11.2.3 Emergency bearer services / CSG cell / LIMITED-SERVICE / Attach / Security mode control procedure without prior authentication / PDN connect / Service request / PDN disconnect / Detach upon UE switched off / Temporary storage of EMM information

36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

11.2.3.1 Test Purpose (TP)

(1)

with { the only suitable cell is a non-allowed CSG cell }

ensure that {

when { a call to send user data related to Emergency call is originated at the UE }

then { UE performs an Attach for emergency bearer services on non-allowed CSG cell }

}

(2)

void

(3)

with { the UE is attached for emergency bearer services }

ensure that {
when { the UE is detached }

then { the UE deletes EMM parameters stored temporarily while attached for emergency bearer services }

}

11.2.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.2.3.2.3, 5.4.3.2, 5.5.1.2.2, 5.5.2.1, 5.6.1.4 and Annex C.

[TS 24.301, clause 5.2.3.2.3]

The UE:

– shall perform cell selection/reselection according to 3GPP TS 36.304 [21];

– may respond to paging (with IMSI); and

– may initiate attach for emergency bearer services.

If a valid NAS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message. When the UE does not have a valid NAS security context, the ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message is not integrity protected.

[TS 24.301, clause 5.4.3.2]

…

The MME shall create a locally generated K_ASME and send the SECURITY MODE COMMAND message including a KSI value in the NAS key set identifier IE set to "000" and EIA0 and EEA0 as the selected NAS security algorithms when the security mode control procedure is initiated:

– during an attach procedure for emergency bearer services if no shared EPS security context is available;

– during a tracking area updating procedure for a UE that has a PDN connection for emergency bearer services if no shared EPS security context is available; or

– after a failed authentication procedure for a UE that has a PDN connection for emergency bearer services if continued usage of a shared security context is not possible.

The UE shall process a SECURITY MODE COMMAND message including a KSI value in the NAS key set identifier IE set to "000" and EIA0 and EEA0 as the selected NAS security algorithms and, if accepted, create a locally generated K_ASME when the security mode control procedure is initiated:

– during an attach procedure for emergency bearer services;

– during a tracking area updating procedure when the UE has a PDN connection for emergency bearer services; or

– after an authentication procedure when the UE has a PDN connection for emergency bearer services.

NOTE 1: The process for creation of the locally generated K_ASME by the MME and the UE is implementation dependent.

…

[TS 24.301, clause 5.5.1.2.2]

…

In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411.

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the EPS mobile identity IE in the ATTACH REQUEST message as follows:

– The UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the EPS mobile identity as follows:

– If the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE. If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE.

NOTE: The mapping of the P-TMSI and the RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE.

– If the TIN is deleted and

– the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE; or

– otherwise, if the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE. If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE.

– Otherwise the UE shall include the IMSI in the EPS mobile identity IE.

If the UE is attaching for emergency bearer services and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the EPS mobile identity IE.

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

If UE supports A/Gb mode or Iu mode or if the UE wants to indicate its UE specific DRX parameter to the network, the UE shall include the UE specific DRX parameter in the DRX parameter IE in the ATTACH REQUEST message.

[TS 24.301, clause 5.5.2.1]

…

After the completion of application for which the emergency services were invoked, in order to regain normal services, a UE attached for emergency bearer services may perform a detach procedure, followed by a subsequent re-attach, if the UE moves to a new cell that provides normal service.

If a detach is requested by the HSS for a UE that has bearers for emergency services, the MME shall not send a DETACH REQUEST message to the UE, and shall follow the procedures in subclause 6.4.4.1 for a UE that has bearers for emergency services.

If the detach procedure for EPS services is performed, the EPS bearer context(s) for this particular UE are deactivated locally without peer-to-peer signalling between the UE and the MME.

…

[TS 24.301, clause 5.6.1.4]

…

If the SERVICE REQUEST message was sent in a CSG cell and the CSG subscription has expired or was removed for a UE, but the UE has a PDN connection for emergency bearer services established, the network shall accept the SERVICE REQUEST message and deactivate all non-emergency EPS bearers locally. The emergency EPS bearers shall not be deactivated.

…

[TS 24.301, Annex C]

The following EMM parameters shall be stored on the USIM if the corresponding file is present:

– GUTI;

– last visited registered TAI;

– EPS update status;

– Allowed CSG list;

– Operator CSG list; and

– EPS security context parameters from a full native EPS security context (see 3GPP TS 33.401 [19]).

…

The following EMM parameter shall be stored in a non-volatile memory in the ME together with the IMSI from the USIM:

– TIN.

…

If the UE is attached for emergency bearer services, the UE shall not store the EMM parameters described in this annex on the USIM or in non-volatile memory. Instead the UE shall temporarily store these parameters locally in the ME and the UE shall delete these parameters when the UE is detached.

11.2.3.3 Test description

11.2.3.3.1 Pre-test conditions

System Simulator:

– cell A and cell B.

– cell A is not a CSG cell and is “Serving cell”;

– cell B is a CSG cell and is “Non-suitable cell”.

– System information combination 7 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– if pc_Allowed_CSG_list is set to ‘true’, The UE’ s allowed CSG list shall not contain CSG ID 2.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to 36.508 [18].

– the UE is not attached for emergency bearer services.

11.2.3.3.2 Test procedure sequence

Table 11.2.3.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – cell A as a "Non-suitable “Off” cell". – cell B as a "Serving cell".	–	–	–	–
2	The SS waits 1 min to ensure the UE is in limited service on Cell B.	–	–	–	–
3	Cause the UE to originate a call to send user data related to Emergency call. (Note 1)	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message to attach for emergency bearer services, together with a PDN CONNECTIVITY REQUEST message for emergency bearer services, on Cell B?	–>	ATTACH REQUEST PDN CONNECTIVITY REQUEST	1	P
5-14	Steps 7 to 16 of the generic test procedure in TS 36.508 subclause 4.5A.5 are performed on cell B. NOTE: The Attach procedure for emergency bearer services is completed and a default EPS bearer context for emergency bearer services is activated. Authentication is not performed.	–	–	–	–
15-23	Steps 17 to 19 of the generic test procedure in TS 36.508 subclause 4.5A.5 are performed on cell B. NOTE: Radio bearer establishment procedure is performed to successfully complete the Service Request procedure.	–	–	–	–
23A	Release IMS Call (see Note 2)	–	–	–	–
–	EXCEPTION: Steps 23Ba1 and 23Ba2 describe optional behaviour that depends on the UE implementation.	–	–	–	–
23Ba1	The UE transmits a DETACH REQUEST message with the Detach type IE indicating “EPS detach” to regain normal service.	–>	DETACH REQUEST	–	–
23Ba2	The SS responds the DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
24	If possible (see ICS) switch off is performed. Otherwise the power is removed, or the USIM is removed.	–	–	–	–
–	EXCEPTION: Steps 25 and 25A describe behaviour that depends on the UE capability and will only occur if the UE did not already DETACH in steps 23Ba1 – 23Ba2.	–	–	–	–
25	If pc_SwitchOnOff then the UE transmits a DETACH REQUEST with the Detach Type IE indicating “switch off”.	–>	DETACH REQUEST	–	–
25A	The SS responds the DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
26	The SS configures: – cell A as a “Serving cell”. – cell B as a “Non-suitable “Off” cell”. (Note 3)	–	–	–	–
27	The UE is brought back to operation (i.e. powered up, switched on, and the USIM inserted if it was removed in step 24).	–	–	–	–
28	Check: Does the UE transmit an ATTACH REQUEST on Cell A with EMM parameters not reflecting previous ATTACH on cell B and with reset security parameters?	–>	ATTACH REQUEST	3	P
29-42b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA Idle (E1) according to 36.508 (18)	–	–	–	–
Note 1: This could be done by e.g. MMI or AT command. Note 2: The IMS Call is released using the generic procedure in TS 34.229-1 [35] subclause C.32. Note 3: UE switch-off shall be completed before power level changes to avoid race condition (cell reselection).

11.2.3.3.3 Specific message contents

Table 11.2.3.3.3-1: Conditions for Table 11.2.3.3.3-2

Condition	Explanation
Cell A	This condition applies to system information transmitted on Cell A.
Cell B	This condition applies to system information transmitted on Cell B.

Table 11.2.3.3.3-2: SystemInformationBlockType1 for cell A and B (Pre-test conditions and all steps, Table 11.2.3.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	FALSE		Cell A
	TRUE		Cell B
csg-Identity	Not present		Cell A
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B
}
}

Table 11.2.3.3.3-3: SystemInformationBlockType4 for cell A and B (Pre-test conditions and all steps, Table 11.2.3.3.2-1)

Derivation Path: 36.508 clause 4.4.3.3, Table 4.4.3.3-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType4 ::= SEQUENCE {
csg-PhysCellIdRange ::= SEQUENCE {
Start	2
Range	Not present	The UE shall apply value 1 in case the field is absent, in which case only the physical cell identity value indicated by start applies.
}
}

Table 11.2.3.3.3-4: ATTACH REQUEST (Step 4, Table 11.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
EPS attach type	‘0110’B	EPS emergency attach
NAS key set identifier
NAS key set identifier	NAS key set identifier allocated to UE during authentication in test preamble
TSC	‘0’B	Native security context
EPS Mobile Identity	GUTI allocated to UE during previous attach on Cell A.
Last visited registered TAI	TAI-1
Old location area identification	Not present
TMSI status	Not present

Table 11.2.3.3.3-5: PDN CONNECTIVITY REQUEST (Step 4, Table 11.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
Request type	‘0100’B	emergency

Table 11.2.3.3.3-6: ATTACH REQUEST (Step 28, Table 11.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	’111’B	No key is available
TSC	‘0’B	Native security context
Old GUTI or IMSI	GUTI allocated to UE during previous attach on Cell A.
Last visited registered TAI	TAI-1
Old location area identification	LAI-1 if present
TMSI status	Not present