22.5.6 NB-IoT / Attach Abnormal cases / Unsuccessful attach or Repeated rejects for network failures / Change of cell into a new tracking area / EPS services not allowed / Failure due to non integrity protection /UE initiated detach USIM removed from the UE / Detach procedure collision.
36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification
22.5.6.1 Test Purpose (TP)
(1)
with { UE has sent an ATTACH REQUEST message and started T3410 timer}
ensure that {
when { T3410 timer expires }
then { the UE release NAS signalling connection locally }
}
(2)
with { UE has sent an ATTACH REQUEST message and T3410 timer expired}
ensure that {
when { T3411 timer expires and attach attempt counter is less than 5 }
then { the UE restarts the attach procedure }
}
(3)
with { UE has sent an ATTACH REQUEST message }
ensure that {
when { Lower Layer failure (RRC Connection is released) before the ATTACH ACCEPT or ATTACH REJECT message is received, T3411 has expired and attach attempt counter is less than 5}
then { the UE restarts the attach procedure }
}
(4)
with { UE having valid GUTI, has sent an ATTACH REQUEST message }
ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to #17 and attach attempt counter is less than 5}
then { UE starts timer T3411 and shall not delete stored GUTI }
when { Timer T3411 expires}
then { UE restarts attach procedure }
}
(5)
with { UE having valid GUTI, has sent an ATTACH REQUEST message }
ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to #22 and attempt counter is less than 5}
then { UE starts timer T3411 and shall not delete stored GUTI }
when { Timer T3411 expires}
then { UE restarts attach procedure }
}
(6)
with { UE having valid GUTI, has sent an ATTACH REQUEST message }
ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to #22 and attempt counter is set to 5}
then { the UE stops attach attempts and starts timer T3402, shall delete stored GUTI }
}
(7)
Void
(8)
with { UE has sent an ATTACH REQUEST message and received ATTACH ACCEPT message containing GUTI }
ensure that {
when { UE reselects a cell belonging to a new tracking area }
then { the UE restarts the attach procedure }
}
(9)
with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message or an ESM DUMMY MESSAGE }
ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services not allowed" }
then { UE deletes the GUTI and the last visited registered TAI and KSI and considers the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed and deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED }
(10)
with { UE having been initiated an Attach }
ensure that {
when { UE receives an ATTACH ACCEPT messages without NAS integrity protection before NAS security mode control procedure being performed }
then { UE discards this message }
}
(11)
with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }
ensure that {
when { UE receives a valid NAS signalling message without integrity protection }
then { UE discards this NAS signalling message }
}
(12)
with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }
ensure that {
when { UE receives a valid security protected NAS signalling message with the Message authentication code set to an incorrect value }
then { UE discards this NAS signalling message }
}
(13)
with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }
ensure that {
when { UE receives a valid NAS signalling message with integrity protection which require a response from the UE }
then { UE sends the response as a security protected NAS message }
}
(14)
with { UE in EMM-REGISTERED }
ensure that {
when { the USIM is removed from the UE }
then { the UE sends DETACH REQUEST message and indicates that detach is for EPS services depending on the EPS attach type used }
}
(15)
with { UE in EMM-REGISTERED-INITIATED state a valid USIM }
ensure that {
when { UE receives a DETACH REQUEST message and detach type indicates “re-attach not required” }
then { the UE sends DETACH ACCEPT }
}
(16)
with { UE in EMM-REGISTERED-INITIATED state }
ensure that {
when { UE receives a DETACH REQUEST message and detach type indicates “re-attach required” }
then { the UE continues with ATTACH procedure }
}
22.5.6.2 Conformance requirements
References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.4.4.1, 4.4.4.2 , 5.5.2.2 , 5.5.2.2.1 ,5.5.2.2.3 ,5.5.1.2.2 ,5.5.1.2.5 ,5.5.1.2.6 , 5.5.1.3.6 ,10.2 , 9.9.3.9.
[TS 24.301, clause 5.5.1.2.6]
The following abnormal cases can be identified:
…
b) Lower layer failure or release of the NAS signalling connection without "Extended wait time" received from lower layers before the ATTACH ACCEPT or ATTACH REJECT message is received
The attach procedure shall be aborted, and the UE shall proceed as described below.
c) T3410 timeout
The UE shall abort the attach procedure and proceed as described below. The NAS signalling connection, if any, shall be released locally.
…
e) Change of cell into a new tracking area
If a cell change into a new tracking area occurs before the attach procedure is completed, the attach procedure shall be aborted and re-initiated immediately. If a tracking area border is crossed when the ATTACH ACCEPT message has been received but before an ATTACH COMPLETE message is sent, the attach procedure shall be re-initiated. If a GUTI was allocated during the attach procedure, this GUTI shall be used in the attach procedure.
…
g) Detach procedure collision
If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach not required" and no EMM cause IE, or "re-attach not required" and the EMM cause value is not #2 "IMSI unknown in HSS", the detach procedure shall be progressed and the attach procedure shall be aborted. Otherwise the attach procedure shall be progressed and the DETACH REQUEST message shall be ignored.
…
For the cases b, c, d, l and m:
– Timer T3410 shall be stopped if still running.
– For the cases b, c, d, and l when the "Extended wait time" is ignored, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", the attach attempt counter shall be incremented, unless it was already set to 5.
– If the attach attempt counter is less than 5:
– for the cases l and m, the attach procedure is started, if still necessary, when timer T3346 expires or is stopped;
– for the cases b, c, d, and l when the "Extended wait time" is ignored, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", timer T3411 is started and the state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When timer T3411 expires the attach procedure shall be restarted, if still required by ESM sublayer.
– If the attach attempt counter is equal to 5:
– the UE shall delete any GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs and KSI, shall set the update status to EU2 NOT UPDATED, and shall start timer T3402. The state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH or optionally to EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6]; and
– if A/Gb mode or Iu mode is supported by the UE:
– the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5; and
– the UE shall attempt to select GERAN or UTRAN radio access technology and proceed with appropriate GMM specific procedures. Additionally, the UE may disable the E-UTRA capability as specified in subclause 4.5.
[TS 24.301, clause 10.2]
Table 10.2.1: EPS mobility management timers – UE side
|
TIMER NUM. |
TIMER VALUE |
STATE |
CAUSE OF START |
NORMAL STOP |
ON |
|---|---|---|---|---|---|
|
T3402 |
Default 12 min. NOTE 1 |
EMM-DEREGISTERED EMM-REGISTERED |
At attach failure and the attempt counter is equal to 5. At tracking area updating failure and the attempt counter is equal to 5. ATTACH ACCEPT with EMM cause #16 or #17 and the attempt counter is equal to 5 for CS/PS mode 2 UE, or ATTACH ACCEPT with EMM cause #22, as described in subclause 5.5.1.3.4.3. TRACKING AREA UPDATE ACCEPT with EMM cause #16 or #17 and the attempt counter is equal to 5 for CS/PS mode 2 UE, TRACKING AREA UPDATE ACCEPT with EMM cause #16 or #17 and the attempt counter is equal to 5 for CS/PS mode 1 UE with "IMS voice not available" and with a persistent EPS bearer context, or TRACKING AREA UPDATE ACCEPT with EMM cause #22, as described in subclause 5.5.3.3.4.3. |
ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent NAS signalling connection released |
Initiation of the attach procedure, if still required or TAU procedure |
|
… |
|||||
|
T3410 |
15s |
EMM-REGISTERED-INITIATED |
ATTACH REQUEST sent |
ATTACH ACCEPT received ATTACH REJECT received |
Start T3411 or T3402 as described in subclause 5.5.1.2.6 |
|
T3411 |
10s |
EMM-DEREGISTERED. ATTEMPTING-TO-ATTACH EMM-REGISTERED. ATTEMPTING-TO-UPDATE EMM-REGISTERED. NORMAL-SERVICE |
At attach failure due to lower layer failure, T3410 timeout or attach rejected with other EMM cause values than those treated in subclause 5.5.1.2.5. At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5. |
ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent EMM-CONNECTED mode entered (NOTE 6) |
Retransmission of the ATTACH REQUEST, if still required as described in subclause 5.5.1.2.6 or retransmission of TRACKING AREA UPDATE REQUEST |
|
… |
|||||
|
NOTE 1: The cases in which the default value of this timer is used are described in subclause 5.3.6. NOTE 2: The value of this timer is provided by the network operator during the attach and tracking area updating procedures. NOTE 3: The value of this timer may be provided by the network in the ATTACH ACCEPT message and TRACKING AREA UPDATE ACCEPT message. The default value of this timer is identical to the value of T3412. NOTE 4: The value of this timer is provided by the network operator when a service request for CS fallback is rejected by the network with EMM cause #39 "CS service temporarily not available". NOTE 5: The default value of this timer is used if the network does not indicate a value in the TRACKING AREA UPDATE ACCEPT message and the UE does not have a stored value for this timer. NOTE 6: The conditions for which this applies are described in subclause 5.5.3.2.6. NOTE 7: In NB-S1 mode, the timer value shall be calculated as described in subclause 4.7. NOTE 8: In WB-S1 mode, if the UE supports CE mode B, then the timer value is calculated as described in subclause 4.8. |
|||||
[TS 24.301, clause 5.5.1.2.5]
If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.
If the attach procedure fails due to:
– a default EPS bearer setup failure;
– an ESM procedure failure; or
– operator determined barring is applied on default EPS bearer context activation during attach procedure,
the MME shall:
– combine the ATTACH REJECT message with a PDN CONNECTIVITY REJECT message contained in the ESM message container information element. In this case the EMM cause value in the ATTACH REJECT message shall be set to #19 "ESM failure"; or
– send the ATTACH REJECT message with the EMM cause set to #15 "No suitable cells in tracking area", if the PDN connectivity reject is due to ESM cause #29 subject to operator policies (see 3GPP TS 29.274 [16D] for further details). In this case, the network may additionally include the Extended EMM cause IE with value "E-UTRAN not allowed".
If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a back-off timer T3346.
If the attach request is rejected due to incompatibility between the CIoT EPS optimizations supported by the UE and what the network supports and the network sets the EMM cause value to #15 "no suitable cells in tracking area", the network may additionally include the Extended EMM cause IE with value "requested EPS optimization not supported".
NOTE 1: How the UE uses the Extended EMM cause IE with value "requested EPS optimization not supported" is implementation specific. The UE still behaves according to the EMM cause value #15.
Upon receiving the ATTACH REJECT message, if the message is integrity protected or contains a reject cause other than EMM cause value #25, the UE shall stop timer T3410.
If the ATTACH REJECT message with EMM cause #25 was received without integrity protection, then the UE shall discard the message.
The UE shall take the following actions depending on the EMM cause value received in the ATTACH REJECT message.
…
#7 (EPS services not allowed);
The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a. Additionally, the UE shall delete the list of equivalent PLMNs and enter state EMM-DEREGISTERED.
If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.
…
Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in subclause 5.5.1.2.6.
[TS 24.301, clause 9.9.3.9]
Table 9.9.3.9.1: EMM cause information element
|
Cause value (octet 2) |
|||||||||
|
Bits |
|||||||||
|
8 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
||
|
0 |
0 |
0 |
1 |
0 |
0 |
0 |
1 |
Network failure |
|
|
0 |
0 |
0 |
1 |
0 |
0 |
1 |
0 |
CS domain not available |
|
|
0 |
0 |
0 |
1 |
0 |
0 |
1 |
1 |
ESM failure |
|
|
0 |
0 |
0 |
1 |
0 |
1 |
0 |
0 |
MAC failure |
|
|
0 |
0 |
0 |
1 |
0 |
1 |
0 |
1 |
Synch failure |
|
|
0 |
0 |
0 |
1 |
0 |
1 |
1 |
0 |
Congestion |
|
|
0 |
0 |
0 |
1 |
0 |
1 |
1 |
1 |
UE security capabilities mismatch |
|
|
… |
|||||||||
|
Any other value received by the mobile station shall be treated as 0110 1111, "protocol error, unspecified". Any other value received by the network shall be treated as 0110 1111, "protocol error, unspecified". |
|||||||||
[TS 24.301, clause 5.5.1.3.6]
The UE shall proceed as follows:
…
3) otherwise, the abnormal cases specified in subclause 5.5.1.2.6 apply with the following modification.
If the attach attempt counter is incremented according to subclause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:
– if the attach attempt counter is less than 5, the UE shall set the update status to U2 NOT UPDATED but shall not delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs; or
– if the attach attempt counter is equal to 5, then the UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. The UE shall attempt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures. Additionally, the UE may disable the E-UTRA capability as specified in subclause 4.5.
…
[TS 24.301, clause 5.5.1.2.2]
In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411.
The UE shall include the IMSI in the EPS mobile identity IE in the ATTACH REQUEST message if the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs and:
– the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]; or
– the UE is in NB-S1 mode.
For all other cases, the UE shall handle the EPS mobile identity IE in the ATTACH REQUEST message as follows:
If the UE supports neither A/Gb mode nor Iu mode:
– the UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. In addition, the UE shall include Old GUTI type IE with GUTI type set to "native GUTI". If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message.
…
[TS 24.301, clause 4.4.4.1]
For the UE, integrity protected signalling is mandatory for the NAS messages once a valid EPS security context exists and has been taken into use. For the network, integrity protected signalling is mandatory for the NAS messages once a secure exchange of NAS messages has been established for the NAS signalling connection. Integrity protection of all NAS signalling messages is the responsibility of the NAS. It is the network which activates integrity protection.
…
[TS 24.301, clause 4.4.4.2]
Except the messages listed below, no NAS signalling messages shall be processed by the receiving EMM entity in the UE or forwarded to the ESM entity, unless the network has established secure exchange of NAS messages for the NAS signalling connection:
– EMM messages:
– IDENTITY REQUEST (if requested identification parameter is IMSI);
– AUTHENTICATION REQUEST;
– AUTHENTICATION REJECT;
– ATTACH REJECT (if the EMM cause is not #25);
– DETACH ACCEPT (for non switch off);
– TRACKING AREA UPDATE REJECT (if the EMM cause is not #25);
– SERVICE REJECT (if the EMM cause is not #25).
NOTE: These messages are accepted by the UE without integrity protection, as in certain situations they are sent by the network before security can be activated.
All ESM messages are integrity protected.
Once the secure exchange of NAS messages has been established, the receiving EMM or ESM entity in the UE shall not process any NAS signalling messages unless they have been successfully integrity checked by the NAS. If NAS signalling messages, having not successfully passed the integrity check, are received, then the NAS in the UE shall discard that message. The processing of the SECURITY MODE COMMAND message that has not successfully passed the integrity check is specified in subclause 5.4.3.5. If any NAS signalling message is received as not integrity protected even though the secure exchange of NAS messages has been established by the network, then the NAS shall discard this message.
[TS 24.301, clause 5.5.2.2.1]
The detach procedure is initiated by the UE by sending a DETACH REQUEST message (see example in figure 5.5.2.2.1.1). The Detach type IE included in the message indicates whether detach is due to a "switch off" or not. The Detach type IE also indicates whether the detach is for EPS services only, for non-EPS services only, or for both. If the UE has a mapped EPS security context as the current EPS security context, the UE shall set the type of security context flag to "mapped security context". Otherwise, the UE shall set the type of security context flag to "native security context".
If the UE has a valid GUTI, the UE shall populate the EPS mobile identity IE with the valid GUTI. If the UE does not have a valid GUTI, the UE shall populate the EPS mobile identity IE with its IMSI.
If the UE does not have a valid GUTI and it does not have a valid IMSI, then the UE shall populate the EPS mobile identity IE with its IMEI.
NOTE: During the attach for emergency service when the UE (with no USIM or invalid USIM) is in EMM-REGISTERED-INITIATED STATE, the UE has neither a valid GUTI nor a valid IMSI.
If the detach is not due to switch off and the UE is in the state EMM-REGISTERED or EMM-REGISTERED-INITIATED, timer T3421 shall be started in the UE after the DETACH REQUEST message has been sent. If the detach type indicates that the detach is for non-EPS services only the UE shall enter the state EMM-REGISTERED.IMSI-DETACH-INITIATED, otherwise the UE shall enter the state EMM-DEREGISTERED-INITIATED. If the detach type indicates that the detach is for non-EPS services or both EPS and non-EPS services, the UE shall enter the state MM IMSI DETACH PENDING.
If the UE is to be switched off, the UE shall try for a period of 5 seconds to send the DETACH REQUEST message. During this period, the UE may be switched off as soon as the DETACH REQUEST message has been sent.
After the last DETACH REQUEST message is sent, the UE shall proceed as follows:
– if the current EPS security context is a native EPS security context, then the UE shall store the current EPS security context as specified in annex C and mark it as valid;
– else if the current EPS security context is a mapped EPS security context and a non-current full native EPS security context exists, then the UE shall store the non-current EPS security context as specified in annex C and mark it as valid, and finally the UE shall delete any mapped EPS security context or partial native EPS security context.
Figure 5.5.2.2.1.1: UE initiated detach procedure
[TS 24.301 clause 5.5.2.2.3]
When the DETACH REQUEST message is received by the network, a DETACH ACCEPT message shall be sent to the UE, if the Detach type IE does not indicate "switch off". Otherwise, the procedure is completed when the network receives the DETACH REQUEST message.
Depending on the value of the Detach type IE the following applies:
– combined EPS/IMSI detach:
The network and the UE shall deactivate the EPS bearer context(s) for this UE locally without peer-to-peer signalling between the UE and the MME. The UE is marked as inactive in the network for EPS and for non-EPS services. The states EMM-DEREGISTERED and MM-NULL are entered in both the UE and the network.
– IMSI detach:
The UE is marked as inactive in the network for non-EPS services. The states MM-NULL and EMM-REGISTERED are entered in both the UE and the network.
The UE, when receiving the DETACH ACCEPT message, shall stop timer T3421.
22.5.6.3 Test description
22.5.6.3.1 Pre-test conditions
System Simulator:
– Ncell 50, Ncell 51 are defined in clause 8.1.4.2 in TS 36.508[18]
– NB-IOT system information combination 2 as defined in TS 36.508[18] clause 8.1.4.3.1.1 is used in all cells
– Ncell 50 and Ncell 51 belong to PLMN1.
Table 22.5.6.3-1: Time instances of cell power level and parameter changes
|
Parameter |
Unit |
Ncell 50 |
Ncell 51 |
|
|
T1 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
-120 |
|
T2 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-120 |
-85 |
|
T3 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
-85 |
|
T4 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
-120 |
|
T5 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
-97 |
|
T6 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-97 |
-85 |
|
T7 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
Off |
UE:
– The Test UICC shall be inserted. This shall contain a USIM application on UICC.
– the UE is previously registered on NB-IOT , and when on NB-IOT, the UE is last authenticated and registered on Ncell 50 using default message contents according to TS 36.508 [18].
Preamble:
– the UE is in state Switched OFF (State 1-NB) according to TS 36.508 [18].
– The NAS integrity algorithm shall be set to a different value than ‘EPS integrity algorithm’ EIA0 throughout the whole duration of the test.
22.5.6.3.2 Test procedure sequence
Table 22.5.6.3.2-1: Main behaviour
|
St |
Procedure |
Message Sequence |
TP |
Verdict |
|
|
U – S |
Message |
||||
|
0 |
SS adjusts the cell power levels according to row T1 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
1 |
Switch-on the UE. |
– |
– |
– |
– |
|
2 |
The UE transmits an ATTACH REQUEST message. (Attach attempt counter = 1) |
–> |
ATTACH REQUEST |
– |
– |
|
3 |
The SS waits 265 seconds (255 seconds T3410 and 10 seconds T3411). |
– |
– |
– |
– |
|
3a |
Check: Does the UE transmit an RRCConnectionRequest-NB message? |
– |
– |
1 |
P |
|
4 |
Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 2) |
–> |
ATTACH REQUEST |
2 |
P |
|
5 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
6 |
The SS waits 10 seconds (T3411). |
– |
– |
– |
– |
|
7 |
Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 3) |
–> |
ATTACH REQUEST |
3 |
P |
|
8 |
The SS transmits an ATTACH REJECT message, EMM cause = Network failure (#17) |
<– |
ATTACH REJECT |
– |
– |
|
9 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
10 |
The SS waits 10 seconds (T3411). |
– |
– |
– |
– |
|
11 |
Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 4) |
–> |
ATTACH REQUEST |
4 |
P |
|
12 |
The SS transmits an ATTACH REJECT message, EMM cause = Congestion (#22) |
<– |
ATTACH REJECT |
– |
– |
|
13 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
14 |
The SS waits 10 seconds (T3411). |
– |
– |
– |
– |
|
15 |
Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 5) |
–> |
ATTACH REQUEST |
5 |
P |
|
16 |
The SS transmits an ATTACH REJECT message, EMM cause = Congestion (#22) |
<– |
ATTACH REJECT |
– |
– |
|
17 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
18 |
The SS waits 12 minutes (default value of T3402). |
– |
– |
– |
– |
|
19 |
Check: Does the UE transmit an ATTACH REQUEST message? |
–> |
ATTACH REQUEST |
6 |
P |
|
20-29b1 |
The attach procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 sub clause 8.1.5.2. |
– |
– |
– |
– |
|
30 |
If possible (see ICS) switch off is performed or the USIM is removed. |
– |
– |
– |
– |
|
– |
EXCEPTION: Step 30Aa1 describes behaviour that depends on the UE capability. |
– |
– |
– |
– |
|
30Aa1 |
If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message with the Detach type IE indicating “switch off”. |
–> |
DETACH REQUEST |
– |
– |
|
30B |
SS adjusts the cell power levels according to row T2 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
31 |
Switch-on the UE. |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 51 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
32 |
The UE transmits an ATTACH REQUEST message in Ncell 51 including a PDN CONNECTIVITY REQUEST or ESM DUMMY MESSAGE message. |
–> |
ATTACH REQUEST |
– |
– |
|
33 |
Void |
– |
– |
– |
– |
|
34 |
Void |
– |
– |
– |
– |
|
35 |
Void. |
– |
– |
– |
– |
|
36-41a2 |
Steps 5-10a2 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2 are performed. |
– |
– |
– |
– |
|
42 |
SS adjusts the cell power levels according to row T3 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
43 |
SS is configured to not allocate any UL grant or respond to any NPRACH preambles for ATTACH COMPLETE in Ncell 51. |
– |
– |
– |
– |
|
44 |
SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST or ESM DUMMY MESSAGE message is piggybacked in ATTACH ACCEPT message. GUTI-1 is allocated. |
<– |
ATTACH ACCEPT |
– |
– |
|
45 |
SS adjusts the cell power levels according to row T4 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
46 |
UE transmits RRCConnectionRequest-NB message in Ncell 50 |
– |
– |
– |
– |
|
47 |
SS Sends RRCConnectionSetup-NB |
– |
– |
– |
– |
|
48 |
The UE transmits an RRCConnectionSetupComplete-NB message to confirm the successful completion of the connection establishment in Ncell 50 |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 50 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
49 |
Check: Does the UE transmit an ATTACH REQUEST message, containing GUTI 1? |
–> |
ATTACH REQUEST |
8 |
P |
|
50 |
SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST or ESM DUMMY MESSAGE message. |
<– |
ATTACH ACCEPT |
– |
– |
|
51 |
The UE transmits an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT or ESM DUMMY MESSAGE message. |
–> |
ATTACH COMPLETE |
– |
– |
|
52 |
If possible (see ICS) switch off is performed or the USIM is removed. |
– |
– |
– |
– |
|
– |
EXCEPTION: Step 52Aa1 describes behaviour that depends on the UE capability. |
– |
– |
– |
– |
|
52Aa1 |
If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message with the Detach type IE indicating “switch off”. |
–> |
DETACH REQUEST |
– |
– |
|
52B |
SS adjusts the cell power levels according to row T5 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 50 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
53 |
Switch-on the UE. |
– |
– |
– |
– |
|
54 |
The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST or ESM DUMMY MESSAGE message. |
–> |
ATTACH REQUEST |
– |
– |
|
55 |
The SS transmits an ATTACH REJECT message with EMM cause = "EPS services not allowed". |
<– |
ATTACH REJECT |
– |
– |
|
56 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
57 |
SS adjusts the cell power levels according to row T6 in table 22.5.6.3-1.Note: Ncell 50 and Ncell 51 are in different TAIs – same PLMN(PLMN1). |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 51 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
58 |
Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? |
–> |
ATTACH REQUEST |
9 |
F |
|
59 |
The user initiates an attach by MMI or by AT command. |
– |
– |
– |
– |
|
60 |
Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? |
–> |
ATTACH REQUEST |
9 |
F |
|
– |
If possible (see ICS) switch off is performed or the USIM is removed |
– |
– |
– |
– |
|
61 |
Void |
– |
– |
– |
– |
|
61A |
SS adjusts the cell power levels according to row T7 in table 22.5.6.3-1. |
– |
– |
– |
– |
|
62 |
Switch-on the UE. |
– |
– |
– |
– |
|
63 |
The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message or ESM DUMMY MESSAGE. Note: The ATTACH REQUEST message shall be sent as a security unprotected NAS message. |
–> |
ATTACH REQUEST |
– |
– |
|
64-65 |
Steps -11-12 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2 are performed. (Control_Plane_CIoT_Optimisation are used) |
– |
– |
– |
– |
|
66 |
The SS transmits an ATTACH ACCEPT although UE has not successfully completed any NAS security mode control procedure. Note: The ATTACH ACCEPT message is sent as a plain NAS message (see TS 24.301 – clause 9.1). |
<– |
ATTACH ACCEPT |
– |
– |
|
– |
EXCEPTION: In parallel with step 67, the parallel behaviour defined in table 22.5.6.3.2-3 is running. |
– |
– |
– |
– |
|
67 |
Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message without security protection. |
–> |
ATTACH COMPLETE |
10 |
F |
|
68 |
The SS transmits an AUTHENTICATION REQUEST message to initiate the EPS authentication and AKA procedure. |
<– |
AUTHENTICATION REQUEST |
– |
– |
|
69 |
The UE transmits an AUTHENTICATION RESPONSE message to establish mutual authentication. |
–> |
AUTHENTICATION RESPONSE |
– |
– |
|
70 |
The SS transmits a SECURITY MODE COMMAND message to activate NAS security. |
<– |
SECURITY MODE COMMAND |
– |
– |
|
71 |
The UE transmits a SECURITY MODE COMPLETE message and establishes the initial security configuration. |
–> |
SECURITY MODE COMPLETE |
– |
– |
|
72 |
The SS transmits an ATTACH ACCEPT without integrity protection. Note: The ATTACH ACCEPT message is sent as a plain NAS message (see TS 24.301 – clause 9.1). |
<– |
ATTACH ACCEPT |
– |
– |
|
73 |
Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message without security protection |
–> |
ATTACH COMPLETE |
11 |
F |
|
74 |
The SS transmits an ATTACH ACCEPT with integrity protection with the Message authentication code set to an incorrect value. Note: The ATTACH ACCEPT message is sent as a security protected NAS message (see TS 24.301 – clause 9.1). |
<– |
ATTACH ACCEPT |
– |
– |
|
75 |
Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message because the integrity check is failed. |
–> |
ATTACH COMPLETE |
12 |
F |
|
76 |
The SS transmits an ATTACH ACCEPT message including an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST or ESM DUMMY MESSAGE. Note: The ATTACH ACCEPT message is sent as a security protected NAS message (see TS 24.301 – clause 9.1). Note 1: SS allocates a PDN address of a PDN type which is compliant with the PDN type requested by the UE. |
<– |
ATTACH ACCEPT |
– |
– |
|
77 |
Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT or ESM DUMMY MESSAGE message as specified? Note: The ATTACH COMPLETE message is sent as a security protected NAS message (see TS 24.301 – clause 9.1). |
–> |
ATTACH COMPLETE |
13 |
P |
|
77A |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
78 |
Check: Does the test results of test procedure in 36.508 clause 8.1.5A.2 indicate that the UE is in E-UTRA EMM-REGISTERED state with S-TMSI-2? Note: This step verifies that the UE has correctly stored the GUTI-4 which was included in the protected ATTACH ACCEPT messages. |
– |
– |
13 |
– |
|
79 |
Void. |
– |
– |
– |
– |
|
– |
EXCEPTION: Steps 80a1-80b1 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported |
– |
– |
– |
– |
|
80a1 |
IF pc_USIM_Removal THEN cause removal of USIM from the UE without powering down. |
– |
– |
– |
– |
|
80b1 |
ELSE switch-off the UE. |
– |
– |
– |
– |
|
81 |
Check: Does the UE transmit a DETACH REQUEST with the Detach Type IE indicating "normal detach" or “power off” detach and "IMSI detach" or "EPS detach" depending on the UE configuration? |
–> |
DETACH REQUEST |
14 |
P |
|
– |
EXCEPTION: Step 81Aa1 describe behaviour that depends on the UE implementation |
– |
– |
– |
– |
|
81Aa1 |
If in step 81 normal detach is performed the SS responds with DETACH ACCEPT message |
<– |
DETACH ACCEPT |
– |
– |
|
81Aa2 |
The SS releases the RRC connection. |
||||
|
– |
EXCEPTION: Step 82a1 is performed only if step 80a1 has been performed. |
– |
– |
– |
– |
|
82a1 |
Check: Does the test result of generic procedure in TS 36.508 subclause 8.1.5A.2 indicate that the UE does not respond to paging when paged with S-TMSI included in GUTI-1 and with CN domain indicator set to "PS"? |
– |
– |
14 |
– |
|
– |
EXCEPTION: Steps 83a1-83b1 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported |
– |
– |
– |
– |
|
83a1 |
IF pc_USIM_Removal THEN insert a valid USIM and switch-on the UE. |
– |
– |
– |
– |
|
83b1 |
ELSE switch-on the UE. |
– |
– |
– |
– |
|
84 |
Void |
– |
– |
– |
– |
|
85 |
The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST or ESM DUMMY MESSAGE message (NOTE 2) |
–> |
ATTACH REQUEST |
– |
– |
|
86 |
The SS initiates Detach procedure with the Detach Type IE "re-attach not required" |
<– |
DETACH REQUEST |
– |
– |
|
87 |
Check: Does the UE send DETACH ACCEPT message? |
–> |
DETACH ACCEPT |
15 |
P |
|
88 |
The SS releases the RRC connection. |
– |
– |
– |
– |
|
88A |
The SS waits 5 seconds (NOTE 1) |
– |
– |
– |
– |
|
89 |
If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed. |
– |
– |
– |
– |
|
89A |
The UE is brought back to operation or the USIM is inserted. |
– |
– |
– |
– |
|
90 |
The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message. (NOTE 2) |
–> |
ATTACH REQUEST |
– |
– |
|
91-96a2 |
Steps 5-10a2 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2 are performed. |
– |
– |
– |
– |
|
97 |
The SS initiates Detach procedure with the Detach Type IE "re-attach required" |
<– |
DETACH REQUEST |
– |
– |
|
– |
EXCEPTION: In parallel with steps 98 to 99, the parallel behaviour defined in table 22.5.6.3.2-2 is running. |
– |
– |
– |
– |
|
98 |
SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST or ESM DUMMY MESSAGE message is piggybacked in ATTACH ACCEPT message. GUTI-1 is allocated. |
<– |
ATTACH ACCEPT |
– |
– |
|
99 |
The UE transmits an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT or ESM DUMMY MESSAGE message? |
–> |
ATTACH COMPLETE |
16 |
P |
|
NOTE 1: The time delay is added to additionally guarantee UE has respected the content of the DETACH REQUEST message. NOTE 2: Any type of attach is acceptable. |
|||||
Table 22.5.6.3.2-2: Parallel behaviour
|
St |
Procedure |
Message Sequence |
TP |
Verdict |
|
|
U – S |
Message |
||||
|
1 |
Check: Does the UE send DETACH ACCEPT message? |
–> |
DETACH ACCEPT |
16 |
F |
Table 22.5.6.3.2-3: Parallel behaviour
|
St |
Procedure |
Message Sequence |
TP |
Verdict |
|
|
U – S |
Message |
||||
|
1 |
The UE transmits EMM STATUS message. |
–> |
EMM STATUS |
– |
– |
22.5.6.3.3 Specific message contents
Table 22.5.6.3.3-1: Message ATTACH REQUEST (step 19 Table 22.5.6.3.2-1)
|
Derivation Path: TS 36.508 Table 4.7.2-4 |
|||
|
Information Element |
Value/remark |
Comment |
Condition |
|
NAS key set identifier |
111 |
"No key is available" |
|
|
Old GUTI or IMSI |
IMSI-1 |
GUTI has been deleted; only IMSI is available. |
|
|
Last visited registered TAI |
Not present |
TAI has been deleted. |
|
Table 22.5.6.3.3-2: Message ATTACH REQUEST (step 7, 11 ,15 Table 22.5.6.3.2-1)
|
Derivation path: TS 36.508 table 4.7.2.-4 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
NAS key set identifier |
Any allowed value other than ‘111’B |
"Stored key is available" |
|
|
Old GUTI or IMSI |
GUTI-1 |
As stored in USIM |
|
|
Last visited registered TAI |
TAI-1 |
Stored TAI. |
|
Table 22.5.6.3.3-3: Message ATTACH REJECT (steps 8 Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2.3 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Security header type |
0000 |
" Plain NAS message, not security protected " |
|
|
EMM cause |
00010001 |
#17 " Network failure" |
|
|
ESM message container |
Not present |
||
Table 22.5.6.3.3-4: Message ATTACH REJECT (steps 12,16 Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2.3 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Security header type |
0000 |
" Plain NAS message, not security protected " |
|
|
EMM cause |
00010110 |
#22 "Congestion " |
|
|
ESM message container |
Not present |
||
Table 22.5.6.3.3-5: Message ATTACH ACCEPT (step 44, Table 22.5.6.3.2-1)
|
Derivation path: TS 36.508 table 4.7.2-1 |
|||||
|
Information Element |
Value/Remark |
Comment |
Condition |
||
|
TAI list |
|||||
|
Length of tracking area identity list contents |
‘0000 0110’B |
||||
|
Partial tracking area identity list 1 |
|||||
|
Number of elements |
‘0 0000’B |
||||
|
Type of list |
’00’B |
||||
|
MCC |
MCC of Ncell 50 |
||||
|
MNC |
MNC of Ncell 50 |
||||
|
TAC 1 |
TAC of Ncell50 |
||||
|
GUTI |
GUTI-1 |
||||
Table 22.5.6.3.3-6: Void
Table 22.5.6.3.3-7: Void
Table 22.5.6.3.3-8: Message ATTACH REQUEST (step 49, Table 22.5.6.3.2-1)
|
Derivation path: TS 36.508 table 4.7.2-4 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Last visited registered TAI |
TAI of Ncell 51 |
||
Table 22.5.6.3.3-9: Message ATTACH REJECT (step 55, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-3 (This message is transmitted as a "plain NAS message") |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Security header type |
0000 |
"Plain NAS message, not security protected" |
|
|
EMM cause |
00000111 |
#7 "EPS services not allowed" |
|
|
ESM message container |
Not present |
||
Table 22.5.6.3.3-10: Message ATTACH ACCEPT (steps 66 and 72, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-1 (Plain NAS message) |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
GUTI |
GUTI-2 |
The SS chooses a value different from GUTI-1. |
|
Table 22.5.6.3.3-11: Message SECURITY PROTECTED NAS MESSAGE (step 74, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.1-1 with condition CIPHERED |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Message authentication code |
Incorrect value |
The SS chooses an incorrect value which fails integrity checks. (e.g. 00000000) |
|
|
NAS message |
ATTACH ACCEPT (see table 22.5.6.3.3-3) |
||
Table 22.5.6.3.3-12: Message ATTACH ACCEPT (step 74, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-1 (Security protected NAS message) |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
GUTI |
GUTI-3 |
The SS chooses a value different from GUTI-1 and GUTI-2. |
|
Table 22.5.6.3.3-13: Message ATTACH ACCEPT (step 76, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-1 (Security protected NAS message) |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
GUTI |
GUTI-4 |
The SS chooses a value different from GUTI-1, GUTI-2 and GUTI-3. |
|
Table 22.5.6.3.3-14: DETACH REQUEST (step 81, Table 22.5.6.3.2-1)
|
Derivation Path: 36.508, Table 4.7.2-11 |
|||
|
Information Element |
Value/remark |
Comment |
Condition |
|
Detach type |
|||
|
Type of detach |
001 |
EPS detach |
EPSOnlyAttach |
|
Switch off |
Not checked |
||
|
GUTI or IMSI |
GUTI-1 |
||
Table 22.5.6.3.3-15: Message DETACH REQUEST (step 86, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-12 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Detach type |
‘010’B |
"re-attach not required" |
|
|
EMM cause |
‘07’H |
EPS services not allowed |
|
Table 22.5.6.3.3-16: Message DETACH REQUEST (step 97, Table 22.5.6.3.2-1)
|
Derivation path: 36.508 table 4.7.2-12 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Detach type |
‘001’B |
"re-attach required" |
|
|
EMM cause |
NOT PRESENT |
||
Table 22.5.6.3.3-17: Message EMM STATUS (parallel behaviour, Table 22.5.6.3.2-3)
|
Derivation path: 36.508 table 4.7.2-14 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
EMM cause |
‘0110 0101’B |
Message not compatible with protocol state. |
|