list of "forbidden location areas for non-GPRS services" and the list of "forbidden location areas for GPRS services", if the MS maintains these lists;

– if the MS maintains a list of PLMN-specific attempt counters, for each PLMN-specific attempt counter that has a value greater than zero and less than an MS implementation-specific maximum value, remove the respective PLMN from the extension of the "forbidden PLMNs" list;

– if the MS maintains a list of PLMN-specific PS-attempt counters, for each PLMN-specific PS-attempt counter that has a value greater than zero and less than an MS implementation-specific maximum value, remove the respective PLMN from the "forbidden PLMNs for GPRS service" list. If the resulting "forbidden PLMNs for GPRS service" list is empty and the MS is supporting S1 mode, the MS re-enables the E-UTRA capability as specified in 3GPP TS 24.301 [120] for the case when timer T3247 expires;

– if the MS is supporting S1 mode, perform the actions as specified in 3GPP TS 24.301 [120] for the case when timer T3247 expires;

– if the MS is supporting N1 mode, perform the actions as specified in 3GPP TS 24.501 [167] for the case when timer T3247 expires; and

– initiate a location updating procedure, GPRS attach procedure or routing area updating procedure, if still needed, dependent on MM state and update status, and GMM state and GPRS update status, or perform a PLMN selection according to 3GPP TS 23.122 [14].

If the MS maintains a list of PLMN-specific attempt counters and PLMN-specific PS-attempt counters, when the MS is switched off, the MS shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the MS implementation-specific maximum value, remove the respective PLMN from the forbidden PLMN list. When the SIM/USIM is removed, the MS should perform this action.

NOTE 4: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to 3GPP TS 23.122 [14] the MS will delete the contents of this extension when the MS is switched off or the SIM/USIM is removed.

4.1.1.7 Handling of NAS level mobility management congestion control

The network may detect GMM or MM signalling congestion and perform NAS level mobility management congestion control. PS domain NAS level mobility management congestion control consists of general NAS level mobility management congestion control and subscribed APN based congestion control. CS domain NAS level mobility management congestion control consists of general NAS level mobility management congestion control.

Under NAS level mobility management congestion control the network may reject mobility management signalling requests from MSs as specified in 3GPP TS 23.060 [74]. The network should not reject requests for emergency bearer services.

When subscribed APN based congestion control is active for a particular APN, the network may reject attach request from MSs with subscription to this APN.

In mobility management the network may detect NAS signalling congestion. The network may start or stop performing the subscribed APN based congestion control based on mobility management level criteria such as:

– rate of mobility management NAS messages from a group of MSs with a subscription to a particular APN exceeds or falls below certain thresholds; or

– setting in network management.

When the NAS level mobility management congestion control is active, the network may include a value for the mobility management back-off timer T3246 or T3346 in the reject messages. The MS starts the mobility management back-off timer with the value received in the mobility management reject messages. To avoid that large numbers of MSs simultaneously initiate deferred requests, the network should select the value for the mobility management back-off timer for the rejected MSs so that timeouts are not synchronised.

For subscribed APN based congestion control the value of timer T3346 for a particular APN may be APN dependent.

If the timer T3346 is running when the MS enters state GMM-DEREGISTERED, the MS remains switched on, and the SIM/USIM in the MS remains the same, then timer T3346 is kept running until it expires or it is stopped.

If the MS is switched off when the timer T3246 or T3346 is running, the MS shall behave as follows for each running timer when the MS is switched on and the SIM/USIM in the MS remains the same:

– let t1 be the time remaining until timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the MS is not capable of determining t, then the MS shall restart the timer with the value t1; and

– if prior to switch off, timer T3346 was started due to a NAS request message (ATTACH REQUEST, ROUTING AREA UPDATE REQUEST or SERVICE REQUEST) which contained the low priority indicator set to "MS is configured for NAS signalling low priority", then if timer T3346 is restarted at switch on, the MS configured for low priority shall handle mobility management requests as indicated in subclauses 4.7.3.1.5, 4.7.5.1.5 and 4.7.13.5.

If the MS enters a new PLMN while timer T3246 is running, and the new PLMN is not equivalent to the PLMN where the MS started timer T3246, the MS shall stop timer T3246 when initiating mobility management procedures in the new PLMN.

If the MS enters a new PLMN while timer T3346 is running, and the new PLMN is not equivalent to the PLMN where the MS started timer T3346, the MS shall stop timer T3346 when initiating mobility management procedures in the new PLMN.

At an inter-system change from S1 mode to A/Gb mode or from Iu mode to A/Gb mode within the same RA, if the timer T3346 is running and the TIN indicates "RAT‑related TMSI", the MS shall set the GPRS update status to GU2 NOT UPDATED and enter state GMM-REGISTERED.ATTEMPTING-TO-UPDATE.

After change in RAI, if the timer T3346 is running and GPRS update status is GU1 UPDATED then MS shall set the GPRS update status to GU2 NOT UPDATED and enter state GMM-REGISTERED.ATTEMPTING-TO-UPDATE.

After change in LAI, if the timer T3246 is running and MM update status is U1 UPDATED then MS shall set the MM update status to U2 NOT UPDATED and enter state MM IDLE, ATTEMPTING TO UPDATE.

4.1.1.8 Handling of security related parameters at switch on and switch off

At switch on, an ME supporting UTRAN Iu mode shall proceed as follows:

– if a USIM is inserted, the ME shall read the START_CS and START_PS value from the USIM. If START_CS and/or START_PS read from the USIM are greater than or equal to the maximum value of START_CS and START_PS provided on the USIM (see 3GPP TS 31.102 [112]) or the CKSN or GPRS CKSN stored on the USIM indicates "no key available", the ME shall set the START value in the volatile memory of the ME for the corresponding core network domain(s) to zero. In addition if the read START_CS and/or START_PS are greater than or equal to the maximum value, the ME shall delete the corresponding CKSN or GPRS CKSN from the ME and the USIM. The ME shall set the START_CS and START_PS value on the USIM to the maximum value of START_CS and START_PS provided on the USIM (see 3GPP TS 31.102 [112]); and

– if a SIM is inserted, the ME shall read the START_CS and START_PS value from the non-volatile memory. If START_CS and/or START_PS read from the non-volatile memory are greater than or equal to the default value specified in 3GPP TS 33.102 [5a], subclause 6.8.2.4 or the CKSN or GPRS CKSN stored on the SIM indicates "no key available", the ME shall set the START value in the volatile memory of the ME for the corresponding core network domain(s) to zero. In addition if the read START_CS and/or START_PS are greater than or equal to the default value, the ME shall delete the corresponding CKSN or GPRS CKSN from the ME. The ME shall set the START_CS and START_PS value in the non-volatile memory to the default value specified in 3GPP TS 33.102 [5a], subclause 6.8.2.4.

NOTE: The lower layer handles the START_CS and START_PS value stored in the volatile memory of the ME as specified in 3GPP TS 25.331 [23c].

Only at switch off, an ME supporting UTRAN Iu mode shall proceed for each of the two domains, CS and PS, as follows:

– if since switch on the ME performed an authentication procedure for the respective domain and stored the new security context on the USIM or SIM, and the new security context was not taken into use, the ME shall set the START value for this domain on the USIM or, if a SIM is inserted, in the non-volatile memory to zero; and

– otherwise, if a security context for the respective domain is stored on the USIM or SIM, i.e. the CKSN or GPRS CKSN stored on the USIM or SIM is different from "no key available", the ME shall store the current START value used by the lower layer for this domain on the USIM or, if a SIM is inserted, in the non-volatile memory.

4.1.1.9 Equivalent PLMNs list

The mobile equipment shall store a list of "equivalent PLMNs". These PLMNs shall be regarded by the MS as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by 5GMM, EMM, GMM and MM (see 3GPP TS 24.501 [167] and 3GPP TS 24.301 [120]).

The list of equivalent PLMNs is replaced or deleted at the end of each location updating procedure, routing area updating procedure and GPRS attach procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. The stored list shall not be deleted when the MS is switched off. The stored list shall be deleted if the SIM/USIM is removed or when an MS attached for emergency bearer services enters the state GMM-DEREGISTERED. The maximum number of possible entries in the stored list is 16.

4.1.1.10 Dedicated core network

The network may reject mobility management signalling requests from MSs due to dedicated core network as specified in 3GPP TS 23.060 [74]. When the network rejects mobility management signalling requests due to dedicated core network, the mechanism for general NAS level mobility management congestion control as specified in subclause 4.1.1.7 shall be followed.

4.1.2 MM sublayer states

The description of the states for the MM sublayer is organized as follows. The main states for the MS side, related to the procedures, are described in subclause 4.1.2.1.1. The MM IDLE state is subdivided in substates for the description of the behaviour in idle mode (subclause 4.1.2.1.2). This behaviour depends on an update status, described in subclause 4.1.2.2. The states for the network side are described in subclause 4.1.2.3.

4.1.2.1 MM sublayer states in the mobile station

In this subclause, the possible states for the MM sublayer in the mobile station is described. In figure 4.1 of the present document, an overview of the MM sublayer protocol is given.

4.1.2.1.1 Main states

0 NULL

The mobile station is inactive (e.g. power down). Important parameters are stored. Only manual action by the user may transfer the MM sublayer to another state.

3 LOCATION UPDATING INITIATED

A location updating procedure has been started and the MM awaits a response from the network. The timer T3210 is running.

5 WAIT FOR OUTGOING MM CONNECTION

The MM connection establishment has been started, and the MM awaits a response from the network. The timer T3230 is running.

6 MM CONNECTION ACTIVE

The MM sublayer has a RR connection to its peer entity on the network side. One or more MM connections are active.

7 IMSI DETACH INITIATED

The IMSI detach procedure has been started. The timer T3220 is running.

8 PROCESS CM SERVICE PROMPT

The MM sublayer has a RR connection to its peer entity on the network side. The Mobile Station has received a CM SERVICE PROMPT message but has not yet responded $(CCBS)$.

9 WAIT FOR NETWORK COMMAND

The MM sublayer has a RR connection to its peer entity in the network, but no MM connection is established. The mobile station is passive, awaiting further commands from the network. The timer T3240 may be running.

10 LOCATION UPDATE REJECTED

A location updating procedure has been rejected and RR connection release is awaited. The timer T3240 is running.

Figure 4.1a/3GPP TS 24.008: Overview mobility management protocol/MS Side

Additions to Figure 4.1a/3GPP TS 24.008

13. WAIT FOR RR CONNECTION (LOCATION UPDATING)

The MM sublayer has requested RR connection establishment for starting the location updating procedure.

14. WAIT FOR RR CONNECTION (MM CONNECTION)

The MM sublayer has requested RR connection establishment for dedicated mode for starting the MM connection establishment.

15. WAIT FOR RR CONNECTION (IMSI DETACH)

The MM sublayer has requested RR connection establishment for starting the IMSI detach procedure.

17. WAIT FOR REESTABLISH

A lower layer failure has occurred and re-establishment may be performed from the disturbed CM layer entities.

18. WAIT FOR RR ACTIVE

The MM sublayer has requested activation of the RR sublayer.

19. MM IDLE

There is no MM procedure running and no RR connection exists except that a local MM context may exist when the RR sublayer is in Group Receive mode. This is a compound state, and the actual behaviour of the mobile station to Connection Management requests is determined by the actual substate as described hereafter.

20. WAIT FOR ADDITIONAL OUTGOING MM CONNECTION.

The MM connection establishment for an additional MM connection has been started, and the MM awaits response from the network.

21. MM CONNECTION ACTIVE (GROUP TRANSMIT MODE)

(Only applicable for mobile stations supporting VGCS talking:) The MM sublayer has a RR connection on the VGCS channel to its peer entity on the network side. Only one MM connection is active.

22. WAIT FOR RR CONNECTION (GROUP TRANSMIT MODE)

(Only applicable for mobile stations supporting VGCS talking:) The MM sublayer has requested to perform an uplink access on the VGCS channel.

23. LOCATION UPDATING PENDING

(Only applicable for GPRS MS operation modes A and B; not shown in figure 4.1a) A location updating has been started using the combined GPRS attach procedure or the combined GPRS routing area updating procedure.

24. IMSI DETACH PENDING

(Only applicable for GPRS MS operation modes A and B; not shown in figure 4.1a) An IMSI detach for non-GPRS services has been started using the combined GPRS detach procedure at not switching off.

25. RR CONNECTION RELEASE NOT ALLOWED

(Only applicable for mobile stations supporting RRLP procedures (see 3GPP TS 44.031 [23b]) or LCS procedures over RRC (see 3GPP TS 25.331 [23c])). All MM connections are released by their CM entities, but the RR connection is maintained by the network due to an ongoing RRLP procedure or LCS procedure over RRC.

4.1.2.1.2 Substates of the MM IDLE state

For the description of the behaviour of the MS the MM IDLE state is subdivided in several substates, also called the service states. The service state pertains to the whole MS (ME alone if no SIM/USIM is inserted, or ME plus SIM/USIM). The service state depends on the update status (see subclause 4.1.2.2) and on the selected cell.

19.1 NORMAL SERVICE

Valid subscriber data are available, update status is U1, a cell is selected that belongs to the LA where the subscriber is registered.

In this state, all requests from the CM layers are treated normally.

19.2 ATTEMPTING TO UPDATE

Valid subscriber data are available, update status is U2 and a cell is selected. Requests from upper layers are accepted. Emergency call requests are treated normally, otherwise the request triggers first a location updating attempt in the selected cell, and then triggers the needed procedure only in case of successful location updating, otherwise the request is rejected.

19.3 LIMITED SERVICE

Valid subscriber data are available, update status is U3, and a cell is selected, which is known not to be able to provide normal service. Only emergency services are offered.

19.4 NO IMSI

No valid subscriber data (no SIM/USIM, or the SIM/USIM is not considered valid by the ME), and a cell is selected. Only emergency services are offered.

19.5 NO CELL AVAILABLE

No cell can be selected. This state is entered after a first intensive search failed (state 19.7). Cells are searched at a low rhythm.

This state is also entered when S1 mode is activated in the MS and current cell is an E-UTRAN cell. No services, except those provided by CS fallback and SMS over SGs, are offered.

19.6 LOCATION UPDATE NEEDED

Valid subscriber data are available, and for some reason a location updating must be done as soon as possible (for instance update status is U1 but the selected cell is not in the registered LA, or the timer has expired). This state is usually of no duration, but can last, e.g. due to access class control, (see subclause 4.1.1.2.1).

19.7 PLMN SEARCH

The mobile station is searching for PLMNs, and the conditions for state 19.8 are not met. This state is ended when either a cell is selected (the new state is 19.1, 19.3 or 19.6), or when it is concluded that no cell is available for the moment (the new state is 19.5).

19.8 PLMN SEARCH, NORMAL SERVICE

Valid subscriber data are available, update status is U1, a cell is selected which belongs to the LA where the subscriber is registered, and the mobile station is searching for PLMNs. This state is ended when either a cell is selected (the new state is 19.1, 19.3 or 19.6), or when it is concluded that no cell is available for the moment (the new state is 19.5).

19.9 RECEIVING GROUP CALL (NORMAL SERVICE)

Only applicable for mobile stations supporting VGCS listening or VBS listening. Valid subscriber data are available, update status is U1, a VGCS channel or VBS channel is received in a cell that belongs to the LA where the subscriber is registered.

In this state, only requests from the GCC or BCC layers are treated.

19.10 RECEIVING GROUP CALL (LIMITED SERVICE)

Only applicable for mobile stations supporting VGCS listening or VBS listening. Valid subscriber data are available, update status is U3, a VGCS channel or VBS channel is received in a cell which is known not to be able to provide normal service.

In this state, only requests from the GCC or BCC layers for the reception of VGCS or VBS calls are treated and group call emergency services are offered.

19.11 eCALL INACTIVE

Valid subscriber data are available, update status is U4, and a cell is selected, which is expected to be able to provide normal service. Only emergency services and test/reconfiguration calls (see 3GPP TS 22.101 [8]) can be initiated by the mobile station. This state is applicable only to an eCall only mobile station (as determined by information configured in USIM). The state is entered by the mobile station in order to avoid MM activity and MM signalling in the absence of an emergency call or test/reconfiguration call. The state is ended when an emergency services or test/reconfiguration calls[8] is initiated by the mobile station, the new state depends on the result of the procedure when returning to MM-IDLE described in subclause 4.2.3.

4.1.2.2 The update Status

In parallel with the sublayer states described in subclause 4.1.2.1 and which control the MM sublayer protocol, an update status exists.

The update status pertains to a specific subscriber embodied by a SIM/USIM. This status is defined even when the subscriber is not activated (SIM/USIM removed or connected to a switched-off ME). It is stored in a non volatile memory in the SIM/USIM. The update status is changed only as a result of a location updating procedure attempt (with the exception of an authentication failure and of some cases of CM service rejection). In some cases, the update status is changed as a result of a GPRS attach, GPRS routing area update, service request network initiated GPRS detach procedure or due to change in LAI while timer T3246 running.

U1 UPDATED

The last location updating attempt was successful (correct procedure outcome, and the answer was acceptance from the network). With this status, the SIM/USIM contains also the LAI of the LA where the subscriber is registered, and possibly valid TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key and ciphering key sequence number. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME may contain a valid GSM Kc₁₂₈. The "Location update status" stored on the SIM/USIM shall be "updated".

U2 NOT UPDATED

The last location updating attempt made failed procedurally (no significant answer was received from the network, including the cases of failures or congestion inside the network).

For this status, the SIM/USIM can contain a valid LAI of the location area to which the subscriber was registered, and possibly also a valid TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key and ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted" value if the LAI is deleted. However the presence of other values shall not be considered an error by the mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GSM Kc₁₂₈ stored if the LAI is deleted. The "Location update status" stored on the SIM/USIM shall be "not updated".

U3 ROAMING NOT ALLOWED

The last location updating attempt run correctly, but the answer from the network was negative (because of roaming or subscription restrictions).

For this status, the SIM/USIM can contain a valid LAI, TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key or ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted" value if the LAI is deleted. However the presence of other values shall not be considered an error by the mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GSM Kc₁₂₈ stored if the LAI is deleted. The "Location update status" stored on the SIM/USIM shall be "Location Area not allowed".

U4 UPDATING DISABLED

Location updating has been disabled.

For this status, the SIM/USIM does not contain any valid LAI, TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key or ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted" value at the moment the status is set to eCALL INACTIVE. However the presence of other values shall not be considered an error by the mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GSM Kc₁₂₈ stored at the moment the status is set to eCALL INACTIVE. The "Location update status" stored on the SIM/USIM shall be "not updated".

4.1.2.3 MM sublayer states on the network side

1. IDLE

The MM sublayer is not active except possibly when the RR sublayer is in Group Receive mode.

2. WAIT FOR RR CONNECTION

The MM sublayer has received a request for MM connection establishment from the CM layer. A RR connection to the mobile station is requested from the RR sublayer (i.e. paging is performed).

3. MM CONNECTION ACTIVE

The MM sublayer has a RR connection to a mobile station. One or more MM connections are active, or no MM connection is active but an RRLP procedure or LCS procedure over RRC is ongoing.

4. IDENTIFICATION INITIATED

The identification procedure has been started by the network. The timer T3270 is running.

5. AUTHENTICATION INITIATED

The authentication procedure has been started by the network. The timer T3260 is running.

6. TMSI REALLOCATION INITIATED

The TMSI reallocation procedure has been started by the network. The timer T3250 is running.

7. SECURITY MODE INITIATED

In Iu mode, the security mode setting procedure has been requested to the RR sublayer. In A/Gb mode, the cipher mode setting procedure has been requested to the RR sublayer.

8a. WAIT FOR MOBILE ORIGINATED MM CONNECTION

A CM SERVICE REQUEST message is received and processed, and the MM sublayer awaits the "opening message" of the MM connection.

8b. WAIT FOR NETWORK ORIGINATED MM CONNECTION

A CM SERVICE PROMPT message has been sent by the network and the MM sublayer awaits the "opening message" of the MM connection $(CCBS)$.

9. WAIT FOR REESTABLISHMENT

The RR connection to a mobile station with one or more active MM connection has been lost. The network awaits a possible re-establishment request from the mobile station.

10. WAIT OF A GROUP CALL

Only applicable in case for mobile station supporting VGCS talking. The MM sublayer has received a request for establishing a VGCS from the GCC sublayer. The request for establishing a VGCS channels is given to the RR sublayer.

11. GROUP CALL ACTIVE

Only applicable in case of mobile station supporting VGCS talking. A VGCS channel is established by the RR sublayer. An RR connection to the talking mobile station can be established by the RR sublayer on the VGCS channel. The MM sublayer is active but no sending of MM message between the network and the mobile station has occurred.

12. MM CONNECTION ACTIVE (GROUP CALL)

Only applicable in case of mobile station supporting VGCS talking. The MM sublayer has a RR connection to the talking mobile station on the VGCS channel. Only one MM connection is active.

13. WAIT FOR BROADCAST CALL

Only applicable in case of VBS. The MM sublayer has received a request for a VBS establishment from the BCC sublayer. The request for establishment of VBS channels is given to the RR sublayer.

14. BROADCAST CALL ACTIVE

Only applicable in case of VBS. A VBS channel is established by the RR sublayer. The MM sublayer is active but no explicit MM establishment between the Network and the mobile station has occurred.

4.1.3 GPRS mobility management (GMM) sublayer states

In this subclause, the GMM protocol of the MS and the network are described by means of two different state machines. In subclause 4.1.3.1, the states of the GMM entity in the MS are introduced. The behaviour of the MS depends on a GPRS update status that is described in subclause 4.1.3.2. The states for the network side are described in subclause 4.1.3.3.

4.1.3.1 GMM states in the MS

In this subclause, the possible GMM states are described of a GMM entity in the mobile station. subclause 4.1.3.1.1 summarises the main states of a GMM entity, see figure 4.1b of the present document. The substates that have been defined are described in subclause 4.1.3.1.2 and subclause 4.1.3.1.3.

However, it should be noted that this subclause does not include a description of the detailed behaviour of the MS in the single states and does not cover abnormal cases. Thus, figure 4.1b of the present document is rather intended to give an overview of the state transitions than to be a complete state transition diagram. A detailed description of the behaviour of the MS is given in subclause 4.2. Especially, with respect to the behaviour of the MS in abnormal cases it is referred to subclause 4.7.

4.1.3.1.1 Main states

4.1.3.1.1.1 GMM-NULL

The GPRS capability is disabled in the MS. No GPRS mobility management function shall be performed in this state.

4.1.3.1.1.2 GMM-DEREGISTERED

The GPRS capability has been enabled in the MS, but no GMM context has been established. In this state, the MS may establish a GMM context by starting the GPRS attach or combined GPRS attach procedure.

4.1.3.1.1.3 GMM-REGISTERED-INITIATED

A GPRS attach or combined GPRS attach procedure has been started and the MS is awaiting a response from the network.

4.1.3.1.1.4 GMM-REGISTERED

A GMM context has been established, i.e. the GPRS attach or combined GPRS attach procedure has been successfully performed. In this state, the MS may activate PDP contexts, MBMS contexts, may send and receive user data and signalling information and may reply to a page request. Furthermore, cell and routing area updating are performed.

4.1.3.1.1.5 GMM-DEREGISTERED-INITIATED

The MS has requested release of the GMM context by starting the GPRS detach or combined GPRS detach procedure. This state is only entered if the MS is not being switched off at detach request.

4.1.3.1.1.6 GMM-ROUTING-AREA-UPDATING-INITIATED

A routing area updating procedure has been started and the MS is awaiting a response from the network.

4.1.3.1.1.7 GMM-SERVICE-REQUEST-INITIATED (Iu mode only)

A service request procedure has been started and the MS is awaiting a response from the network.

4.1.3.1.2 Substates of state GMM-DEREGISTERED

The GMM-DEREGISTERED state is subdivided into several substates as explained below. The substates pertain to the whole MS (ME alone if no SIM/USIM is inserted, or ME plus SIM/USIM). The selection of the appropriate substate depends on the GPRS update status, see subclause 4.1.3.2, and on the selected cell.

4.1.3.1.2.1 GMM-DEREGISTERED.NORMAL-SERVICE

Valid subscriber data is available, a suitable cell has been found and the PLMN or LA is not in the forbidden list. In this state, a request for GPRS attach is performed using the stored temporary mobile subscriber identity for GPRS (P-TMSI), routing area identification (RAI) and GPRS ciphering key sequence number in case of GU1. If the GPRS update status is GU2, the IMSI shall be used to attach for GPRS services.

4.1.3.1.2.2 GMM-DEREGISTERED.LIMITED-SERVICE

Valid subscriber data is available, and a cell is selected, which is known not to be able to provide normal service.

4.1.3.1.2.3 GMM-DEREGISTERED.ATTACH-NEEDED

Valid subscriber data is available and for some reason a GPRS attach must be performed as soon as possible. This state is usually of no duration, but can last, e.g. due to access class control (see subclause 4.1.1.2.1).

4.1.3.1.2.4 GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH

A cell is selected, a previous GPRS attach was rejected or failed due to a missing response from the network. The execution of further attach procedures depends on the GPRS attach attempt counter. No GMM procedure except GPRS attach shall be initiated by the MS in this substate.

4.1.3.1.2.5 GMM-DEREGISTERED.NO-IMSI

No valid subscriber data is available (no SIM/USIM, or the SIM/USIM is not considered valid by the ME) and a cell has been selected.

4.1.3.1.2.6 GMM-DEREGISTERED.NO-CELL-AVAILABLE

No cell can be selected. This substate is entered after a first intensive search failed (substate PLMN SEARCH). Cells are searched for at a low rhythm. No services are offered.

4.1.3.1.2.7 GMM-DEREGISTERED.PLMN-SEARCH

The mobile station is searching for PLMNs. This substate is left either when a cell has been selected (the new substate is NORMAL-SERVICE or LIMITED-SERVICE) or when it has been concluded that no cell is available at the moment (the new substate is NO-CELL-AVAILABLE).

4.1.3.1.2.8 GMM-DEREGISTERED.SUSPENDED (A/Gb mode only)

The MS shall enter this substate when entering dedicated mode and the MS limitations make it unable to communicate on GPRS channels. The MS shall leave this substate when leaving dedicated mode.

4.1.3.1.3 Substates of state GMM-REGISTERED

The state GMM-REGISTERED is subdivided into several substate as explained below. The substates pertain to the whole MS (ME alone if no SIM/USIM is inserted, or ME plus SIM/USIM).

4.1.3.1.3.1 GMM-REGISTERED.NORMAL-SERVICE

User data and signalling information may be sent and received.

4.1.3.1.3.2 GMM-REGISTERED.SUSPENDED (A/Gb mode only)

The MS shall enter this substate when entering dedicated mode and when the MS limitations makes it unable to communicate on GPRS channels. In this substate, no user data should be sent and no signalling information shall be sent. The MS shall leave this substate when leaving dedicated mode.

4.1.3.1.3.3 GMM-REGISTERED.UPDATE-NEEDED

The MS has to perform a routing area updating procedure, but its access class is not allowed in the cell due to access class control (see subclause 4.1.1.2.1). The procedure will be initiated as soon as access is granted (this might be due to a cell-reselection or due to change of the access classes allowed in the current cell). No GMM procedure except routing area updating shall be initiated by the MS in this substate. In this substate, no user data and no signalling information shall be sent.

4.1.3.1.3.4 GMM-REGISTERED.ATTEMPTING-TO-UPDATE

A routing area updating procedure failed due to a missing response from the network. The MS retries the procedure controlled by timers and a GPRS attempt counter. No GMM procedure except routing area updating shall be initiated by the MS in this substate. No data shall be sent or received.

4.1.3.1.3.5 GMM-REGISTERED.NO-CELL-AVAILABLE

GPRS coverage has been lost or PSM is active in the MS. If PSM is active, the MS can deactivate PSM at any time by activating the AS layer when the MS needs to send mobile originated signalling or user data. Otherwise, the MS shall not initiate any GMM procedures except of cell (and PLMN) reselection.

Figure 4.1b/3GPP TS 24.008:GMM main states in the MS

4.1.3.1.3.6 GMM-REGISTERED.LIMITED-SERVICE

A cell is selected, which is known not to be able to provide normal service. The MS will remain in this sub-state until a cell is selected which is able to provide normal service.

4.1.3.1.3.7 GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM

A combined routing area updating procedure or a combined GPRS attach procedure was successful for GPRS services only. The MS retries the procedure controlled by timers and a GPRS attempt counter. User data and signalling information may be sent and received.

4.1.3.1.3.8 GMM-REGISTERED.IMSI-DETACH-INITIATED

The MS performs a combined GPRS detach procedure for non-GPRS services only (detach type "IMSI Detach"). This state is entered if the MS is attached for GPRS and non-GPRS services in a network that operates in network mode I and wants to detach for non-GPRS services only. User data and signalling information may be sent and received.

4.1.3.1.3.9 GMM-REGISTERED.PLMN-SEARCH

4.1.3.2 GPRS update status

In addition to the GMM sublayer states described so far, a GPRS update status exists.

The GPRS update status pertains to a specific subscriber embodied by a SIM/USIM. This status is defined even when the subscriber is not activated (SIM/USIM removed or connected to a switched off ME). It is stored in a non volatile memory in the SIM/USIM. The GPRS update status is changed only after execution of a GPRS attach, combined GPRS attach, network initiated GPRS detach, authentication, service request, paging for GPRS services using IMSI, routing area updating, combined routing area updating procedure or due to change in RAI while timer T3346 running.

GU1: UPDATED

The last GPRS attach or routing area updating attempt was successful (correct procedure outcome, and the answer was accepted by the network). The SIM/USIM contains the RAI of the routing area (RA) to which the subscriber was attached, and possibly a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS integrity key and GPRS ciphering key sequence number. Furthermore, if the ME supports any GEA ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME may contain a valid GPRS GSM Kc₁₂₈. Furthermore, if the ME supports any GIA integrity algorithm that requires a 128-bit integrity key and a USIM is in use, then the ME may contain a valid GPRS GSM Kint.

GU2: NOT UPDATED

The last GPRS attach or routing area updating attempt failed procedurally, e.g. no response was received from the network. This includes the cases of failures or congestion inside the network.

In this case, the SIM/USIM can contain the RAI of the routing area (RA) to which the subscriber was attached, and possibly also a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS integrity key and GPRS ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted" value if the RAI is deleted. However, the presence of other values shall not be considered an error by the MS. Furthermore, if the ME supports any GEA ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GPRS GSM Kc₁₂₈ stored if the RAI is deleted. Furthermore, if the ME supports any GIA integrity algorithm that requires a 128-bit integrity key and a USIM is in use, then the ME shall delete the GPRS GSM Kintstored if the RAI is deleted.

GU3: ROAMING NOT ALLOWED

The last GPRS attach or routing area updating attempt was correctly performed, but the answer from the network was negative (because of roaming or subscription restrictions).

In this case, the SIM/USIM can contain the RAI of the routing area (RA) to which the subscriber was attached, and possibly also a valid P-TMSI, GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS integrity key or GPRS ciphering key sequence number. For compatibility reasons, all these fields shall be set to the value "deleted" if the RAI is deleted. However, the presence of other values shall not be considered an error by the MS. Furthermore, if the ME supports any GEA ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GPRS GSM Kc₁₂₈ stored if the RAI is deleted. Furthermore, if the ME supports any GIA integrity algorithm that requires a 128-bit integrity key and a USIM is in use, then the ME shall delete the GPRS GSM Kintstored if the RAI is deleted.

If the MS is attached for emergency bearer services, the MS shall not store the GMM parameters described in this subclause on the SIM/USIM or in non-volatile memory. Instead the MS shall temporarily store these parameters locally in the ME and the MS shall delete these parameters when the MS is detached.

4.1.3.3 GMM mobility management states on the network side

In this subsubclause, the possible states are described for the GMM on the network side. Subclause 4.1.3.3.1 summarises the main states. The corresponding substates are described in subclause 4.1.3.3.2.

However, it should be noted that this subclause does not include a description of the detailed behaviour of the network in the single states and does not cover abnormal cases. Thus, figure 4.1c/3GPP TS 24.008 is rather intended to give an overview of the state transitions than to be a complete state transition diagram. A detailed description of the behaviour of the MS is given in subclause 4.2. Especially, with respect to the behaviour of the MS in abnormal cases it is referred to subclause 4.7.

4.1.3.3.1 Main States

4.1.3.3.1.1 GMM-DEREGISTERED

The network has no GMM context or the GMM context is marked as detached, the MS is detached. In this state, the network may answer to a GPRS attach or combined GPRS attach procedure initiated by the MS.

4.1.3.3.1.2 GMM-COMMON-PROCEDURE-INITIATED

A common GMM procedure, as defined in subclause 4.1.1, has been started. The network is awaiting the answer from the MS.

4.1.3.3.1.3 GMM-REGISTERED

The GMM context has been established and the GPRS attach procedure has been successfully performed.

4.1.3.3.1.4 GMM-DEREGISTERED-INITIATED

The network has started a GPRS detach procedure and is awaiting the answer from the MS.

Figure 4.1c/3GPP TS 24.008: GMM main states on the network side

4.1.3.3.2 Substates of state GMM-REGISTERED

The state GMM-REGISTERED is subdivided into two substates as explained below.

4.1.3.3.2.1 GMM-REGISTERED.NORMAL-SERVICE

User data and signalling information may be sent and received.

4.1.3.3.2.2 GMM-REGISTERED.SUSPENDED (A/Gb mode only)

In this substate, the lower layers shall be prevented of sending user data or signalling information.