9.1.10 Network slice-specific authentication and authorization

38.523-13GPP5GSPart 1: ProtocolRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

9.1.10.1 NSSAA / EAP message transport / Success

9.1.10.1.1 Test Purpose (TP)

(1)

with { UE in 5GMM-DEREGISTERED state and supports network slice-specific authentication and authorization }

ensure that {

when { UE is switched on }

then { UE transmits REGISTRATION REQUEST message with NSSAA bit in the 5GMM capability IE set to "network slice-specific authentication and authorization supported" }

}

(2)

with { UE is in 5GMM-REGISTERED state }

ensure that {

when { SS sends NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message with EAP message IE set to EAP-request message }

then { UE sends NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message with EAP message IE set to the EAP-response message }

}

(3)

with { UE is in 5GMM-REGISTERED state }

ensure that {

when { SS sends NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message }

then { UE sends NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message with S-NSSAI IE set to the S-NSSAI value received in NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message }

}

(4)

with { UE is in 5GMM-REGISTERED state }

ensure that {

when { SS sends CONFIGURATION UPDATE COMMAND message with allowed NSSAI for which the network slice-specific authentication and authorization has been successfully performed }

then { UE considers the new allowed NSSAI as valid and store the allowed NSSAI }

}

(5)

with { UE in 5GMM-REGISTERED-INITIATED state }

ensure that {

when { SS sends REGISTRATION ACCEPT message with pending NSSAI and "NSSAA to be performed" indicator set to indicate that the network slice-specific authentication and authorization procedure will be performed }

then { UE shall store the S-NSSAI(s) in the pending NSSAI }

}

(6)

with { UE in 5GMM-REGISTERED state and configured with allowed NSSAI }

ensure that {

when { UE receives CONFIGURATION UPDATE COMMAND message with allowed NSSAI which the network slice-specific authentication and authorization has been successfully performed }

then { UE considers the new allowed NSSAI as valid and considers the old allowed NSSAI as invalid }

}

9.1.10.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 5.4.4.3, 5.4.7.2.2, 5.5.1.2.2, 5.5.1.2.4 and TS 23.502, clause 4.2.9.2. Unless otherwise stated these are Rel-16 requirements.

[TS 24.501 clause 5.4.4.3]

If the UE receives a new allowed NSSAI for the associated access type in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new allowed NSSAI as valid for the associated access type, store the allowed NSSAI for the associated access type as specified in subclause 4.6.2.2 and consider the old allowed NSSAI for the associated access type as invalid; otherwise, the UE shall consider the old Allowed NSSAI as valid for the associated access type.

[TS 24.501 clause 5.4.7.2.2]

When the upper layers provide an EAP-response message associated with the HPLMN S-NSSAI, the UE shall create a NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message.

The UE shall set the EAP message IE of the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message to the EAP-response message.

The UE shall set the S-NSSAI IE of the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message to the HPLMN S-NSSAI associated with the EAP-response message.

The UE shall send the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message. Apart from this action, the network slice-specific authentication and authorization procedure is transparent to the 5GMM layer of the UE.

[TS 24.501 clause 5.5.1.2.2]

The UE initiates the registration procedure for initial registration by sending a REGISTRATION REQUEST message to the AMF, starting timer T3510. If timer T3502 is currently running, the UE shall stop timer T3502. If timer T3511 is currently running, the UE shall stop timer T3511.

…

If the UE supports network slice-specific authentication and authorization, the UE shall set the NSSAA bit to "network slice-specific authentication and authorization supported" in the 5GMM capability IE of the REGISTRATION REQUEST message.

[TS 24.501 clause 5.5.1.2.4]

If the UE indicated the support for network slice-specific authentication and authorization, and if the Requested NSSAI IE includes one or more S-NSSAIs subject to network slice-specific authentication and authorization, the AMF shall in the REGISTRATION ACCEPT message include:

a) the allowed NSSAI containing the S-NSSAI(s) or the mapped S-NSSAI(s), if any:

1) which are not subject to network slice-specific authentication and authorization and are allowed by the AMF; or

2) for which the network slice-specific authentication and authorization has been successfully performed;

b) optionally, the rejected NSSAI;

c) pending NSSAI containing one or more S-NSSAIs for which network slice-specific authentication and authorization will be performed or is ongoing, and one or more S-NSSAIs from the pending NSSAI which the AMF provided to the UE during the previous registration procedure for which network slice-specific authentication and authorization will be performed or is ongoing, if any; and

d) the "NSSAA to be performed" indicator in the 5GS registration result IE set to indicate that the network slice-specific authentication and authorization procedure will be performed by the network, if the allowed NSSAI is not included in the REGISTRATION ACCEPT message.

If the UE indicated the support for network slice-specific authentication and authorization, and if:

a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the S-NSSAIs in the requested NSSAI in the REGISTRATION REQUEST message are allowed;

b) all subscribed S-NSSAIs marked as default are subject to network slice-specific authentication and authorization; and

c) the network slice-specific authentication and authorization procedure has not been successfully performed for any of the subscribed S-NSSAIs marked as default,

the AMF shall in the REGISTRATION ACCEPT message include:

a) the "NSSAA to be performed" indicator in the 5GS registration result IE to indicate that the network slice-specific authentication and authorization procedure will be performed by the network;

b) pending NSSAI containing one or more subscribed S-NSSAIs marked as default for which network slice-specific authentication and authorization will be performed or is ongoing and one or more S-NSSAIs from the pending NSSAI which the AMF provided to the UE during the previous registration procedure for which network slice-specific authentication and authorization will be performed or is ongoing (if any); and

c) optionally, the rejected NSSAI.

If the UE indicated the support for network slice-specific authentication and authorization, and if:

a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the S-NSSAIs in the requested NSSAI in the REGISTRATION REQUEST message are allowed; and

b) one or more subscribed S-NSSAIs marked as default are not subject to network slice-specific authentication and authorization or the network slice-specific authentication and authorization procedure has been successfully performed for one or more subscribed S-NSSAIs marked as default;

the AMF shall in the REGISTRATION ACCEPT message include:

a) pending NSSAI containing one or more subscribed S-NSSAIs marked as default for which network slice-specific authentication and authorization will be performed or is ongoing (if any) and one or more S-NSSAIs from the pending NSSAI which the AMF provided to the UE during the previous registration procedure for which network slice-specific authentication and authorization will be performed or is ongoing (if any);

b) allowed NSSAI containing S-NSSAI(s) for the current PLMN each of which corresponds to a subscribed S-NSSAI marked as default which are not subject to network slice-specific authentication and authorization or for which the network slice-specific authentication and authorization has been successfully performed;

c) allowed NSSAI containing one or more subscribed S-NSSAIs marked as default, as the mapped S-NSSAI(s) for the allowed NSSAI in roaming scenarios, which are not subject to network slice-specific authentication and authorization or for which the network slice-specific authentication and authorization has been successfully performed; and

d) optionally, the rejected NSSAI.

When the REGISTRATION ACCEPT message includes a pending NSSAI, the pending NSSAI shall contain all S-NSSAIs for which network slice-specific authentication and authorization will be performed or is ongoing from the requested NSSAI of the REGISTRATION REQUEST message that was received over the 3GPP access, non-3GPP access, or both the 3GPP access and non-3GPP access

…

The UE that has indicated the support for network slice-specific authentication and authorization receiving the pending NSSAI in the REGISTRATION ACCEPT message shall store the S-NSSAI(s) in the pending NSSAI as specified in subclause 4.6.2.2. If the registration area contains TAIs belonging to different PLMNs, which are equivalent PLMNs, the UE shall store the received pending NSSAI for each of the equivalent PLMNs as specified in subclause 4.6.2.2. If the pending NSSAI is not included in the REGISTRATION ACCEPT message and the "NSSAA to be performed" indicator is not set to "Network slice-specific authentication and authorization is to be performed" in the 5GS registration result IE of the REGISTRATION ACCEPT message, then the UE shall delete the pending NSSAI for the current PLMN or SNPN, if existing, as specified in subclause 4.6.2.2.

[TS 23.502 clause 4.2.9.2]

19a. [Conditional] If a new Allowed NSSAI (i.e. including any new S-NSSAIs in a Requested NSSAI for which the NSSAA procedure succeeded and/or excluding any S-NSSAI(s) in the existing Allowed NSSAI for the UE for which the procedure has failed) and/or new Rejected S-NSSAIs (i.e. including any S-NSSAI(s) in the existing Allowed NSSAI for the UE for which the procedure has failed, or any new requested S-NSSAI(s) for which the NSSAA procedure failed) need to be delivered to the UE, or if the AMF re-allocation is required, the AMF initiates the UE Configuration Update procedure, for each Access Type, as described in clause 4.2.4.2. If the Network Slice-Specific Re-Authentication and Re-Authorization fails and there are PDU session(s) established that are associated with the S-NSSAI for which the NSSAA procedure failed, the AMF shall initiate the PDU Session Release procedure as specified in clause 4.3.4 to release the PDU sessions with the appropriate cause value.

9.1.10.1.3 Test description

9.1.10.1.3.1 Pre-test conditions

System Simulator:

NGC Cell A belongs to Home PLMN and TAI1 and set as serving cell;

UE:

None.

Preamble:

The UE is in state Switched OFF (state 0N-B) according to TS 38.508-1 [4].

9.1.10.1.3.2 Test procedure sequence

Table 9.1.10.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Check: Does UE transmit a REGISTRATION REQUEST message including NSSAA bit?	–>	REGISTRATION REQUEST	1	P
3-11	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
12	The SS transmits a REGISTRATION ACCEPT message including Pending NSSAI.	<–	REGISTRATION ACCEPT	–	–
13	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 14a1 is performed if pc_noOf_PDUsSameConnection > 0.
14a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
15	The SS transmits a NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message with an EAP-Request message.	<–	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND	–	–
16	Check: Does the UE respond with a NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message, with an EAP-Response message and NSSAI?	–>	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE	2, 3	P
17	The SS transmits a NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT message with an EAP-success message.	<–	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT	–	–
18	The SS transmits a CONFIGURATION UPDATE COMMAND message including a new allowed NSSAI list.	<–	CONFIGURATION UPDATE COMMAND	–	–
19	The UE transmits a CONFIGURATION UPDATE COMPLETE message.	–>	CONFIGURATION UPDATE COMPLETE	–	–
20	SS releases the RRC connection	–	–	–	–
21	Void	–	–	–	–
22	Check: Does UE transmit a REGISTRATION REQUEST message including S-NSSAI=1 but not including S-NSSAI=2 in Request NSSAI list?	–>	REGISTRATION REQUEST	4,5,6	P
23	The SS transmits a REGISTRATION REJECT message.	<–	REGISTRATION REJECT
24	The SS releases the RRC connection

9.1.10.1.3.3 Specific message contents

Table 9.1.10.1.3.3-1: REGISTRATION REQUEST (step 2, Table 9.1.10.1.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
5GMM capability
NSSAA	‘1’B	Network slice-specific authentication and authorization supported

Table 9.1.10.1.3.3-2: REGISTRATION ACCEPT (step 12, Table 9.1.10.1.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000011’B	SST value 3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Pending NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.1.3.3-3: NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND (step 15, Table 9.1.10.1.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-31
Information Element	Value/remark	Comment	Condition
S-NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.1.3.3-4: NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE (step 16, Table 9.1.10.1.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-32
Information Element	Value/remark	Comment	Condition
S-NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.1.3.3-5: NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT (step 17, Table 9.1.10.1.3.2-1)

Derivation Path: TS 38.508-1, Table 4.7.1-33
Information Element	Value/remark	Comment	Condition
S-NSSAI	Set according to specific message content
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
EAP message	EAP-Success

Table 9.1.10.1.3.3-6: CONFIGURATION UPDATE COMMAND (step 18, Table 9.1.10.1.3.2-1)

Derivation path: TS 38.508-1, Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Configuration update indication	0011	Acknowledgement requested Registration Requested
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.1.3.3-7: REGISTRATION REQUEST (step 22, Table 9.1.10.1.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘010’B	Mobility
5GMM capability
NSSAA	‘1’B	Network slice-specific authentication and authorization supported
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.1.3.3-8: REGISTRATION REJECT (step 23, Table 9.1.10.1.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-9
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0000 0011’B	Illegal UE

9.1.10.2 Network slice-specific authentication and authorization / EAP message transport / Abnormal

9.1.10.2.1 Test Purpose (TP)

(1)

with { the UE in 5GMM-DEREGISTERED-INITIATED state }

ensure that {

when { SS sends NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message }

then { the UE shall ignore the NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message and proceed with the de-registration procedure }

}

9.1.10.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 5.4.7.2.4. Unless otherwise stated these are Rel-16 requirements.

[TS 24.501 clause 5.4.7.2.4]

The following abnormal cases can be identified:

a) Transmission failure of the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message with TAI change from lower layers

If the current TAI is not in the TAI list, the network slice-specific authentication and authorization procedure shall be aborted and a registration procedure for mobility and periodic registration update indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message shall be initiated.

If the current TAI is still part of the TAI list, it is up to the UE implementation how to re-run the ongoing procedure that triggered the network slice-specific authentication and authorization procedure.

b) Transmission failure of NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message indication without TAI change from lower layers

It is up to the UE implementation how to re-run the ongoing procedure that triggered the network slice-specific authentication and authorization procedure.

c) Network slice-specific authentication and authorization procedure and de-registration procedure collision

If the UE receives NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message after sending a DEREGISTRATION REQUEST message and the access type included in the DEREGISTRATION REQUEST message is the same as the access in which the NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message is received, then the UE shall ignore the NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message and proceed with the de-registration procedure. Otherwise, the UE shall proceed with both procedures.

9.1.10.2.3 Test description

9.1.10.2.3.1 Pre-test conditions

System Simulator:

NGC Cell A;

UE:

None.

Preamble:

The UE is in state Switched OFF (state 0N-B) according to TS 38.508-1 [4].

9.1.10.2.3.2 Test procedure sequence

Table 9.1.10.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Check: Does UE transmit a REGISTRATION REQUEST message including NSSAA bit?	–>	REGISTRATION REQUEST	1	P
3-11	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
12	The SS transmits a REGISTRATION ACCEPT message including Pending NSSAI and T3512 value IE.	<–	REGISTRATION ACCEPT	–	–
13	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 14a1 is performed if pc_noOf_PDUsSameConnection > 0.
14a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
15	Cause UE De-Registration by AT or MMI command	–	–	–	–
16	Check: Does the UE transmit a DEREGISTRATION REQUEST with the De-registration type IE indicating "normal de-registration"?	–>	DEREGISTRATION REQUEST	–	–
17	The SS transmits a NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message.	<–	NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND	–	–
18	Check: Does the UE transmit a NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message within 5 seconds	–>	NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE	1	F
19	The SS transmits DEREGISTRATION ACCEPT message.	<–	DEREGISTRATION ACCEPT	–	–
20	The SS transmits an RRCRelease message.	–	–	–	–
21	Check: Does the test result of the generic procedure in TS 38.508-1 [4] subclause 4.9.13 indicates that the UE doesn’t responds to paging when paged with NG-5G-S-TMSI?	–	–	1	P

9.1.10.2.3.3 Specific message contents

Table 9.1.10.2.3.3-1: REGISTRATION ACCEPT (step 12, Table 9.1.10.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Pending NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
T3512 value	Not Present

Table 9.1.10.2.3.3-1A: DEREGISTRATION REQUEST (step 16, Table 9.1.10.2.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-12
Information Element	Value/remark	Comment	Condition
De-registration type
Switch off	‘0’B	Normal de-registration
Access type	‘01’B	3GPP access

Table 9.1.10.2.3.3-2: NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND (step 17, Table 9.1.10.2.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-31
Information Element	Value/remark	Comment	Condition
S-NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

9.1.10.3 NSSAA / Initial registration / Rejected NSSAI, pending NSSAI

9.1.10.3.1 Test Purpose (TP)

(1)

with { UE has sent REGISTRATION REQUEST message with NSSAA bit and Request NSSAI }

ensure that {

when { SS sends REGISTRATION ACCEPT message contains rejected NSSAI with rejection cause of "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" }

then { UE stores the rejected S-NSSAI(s) in the rejected NSSAI and shall not attempt to use this S-NSSAI in the current PLMN over any access }

}

(2)

with { UE receives rejected NSSAI in the REGISTRATION ACCEPT message with rejection cause of "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" }

ensure that {

when { UE is switched off and switched on }

then { UE deletes the stored Rejected NSAAI for the current PLMN }

}

(3)

ensure that {

when { The UICC containing the USIM is removed }

then { UE deletes the stored Rejected NSAAI for the current PLMN }

}

(4)

with { UE stores pending NSSAI }

ensure that {

when { SS sends REGISTRATION ACCEPT message with the pending NSSAI is not included and "NSSAA to be performed" indicator is not set to "Network slice-specific authentication and authorization is to be performed" }

then { deletes the stored pending NSSAI for the current PLMN }

9.1.10.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 5.5.1.2.4.

[TS 24.501 clause 5.5.1.2.4]

If the REGISTRATION ACCEPT message contains the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed", or contains a configured NSSAI IE with a new configured NSSAI for the current PLMN and optionally the mapped S-NSSAI(s) for the configured NSSAI for the current PLMN, the UE shall return a REGISTRATION COMPLETE message to the AMF to acknowledge the successful update of the network slicing information.

…

The AMF shall include the allowed NSSAI for the current PLMN and shall include the mapped S-NSSAI(s) for the allowed NSSAI contained in the requested NSSAI from the UE if available, in the REGISTRATION ACCEPT message if the UE included the requested NSSAI in the REGISTRATION REQUEST message and the AMF allows one or more S-NSSAIs in the requested NSSAI.

The AMF may also include rejected NSSAI in the REGISTRATION ACCEPT message. Rejected NSSAI contains S-NSSAI(s) which was included in the requested NSSAI but rejected by the network associated with rejection cause(s) with the following restrictions:

a) rejected NSSAI for the current PLMN or SNPN shall not include an S-NSSAI for the current PLMN or SNPN which is associated to multiple mapped S-NSSAIs and some of these mapped S-NSSAIs are not allowed; and

b) rejected NSSAI for the current registration area shall not include an S-NSSAI for the current PLMN or SNPN which is associated to multiple mapped S-NSSAIs and some of these mapped S-NSSAIs are not allowed.

NOTE 6: The UE can avoid requesting an S-NSSAI associated with a mapped S-NSSAI, which was included in the previous requested NSSAI but neither in the allowed NSSAI nor in the rejected NSSAI in the consequent registration procedures.

a) the allowed NSSAI containing the S-NSSAI(s) or the mapped S-NSSAI(s), if any:

1) which are not subject to network slice-specific authentication and authorization and are allowed by the AMF; or

2) for which the network slice-specific authentication and authorization has been successfully performed;

b) optionally, the rejected NSSAI;

d) the "NSSAA to be performed" indicator in the 5GS registration result IE set to indicate whether network slice-specific authentication and authorization procedure will be performed by the network, if the allowed NSSAI is not included in the REGISTRATION ACCEPT message.

If the UE indicated the support for network slice-specific authentication and authorization, and if:

a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the S-NSSAIs in the requested NSSAI in the REGISTRATION REQUEST message are allowed;

b) all subscribed S-NSSAIs marked as default are subject to network slice-specific authentication and authorization;

c) the network slice-specific authentication and authorization procedure has not been successfully performed for any of the subscribed S-NSSAIs marked as default; and

d) the network slice-specific authentication and authorization procedure has not failed or been revoked for all subscribed S-NSSAI marked as default;

the AMF shall in the REGISTRATION ACCEPT message include:

a) the "NSSAA to be performed" indicator in the 5GS registration result IE to indicate whether network slice-specific authentication and authorization procedure will be performed by the network; and

If the UE indicated the support for network slice-specific authentication and authorization, and if:

a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the S-NSSAIs in the requested NSSAI in the REGISTRATION REQUEST message are allowed; and

the AMF shall in the REGISTRATION ACCEPT message include:

The AMF may include a new configured NSSAI for the current PLMN in the REGISTRATION ACCEPT message if:

a) the REGISTRATION REQUEST message did not include the requested NSSAI;

b) the REGISTRATION REQUEST message included the requested NSSAI containing an S-NSSAI that is not valid in the serving PLMN;

c) the REGISTRATION REQUEST message included the requested NSSAI containing S-NSSAI(s) with incorrect mapped S-NSSAI(s); or

d) the REGISTRATION REQUEST message included the Network slicing indication IE with the Default configured NSSAI indication bit set to "Requested NSSAI created from default configured NSSAI".

If a new configured NSSAI for the current PLMN is included in the REGISTRATION ACCEPT message, the AMF shall also include the mapped S-NSSAI(s) for the configured NSSAI for the current PLMN if available in the REGISTRATION ACCEPT message. In this case the AMF shall start timer T3550 and enter state 5GMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.1.3.2.3.3.

If the UE requests ciphering keys for ciphered broadcast assistance data in the REGISTRATION REQUEST message and the AMF has valid ciphering key data applicable to the UE’s subscription and current tracking area, then the AMF shall include the ciphering key data in the Ciphering key data IE of the REGISTRATION ACCEPT message.

The AMF shall include the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed" in the REGISTRATION ACCEPT message if the UDM has indicated that the subscription data for network slicing has changed. In this case the AMF shall start timer T3550 and enter state 5GMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.1.3.2.3.3.

The UE receiving the rejected NSSAI in the REGISTRATION ACCEPT message takes the following actions based on the rejection cause in the rejected S-NSSAI(s):

"S-NSSAI not available in the current PLMN or SNPN"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current PLMN until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.2.2.

"S-NSSAI not available in the current registration area"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current registration area until switching off the UE, the UE moving out of the current registration area, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.2.2.

"S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the failed or revoked NSSAA as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN over any access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.1 and 4.6.2.2.

If the UE sets the NSSAA bit in the 5GMM capability IE to "Network slice-specific authentication and authorization not supported", and:

a) if the Requested NSSAI IE only includes the S-NSSAI(s) subject to network slice-specific authentication and authorization and one or more subscribed S-NSSAIs (containing one or more S-NSSAIs each of which may be associated with a new S-NSSAI) marked as default which are not subject to network slice-specific authentication and authorization are available, the AMF shall in the REGISTRATION ACCEPT message include:

1) the allowed NSSAI containing S-NSSAI(s) for the current PLMN each of which corresponds to a subscribed S-NSSAI marked as default which are not subject to network slice-specific authentication and authorization;

2) the allowed NSSAI containing the subscribed S-NSSAIs marked as default, as the mapped S-NSSAI(s) for the allowed NSSAI in roaming scenarios, which are not subject to network slice-specific authentication and authorization; and

3) the rejected NSSAI containing the S-NSSAI(s) subject to network slice specific authentication and authorization with the rejection cause indicating "S-NSSAI not available in the current PLMN or SNPN", except if the S-NSSAI(s) is associated to multiple mapped S-NSSAIs and some of these mapped S-NSSAIs are not subject to NSSAA; or

b) if the Requested NSSAI IE includes one or more S-NSSAIs subject to network slice-specific authentication and authorization, the AMF shall in the REGISTRATION ACCEPT message include:

1) the allowed NSSAI containing the S-NSSAI(s) or the mapped S-NSSAI(s) which are not subject to network slice-specific authentication and authorization; and

2) the rejected NSSAI containing:

i) the S-NSSAI(s) subject to network slice specific authentication and authorization with the rejection cause indicating "S-NSSAI not available in the current PLMN or SNPN", except if the S-NSSAI is associated to multiple mapped S-NSSAIs and some of these mapped S-NSSAIs are not subject to NSSAA; and

ii) the S-NSSAI(s) which was included in the requested NSSAI but rejected by the network associated with the rejection cause indicating "S-NSSAI not available in the current PLMN or SNPN" or the rejection cause indicating "S-NSSAI not available in the current registration area", if any.

If the UE does not indicate support for network slice-specific authentication and authorization, and if:

a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message; or

b) none of the S-NSSAIs in the requested NSSAI in the REGISTRATION REQUEST message are allowed;

and one or more subscribed S-NSSAIs (containing one or more S-NSSAIs each of which may be associated with a new S-NSSAI) marked as default which are not subject to network slice-specific authentication and authorization are available, the AMF shall:

a) put the allowed S-NSSAI(s) for the current PLMN each of which corresponds to a subscribed S-NSSAI marked as default and not subject to network slice-specific authentication and authorization in the allowed NSSAI of the REGISTRATION ACCEPT message;

b) put the subscribed S-NSSAIs marked as default and not subject to network slice-specific authentication and authorization, as the mapped S-NSSAI(s) for the allowed NSSAI in roaming scenarios, in the allowed NSSAI of the REGISTRATION ACCEPT message; and

c) determine a registration area such that all S-NSSAIs of the allowed NSSAI are available in the registration area.

If the REGISTRATION ACCEPT message contains the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed", the UE shall delete the network slicing information for each and every PLMN except for the current PLMN as specified in subclause 4.6.2.2.

If the REGISTRATION ACCEPT message contains the allowed NSSAI, then the UE shall store the included allowed NSSAI together with the PLMN identity of the registered PLMN and the registration area as specified in subclause 4.6.2.2. If the registration area contains TAIs belonging to different PLMNs, which are equivalent PLMNs, the UE shall store the received allowed NSSAI in each of allowed NSSAIs which are associated with each of the PLMNs.

If the REGISTRATION ACCEPT message contains a configured NSSAI IE with a new configured NSSAI for the current PLMN and optionally the mapped S-NSSAI(s) for the configured NSSAI for the current PLMN, the UE shall store the contents of the configured NSSAI IE as specified in subclause 4.6.2.2.

If the REGISTRATION ACCEPT message:

a) includes the "NSSAA to be performed" indicator in the 5GS registration result IE;

b) includes a pending NSSAI; and

c) does not include an allowed NSSAI,

the UE shall not initiate a:

a) 5GSM procedure except for emergency services or high priority access until the UE receives an allowed NSSAI; and

b) service request procedure except for cases f) and i) in subclause 5.6.1.1.

…

If required by operator policy, the AMF shall include the NSSAI inclusion mode IE in the REGISTRATION ACCEPT message (see table 4.6.2.3.1 of subclause 4.6.2.3). Upon receipt of the REGISTRATION ACCEPT message:

a) if the message includes the NSSAI inclusion mode IE, the UE shall operate in the NSSAI inclusion mode indicated in the NSSAI inclusion mode IE over the current access within the current PLMN and its equivalent PLMN(s), if any, in the current registration area; or

b) otherwise:

1) if the UE has NSSAI inclusion mode for the current PLMN and access type stored in the UE, the UE shall operate in the stored NSSAI inclusion mode;

2) if the UE does not have NSSAI inclusion mode for the current PLMN and the access type stored in the UE and if the UE is performing the registration procedure over:

i) 3GPP access, the UE shall operate in NSSAI inclusion mode D in the current PLMN and the current access type;

ii) untrusted non-3GPP access, the UE shall operate in NSSAI inclusion mode B in the current PLMN and the current access type; or

iii) trusted non-3GPP access, the UE shall operate in NSSAI inclusion mode D in the current PLMN and the current access type; or

3) if the 5G-RG does not have NSSAI inclusion mode for the current PLMN and wireline access stored in the 5G-RG, and the 5G-RG is performing the registration procedure over wireline access, the 5G-RG shall operate in NSSAI inclusion mode B in the current PLMN and the current access type.

9.1.10.3.3 Test description

9.1.10.3.3.1 Pre-test conditions

System Simulator:

NGC Cell A belongs to Home PLMN and TAI1 and set as serving cell;

UE:

None.

Preamble:

The UE is in state Switched OFF (state 0N-B) according to TS 38.508-1 [4].

9.1.10.3.3.2 Test procedure sequence

Table 9.1.10.3.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits a REGISTRATION REQUEST message including NSSAA bit	–>	REGISTRATION REQUEST	–	–
3-11	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
12	The SS transmits a REGISTRATION ACCEPT message including Rejected S-NSSAI=1	<–	REGISTRATION ACCEPT	–	–
13	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 14a1 is performed if pc_noOf_PDUsSameConnection > 0.
14a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
15	Check: Is S-NSSAI=1 in the Rejected NSSAI list with cause ‘S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization’’ associated with current PLMN using AT/MMI command (+C5GNSSAIRDP)?	–	–	1	P
16	Cause the UE to request establishment of PDU session with S-NSSAI=1.(Note 1)
17	Check: Does the UE transmit a PDU SESSION ESTABLISHMENT REQUEST message within 5 seconds?	–>	5GMM: UL NAS TRANSPORT 5GSM: PDU SESSION ESTABLISHMENT REQUEST	1	F
18	Switch off procedure in RRC_CONNECTED specified in TS 38.508-1 subclause 4.9.6.3 is performed.	–	–	–	–
19	The SS configures NGC Cell A as the "Non-suitable OFF cell"
20	The UE is switched on.	–	–	–	–
21	Check: Is S-NSSAI=1 in the Rejected NSSAI list with cause ‘S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization’’ associated with current PLMN using AT/MMI command (+C5GNSSAIRDP)?	–	–	2	F
22	The SS configures NGC Cell A as the "Serving cell".
23	The UE transmits a REGISTRATION REQUEST message including NSSAA bit	–>	REGISTRATION REQUEST	–	–
24-32	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
33	The SS transmits a REGISTRATION ACCEPT message including Rejected S-NSSAI=2 and Pending S-NSSAI-1.	<–	REGISTRATION ACCEPT	–	–
34	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 35a1 is performed if pc_noOf_PDUsSameConnection > 0.
35a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
36	Check: Is S-NSSAI=2 in the Rejected NSSAI list with cause ‘S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization’’ associated with current PLMN using AT/MMI command (+C5GNSSAIRDP)?	–	–	3	P
37	The SS releases the RRC connection.	–	–	–	–
	EXCEPTION: Steps 38a1 to 38b2 take place depending upon UE implementation; the "lower case letter" identifies a step sequence that take place if a particular implementation is under test.
38a1	If pc_USIM_Removal = TRUE, cause removal of USIM from the UE without powering down.	–	–	–	–
38a2a1-38a2a4	Steps 1a2 to 1a5 of generic procedure for Switch off in RRC_IDLE specified in TS 38.508-1 subclause 4.9.6.1 is performed.	–	–	–	–
38a3	The SS configures NGC Cell A as the "Non-suitable OFF cell"	–	–	–	–
38a4	The USIM is inserted into the UE.	–	–	–	–
38a5	Check: Using AT/MMI command (+C5GNSSAIRDP) verify that S-NSSAI=2 is not in the Rejected NSSAI list associated with current PLMN	–	–	3	P
38a6	The SS configures NGC Cell A as the "Serving cell".	–	–	–	–
38b1	Else The UE is switched off by executing generic procedure in Table 4.9.6.1 as specified inTS 38.508-1 [4].	–	–	–	–
38b2	The UE is switched on.	–	–	–	–
39	The UE transmits a REGISTRATION REQUEST message including NSSAA bit	–>	REGISTRATION REQUEST	–	–
40-48	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
49	The SS transmits a REGISTRATION ACCEPT message not including Pending S-NSSAI=1	<–	REGISTRATION ACCEPT	–	–
50	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 51a1 is performed if pc_noOf_PDUsSameConnection > 0.
51a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
52	Cause the UE to request establishment of PDU session with S-NSSAI=1.(Note 1)	–	–	–	–
53	message with the S-NSSAI IE set to 1?	–>	5GMM: UL NAS TRANSPORT 5GSM: PDU SESSION ESTABLISHMENT REQUEST	4	P
54	The SS transmits PDU SESSION ESTABLISHMENT REJECT message with 5GSM cause #26.	<–	PDU SESSION ESTABLISHMENT REJECT
55	SS transmits an RRCRelease message to release RRC connection and move the UE to RRC_IDLE.	<–	NR RRC: RRCRelease	–	–
Note1: The request to establish a PDU session may be performed by MMI or AT Command.

9.1.10.3.3.3 Specific message contents

Table 9.1.10.3.3.3-1: REGISTRATION REQUEST (steps 2, 23 and 39, Table 9.1.10.3.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
5GMM capability
NSSAA	‘1’B	Network slice-specific authentication and authorization supported

Table 9.1.10.3.3.3-2: REGISTRATION ACCEPT (step 12, Table 9.1.10.3.3.3-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000011’B	SST value 3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 4
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000100’B	SST value 4
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Rejected NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of rejected S-NSSAI	‘0001’B	SST
Cause value	‘0010’B	S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization.
SST	‘00000001’B	SST value 1
SD	Not Present

Table 9.1.10.3.3.3-3: REGISTRATION ACCEPT (step 33, Table 9.1.10.3.3.3-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000011’B	SST value 3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 4
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000100’B	SST value 4
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Pending NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Rejected NSSAI
S-NSSAI IEI		S-NSSAI value 2
Length of rejected S-NSSAI	‘0001’B	SST
Cause value	‘0010’B	S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization.
SST	‘00000010’B	SST value 2
SD	Not Present

Table 9.1.10.3.3.3-4: REGISTRATION ACCEPT (step 49, Table 9.1.10.3.3.3-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘0’B	Network slice-specific authentication and authorization is not to be performed
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
T3512 value
Unit	‘101’B	value is incremented in multiples of 1 minute
Timer value	‘0 0001’B	1 minute
SD	Not Present

Table 9.1.10.3.3.3-5: UL NAS TRANSPORT (step 53, Table 9.1.10.3.3.3-1)

Derivation path: TS 38.508-1 Table 4.7.1-10
Information Element	Value/remark	Comment	Condition
S-NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘0000 0001’B	SST
SST	‘0000 0001’B	SST value 1

9.1.10.4 NSSAA / Initial registration / Reject

9.1.10.4.1 Test Purpose (TP)

(1)

with { UE in 5GMM-REGISTERED-INITIATED state }

ensure that {

when { UE receives a REGISTRATION REJECT with cause #62 "No network slices available" }

then { UE abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED, enter state 5GMM-DEREGISTERED.NORMAL-SERVICE or 5GMM-DEREGISTERED.PLMN-SEARCH and reset the registration attempt counter }

}

(2)

with { UE in 5GMM-REGISTERED-INITIATED state }

ensure that {

when { UE receives the rejected NSSAI in the REGISTRATION REJECT message with rejection cause of "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" }

then { UE stores the rejected NSSAI and doesn’t attempt to use this S-NSSAI in the current PLMN over any access }

9.1.10.4.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 5.5.1.2.5.

[TS 24.501 clause 5.5.1.2.5]

If the initial registration request is rejected because:

a) all the S-NSSAI(s) included in the requested NSSAI are either rejected for the current PLMN, rejected for the current registration area, or rejected for the failed or revoked NSSAAs; and

b) the UE set the NSSAA bit in the 5GMM capability IE to:

1) "Network slice-specific authentication and authorization supported" and:

i) there are no subscribed S-NSSAIs marked as default;

ii) all subscribed S-NSSAIs marked as default are not allowed; or

iii) network slice-specific authentication and authorization has failed or been revoked for all subscribed S-NSSAIs marked as default and based on network local policy, the network decides not to initiate the network slice-specific re-authentication and re-authorization procedures for any subscribed S-NSSAI marked as default requested by the UE; or

2) "Network slice-specific authentication and authorization not supported"; and

i) there are no subscribed S-NSSAIs which are marked as default; or

ii) all subscribed S-NSSAIs marked as default are either not allowed or are subject to network slice-specific authentication and authorization;

the network shall set the 5GMM cause value to #62 "No network slices available". If the UE had included requested NSSAI in the REGISTRATION REQUEST message, then the network shall include the rejected S-NSSAI(s) in the Rejected NSSAI IE of the REGISTRATION REJECT message. Otherwise, the network may include the rejected NSSAI.

…

#62 (No network slices available).

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.NORMAL-SERVICE or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter.

The UE receiving the rejected NSSAI in the REGISTRATION REJECT message takes the following actions based on the rejection cause in the rejected S-NSSAI(s):

"S-NSSAI not available in the current PLMN or SNPN"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN or SNPN as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current PLMN or SNPN until switching off the UE, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2.

"S-NSSAI not available in the current registration area"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as described in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current registration area until switching off the UE, the UE moving out of the current registration area, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.2.2.

"S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization"

9.1.10.4.3 Test description

9.1.10.4.3.1 Pre-test conditions

System Simulator:

NGC Cell A belongs to Home PLMN and TAI1 and set as serving cell;

NGC Cell B belongs to Home PLMN and TAI-2 and set as Non-Suitable “Off” cell.

UE:

None.

Preamble:

The UE is in state Switched OFF (state 0N-B) according to TS 38.508-1 [4].

9.1.10.4.3.2 Test procedure sequence

Table 9.1.10.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – NGC cell A as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on NGC Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3-14	Steps 2-13 of Table 4.5.2.2-2 of the generic procedure in TS 38.508-1 [4] are performed.	–	–	–	–
15	The SS transmits a REGISTRATION REJECT message with the 5GMM cause set to #62 "No network slices available"	<–	5GMM: REGISTRATION REJECT	–	–
16	The SS releases the RRC connection.	–	–	–	–
17	Check: Does the UE transmit an REGISTRATION REQUEST message on NGC cell A in the next 90 seconds?	–>	5GMM: REGISTRATION REQUEST	1	F
18	The SS configures NGC Cell A as a “Non-suitable OFF cell” and NGC Cell B as the “Serving cell”.	–	–	–	–
19	The UE transmits a REGISTRATION REQUEST message	–>	REGISTRATION REQUEST	–	–
20-28	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
29	The SS transmits a REGISTRATION ACCEPT message including Configured S-NSSAI=2 IE	<–	REGISTRATION ACCEPT	–	–
30	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
	EXCEPTION: Step 31a1 is performed if pc_noOf_PDUsSameConnection > 0.
31a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
32	Cause the UE to request establishment of PDU session with S-NSSAI=1.(Note 1)	–	–	–	–
33	Check: Does the UE transmit an RRCSetupRequest message within 5 seconds?	–>	NR RRC: RRCSetupRequest	2	F
Note1: The request to establish a PDU session may be performed by MMI or AT Command.

9.1.10.4.3.3 Specific message contents

Table 9.1.10.4.3.3-1: REGISTRATION REJECT (step 15, Table 9.1.10.4.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-9
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0011 1110’B	No network slices available
Rejected NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of rejected S-NSSAI	‘0001’B	SST
Cause value	‘0010’B	S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization.
SST	‘00000001’B	SST value 1
SD	’FFFFFF’H	no SD value associated with the SST

Table 9.1.10.4.3.3-1a: REGISTRATION REQUEST (step 19, Table 9.1.10.4.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type
5GS registration type value	‘001’B	Initial registration

Table 9.1.10.4.3.3-2: REGISTRATION ACCEPT (step 29, Table 9.1.10.4.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

9.1.10.5 9.1.10.6 NSSAA / UE configuration update / Rejected NSSAI

9.1.10.6.1 Test Purpose (TP)

(1)

with { UE is in 5GMM-REGISTERED state and NSSAA failure }

ensure that {

when { SS sends the rejected NSSAI in the CONFIGURATION UPDATE COMMAND message with rejection cause of "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" }

then { UE adds the rejected S-NSSAI(s) in the rejected NSSAI and shall not attempt to use this S-NSSAI in the current PLMN over any access }

}

(2)

with { UE receives the rejected NSSAI in the CONFIGURATION UPDATE COMMAND message with rejection cause of "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" }

ensure that {

when { UE has been switched off, then switched on }

then { UE deletes the stored Rejected NSAAI for the current PLMN }

}

(3)

ensure that {

when { The UICC containing the USIM is removed }

then { UE deletes the stored Rejected NSAAI for the current PLMN }

}

9.1.10.6.2 Conformance requirements

[TS 24.501 clause 5.4.4.3]

The UE receiving the rejected NSSAI in the CONFIGURATION UPDATE COMMAND message takes the following actions based on the rejection cause in the rejected S-NSSAI(s):

"S-NSSAI not available in the current PLMN or SNPN"

"S-NSSAI not available in the current registration area"

"S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the failed or revoked NSSAA as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN over any access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.1 and 4.6.2.2.

9.1.10.6.3 Test description

9.1.10.6.3.1 Pre-test conditions

System Simulator:

NGC Cell A belongs to Home PLMN and TAI1 and set as serving cell;

UE:

None.

Preamble:

The UE is in state Switched OFF (state 0N-B) according to TS 38.508-1 [4].

9.1.10.6.3.2 Test procedure sequence

Table 9.1.10.6.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits a REGISTRATION REQUEST message including NSSAA bit	–>	REGISTRATION REQUEST	–	–
3-11	Steps 5 to 13 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
12	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI and Pending NSSAI	<–	REGISTRATION ACCEPT	–	–
13	The UE transmits an ULInformationTransfer message and a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
–	EXCEPTION: Step 14a1 is performed if pc_noOf_PDUsSameConnection > 0.	–	–	–	–
14a1	The generic procedure for UE-requested PDU session establishment, specified in subclause 4.5A.2, takes place performing establishment of UE-requested PDU session(s) with ExpectedNumberOfNewPDUSessions = pc_noOf_PDUsSameConnection.	–	–	–	–
15	The SS transmits a NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message with an EAP-Request message.	<–	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND
16	The UE responds with a NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message, with an EAP-Response message and NSSAI	–>	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE
17	The SS transmits a NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT message with an EAP-failure message.	<–	5GMM: NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT
18	The SS transmits a CONFIGURATION UPDATE COMMAND message including a new rejected NSSAI list.	<–	CONFIGURATION UPDATE COMMAND	–	–
19	The UE transmits a CONFIGURATION UPDATE COMPLETE message.	–>	CONFIGURATION UPDATE COMPLETE	–	–
20	The SS transmits an RRCRelease message.	–	–	–	–
21	Check: Is S-NSSAI=2 in the Rejected NSSAI list with cause ‘S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization’’ associated with current PLMN using AT/MMI command (+C5GNSSAIRDP)?	–	–	1	P
22	Cause the UE to request establishment of PDU session with S-NSSAI=2.(Note 1)	–	–	–	–
23	Check: Does the UE transmit an RRCSetupRequest message?	–>	NR RRC: RRCSetupRequest	1	F
24	Switch off procedure in RRC_IDLE specified in TS 38.508-1 subclause 4.9.6.1 is performed.	–	–	–	–
25	The SS configures NGC Cell A as the "Non-suitable cell"	–	–	–	–
26	The UE is switched on.	–	–	–	–
27	Check: Using AT/MMI command (+C5GNSSAIRDP) verify that S-NSSAI=2 is not in the Rejected NSSAI list associated with current PLMN			2	P
27	The SS configures NGC Cell A as the "Serving cell".	–	–	–	–
–	EXCEPTION: Steps 28a1 to 28a27 take place if pc_USIM_Removal = TRUE	–	–	–	–
28a1-a21	Steps 2 to 22 above are repeated	–	–	–	–
28a22	Cause removal of USIM from the UE without powering down.	–	–	–	–
28a23	Steps 1a2 to 1a5 of generic procedure for Switch off in RRC_IDLE specified in TS 38.508-1[4], subclause 4.9.6.1 is performed.	–	–	–	–
28a24	The SS configures NGC Cell A as the "Non-suitable cell"	–	–	–	–
28a25	The USIM is inserted into the UE.	–	–	–	–
28a26	Check: Using AT/MMI command (+C5GNSSAIRDP) verify that S-NSSAI=2 is not in the Rejected NSSAI list associated with current PLMN	–	–	3	P
28a27	The SS configures NGC Cell A as the "Serving cell".	–	–	–	–
29-47	Steps 2 to 20a1 of the generic procedure for NR RRC_IDLE specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
Note1: The request to establish a PDU session may be performed by MMI or AT Command.

9.1.10.6.3.3 Specific message contents

Table 9.1.10.6.3.3-1: REGISTRATION REQUEST (step 2, Table 9.1.10.6.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
5GMM capability
NSSAA	‘1’B	Network slice-specific authentication and authorization supported

Table 9.1.10.6.3.3-2: REGISTRATION ACCEPT (step 12, Table 9.1.10.6.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
5GS registration result value	‘001’B	3GPP access
NSSAA Performed	‘1’B	Network slice-specific authentication and authorization is to be performed
Allowed NSSAI
Allowed NSSAI IEI		NSSAI value 1
Length of Allowed NSSAI	‘0000 0010’B	2 octets
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Configured NSSAI		2 S-NSSAI
S-NSSAI IEI		NSSAI value 2
Length of Configured NSSAI	‘0000 010’B	2 octets
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	SST value 1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Pending NSSAI
Pending NSSAI IEI		NSSAI value 3
Length of Pending NSSAI contents	‘0000 0010’B	2 octets
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.6.3.3-3: NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND (step 15, Table 9.1.10.6.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-31
Information Element	Value/remark	Comment	Condition
S-NSSAI
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.6.3.3-4: NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE (step 16, Table 9.1.10.6.3.2-1)

Derivation Path: TS 38.508-1 Table 4.7.1-32
Information Element	Value/remark	Comment	Condition
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.1.10.6.3.3-5: NETWORK SLICE-SPECIFIC AUTHENTICATION RESULT (step 17, Table 9.1.10.6.3.2-1)

Derivation Path: TS 38.508-1, Table 4.7.1-33
Information Element	Value/remark	Comment	Condition
S-NSSAI	Set according to specific message content
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	SST value 2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
EAP message	EAP-failure

Table 9.1.10.6.3.3-6: CONFIGURATION UPDATE COMMAND (step 18, Table 9.1.10.6.3.2-1)

Derivation path: TS 38.508-1, Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Configuration update indication	0001	Acknowledgement requested
Rejected NSSAI
Rejected NSSAI IEI		Rejected S-NSSAI value 1
Length of Rejected NSSAI contents	‘00000101’B	5 octets
Length of rejected S-NSSAI[1]	‘0100’B	4 octest
Cause value	‘0010’B	S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization
SST	‘00000010’B	2
SD	Not present