9.2 5GS Non-3GPP Access Mobility Management

38.523-13GPP5GSPart 1: ProtocolRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

9.2.1 Primary authentication and key agreement procedure

9.2.1.1 EAP based primary authentication and key agreement

9.2.1.1.1 Test Purpose (TP)

Same TP’s as clause 9.1.1.1.1

9.2.1.1.2 Conformance requirements

Same Conformance requirements as in clause 9.1.1.1.2.

9.2.1.1.3 Test description

9.2.1.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state Switched OFF (state 0W-B) according to TS 38.508-1 [4].

9.2.1.1.3.2 Test procedure sequence

Table 9.2.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Switch the UE on	–	–	–	–
2-4	The UE initiates establishment of an IPsec tunnel and registration procedure by executing steps 1-3 of Table 4.5.2.2-3 in TS 38.508-1 [4].	–	–	–	–
5	SS transmits an AUTHENTICATION REQUEST message with an EAP-Request/AKA’-Identity message.	<–	5GMM: AUTHENTICATION REQUEST
6	Check: Does the UE respond with an AUTHENTICATION RESPONSE message, with an EAP-Response/AKA’-Identity message?	–>	5GMM: AUTHENTICATION RESPONSE	1	P
7	SS transmits an AUTHENTICATION REQUEST message with an EAP-Request/AKA’-challenge message which contains a not correct sequence number.	<–	5GMM: AUTHENTICATION REQUEST	–	–
8	Check: Does the UE respond with an AUTHENTICATION RESPONSE message, with an EAP-Response/AKA’-synchronization-failure?	–>	5GMM: AUTHENTICATION RESPONSE	2	P
9	SS transmits a correct AUTHENTICATION REQUEST message with an EAP-Request/AKA’-challenge message.	<–	5GMM: AUTHENTICATION REQUEST	–	–
10	Check: Does the UE respond with a correct AUTHENTICATION RESPONSE message, with an EAP-Request/AKA’-challenge message?	–>	5GMM: AUTHENTICATION RESPONSE	3	P
11	SS transmits an AUTHENTICATION RESULT message with an EAP-success message.	<–	5GMM: AUTHENTICATION RESULT	–	–
12-14	The registration procedure is performed by executing steps 6-8 of Table 4.5.2.2-3 in TS 38.508-1 [4].	–	–	–	–
15	Check: Does the UE transmits a REGISTRATION COMPLETE message?	–>	5GMM: REGISTRATION COMPLETE	4	P
16	The registration procedure is successfully completed by executing steps 10 of Table 4.5.2.2-3 in TS 38.508-1 [4].	–	–	–	–

9.2.1.1.3.3 Specific message contents

Table 9.2.1.1.3.3-1: Message AUTHENTICATION REQUEST (step 5, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-1
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-request/AKA’-Identity	See Table 4.7.3.2-7 in TS 38.508-1 [4].	EAP-AKA

Table 9.2.1.1.3.3-2: Message AUTHENTICATION RESPONSE (step 6, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-2
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-response/AKA’-Identity	See Table 4.7.3.2-8 in TS 38.508-1 [4].	EAP-AKA

Table 9.2.1.1.3.3-3: Message AUTHENTICATION REQUEST (step 7, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-1
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-request/AKA’- challenge	The sequence number in AUTN is not correct	EAP-AKA

Table 9.2.1.1.3.3-4: Message AUTHENTICATION RESPONSE (step 8, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-2
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-response/AKA’-synchronization-failure	See Table 4.7.3.2-5 in TS 38.508-1 [4].	EAP-AKA

Table 9.2.1.1.3.3-5: Message AUTHENTICATION RESPONSE (step 10, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-2
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-Response/AKA’-Challenge	RES* equal to the XRES* calculated in the SS with the parameters provided/indicated in the AUTHENTICATION REQUEST	EAP-AKA

Table 9.2.1.1.3.3-6: Message AUTHENTICATION RESULT (step 11, Table 9.2.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-3
Information Element	Value/Remark	Comment	Condition
EAP message	EAP-Success		EAP-AKA

9.2.1.2 5G AKA based primary authentication and key agreement

9.2.1.2.1 Test Purpose (TP)

Same Test purpose as in clause 9.1.1.4.1

9.2.1.2.2 Conformance requirements

Same Conformance requirements as in clause 9.1.1.4.2

9.2.1.2.3 Test description

9.2.1.2.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state Switched OFF (state 0W-B) according to TS 38.508-1 [4].

9.2.1.2.3.2 Test procedure sequence

Table 9.2.1.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Switch the UE on	–	–	–	–
2-4	The UE initiates establishment of an IPsec tunnel and registration procedure by executing steps 1-3 of Table 4.5.2.2-3 in TS 38.508-1 [4].	–	–	–	–
5	The SS transmits an AUTHENTICATION REQUEST message which contains an invalid MAC code.	<–	AUTHENTICATION REQUEST	–	–
6	Check: Does the UE respond with an AUTHENTICATION FAILURE message with 5GMM cause "MAC failure"?	–>	AUTHENTICATION FAILURE	1	P
7	SS transmits a correct AUTHENTICATION REQUEST message with RAND different to the one send in Step 5	<–	AUTHENTICATION REQUEST	–	–
8	Check: Does the UE respond with a correct AUTHENTICATION RESPONSE message with RES* that is equal to the XRES* calculated in the SS?	–>	AUTHENTICATION RESPONSE	4	P
9	SS transmits a NAS SECURITY MODE COMMAND message including the ngKSI of the new 5G NAS security context (as provided in step 7), to proceed with the registration procedure.	<–	SECURITY MODE COMMAND	–	–
10	Check: Does the UE respond with NAS SECURITY MODE COMPLETE message integrity protected and ciphered with the new 5G NAS security context identified by the ngKSI received in the SECURITY MODE COMMAND message in step 9.	–>	SECURITY MODE COMPLETE	5	P
11	Steps 10 of the generic procedure (TS 38.508-1 Table 4.5.2.2-3 [4]) are executed to successfully complete the registration procedure.	–	–	–	–
12	Switch off procedure in Ipsec_SA_Established specified in TS 38.508-1 [4] subclause 4.9.6.5 is performed.	–	–	–	–
13-16	Steps 1-4 above are repeated	–	–	–	–
17	SS transmits an AUTHENTICATION REQUEST message with "separation bit" in the AMF field is 0.	<–	AUTHENTICATION REQUEST	–	–
18	Check: Does the UE respond with an AUTHENTICATION FAILURE message, with 5GMM cause " Non-5G authentication unacceptable "?	–>	AUTHENTICATION FAILURE	2	P
19	SS transmits a correct AUTHENTICATION REQUEST message with RAND different to the one send in Step 22	<–	AUTHENTICATION REQUEST	–	–
20	Check: Does the UE respond with a correct AUTHENTICATION RESPONSE message with RES* that is equal to the XRES* calculated in the SS?	–>	AUTHENTICATION RESPONSE	4	P
21	Step 10 of the generic procedure (TS 38.508-1 Table 4.5.2.2-3 [4]) are executed to successfully complete the registration procedure.	–	–	–	–
22	Switch off procedure in Ipsec_SA_Established specified in TS 38.508-1 [4] subclause 4.9.6.5 is performed.	–	–	–	–
23-26	Steps 1-4 above are repeated	–	–	–	–
27	SS transmits AUTHENTICATION REQUEST message with the AMF field in the IE "Authentication parameter AUTN" set to "AMF_RESYNCH" value to trigger SQN re-synchronisation procedure in test USIM	<–	AUTHENTICATION REQUEST	–	–
28	Check: Does the UE respond with an AUTHENTICATION FAILURE message, with 5GMM cause "Synch failure" and Authentication failure parameter?	–>	AUTHENTICATION FAILURE	3	P
29	SS transmits a correct AUTHENTICATION REQUEST message with RAND different to the one send in Step 32.	<–	AUTHENTICATION REQUEST	–	–
30	Check: Does the UE respond with a correct AUTHENTICATION RESPONSE message with RES* that is equal to the XRES* calculated in the SS?	–>	AUTHENTICATION RESPONSE	4	P
31	Step 10 of the generic procedure (TS 38.508-1 Table 4.5.2.2-3 [4]) are executed to successfully complete the registration procedure.	–	–	–	–

9.2.1.2.3.3 Specific message contents

Table 9.2.1.2.3.3-1: AUTHENTICATION RESPONSE (step 8, step 20 and step 30，Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-2
Information Element	Value/remark	Comment	Condition
Authentication response parameter	RES* equal to the XRES* calculated in the SS with the parameters provided/indicated in the AUTHENTICATION REQUEST

Table 9.2.1.2.3.3-2: AUTHENTICATION REQUEST (step 5, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-1
Information Element	Value/remark	Comment	Condition
Authentication parameter AUTN	Invalid MAC	SS shall calculate the correct MAC value as specified in TS 33.102 and use any different value, e.g. correct_MAC+5.

Table 9.2.1.2.3.3-3: AUTHENTICATION FAILURE (step 6, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-4
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0001 0100’B	MAC failure

Table 9.2.1.2.3.3-4: AUTHENTICATION REQUEST (step 17, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-1
Information Element	Value/remark	Comment	Condition
Authentication parameter AUTN	"separation bit"=0	The "separation bit" in the AMF field of AUTN supplied by the core network is 0.

Table 9.2.1.2.3.3-5: AUTHENTICATION FAILURE (step 18, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-4
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0001 1010’B	Non-5G authentication unacceptable

Table 9.2.1.2.3.3-6: AUTHENTICATION REQUEST (step 27, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-1

Information Element

Value/remark

Comment

Condition

Authentication parameter AUTN

AMF field set to "AMF_RESYNCH",

AMF_RESYNCH= ‘1111 1111 1111 1111’B

AMF_RESYNCH see TS 34.108, 8.1.2.2

Table 9.2.1.2.3.3-7: AUTHENTICATION FAILURE (step 28, Table 9.2.1.2.3.2-1)

Derivation path: TS 38.508, Table 4.7.1-4
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0001 0101’B	Synch failure
Authentication failure parameter	AUTS	AUTS see TS 34.108, 8.1.2.2

9.2.2 Security Mode Control

9.2.2.1 NAS security mode command

9.2.2.1.1 Test Purpose (TP)

(1)

with { the UE is in 5GMM-REGISTERED-INITIATED state and the SS initiates the NAS security mode control procedure by sending a SECURITY MODE COMMAND message during initial registration procedure }

ensure that {

when { the UE receives an integrity protected SECURITY MODE COMMAND message including not matching replayed security capabilities }

then { the UE send a SECURITY MODE REJECT message and does not start applying the NAS security in both UL and DL }

}

(2)

with { the UE is in 5GMM-REGISTERED-INITIATED state and the SS initiates the NAS security mode control procedure by sending a SECURITY MODE COMMAND message during initial registration procedure }

ensure that {

when { the UE receives an integrity protected SECURITY MODE COMMAND message including IMEISV request }

then { the UE send an integrity protected and ciphered SECURITY MODE COMPLETE message including IMEISV and starts applying the NAS Security in both UL and DL }

}

9.2.2.1.2 Conformance requirements

References: The conformance requirements covered in the present test case are specified in: TS 24.501, clauses 5.4.2.1, 5.4.2.3 and 5.4.2.5. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.4.2.1]

The purpose of the NAS security mode control procedure is to take a 5G NAS security context into use, and initialise and start NAS signalling security between the UE and the AMF with the corresponding 5G NAS keys and 5G NAS security algorithms.

Furthermore, the network may also initiate the security mode control procedure in the following cases:

a)- in order to change the 5G NAS security algorithms for a current 5G NAS security context already in use;

b) in order to change the value of uplink NAS COUNT used in the latest SECURITY MODE COMPLETE message as described in 3GPP TS 33.501 [24], subclause 6.9.4.4; and

c) in order to provide the Selected EPS NAS security algorithms to the UE

For restrictions concerning the concurrent running of a security mode control procedure with other security related procedures in the AS or inside the core network see 3GPP TS 33.501 [24], subclause 6.9.5.

[TS 24.501, clause 5.4.2.3]

Upon receipt of the SECURITY MODE COMMAND message, the UE shall check whether the security mode command can be accepted or not. This is done by performing the integrity check of the message, and by checking that the received Replayed UE security capabilities IE has not been altered compared to the latest values that the UE sent to the network.

When the SECURITY MODE COMMAND message includes an EAP-success message the UE handles the EAP-success message and the ABBA as described in subclause 5.4.1.2.2.8.

If the UE is registered for emergency services, performing initial registration for emergency services or establishing an emergency PDU session and the SECURITY MODE COMMAND message is received with ngKSI value "000" and 5G-IA0 and 5G-EA0 as selected 5G NAS security algorithms, the UE shall locally derive and take in use 5G NAS security context. The UE shall delete existing current 5G NAS security context.

The UE shall ignore the Replayed S1 UE security capabilities IE if this IE is included in the SECURITY MODE COMMAND message.

The UE shall accept a SECURITY MODE COMMAND message indicating the "null integrity protection algorithm" 5G-EA0 as the selected 5G NAS integrity algorithm only if the message is received when the UE is registered for emergency services, performing initial registration for emergency services or establishing an emergency PDU session.

If the type of security context flag included in the SECURITY MODE COMMAND message is set to "native security context" and if the ngKSI matches a valid non-current native 5G NAS security context held in the UE while the UE has a mapped 5G NAS security context as the current 5G NAS security context, the UE shall take the non-current native 5G NAS security context into use which then becomes the current native 5G NAS security context and delete the mapped 5G NAS security context.

If the SECURITY MODE COMMAND message can be accepted, the UE shall take the 5G NAS security context indicated in the message into use. The UE shall in addition reset the uplink NAS COUNT counter if:

a) the SECURITY MODE COMMAND message is received in order to take a 5G NAS security context into use created after a successful execution of the 5G AKA based primary authentication and key agreement procedure or the EAP based primary authentication and key agreement procedure; or

b) the SECURITY MODE COMMAND message received includes the type of security context flag set to "mapped security context" in the NAS key set identifier IE the ngKSI does not match the current 5G NAS security context, if it is a mapped 5G NAS security context.

If the SECURITY MODE COMMAND message can be accepted and a new 5G NAS security context is taken into use and SECURITY MODE COMMAND message does not indicate the "null integrity protection algorithm" 5G-IA0 as the selected NAS integrity algorithm, the UE shall:

– if the SECURITY MODE COMMAND message has been successfully integrity checked using an estimated downlink NAS COUNT equal to 0, then the UE shall set the downlink NAS COUNT of this new 5G NAS security context to 0;

– otherwise the UE shall set the downlink NAS COUNT of this new 5G NAS security context to the downlink NAS COUNT that has been used for the successful integrity checking of the SECURITY MODE COMMAND message.

If the SECURITY MODE COMMAND message includes the horizontal derivation parameter indicating "K_AMF derivation is required", the UE shall derive a new K’_AMF, as specified in 3GPP TS 33.501 [24] for K_AMF to K’_AMF derivation in mobility, and set both uplink and downlink NAS COUNTs to zero. When the new 5G NAS security context is taken into use for current access and the UE is registered with the same PLMN over the 3GPP access and the non-3GPP access:

a) the UE is in 5GMM-IDLE mode over the non-current access, the AMF and the UE shall activate the new 5G NAS security context over the non-current access as described in 3GPP TS 33.501 [24]. The AMF and the UE shall set the downlink NAS COUNT and uplink NAS COUNT to zero for the non-current access; or

b) the UE is in 5GMM-CONNECTED mode over the non-current access, the AMF shall send the SECURITY MODE COMMAND message over the non-current access to activate the new 5G NAS security context that was activated over the current access as described in 3GPP TS 33.501 [24]. The AMF shall include the same ngKSI in the SECURITY MODE COMMAND message to identify the new 5G NAS security context.

If the SECURITY MODE COMMAND message includes the horizontal derivation parameter indicating "K_AMF derivation is not required" or the Additional 5G security parameters IE is not included in the message, the UE is registered with the same PLMN over the 3GPP access and non-3GPP access, then after the completion of a security mode control procedure over the current access:

a) the UE is in 5GMM-IDLE mode over the non-current access, the AMF and the UE shall activate the new 5G NAS security context for the non-current access. If a primary authentication and key agreement procedure was completed before the security mode control procedure, the AMF and the UE shall set the downlink NAS COUNT and uplink NAS COUNT to zero for the non-current access, otherwise the downlink NAS COUNT and uplink NAS COUNT for the non-3GPP access are not changed; or

If the SECURITY MODE COMMAND message can be accepted, the UE shall send a SECURITY MODE COMPLETE message integrity protected with the selected 5GS integrity algorithm and the 5G NAS integrity key based on the K_AMF or mapped K’_AMF if the type of security context flag is set to "mapped security context" indicated by the ngKSI. When the SECURITY MODE COMMAND message includes the type of security context flag set to "mapped security context" in the NAS key set identifier IE, then the UE shall check whether the SECURITY MODE COMMAND message indicates the ngKSI of the current 5GS security context, if it is a mapped 5G NAS security context, in order not to re-generate the K’_AMF.

Furthermore, if the SECURITY MODE COMMAND message can be accepted, the UE shall cipher the SECURITY MODE COMPLETE message with the selected 5GS ciphering algorithm and the 5GS NAS ciphering key based on the K_AMF or mapped K’_AMF indicated by the ngKSI. The UE shall set the security header type of the message to "integrity protected and ciphered with new 5G NAS security context".

From this time onward the UE shall cipher and integrity protect all NAS signalling messages with the selected 5GS integrity and ciphering algorithms.

If the AMF indicated in the SECURITY MODE COMMAND message that the IMEISV is requested, the UE shall include its IMEISV in the SECURITY MODE COMPLETE message.

If, during an ongoing registration procedure or service request procedure, the SECURITY MODE COMMAND message includes the Additional 5G security information IE with the RINMR bit set to "Retransmission of the initial NAS message requested", the UE shall include the entire uncyphered REGISTRATION REQUEST message or SERVICE REQUEST message, which the UE had previously included in the NAS message container IE of the initial NAS message (i.e. REGISTRATION REQUEST message or SERVICE REQUEST message, respectively), in the NAS message container IE of the SECURITY MODE COMPLETE message.

If, prior to receiving the SECURITY MODE COMMAND message, the UE without a valid 5GS NAS security context had sent a REGISTRATION REQUEST message the UE shall include the entire REGISTRATION REQUEST message in the NAS message container IE of the SECURITY MODE COMPLETE message as described in subclause 4.4.6.

If the UE operating in the single-registration mode receives the Selected EPS NAS security algorithms IE, the UE shall use the IE according to 3GPP TS 33.501 [24].

For a UE operating in single-registration mode with N26 interface supported in the network, after an inter-system change from S1 mode to N1 mode in 5GMM-CONNECTED mode, the UE shall set the value of the Selected EPS NAS security algorithms IE in the 5G NAS security context to the NAS security algorithms that were received from the source MME when the UE was in S1 mode.

[TS 24.501, clause 5.4.2.5]

If the security mode command cannot be accepted, the UE shall send a SECURITY MODE REJECT message. The SECURITY MODE REJECT message contains a 5GMM cause that typically indicates one of the following cause values:

#23 UE security capabilities mismatch.

#24 security mode rejected, unspecified.

If the UE detects that the received Replayed UE security capabilities IE has been altered compared to the latest values that the UE sent to the network, the UE shall set the cause value to #23 "UE security capabilities mismatch".

Upon receipt of the SECURITY MODE REJECT message, the AMF shall stop timer T3560. The AMF shall also abort the ongoing procedure that triggered the initiation of the NAS security mode control procedure.

Both the UE and the AMF shall apply the 5G NAS security context in use before the initiation of the security mode control procedure, if any, to protect the SECURITY MODE REJECT message and any other subsequent messages according to the rules in subclause 4.4.4 and 4.4.5.

9.2.2.1.3 Test description

9.2.2.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state Switched OFF (state 0-A) according to TS 38.508-1 [4].

9.2.2.1.3.2 Test procedure sequence

Table 9.2.2.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
1A	The UE transmits a REGISTRATION REQUEST message.	–>	REGISTRATION REQUEST	–	–
1B	The SS transmits an AUTHENTICATION REQUEST message including EAP-Request/AKA’-Challenge or 5G AKA Challenge.	<–	AUTHENTICATION REQUEST	–	–
1C	The UE transmits an AUTHENTICATION RESPONSE message including EAP-Response/AKA’-Challenge or 5G AKA Response.	–>	AUTHENTICATION RESPONSE	–	–
1D	The SS transmits a SECURITY MODE COMMAND message including EAP-Success if EAP-AKA’ used.	<–	SECURITY MODE COMMAND	–	–
1E	The UE transmits a SECURITY MODE COMPLETE message.	–>	SECURITY MODE COMPLETE	–	–
1F	The SS transmits a REGISTRATION REJECT message with the cause value set to #6 Illegal ME as default.	<–	REGISTRATION REJECT	–	–
1G	The UE is switched off.	–	–	–	–
1H	The UE is switched on.	–	–	–	–
2-6	Steps 1-5 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
7	The SS transmits a SECURITY MODE COMMAND message to activate NAS security. It is integrity protected and includes unmatched replayed security capabilities.	<–	SECURITY MODE COMMAND	–	–
8	Check: Does the UE transmit a SECURITY MODE REJECT message with cause’#23: UE security capabilities mismatch’?	–>	SECURITY MODE REJECT	1	P
9	The SS transmits an IDENTITY REQUEST message (Security not applied).	<–	IDENTITY REQUEST	–	–
10	Check: Does the UE transmit a non-security protected IDENTIY RESPONSE message?	–>	IDENTITY RESPONSE	1	P
11	The SS transmits a SECURITY MODE COMMAND message to activate NAS security. It is integrity protected and includes IMEISV.	<–	SECURITY MODE COMMAND	–	–
12	Check: Does the UE transmit a SECURITY MODE COMPLETE message and does it establish the initial security configuration?	–>	SECURITY MODE COMPLETE	2	P
13-15	Steps 8-10 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
16	The SS transmits an IDENTITY REQUEST message (Security protected as per the algorithms specified in step 11).	<-	IDENTITY REQUEST	–	–
17	Check: Does the UE transmit an IDENTIY RESPONSE message (Security Protected as per the algorithms specified in step 11)?	->	IDENTITY RESPONSE	2	P
Note 1: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 4 to 12 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [31] clause 4.12.2.2 figure 4.12.2.2-1.

9.2.2.1.3.3 Specific message contents

Table 9.2.2.1.3.3-0: REGISTRATION REJECT (Step 1F, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-9
Information Element	Value/Remark	Comment	Condition
5GMM cause	‘00000110’B	Illegal ME

Table 9.2.2.1.3.3-1: SECURITY MODE COMMAND (Step 7, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-25
Information Element	Value/Remark	Comment	Condition
Replayed UE security capabilities	Set to mismatch the security capability of UE under test

Table 9.2.2.1.3.3-2: SECURITY MODE REJECT (Step 8, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-27
Information Element	Value/Remark	Comment	Condition
5GMM cause	#23

Table 9.2.2.1.3.3-3: IDENTITY REQUEST (Step 9, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-21
Information Element	Value/Remark	Comment	Condition
Identity type	‘0001’B	SUCI

Table 9.2.2.1.3.3-4: IDENTITY RESPONSE (Step 10, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-22
Information Element	Value/Remark	Comment	Condition
Mobile identity
Type of identity	‘001’B	SUCI

Table 9.2.2.1.3.3-5: SECURITY MODE COMMAND (Step 11, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-25
Information Element	Value/Remark	Comment	Condition
Selected NAS security algorithms
Type of ciphering algorithm	Set according to PIXIT parameter for default ciphering algorithm if it is set to a value different to 5G-EA0, or, set to any value different to 5G-EA0 otherwise	Non-zero ciphering algorithm
IMEISV request	Present

Table 9.2.2.1.3.3-6: SECURITY MODE COMPLETE (Step 12, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-26
Information Element	Value/Remark	Comment	Condition
IMEISV	Present

Table 9.2.2.1.3.3-7: IDENTITY REQUEST (Step 16, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-21
Information Element	Value/Remark	Comment	Condition
Identity type	‘0011’B	IMEI

Table 9.2.2.1.3.3-8: IDENTITY RESPONSE (Step 17, Table 9.2.2.1.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-22
Information Element	Value/Remark	Comment	Condition
Mobile identity
Type of identity	‘011’B	IMEI

9.2.2.2 Protection of initial NAS signalling messages

9.2.2.2.1 Test Purpose (TP)

Same Test purpose as in clause 9.1.2.2.1

9.2.2.2.2 Conformance requirements

Same conformance requirements as in clause 9.1.2.2.2

9.2.2.2.3 Test description

9.2.2.2.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27.

UE:

– None.

Preamble:

– The UE is in state 0W-B on WLAN Cell 27 according to TS 38.508-1 [4].

9.2.2.2.3.2 Test procedure sequence

Table 9.2.2.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
1A	The UE transmits a REGISTRATION REQUEST message.	–>	REGISTRATION REQUEST	–	–
1B	The SS transmits an AUTHENTICATION REQUEST message including EAP-Request/AKA’-Challenge or 5G AKA Challenge.	<–	AUTHENTICATION REQUEST	–	–
1C	The UE transmits an AUTHENTICATION RESPONSE message including EAP-Response/AKA’-Challenge or 5G AKA Response.	–>	AUTHENTICATION RESPONSE	–	–
1D	The SS transmits a SECURITY MODE COMMAND message including EAP-Success if EAP-AKA’ used.	<–	SECURITY MODE COMMAND	–	–
1E	The UE transmits a SECURITY MODE COMPLETE message.	–>	SECURITY MODE COMPLETE	–	–
1F	The SS transmits a REGISTRATION REJECT message with the cause value set to #6 Illegal ME as default.	<–	REGISTRATION REJECT	–	–
1G	The UE is switched off.	–	–	–	–
1H	The UE is switched on.	–	–	–	–
2-3	Steps 1-2 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 4 to 8 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [31] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
4	The UE transmits a REGISTRATION REQUEST message.	–>	REGISTRATION REQUEST	1	P
5	The SS transmits a DLInformationTransfer message and an AUTHENTICATION REQUEST message.	<–	AUTHENTICATION REQUEST	–	–
6	The UE transmits an ULInformationTransfer message and an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
7	The SS transmits a DLInformationTransfer message and a SECURITY MODE COMMAND message.	<–	SECURITY MODE COMMAND
8	The UE transmits an ULInformationTransfer message and a SECURITY MODE COMPLETE message.	–>	SECURITY MODE COMPLETE	2	P
9-11	Steps 8-10 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–

9.2.2.2.3.3 Specific message contents

Table 9.2.2.2.3.3-0: REGISTRATION REJECT (Step 1F, Table 9.2.2.2.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-9
Information Element	Value/Remark	Comment	Condition
5GMM cause	‘00000110’B	Illegal ME

Table 9.2.2.2.3.3-1: REGISTRATION REQUEST (Step 4, Table 9.2.2.2.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-6 using condition NON_CLEARTEXT_IE
Information Element	Value/Remark	Comment	Condition

Table 9.2.2.2.3.3-2: SECURITY MODE COMPLETE (Step 8, Table 9.2.2.2.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-26
Information Element	Value/Remark	Comment	Condition
NAS message container	Contents of Table 9.2.2.2.3.3-3

Table 9.2.2.2.3.3-3: REGISTRATION REQUEST (Step 8, Table 9.2.2.2.3.2-1)

Derivation path: TS 38.508-1 [4],table 4.7.1-6 using condition CIPHERED_MESSAGE
Information Element	Value/Remark	Comment	Condition

9.2.3 Void

9.2.4 Generic UE configuration

9.2.4.1 Generic UE configuration update

9.2.4.1.1 Test Purpose (TP)

(1)

with { UE in 5GMM-REGISTERED state }

ensure that {

when { UE receives a new 5G-GUTI in the CONFIGURATION UPDATE COMMAND message and acknowledgement from the UE is requested }

then { UE sends a CONFIGURATION UPDATE COMPLETE message and UE shall consider new 5G-GUTI as valid }

}

(2)

with { UE in 5GMM-REGISTERED state }

ensure that {

when { UE receives a NITZ information in the CONFIGURATION UPDATE COMMAND message and acknowledgement from the UE is not requested }

then { UE updates NITZ information }

}

(3)

with { UE in 5GMM-REGISTERED state }

ensure that {

when { UE receives CONFIGURATION UPDATE COMMAND message indicating “registration requested” and contains no other parameters }

then { UE deletes any stored allowed NSSAI for this PLMN and then release the existing N1 NAS signalling connection, starts a mobility registration procedure }

}

(4)

with { UE in 5GMM-REGISTERED state }

ensure that {

when { UE receives a new allowed NSSAI in the CONFIGURATION UPDATE COMMAND message and registration is not requested }

then { UE replaces any stored allowed NSSAI for this PLMN with new allowed NSSAI }

}

9.2.4.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 4.6.2.2, 5.4.4.1, 5.4.4.2 and 5.4.4.3. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501 clause 4.6.2.2]

If available, the configured NSSAI(s) shall be stored in a non-volatile memory in the ME as specified in annex C.

…

If the UE receives the CONFIGURATION UPDATE COMMAND message indicating "registration requested" and contains no other parameters (see subclauses 5.4.4.2 and 5.4.4.3), the UE shall delete any stored allowed NSSAI for this PLMN, and delete any stored mapping of each S-NSSAI of the allowed NSSAI to the S-NSSAI(s) of the HPLMN, if available;

…

d) When the UE receives the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed" in the REGISTRATION ACCEPT message or in the CONFIGURATION UPDATE COMMAND message, the UE shall delete the network slicing information for each of the PLMNs that the UE has slicing information stored for (excluding the current PLMN). The UE shall not delete the default configured NSSAI. Additionally, the UE shall update the network slicing information for the current PLMN (if received) as specified above in bullets a), b) and c):

[TS 24.501 clause 5.4.4.1]

The purpose of this procedure is to:

a) allow the AMF to update the UE configuration for access and mobility management-related parameters decided and provided by the AMF by providing new parameter information within the command; or

b) request the UE to perform a registration procedure for mobility and periodic registration update towards the network to update access and mobility management-related parameters decided and provided by the AMF (see subclause 5.5.1.3).

This procedure is initiated by the network and can only be used when the UE has an established 5GMM context, and the UE is in 5GMM-CONNECTED mode. When the UE is in 5GMM-IDLE mode, the AMF may use the paging or notification procedure to initiate the generic UE configuration update procedure. The AMF can request a confirmation response in order to ensure that the parameter has been updated by the UE.

This procedure shall be initiated by the network to assign a new 5G-GUTI to the UE after a successful service request procedure invoked as a response to a paging request from the network and before the release of the N1 NAS signalling connection. If the service request procedure was triggered due to 5GSM downlink signalling pending, the procedure for assigning a new 5G-GUTI can be initiated by the network after the transport of the 5GSM downlink signalling.

The following parameters are supported by the generic UE configuration update procedure without the need to request the UE to perform the registration procedure for mobility and periodic registration update:

a) 5G-GUTI;

b) TAI list;

c) Service area list;

d) Network identity and time zone information (Full name for network, short name for network, local time zone, universal time and local time zone, network daylight saving time);

e) LADN information;

f) Rejected NSSAI;r

g) Network slicing indication;

h) Operator-defined access category definitions; and

i) SMS indication.

The following parameters can be sent to the UE with or without a request to perform the registration procedure for mobility and periodic registration update:

a) Allowed NSSAI; or

b) Configured NSSAI.

The following parameter is sent to the UE with a request to perform the registration procedure for mobility and periodic registration update:

a) MICO indication.

The following parameters are sent over 3GPP access only:

a) LADN information;

b) MICO indication;

c) TAI list; and

d) Service area list.

The following parameters are managed and sent per access type i.e., independently over 3GPP access or non 3GPP access:

a) Allowed NSSAI; and

b) Rejected NSSAI (when the NSSAI is rejected for the current registration area).

The following parameters are managed commonly and sent over 3GPP access or non 3GPP access:

a) 5G-GUTI;

b) Network identity and time zone information;

c) Rejected NSSAI (when the NSSAI is rejected for the current PLMN);

d) Configured NSSAI; and

e) SMS indication.

Figure 5.4.4.1.1: Generic UE configuration update procedure

[TS 24.501 clause 5.4.4.2]

The AMF shall initiate the generic UE configuration update procedure by sending the CONFIGURATION UPDATE COMMAND message to the UE.

The AMF shall in the CONFIGURATION UPDATE COMMAND message either:

a) include one or more of the following parameters: 5G-GUTI, TAI list, allowed NSSAI that may include the mapped S-NSSAI(s), LADN information, service area list, MICO indication NITZ information, configured NSSAI that may include the mapped S-NSSAI(s), rejected NSSAI, network slicing indication, operator-defined access category definitions or SMS indication;

b) include the Configuration update indication IE with the Registration requested bit set to "registration requested"; or

c) include a combination of both a) and b).

If an acknowledgement from the UE is requested, the AMF shall indicate "acknowledgement requested" in the Acknowledgement bit of the Configuration update indication IE in the CONFIGURATION UPDATE COMMAND message and shall start timer T3555. Acknowledgement shall be requested for all parameters except when only NITZ is included.

To initiate parameter re-negotiation between the UE and network, the AMF shall indicate "registration requested" in the Registration requested bit of the Configuration update indication IE in the CONFIGURATION UPDATE COMMAND message.

If a new allowed NSSAI information or AMF re-configuration of supported S-NSSAIs requires an AMF relocation, the AMF shall indicate "registration requested" in the Registration requested bit of the Configuration update indication IE and include the Allowed NSSAI IE in the CONFIGURATION UPDATE COMMAND message.

If the AMF includes a new configured NSSAI in the CONFIGURATION UPDATE COMMAND message and the new configured NSSAI requires an AMF relocation as specified in 3GPP TS 23.501 [8], the AMF shall indicate "registration requested" in the Registration requested bit of the Configuration update indication IE in the message.

If the AMF indicates "registration requested" in the Registration requested bit of the Configuration update indication IE, acknowledgement shall be requested.

If changes to the allowed NSSAI require the UE to initiate a registration procedure, but the AMF is unable to determine an allowed NSSAI for the UE as specified in 3GPP TS 23.501 [8], the CONFIGURATION UPDATE COMMAND message shall indicate "registration requested" in the Registration requested bit of the Configuration update indication IE, and shall not contain any other parameters.

If the AMF needs to update the LADN information, the AMF shall include the LADN information in the LADN information IE of the CONFIGURATION UPDATE COMMAND message.

During an established 5GMM context, the network may send none, one, or more CONFIGURATION UPDATE COMMAND messages to the UE. If more than one CONFIGURATION UPDATE COMMAND message is sent, the messages need not have the same content.

[TS 24.501 clause 5.4.4.3]

Upon receiving the CONFIGURATION UPDATE COMMAND message, the UE shall stop timer T3346 if running and use the contents to update appropriate information stored within the UE.

If "acknowledgement requested" is indicated in the Acknowledgement bit of the Configuration update indication IE in the CONFIGURATION UPDATE COMMAND message, the UE shall send a CONFIGURATION UPDATE COMPLETE message.

If the UE receives a new 5G-GUTI in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new 5G-GUTI as valid, the old 5G-GUTI as invalid, stop timer T3519 if running, and delete any stored SUCI; otherwise, the UE shall consider the old 5G-GUTI as valid. The UE shall provide the 5G-GUTI to the lower layer of 3GPP access if the CONFIGURATION UPDATE COMMAND message is sent over the non-3GPP access, and the UE is in 5GMM-REGISTERED in both 3GPP access and non-3GPP access in the same PLMN.

If the UE receives a new TAI list in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new TAI list as valid and the old TAI list as invalid; otherwise, the UE shall consider the old TAI list as valid.

If the UE receives a new service area list in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new service area list as valid and the old service area list as invalid; otherwise, the UE shall consider the old service area list, if any, as valid.

If the UE receives new NITZ information in the CONFIGURATION UPDATE COMMAND message, the UE considers the new NITZ information as valid and the old NITZ information as invalid; otherwise, the UE shall consider the old NITZ information as valid.

If the UE receives a LADN information IE in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the old LADN information as invalid and the new LADN information as valid, if any; otherwise, the UE shall consider the old LADN information as valid.

If the UE receives a new allowed NSSAI for the associated access type in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new allowed NSSAI as valid for the associated access type, store the allowed NSSAI for the associated access type as specified in subclause 4.6.2.2 and consider the old allowed NSSAI for the associated access type as invalid; otherwise, the UE shall consider the old Allowed NSSAI as valid for the associated access type.

If the UE receives a new configured NSSAI in the CONFIGURATION UPDATE COMMAND message, the UE shall consider the new configured NSSAI for the registered PLMN as valid and the old configured NSSAI for the registered PLMN as invalid; otherwise, the UE shall consider the old configured NSSAI for the registered PLMN as valid The UE shall store the new configured NSSAI as specified in subclause 4.6.2.2.

If the UE receives the Network slicing indication IE in the CONFIGURATION UPDATE COMMAND message with the Network slicing subscription change indication set to "Network slicing subscription changed", the UE shall delete the network slicing information for each and every PLMN except for the current PLMN as specified in subclause 4.6.2.2.

If the UE receives Operator-defined access category definitions IE in the CONFIGURATION UPDATE COMMAND message and the Operator-defined access category definitions IE contains one or more operator-defined access category definitions, the UE shall delete any operator-defined access category definitions stored for the RPLMN and shall store the received operator-defined access category definitions for the RPLMN. If the UE receives the Operator-defined access category definitions IE in the CONFIGURATION UPDATE COMMAND message and the Operator-defined access category definitions IE contains no operator-defined access category definitions, the UE shall delete any operator-defined access category definitions stored for the RPLMN. If the CONFIGURATION UPDATE COMMAND message does not contain the Operator-defined access category definitions IE, the UE shall not delete the operator-defined access category definitions stored for the RPLMN.

If the UE receives the SMS indication IE in the CONFIGURATION UPDATE COMMAND message with the SMS availability indication set to:

a) "SMS over NAS not available", the UE shall consider that SMS over NAS transport is not allowed by the network; and

b) "SMS over NAS available", the UE may request the use of SMS over NAS transport by performing a registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3, after the completion of the generic UE configuration update procedure.

If the CONFIGURATION UPDATE COMMAND message indicates "registration requested" in the Registration requested bit of the Configuration update indication IE and:

a) contains no other parameters or contains at least one of the following parameters: a new allowed NSSAI, a new configured NSSAI or the Network slicing subscription change indication, and:

1) an emergency PDU session exists, the UE shall, after the completion of the generic UE configuration update procedure and the release of the emergency PDU session, release the existing N1 NAS signalling connection, and start a registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3; or

2) no emergency PDU Session exists, the UE shall, after the completion of the generic UE configuration update procedure and the release of the existing N1 NAS signalling connection, start a registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3; or

b) an MICO indication is included without a new allowed NSSAI or a new configured NSSAI, the UE shall, after the completion of the generic UE configuration update procedure, start a registration procedure for mobility and registration update as specified in subclause 5.5.1.3 to re-negotiate MICO mode with the network.

The UE receiving the rejected NSSAI in the CONFIGURATION UPDATE COMMAND message takes the following actions based on the rejection cause in the rejected NSSAI:

"S-NSSAI not available in the current PLMN"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN as specified in subclause 4.6.2.2 and not attempt to use this S-NSSAI in the current PLMN until switching off the UE or the UICC containing the USIM is removed.

"S-NSSAI not available in the current registration area"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as specified in subclause 4.6.2.2 and not attempt to use this S-NSSAI in the current registration area until switching off the UE, the UE moving out of the current registration area or the UICC containing the USIM is removed.

9.2.4.1.3 Test description

9.2.4.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state 3W-A on WLAN Cell 27 according to TS 38.508-1 [4].

9.2.4.1.3.2 Test procedure sequence

Table 9.2.4.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS transmits a CONFIGURATION UPDATE COMMAND message including a new 5G-GUTI.	<–	CONFIGURATION UPDATE COMMAND	–	–
2	Check: Does UE transmit a CONFIGURATION UPDATE COMPLETE message?	–>	CONFIGURATION UPDATE COMPLETE	1	P
3	The SS transmits an IDENTITY REQUEST requesting 5G-GUTI in the IE identity type	<–	IDENTITY REQUEST	–	–
4	Check: Does the UE respond with an IDENTITY RESPONSE message with including the new 5G-GUTI assigned in step 1 in the 5GS mobile identity IE?	–>	IDENTITY RESPONSE	1	P
5	The SS transmits a CONFIGURATION UPDATE COMMAND message including NITZ information.	<–	CONFIGURATION UPDATE COMMAND	–	–
6	Check: Does the UE transmit a CONFIGURATION UPDATE COMPLETE message within the expiry of T3555?	–>	CONFIGURATION UPDATE COMPLETE	2	F
7	Check: Using MMI/AT command verify the NITZ update on the UE.	–	–	2	P
8	Switch off procedure in Ipsec_SA_Established specified in TS 38.508-1 [4] subclause 4.9.6.5 is performed.	–	–	–	–
9	The UE is switched On.	–	–	–	–
10-16	Steps 1 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 [4] subclause 4.5.2 are performed.	–	–	–	–
17	The SS transmits a REGISTRATION ACCEPT message including Configured NSSAI.	<–	REGISTRATION ACCEPT	–	–
17A-17B	Steps 9 to 10 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 [4] subclause 4.5.2 are performed.	–	–	–	–
18	The SS transmits a CONFIGURATION UPDATE COMMAND message including registration requested IE.	<–	CONFIGURATION UPDATE COMMAND	–	–
19	The UE transmits a CONFIGURATION UPDATE COMPLETE message.	–>	CONFIGURATION UPDATE COMPLETE	–	–
19A	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
20	Check: Does UE transmit a REGISTRATION REQUEST message with registration type value set to “Mobility” and including the Requested NSSAI?	–>	REGISTRATION REQUEST	3	P
21-25	Void	–	–	–	–
26	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI.	<–	REGISTRATION ACCEPT	–	–
27	The UE transmits a REGISTRATION COMPLETE message.	–	REGISTRATION COMPLETE	–	–
27A	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
28	Check: Using MMI/AT command (+C5GNSSAIRDP) verify the update of allowed NSSAI.	–	–	3	P
28A-28B	Steps 1 to 2 of the generic procedure for WLAN IPsec_SA_Established specified in TS 38.508-1 [4] subclause 4.5.4.2-4 are performed.	–	–	–	–
29	The SS transmits a CONFIGURATION UPDATE COMMAND message including a new allowed NSSAI list.	<–	CONFIGURATION UPDATE COMMAND	–	–
30	The UE transmits a CONFIGURATION UPDATE COMPLETE message.	–>	CONFIGURATION UPDATE COMPLETE	–	–
31	Check: Using MMI/AT command (+C5GNSSAIRDP) verify the update of allowed NSSAI.	–	–	4	P
32	The SS transmits NSSAI DELETE REQUEST message to delete the Default Configured NSSAI list.	<–	NSSAI DELETE REQUEST	–	–
33	UE transmits NSSAI DELETE RESPONSE message.	–>	NSSAI DELETE RESPONSE	–	–
34	SS releases the RRC connection.	–	–	–	–

9.2.4.1.3.3 Specific message contents

Table 9.2.4.1.3.3-1: CONFIGURATION UPDATE COMMAND (step 1, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Configuration update indication	0001	Acknowledgement (ACK) requested
5G-GUTI	Other than the default value

Table 9.2.4.1.3.3-2: IDENTITY REQUEST (step 3, Table 9.2.4.1.3.2-1)

Derivation Path: TS 38.508-1 [4], Table 4.7.1-21
Information Element	Value/remark	Comment	Condition
Identity type	‘010’B	5G-GUTI

Table 9.2.4.1.3.3-3: IDENTITY RESPONSE (step 4, Table 9.2.4.1.3.2-1)

Derivation Path: TS 38.508-1 [4], Table 4.7.1-22
Information Element	Value/remark	Comment	Condition
mobile identity IE	5G-GUTI assigned in step 1	5G-GUTI

Table 9.2.4.1.3.3-4: CONFIGURATION UPDATE COMMAND (step 5, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Full name for network	Present
Universal time and local time zone	"xx211331832540" O	"<Current Year> 31 December 13:38 52 GMT+1", Note 1, Note 2, Note 3
Note 1: Hard coded values have been chosen to allow for consistent/comparable SS behaviour. Note 2: Daylight Saving Time is included in the Local Time Zone. Note 3: Current Year is derived by the SS.

Table 9.2.4.1.3.3-5: REGISTRATION ACCEPT (step 17, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non-3GPP access
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.4.1.3.3-6: CONFIGURATION UPDATE COMMAND (step 18, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Configuration update indication	0010	Registration requested

Table 9.2.4.1.3.3-7: REGISTRATION REQUEST (step 20, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘010’B		MOBILITY
Requested NSSAI
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000011’B	3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.4.1.3.3-8: REGISTRATION ACCEPT (step 26, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non-3GPP access
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 3
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000011’B	3
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.4.1.3.3-9: CONFIGURATION UPDATE COMMAND (step 30, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-19
Information Element	Value/remark	Comment	Condition
Configuration update indication	0001	Acknowledgement (ACK) requested
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.4.1.3.3-10: NSSAI DELETE REQUEST (step 32, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.509 Table 6.7.1
Information Element	Value/remark	Comment	Condition
Protocol discriminator	1111
Skip indicator	0000
Message type	‘10100110’B
Delete NSSAI type	‘00000001’B	Delete Configured NSSAI
Configured NSSAI	00000000

Table 9.2.4.1.3.3-11: NSSAI DELETE RESPONSE (step 33, Table 9.2.4.1.3.2-1)

Derivation path: TS 38.509 Table 6.7.2
Information Element	Value/remark	Comment	Condition
Protocol discriminator	1111
Skip indicator	0000
Message type	‘10100111’B

9.2.5 Registration

9.2.5.1 Initial Registration

9.2.5.1.1 Initial registration / Success / 5G-GUTI reallocation, Last visited TAI

9.2.5.1.1.1 Test Purpose (TP)

(1)

with { the UE has no valid 5G-GUTI but available SUCI and switched off }

ensure that {

when { the UE is switched on }

then { the UE sends a REGISTRATION REQUEST message including the SUCI in the 5GS mobile identity IE }

}

(2)

with { the UE is 5GMM-REGISTERED state with assigned 5G-GUTI and last visited registered TAI and switched off }

ensure that {

when { the UE is switched on }

then { the UE sends a REGISTRATION REQUEST message including the 5G-GUTI assigned previously in the 5GS mobile identity IE and the last visited registered TAI }

}

9.2.5.1.1.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.501 clauses 5.5.1.2.2 and 5.5.1.2.4. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.5.1.2.2]

The UE initiates the registration procedure for initial registration by sending a REGISTRATION REQUEST message to the AMF, starting timer T3510. If timer T3502 is currently running, the UE shall stop timer T3502. If timer T3511 is currently running, the UE shall stop timer T3511.

During initial registration the UE handles the 5GS mobile identity IE in the following order:

…

b) if the UE holds a valid 5G-GUTI that was previously assigned, over 3GPP access or non-3GPP access, by the same PLMN with which the UE is performing the registration, the UE shall indicate the 5G-GUTI in the 5GS mobile identity IE;

c) if the UE holds a valid 5G-GUTI that was previously assigned, over 3GPP access or non-3GPP access, by an equivalent PLMN, the UE shall indicate the 5G-GUTI in the 5GS mobile identity IE;

d) if the UE holds a valid 5G-GUTI that was previously assigned, over 3GPP access or non-3GPP, by any other PLMN, the UE shall indicate the 5G-GUTI in the 5GS mobile identity IE;

e) if a SUCI is available the UE shall include the SUCI in the 5GS mobile identity IE; and

If the SUCI is included in the 5GS mobile identity IE and the timer T3519 is not running, the UE shall start timer T3519 and store the value of the SUCI sent in the REGISTRATION REQUEST message. The UE shall include the stored SUCI in the REGISTRATION REQUEST message while timer T3519 is running.

…

If the last visited registered TAI is available, the UE shall include the last visited registered TAI in the REGISTRATION REQUEST message.

[TS 24.501, clause 5.5.1.2.4]

The 5G-GUTI reallocation shall be part of the initial registration procedure. During the initial registration procedure, if the AMF has not allocated a new 5G-GUTI by the generic UE configuration update procedure, the AMF shall include in the REGISTRATION ACCEPT message the new assigned 5G-GUTI together with the assigned TAI list.

9.2.5.1.1.3 Test description

9.2.5.1.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state Switched OFF (state 0W-B) according to TS 38.508-1 [4].

9.2.5.1.1.3.2 Test procedure sequence

Table 9.2.5.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2-8	UE establishes an IPSEC SA and trigger 5GMM Registration procedure by executing steps 1 to 7 of Table 4.5.2.2-3 in TS38.508-1 [4].	–	–	–	–
9	SS transmits an REGISTRATION REJECT message with the 5GMM cause IE setting as “Illegal ME”. NOTE1: 5G-GUTI-1 should be deleted, then UE has no valid 5G-GUTI but available SUCI now.	<–	REGISTRATION REJECT	–	–
10	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
11	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
12	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
13-23	Steps 1-11 of Table 4.5.2.2-2 of the generic procedure in TS 38.508-1 [4] are performed	–	–	1	P
24	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
25	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
26-35	Steps 1-11 of Table 4.5.2.2-2 of the generic procedure in TS 38.508-1 [4] are performed	–	–	2	P

9.2.5.1.1.3.3 Specific message contents

Table 9.2.5.1.1.3.3-1: Message REGISTRATION REJECT (step 9, Table 9.2.5.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-9
Information Element	Value/Remark	Comment	Condition
5GMM cause	‘0000 0011’B	Illegal UE

Table 9.2.5.1.1.3.3-2: Message REGISTRATION REQUEST (step 15, Table 9.2.5.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-6
Information Element	Value/Remark	Comment	Condition
5GS registration type	‘0000 0001’B	Initial registration
5GS mobile identity	SUCI	The SUCI of UE

Table 9.2.5.1.1.3.3-3: Message REGISTRATION ACCEPT (step 21, Table 9.2.5.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-7
Information Element	Value/Remark	Comment	Condition
5G-GUTI	5G-GUTI-2

Table 9.2.5.1.1.3.3-4: Message REGISTRATION REQUEST (step 34, Table9.2.5.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-6
Information Element	Value/Remark	Comment	Condition
5GS registration type	‘0000 0001’B	Initial registration
5GS mobile identity	5G-GUTI-2
Last visited registered TAI	TAI-1	N3GPP TAI

9.2.5.1.2 Initial registration / 5GS services / NSSAI handling

9.2.5.1.2.1 Test Purpose (TP)

(1)

with { UE has sent a REGISTRATION REQUEST message including requested NSSAI}

ensure that {

when { UE receives REGISTRATION ACCEPT message with allowed NSSAI }

then { UE shall replace any stored allowed NSSAI for the current PLMN with new allowed NSSAI for the current PLMN }

}

(2)

with { UE has sent a REGISTRATION REQUEST message including Requested NSSAI}

ensure that {

when { UE receives REGISTRATION ACCEPT message with Rejected NSSAI with reject cause “S-NSSAI not available in the current PLMN” }

then { UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN and not attempt to use the Rejected NSSAI in the current PLMN until switching off the UE or the UICC containing the USIM is removed }

}

(3)

with { UE receives REGISTRATION ACCEPT message with Rejected NSSAI with reject cause “S-NSSAI not available in the current PLMN” }

ensure that {

when { UE has been switched off, then switched on }

then { UE shall delete the stored Rejected NSAAI and shall send the NSSAI in Requested NSSAI IE of the REGISTRATION REQUEST message as per the configured and Allowed NSSAI for current PLMN }

}

(4)

with { UE has sent a REGISTRATION REQUEST message including Requested NSSAI}

ensure that {

when { UE receives REGISTRATION ACCEPT message with Rejected NSSAI with reject cause “S-NSSAI not available in the current registration area” }

then { UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN and registration area combination and not attempt to use the Rejected NSSAI in the current registration area until switching off the UE, the UE moving out of the current registration area or the UICC containing the USIM is removed }

}

9.2.5.1.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clause 5.5.1.2.2 and 5.5.1.2.4. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501 clause 5.5.1.2.2]

5.5.1.2.1 General

This procedure can be used by a UE for initial registration for 5GS services.

…

The UE shall include the requested NSSAI containing the S-NSSAI(s) corresponding to the slice(s) to which the UE wants to register and shall include the mapping of the requested NSSAI which is the mapping of each S-NSSAI of the requested NSSAI to the S-NSSAI(s) of the HPLMN, if available, in the REGISTRATION REQUEST message. If the UE has allowed NSSAI or configured NSSAI for the current PLMN, the requested NSSAI shall be either:

a) the configured NSSAI for the current PLMN, or a subset thereof as described below, if the UE has no allowed NSSAI for the current PLMN;

b) the allowed NSSAI for the current PLMN, or a subset thereof as described below, if the UE has an allowed NSSAI for the current PLMN; or

c) the allowed NSSAI for the current PLMN, or a subset thereof as described below, plus one or more S-NSSAIs from the configured NSSAI for which no corresponding S-NSSAI is present in the allowed NSSAI and those are neither in the rejected NSSAI for the current PLMN nor in the rejected NSSAI for the current PLMN and registration area combination.

If the UE has neither allowed NSSAI for the current PLMN nor configured NSSAI for the current PLMN and has a default configured NSSAI, the UE shall:

a) include the S-NSSAI(s) in the Requested NSSAI IE of the REGISTRATION REQUEST message using the default configured NSSAI; and

b) include the Network slicing indication IE with the Default configured NSSAI indication bit set to "Requested NSSAI created from default configured NSSAI" in the REGISTRATION REQUEST message.

If the UE has no allowed NSSAI for the current PLMN, no configured NSSAI for the current PLMN, and no default configured NSSAI, the UE shall not include a requested NSSAI in the REGISTRATION message.

The subset of configured NSSAI provided in the requested NSSAI consists of one or more S-NSSAIs in the configured NSSAI applicable to the current PLMN, if the S-NSSAI is neither in the rejected NSSAI for the current PLMN nor in the rejected NSSAI for the current PLMN and registration area combination.

The subset of allowed NSSAI provided in the requested NSSAI consists of one or more S-NSSAIs in the allowed NSSAI for the current PLMN.

NOTE 3: How the UE selects the subset of configured NSSAI or allowed NSSAI to be provided in the requested NSSAI is implementation.

NOTE 4: The number of S-NSSAI(s) included in the requested NSSAI cannot exceed eight.

[TS 24.501 clause 5.5.1.2.4]

The AMF shall include the allowed NSSAI for the current PLMN and shall include the mapping of each S-NSSAI of the allowed NSSAI to the S-NSSAI(s) of the HPLMN contained in the requested NSSAI from the UE if available, in the REGISTRATION ACCEPT message if the UE included the requested NSSAI in the REGISTRATION REQUEST message and the AMF allows one or more S-NSSAIs in the requested NSSAI. The AMF may also include rejected NSSAI in the REGISTRATION ACCEPT message. Rejected NSSAI contains S-NSSAI(s) which was included in the requested NSSAI but rejected by the network associated with rejection cause(s).

The AMF may include a new configured NSSAI for the current PLMN in the REGISTRATION ACCEPT message if:

a) the REGISTRATION REQUEST message did not include the requested NSSAI;

b) the REGISTRATION REQUEST message included the requested NSSAI containing an S-NSSAI that is not valid in the serving PLMN; or

c) the REGISTRATION REQUEST message included the Network slicing indication IE with the Default configured NSSAI indication bit set to "Requested NSSAI created from default configured NSSAI".

If a new configured NSSAI for the current PLMN is included in the REGISTRATION ACCEPT message, the AMF shall also include the mapping of the configured NSSAI for the current PLMN the S-NSSAI(s) of the HPLMN if available in the REGISTRATION ACCEPT message. In this case the AMF shall start timer T3550 and enter state 5GMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.1.3.2.3.3.

The AMF shall include the Network slicing indication IE with the Network slicing subscription change indication set to "Network slicing subscription changed" in the REGISTRATION ACCEPT message if the UDM has indicated that the subscription data for network slicing has changed. In this case the AMF shall start timer T3550 and enter state 5GMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.1.3.2.3.3.

The UE receiving the rejected NSSAI in the REGISTRATION ACCEPT message takes the following actions based on the rejection cause in the rejected NSSAI:

"S-NSSAI not available in the current PLMN"

"S-NSSAI not available in the current registration area"

The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN and registration area combination as specified in subclause 4.6.2.2 and not attempt to use this S-NSSAI in the current registration area until switching off the UE, the UE moving out of the current registration area or the UICC containing the USIM is removed.

If the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the requested NSSAI are present in the subscribed S-NSSAIs, and one or more subscribed S-NSSAIs (containing one or more S-NSSAIs each of which may be associated with a new S-NSSAI) marked as default are available, the AMF shall put the subscribed S-NSSAIs marked as default in the allowed NSSAI of the REGISTRATION ACCEPT message. The AMF shall determine a registration area such that all S-NSSAIs of the allowed NSSAI are available in the registration area.

9.2.5.1.2.3 Test description

9.2.5.1.2.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– UE is previously registered on WLAN Cell 27 using default message contents according to TS 38.508-1 [4];

– Empty URSP Configuration.

Preamble:

– The UE is in state Switched OFF (state 0W-B) according to TS 38.508-1 [4].

9.2.5.1.2.3.2 Test procedure sequence

Table 9.2.5.1.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 2 to 6 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [33] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
2	Check: Does UE transmit a REGISTRATION REQUEST message?	–>	REGISTRATION REQUEST	–	–
3-6	Steps 4 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
7	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI and Configured NSSAI.	<–	REGISTRATION ACCEPT	–	–
8	Step 10 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
9	Switch off procedure in WLAN Ipsec_SA_Established specified in TS 38.508-1 subclause 4.9.6.5 is performed.	–	–	–	–
10	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 11 to 15 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [33] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
11	Check: Does UE transmit a REGISTRATION REQUEST message including Requested NSSAI?	–>	REGISTRATION REQUEST	1	P
12-15	Steps 4 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
16	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI and Rejected NSSAI.	<–	REGISTRATION ACCEPT	–	–
17	Step 10 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
18	Switch off procedure in WLAN Ipsec_SA_Established specified in TS 38.508-1 subclause 4.9.6.5 is performed.	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 19 to 23 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [33] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
19	Check: Does UE transmit a REGISTRATION REQUEST message including Requested NSSAI?	–>	REGISTRATION REQUEST	2	P
20-23	Steps 4 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
24	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI.	<–	REGISTRATION ACCEPT	–	–
25	The UE transmits a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
26	Step 10 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
27	Check: Is S-NSSAI=2 in the Rejected NSSAI list with cause “S-NSSAI not available in the current PLMN” associated with current PLMN using AT/MMI?	–	–	2	P
28	Switch off procedure in WLAN Ipsec_SA_Established specified in TS 38.508-1 subclause 4.9.6.5 is performed.	–	–	–	–
29	The UE is brought back to operation or the USIM is inserted	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 30 to 34 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [33] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
30	Check: Does UE transmit a REGISTRATION REQUEST message including Requested NSSAI?	–>	REGISTRATION REQUEST	3	P
31-34	Steps 4 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
35	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI and Rejected NSSAI.	<–	REGISTRATION ACCEPT	–	–
36	Step 10 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
37	Check: Is S-NSSAI=2 removed from the Rejected NSSAI list associated with current PLMN?	–	–	3	P
37A	Check: Is S-NSSAI=1 in the Rejected NSSAI list with cause “S-NSSAI not available in the current registration area” associated with current PLMN and registration area combination using AT/MMI?	–	–	4	P
38	Switch off procedure in WLAN Ipsec_SA_Established specified in TS 38.508-1 subclause 4.9.6.5 is performed.	–	–	–	–
39	The UE is brought back to operation or the USIM is inserted	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 40 to 44 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [33] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
40	Check: Does UE transmit a REGISTRATION REQUEST message including Requested NSSAI?	–>	REGISTRATION REQUEST	4	P
41-44	Steps 4 to 7 of the generic procedure for WLAN Ipsec_SA_Released specified in TS 38.508-1 subclause 4.5.2 are performed.	–	–	–	–
45	The SS transmits a REGISTRATION ACCEPT message including Allowed NSSAI.	<–	REGISTRATION ACCEPT	–	–
46	The UE transmits a REGISTRATION COMPLETE message.	–>	REGISTRATION COMPLETE	–	–
47	Check: Is S-NSSAI=1 in the Rejected NSSAI list with cause “S-NSSAI not available in the current registration area” associated with current PLMN and registration area combination using AT/MMI?	–	–	4	P

9.2.5.1.2.3.3 Specific message contents

Table 9.2.5.1.2.3.3-1: REGISTRATION REQUEST (step 2, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
Requested NSSAI		Note
S-NSSAI IEI		S-NSSAI value 1	Note
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Note: S-NSSAI =1 will be always included from the allowed NSSAI list associated with PLMN of WLAN Cell 27 by the UE but may include other S-NSSAI from Configured NSSAI list associated with PLMN of NCG WLAN Cell 27 if configured in the UE. See TS 24.501 sub-clause 5.5.1.2.1

Table 9.2.5.1.2.3.3-2: REGISTRATION ACCEPT (step 7, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non 3GPP access
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Configured NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.5.1.2.3.3-3: PDU SESSION ESTABLISHMENT ACCEPT (step 10, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 clause 4.7.2-2
Information Element	Value/remark	Comment	Condition
S-NSSAI
Length of S-NSSAI contents	‘0000 0001’B	SST
SST	‘0000 0010’B	SST value 2

Table 9.2.5.1.2.3.3-4: REGISTRATION REQUEST (step 11, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
Requested NSSAI		Note
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 2	Note
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Note: S-NSSAI =2 will be always included by the UE from the allowed NSSAI list associated with PLMN of NCG WLAN Cell 27 but may include S-NSSAI =1 from Configured NSSAI list associated with PLMN of NCG WLAN Cell 27. See TS 24.501 sub-clause 5.5.1.2.1

Table 9.2.5.1.2.3.3-5: REGISTRATION ACCEPT (step 16, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non 3GPP access
Allowed NSSAI		Note
S-NSSAI IEI		S-NSSAI value 1	Note
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Rejected NSSAI
Rejected S-NSSAI-1		Rejected S-NSSAI value 1
Cause value	‘0000’B	S-NSSAI not available in the current PLMN
SST	‘00000010’B	2
SD	Not Present
Note: If UE has requested only S-NSSAI =2 in step 22 and S-NSSAI =2 is added in the Rejected NSSAI list by the SS then AMF/SS can include default subscribed S-NSSAIs in the allowed NSSAI of REGISTRATION ACCEPT message, see TS 24.501 sub-clause 5.5.1.2.4.

Table 9.2.5.1.2.3.3-6: REGISTRATION REQUEST (step 19, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
Requested NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.5.1.2.3.3-7: REGISTRATION ACCEPT (step 24, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non 3GPP access
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.5.1.2.3.3-8: REGISTRATION REQUEST (step 30, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	Initial registration
Requested NSSAI		Note
S-NSSAI IEI		S-NSSAI value 1	Note
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	1
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Note: S-NSSAI =1 will be always included by the UE from the allowed NSSAI list associated with PLMN of NCG Cell C but may include S-NSSAI =2 from Configured NSSAI list associated with PLMN of NCG Cell C. See TS 24.501 sub-clause 5.5.1.2.1

Table 9.2.5.1.2.3.3-9: REGISTRATION ACCEPT (step 35, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non 3GPP access
TAI list
Type of list	‘01’B	list of TACs belonging to one PLMN, with consecutive TAC values
Number of elements	‘00001’B	2 Elements
TAC	PLMN =MCC/MNC stored in EFIMSI TAC 1 = 2	TAI2, TAI 3
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000010’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present
Rejected NSSAI
Rejected S-NSSAI-1		Rejected S-NSSAI value 1
Cause value	‘0001’B	S-NSSAI not available in the current registration area
SST	‘00000001’B	1
SD	Not Present
Note: If UE has requested only S-NSSAI =1 in step 57 and S-NSSAI =1 is added in the Rejected NSSAI list by the SS then AMF/SS can include default subscribed S-NSSAIs in the allowed NSSAI of REGISTRATION ACCEPT message, see TS 24.501 sub-clause 5.5.1.2.4.

Table 9.2.5.1.2.3.3-10: PDU SESSION ESTABLISHMENT ACCEPT (step 36, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 clause 4.7.2-2
Information Element	Value/remark	Comment	Condition
S-NSSAI
Length of S-NSSAI contents	‘0000 0001’B	SST
SST	‘0000 0010’B	SST value 2

Table 9.2.5.1.2.3.3-11: REGISTRATION REQUEST (step 40, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type value	‘001’B	initial registration
Requested NSSAI		Note
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000001’B	SST
SST	‘00000001’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

Table 9.2.5.1.2.3.3-12: REGISTRATION ACCEPT (step 45, Table 9.2.5.1.2.3.2-1)

Derivation path: TS 38.508-1 Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result value	‘010’B	Non 3GPP access
Allowed NSSAI
S-NSSAI IEI		S-NSSAI value 1
Length of S-NSSAI contents	‘00000010’B	SST
SST	‘00000001’B	2
SD	Not Present
Mapped configured SST	Not Present
Mapped configured SD	Not Present

9.2.5.1.3 Void

9.2.5.1.4 Initial registration / Rejected / Congestion / Abnormal cases / T3346

9.2.5.1.4.1 Test Purpose (TP)

(1)

with { The UE has sent initial REGISTRAION REQUEST message }

ensure that {

when { UE receives a REGISTRATION REJECT with cause #22 (Congestion) with T3346 included and the UE is NOT configured for High Priority Access }

then { UE does not start the Initial registration until T3346 expires }

}

(2)

with { The UE has received initial REGISTRATION REJECT with T3346 included }

ensure that {

when { upon expiry of T3346 }

then { UE starts the Initial registration procedure }

}

(3)

with { The UE has received initial REGISTRATION REJECT with T3346 included }

ensure that {

when { the timer T3346 is running and the UE needs to perform initial registration for emergency services }

then { UE starts the Initial registration procedure }

}

9.2.5.1.4.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clauses 5.5.1.2.5 and 5.5.1.2.7 and TS 24.301, clause 5.5.1.2.5. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.5.1.2.5]

If the initial registration request cannot be accepted by the network, the AMF shall send a REGISTRATION REJECT message to the UE including an appropriate 5GMM cause value.

If the initial registration request is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a back-off timer T3346.

The UE shall take the following actions depending on the 5GMM cause value received in the REGISTRATION REJECT message.

#3 (Illegal UE); or

#6 (Illegal ME).

…

#22 (Congestion).

If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below; otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.

The UE shall stop timer T3346 if it is running.

If the REGISTRATION REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the REGISTRATION REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [12].

The UE stays in the current serving cell and applies the normal cell reselection process. The initial registration procedure is started if still needed when timer T3346 expires or is stopped.

If the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, and attach attempt counter as specified in 3GPP TS 24.301 [15] for the case when the EPS attach request procedure is rejected with the EMM cause with the same value.

…

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in subclause 5.5.1.2.7.

[TS 24.501, clause 5.5.1.2.7]

The following abnormal cases can be identified:

a) Timer T3346 is running.

The UE shall not start the registration procedure for initial registration unless:

1) the UE is a UE configured for high priority access in selected PLMN;

2) the UE needs to perform the registration procedure for initial registration for emergency services; or

3) the UE receives a DEREGISTRATION REQUEST message with the "re-registration required" indication.

The UE stays in the current serving cell and applies the normal cell reselection process.

NOTE 1: It is considered an abnormal case if the UE needs to initiate a registration procedure for initial registration while timer T3346 is running independent on whether timer T3346 was started due to an abnormal case or a non-successful case.

[TS 24.301, clause 5.5.1.2.5]

…

#22 (Congestion);

If the T3346 value IE is present in the ATTACH REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below; otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.2.6.

The UE shall abort the attach procedure, reset the attach attempt counter, set the EPS update status to EU2 NOT UPDATED and enter state EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

The UE shall stop timer T3346 if it is running.

If the ATTACH REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [13].

The UE stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started if still needed when timer T3346 expires or is stopped.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure is rejected with the 5GMM cause with the same value.

…

9.2.5.1.4.3 Test description

9.2.5.1.4.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

None.

Preamble:

– The UE is in state Switched OFF (State 0W-A as per TS 38.508-1 [4] Table 4.4A.2-0).

9.2.5.1.4.3.2 Test procedure sequence

Table 9.2.5.1.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	UE is switched on.	–	–	–
2-8	Steps 1-7 of Table 4.5.2.2-3 of the generic procedure in TS 38.508-1 [4] are performed.	–	–	–	–
9	SS transmits a REGISTRATION REJECT message with cause #22 (Congestion) and T3346 set to 3 minutes. (Note 1)	<–	REGISTRATION REJECT	–	–
10	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
11	Check: Does the UE initiate IPSec secure tunnel as per 3GPP TS 24.502 [33] clause 7.3.2 within T3346 minutes of Step 9? (Note 1)	–	–	1	F
12-18	Steps 1-7 of Table 4.5.2.2-3 of the generic procedure in TS 38.508-1 [4] are performed.	–	–	2	P
19	SS transmits a REGISTRATION REJECT message with cause #22 (Congestion) and T3346 set to 3 minutes. (Note 1)	<–	REGISTRATION REJECT	–	–
20	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
21	The UE is made to establish an Emergency PDU session. (Note 2)	–	–	–	–
22-32	Steps 1-11a1 of Table 4.5.2.2-3 of the generic procedure in TS 38.508-1 [4] are performed, REGISTRATION REQUEST message with IE 5GS registration type set to "Emergency registration" or “Initial registration”. (Note 3)	–	–	3	P
Note 1: T3346 is set to 3 minutes. This is checked for 3 minutes less tolerance. Note 2: This can be done by an AT/MMI command. Note 3: 5GS registration type can set to either "Initial registration" according to TS 24.501 clause 5.2.2.3.3 or "Emergency registration" according to TS 24.501 clause 5.5.1.2.

9.2.5.1.4.3.3 Specific message contents

Table 9.2.5.1.4.3.3-1: REGISTRATION REJECT (steps 9, 19 Table 9.2.5.1.4.3.2-1)

Derivation Path: TS 38.508-1 [4], Table 4.7.1-9
Information Element	Value/remark	Comment	Condition
5GMM cause	’0001 0110’B	Cause #22 (Congestion)
T3346 Value	‘00100011’B	3 minutes

Table 9.2.5.1.4.3.3-2: REGISTRATION REQUEST (step 25 Table 9.2.5.1.4.3.2-1)

Derivation Path: TS 38.508-1 [4], Table 4.7.1-6, Condition EMERGENCY or INITIAL.

9.2.5.2 Mobility Registration

9.2.5.2.1 Void

9.2.5.2.2 Mobility registration update/Change of SMS over NAS capability

9.2.5.2.2.1 Test Purpose (TP)

(1)

with { UE in state 5GMM-REGISTERED, and 5GMM-IDLE mode over non 3GPP access }

ensure that {

when { UE needs to change the SMS over NAS capability }

then { UE initiates and successfully completes the registration procedure for mobility registration update }

}

9.2.5.2.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501 [22], subclause 5.5.1.3.2. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.5.1.3.2]

The UE in state 5GMM-REGISTERED shall initiate the registration procedure for mobility and periodic registration update by sending a REGISTRATION REQUEST message to the AMF,

…

l) when the UE needs to register for SMS over NAS, indicate a change in the requirements to use SMS over NAS, or de-register from SMS over NAS;

…

For a REGISTRATION REQUEST message with a 5GS registration type IE indicating "mobility registration updating", UE shall include the requested NSSAI containing the S-NSSAI(s) corresponding to the slices to which the UE intends to register with and shall include the mapped S-NSSAI(s) for the requested NSSAI, if available, in the REGISTRATION REQUEST message. If the UE has allowed NSSAI or configured NSSAI for the current PLMN, the requested NSSAI shall be either:

a) the configured NSSAI for the current PLMN, or a subset thereof as described below, if the UE has no allowed NSSAI for the current PLMN;

b) the allowed NSSAI for the current PLMN, or a subset thereof as described below, if the UE has an allowed NSSAI for the current PLMN; or

If the UE has neither allowed NSSAI for the current PLMN nor configured NSSAI for the current PLMN and has a default configured NSSAI, the UE shall:

a) include the S-NSSAI(s) in the Requested NSSAI IE of the REGISTRATION REQUEST message using the default configured NSSAI; and

b) include the Network slicing indication IE with the Default configured NSSAI indication bit set to "Requested NSSAI created from default configured NSSAI" in the REGISTRATION REQUEST message.

If the UE has no allowed NSSAI for the current PLMN, no configured NSSAI for the current PLMN, and no default configured NSSAI, the UE shall not include a requested NSSAI in the REGISTRATION REQUEST message.

The subset of configured NSSAI provided in the requested NSSAI consists of one or more S-NSSAIs in the configured NSSAI applicable to this PLMN, if the S-NSSAI is neither in the rejected NSSAIs for the current PLMN nor in the rejected NSSAI for the current registration area.

The subset of allowed NSSAI provided in the requested NSSAI consists of one or more S-NSSAIs in the allowed NSSAI for this PLMN.

NOTE 3: How the UE selects the subset of configured NSSAI or allowed NSSAI to be provided in the requested NSSAI is implementation specific. The UE can take preferences indicated by the upper layers (e.g. policies, applications) into account.

9.2.5.2.2.3 Test description

9.2.5.2.2.3.1 Pre-test conditions

System Simulator:

WLAN Cell 27

UE:

UE is enabled for SMS over NAS

Preamble:

The UE is in state 3W-A with PDU session Active state according to TS 38.508-1 [4]SMS over NAS allowed.

9.2.5.2.1.3.2 Test procedure sequence

Table 9.2.5.2.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Make the UE deregister the SMS over NAS NOTE 1)	–	–	–	–
2	The UE transmits an REGISTRATION REQUEST message indicating "mobility registration updating".	–>	5GMM: REGISTRATION REQUEST	1	P
3	SS sends a REGISTRATION ACCEPT message	<–	5GMM: REGISTRATION ACCEPT	–	–
4	Check: Does the UE send a REGISTRATION COMPLETE?	–>	5GMM: REGISTRATION COMPLETE	–	–
Note 1: This can be done by MMI or AT command +C5GUSMS

9.2.5.2.1.3.3 Specific message contents

Table 9.2.5.2.1.3.3-1: REGISTRATION REQUEST (preamble)

Derivation path: TS 38.508-1 [4], Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type
5GS registration type value	‘001’B		INITIAL
5GS update type
SMS requested	SMS over NAS supported

Table 9.2.5.2.1.3.3-2: REGISTRATION ACCEPT (preamble)

Derivation path: TS 38.508-1 [4], Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
SMS allowed	SMS over NAS allowed
T3512 value
Timer value	‘00011’B
Unit	‘101’B

Table 9.2.5.2.1.3.3-3: REGISTRATION REQUEST (Table 9.2.5.2.1.3.2-1, step 2)

Derivation path: TS 38.508-1 [4], Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type
5GS registration type value	‘010’B		MOBILITY
5GS update type
SMS requested	SMS over NAS not supported

9.2.6 De-registration

9.2.6.1 UE-initiated de-registration

9.2.6.1.1 UE-initiated de-registration / switch off

9.2.6.1.1.1 Test Purpose (TP)

(1)

with { the UE in 5GMM-REGISTERED state }

ensure that {

when { the UE is switched off }

then { the UE shall send DEREGISTRATION REQUEST message with De-registration type IE indicated to "Switch off" }

}

(2)

with { the UE supports remove USIM without power down and in 5GMM-REGISTERED state }

ensure that {

when { the USIM is removed from the UE }

then { the UE shall send DEREGISTRATION REQUEST message with De-registration type IE indicated to "Switch off" }

}

(3)

with { the UE in 5GMM-DEREGISTERED-INTIATED state }

ensure that {

when { the first four expiries of the timer T3521 }

then { the UE shall retransmit the DEREGISTRATION REQUEST message and shall reset and restart timer T3521 }

}

(4)

with { the UE in 5GMM-DEREGISTERED-INTIATED state }

ensure that {

when { On the fifth expiry of timer T3521 }

then { the deregistration procedure shall be aborted and the UE perform local detach }

}

9.2.6.1.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.501, clauses 5.5.2.1, 5.5.2.2.1 and 5.5.2.2.6. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.5.2.1]

The de-registration procedure is used:

a) by the UE to de-register for 5GS services over 3GPP access when the UE is registered over 3GPP access;;

b) by the UE to de-register for 5GS services over 3GPP access, non-3GPP access, or both when the UE is registered in the same PLMN over both accesses;

c) by the network to inform the UE that it is deregistered for 5GS services over 3GPP access when the UE is registered over 3GPP access;

d) by the network to inform the UE that it is deregistered for 5GS services over 3GPP access, non-3GPP access, or both when the UE is registered in the same PLMN over both accesses; and

e) by the network to inform the UE to re-register to the network.

The de-registration procedure with appropriate de-registration type shall be invoked by the UE:

a) if the UE is switched off; and

b) as part of the eCall inactivity procedure defined in subclause 5.5.3.

The de-registration procedure with appropriate de-registration type shall be invoked by the network:

a) if the network informs whether the UE should re-register to the network.

The de-registration procedure with appropriate access type shall be invoked by the UE:

a) if the UE wants to de-register for 5GS services over 3GPP access when the UE is registered over 3GPP access; or

b) the UE wants to de-register for 5GS services over 3GPP access, non-3GPP access, or both when the UE is registered in the same PLMN over both accesses.

If the de-registration procedure is triggered due to USIM removal, the UE shall indicate "switch off" in the de-registration type IE.

If the de-registration procedure is requested by the UDM for a UE that has an emergency PDU session, the AMF shall not send a DEREGISTRATION REQUEST message to the UE.

If the de-registration procedure for 5GS services is performed, the PDU sessions, if any, for this particular UE are released locally without peer-to-peer signalling between the UE and the network.

The UE is allowed to initiate the de-registration procedure even if the timer T3346 is running.

NOTE: When the UE has no PDU sessions over non-3GPP access, or the UE moves all the PDU sessions over a non-3GPP access to a 3GPP access, the UE and the AMF need not initiate de-registration over the non-3GPP access.

The AMF shall provide the UE with a non-3GPP de-registration timer.

[TS 24.501, clause 5.5.2.2.1]

The de-registration procedure is initiated by the UE by sending a DEREGISTRATION REQUEST message (see example in figure 5.5.2.2.1). The De-registration type IE included in the message indicates whether the de-registration procedure is due to a "switch off" or not. The access type included in the message indicates whether the de-registration procedure is:

a) for 5GS services over 3GPP access when the UE is registered over 3GPP access only;

b) for 5GS services over non-3GPP access when the UE is registered over non-3GPP access only; or

c) for 5GS services over 3GPP access, non-3GPP access or both 3GPP access and non-3GPP access when the UE is registered in the same PLMN over both accesses.

If the UE has a valid 5G-GUTI, the UE shall populate the 5GS mobile identity IE with the valid 5G-GUTI. If the UE does not have a valid 5G-GUTI, the UE shall populate the 5GS mobile identity IE with its SUCI.

If the UE does not have a valid 5G-GUTI and it does not have a valid SUCI, then the UE shall populate the5GSmobile identity IE with its PEI.

If the de-registration request is not due to switch off and the UE is in the state 5GMM-REGISTERED or 5GMM-REGISTERED-INITIATED, timer T3521 shall be started in the UE after the DEREGISTRATION REQUEST message has been sent. The UE shall enter the state 5GMM-DEREGISTERED-INITIATED.

If the UE is to be switched off, the UE shall try for a period of 5 seconds to send the DEREGISTRATION REQUEST message. During this period, the UE may be switched off as soon as the DEREGISTRATION REQUEST message has been sent.

[TS 24.501, clause 5.5.2.2.6]

…

c) T3521 timeout.

On the first four expiries of the timer, the UE shall retransmit the DEREGISTRATION REQUEST message and shall reset and restart timer T3521. On the fifth expiry of timer T3521, the de-registration procedure shall be aborted and the UE proceeds as follows:

9.2.6.1.1.3 Test description

9.2.6.1.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27.

UE:

– None.

Preamble:

– The UE is in state 3W-A on WLAN Cell 27 according to 38.508-1 [4].

9.2.6.1.1.3.2 Test procedure sequence

Table 9.2.6.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Cause switch off	–	–	–	–
2	Check: Does the UE transmit a DEREGISTRATION REQUEST with the De-registration type IE indicating "switch off"?	–>	DEREGISTRATION REQUEST	1	P
3	SS Transmits DEREGISTRATION ACCEPT	<–	DEREGISTRATION ACCEPT	–	–
4	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
5	The UE is switched on.	–	–	–	–
6-15	The registration procedure is completed by executing steps 1-10 of the UE registration procedure in TS 38.508-1 [4] table 4.5.2.2-3.	–	–	–	–
16	Cause UE to initiate deregistration.	–	–	–	–
17	The UE transmits UE transmit a DEREGISTRATION REQUEST message. The UE starts timer T3521.	–>	DEREGISTRATION REQUEST	–	–
18	The SS does not respond to the DEREGISTRATION REQUEST message.	–	–	–	–
19	Check: When the timer T3521 expires does the UE re-transmit DETACH REQUEST message. Timer T3421 is re-started (1^st expiry).	–>	DEREGISTRATION REQUEST	3	P
20	The SS does not respond to the DEREGISTRATION REQUEST message.	–	–	–	–
21	Check: When the timer T3521 expires does the UE re-transmit DEREGISTRATION REQUEST message. Timer T3521 is re-started (2^nd expiry).	–>	DEREGISTRATION REQUEST	3	P
22	The SS does not respond to the DEREGISTRATION REQUEST message.	–	–	–	–
23	Check: When the timer T3521 expires does the UE re-transmit DEREGISTRATION REQUEST message. Timer T3521 is re-started (3^rd expiry).	–>	DEREGISTRATION REQUEST	3	P
24	The SS does not respond to the DEREGISTRATION REQUEST message.	–	–	–	–
25	Check: When the timer T3521 expires does the UE re-transmit DEREGISTRATION REQUEST message. Timer T3521 is re-started (4^th expiry).	–>	DEREGISTRATION REQUEST	3	P
26	The SS does not respond to the DETACH REQUEST message.	–	–	–	–
27	When the timer T3521 expires the UE aborts the detach procedure and performs a local detach (5^th expiry).	–	–	4	P
28	SS Transmits PDU SESSION MODIFICATION COMMAND	<–	PDU SESSION MODIFICATION COMMAND	–	–
29	Check: Does the UE transmit a PDU SESSION MODIFICATION COMPLETE?	–>	PDU SESSION MODIFICATION COMPLETE	4	F
30	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
–	EXCEPTION: Steps 31 to 46 shall be implemented if the UE supports remove USIM without power down: pc_USIM_Removal = TRUE [29]	–	–	–	–
31	The UE is switched off.	–	–	–	–
32	The UE is switched on.	–	–	–	–
33-42	The registration procedure is completed by executing steps 1-10 of the UE registration procedure in TS 38.508-1 [4] table 4.5.2.2-3.	–	–	–	–
43	Cause removal of USIM from the UE without powering down.	–	–	–	–
44	Check: Does the UE transmit a DEREGISTRATION REQUEST with the De-registration type IE indicating "switch off"?	–>	DEREGISTRATION REQUEST	2	P
45	SS Transmits DEREGISTRATION ACCEPT	<–	DEREGISTRATION ACCEPT	–	–
46	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–

9.2.6.1.1.3.3 Specific message contents

Table 9.2.6.1.1.3.3-1: DEREGISTRATION REQUEST (Step 1 and step 44, Table 9.2.6.1.1.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-12
Information Element	Value/Remark	Comment	Condition
De-registration type
Switch off	‘1’B

9.2.6.2 Network-initiated de-registration

9.2.6.2.1 Network-initiated de-registration / De-registration for Non-3GPP access / Re-registration required

9.2.6.2.1.1 Test Purpose (TP)

(1)

with { the UE in 5GMM-REGISTERED state }

ensure that {

when { the SS sends a DEREGISTRATION REQUEST message indicates "re-registration required" and the de-registration request is for non 3GPP access }

then { the UE sends a DEREGISTRATION ACCEPT message to the network and releases the existing NAS signalling connection, then initiates an initial registration and also re-establishes any previously established PDU sessions }

}

9.2.6.2.1.2 Conformance requirements

References: The conformance requirement covered in the present TC is specified in: 3GPP TS 24.501 clauses 5.5.2.3.2. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501 clause 5.5.2.3.2]

NOTE 1: When the de-registration type indicates "re-registration required", user interaction is necessary in some cases when the UE cannot re-establish the PDU session (s), if any, automatically.

…

Upon sending a DEREGISTRATION ACCEPT message, the UE shall delete the rejected NSSAI as specified in subclause 4.6.2.2.

If the de-registration type indicates "re-registration required", then the UE shall ignore the 5GMM cause IE if received.

If the de-registration type indicates "re-registration not required", the UE shall take the actions depending on the received 5GMM cause value:

#3 (Illegal UE);

#6 (Illegal ME); or

#7 (5GS services not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed. The UE shall delete the list of equivalent PLMNs and shall enter the state 5GMM-DEREGISTERED.

If the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when a DETACH REQUEST is received with the EMM cause with the same value and with detach type set to "re-attach not required".

NOTE 2: The possibility to configure a UE so that the radio transceiver for a specific radio access technology is not active, although it is implemented in the UE, is out of scope of the present specification.

If the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

…

#72 (Non-3GPP access to 5GCN not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED.

NOTE 3: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3).

The UE shall disable the N1 mode capability for non-3GPP access (see subclause 4.9.3).

As an implementation option, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

9.2.6.2.1.3 Test description

9.2.6.2.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27.

UE:

– None.

Preamble:

– the UE is in state 3W-A on WLAN Cell 27 according to TS 38.508-1 [4].

9.2.6.2.1.3.2 Test procedure sequence

Table 9.2.6.2.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message/PDU/SDU
1	The SS transmits a DEREGISTRATION REQUEST with indicates "re-registration required".	<–	DEREGISTRATION REQUEST	–	–
2	Check: Does the UE transmits a DEREGISTRATION ACCEPT message?	–>	DEREGISTRATION ACCEPT	1	P
3	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
–	EXCEPTION: step 4 describes a behaviour which depends on the UE capability	–	–	–	–
4	IF NOT pc_Automatic_Re_registration, the user initiates a registration by MMI.	–	–	–	–
6-15	The registration procedure is completed by executing steps 1-10 of the UE registration procedure in TS 38.508-1 [4] table 4.5.2.2-3.	–	–	1	P

9.2.6.2.1.3.3 Specific message contents

Table 9.2.6.2.1.3.3-1: DEREGISTRATION REQUEST (step 1, Table 9.2.6.2.1.3.2-1)

Derivation path: TS 38.508-1 [4] Table 4.7.1-14
Information Element	Value/Remark	Comment	Condition
DEREGISTRATION type
Switch off	‘0’B	Normal de-registration
Re-registration required	‘1’B	re-registration required
Access type	‘10’B	Non 3GPP access
5GMM cause	‘0000 0011’B	Cause #3 (Illegal UE)

Table 9.2.6.2.1.3.3-2: REGISTRATION REQUEST (step 8, Table 9.2.6.2.1.3.2-1)

Derivation path: TS 38.508-1 [4] Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS mobile identity	The valid 5G-GUTI that UE holds

9.2.6.2.2 Network-initiated de-registration / De-registration for Non 3GPP access / Re-registration not required

9.2.6.2.2.1 Test Purpose (TP)

(1)

with { the UE in 5GMM-REGISTERED state }

ensure that {

when { the SS sends a DEREGISTRATION REQUEST message indicates no 5GMM cause IE, ""re-registration not required"" and the de-registration request is for npn-3GPP access and 5GMM cause value is not included }

then { the UE deletes 5G-GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs, ngKSI, sends a DEREGISTRATION ACCEPT message enter the state 5GMM-DEREGISTERED for non 3GPP access }

}

(2)

with { the UE in 5GMM-REGISTERED state }

ensure that {

when { the SS sends a DEREGISTRATION REQUEST message indicates no 5GMM cause IE, "re-registration not required" and the de-registration request is for non-3GPP access and 5GMM cause value set to #7 5GS services not allowed }

then { the UE deletes 5G-GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs, ngKSI, consider the USIM as invalid for 5GS services until switching off or the UICC containing the USIM is removed, sends a DEREGISTRATION ACCEPT message enter the state 5GMM-DEREGISTERED for Non 3GPP access }

}

(3)

with { the UE in 5GMM-REGISTERED state }

ensure that {

then { the UE deletes 5G-GUTI, TAI list, last visited registered TAI, ngKSI, disable the N1 mode capability for non-3GPP access, sends a DEREGISTRATION ACCEPT message enter the state 5GMM-DEREGISTERED for Non 3GPP access }

}

9.2.6.2.2.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.501 clauses 5.5.2.3.2 and 5.5.2.3.4. Unless otherwise stated these are Rel-15 requirements.

[TS 24.501, clause 5.5.2.3.2]

Upon receiving the DEREGISTRATION REQUEST message, if the DEREGISTRATION REQUEST message indicates "re-registration not required" and the de-registration request is for 3GPP access, the UE shall release locally the PDU sessions over 3GPP access, if any. The UE shall send a DEREGISTRATION ACCEPT message to the network and enter the state 5GMM-DEREGISTERED for 3GPP access.

…

If the de-registration type indicates "re-registration not required", the UE shall take the actions depending on the received 5GMM cause value:

…

#7 (5GS services not allowed).

If the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

…

#72 (Non-3GPP access to 5GCN not allowed).

NOTE 3: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3).

The UE shall disable the N1 mode capability for non-3GPP access (see subclause 4.9.3).

As an implementation option, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

[TS 24.501, clause 5.5.2.3.4]

b) DEREGISTRATION REQUEST, other 5GMM cause values than those treated in subclause 5.5.2.3.2 or no 5GMM cause IE is included, and the De-registration type IE indicates "re-registration not required".

The UE shall delete 5G-GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs, ngKSI, shall set the 5GS update status to 5U2 NOT UPDATED and shall start timer T3502.

A UE not supporting S1 mode may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5]; otherwise the UE shall enter the state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.

A UE operating in single-registration mode shall:

– enter the state 5GMM-DEREGISTERED and attempt to select E-UTRAN radio access technology and proceed with the appropriate EMM specific procedures. In this case, the UE may disable N1 mode capability (see subclause 4.9); or

– enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

A UE operating in single-registration mode shall set the EPS update status to EU2 NOT UPDATED and shall delete the EMM parameters 4G-GUTI, last visited registered TAI, TAI list and eKSI and shall enter the state EMM-DEREGISTERED.

9.2.6.2.2.3 Test description

9.2.6.2.2.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27.

UE:

– None

Preamble:

– The UE is in state 3W-A on WLAN Cell 27 according to TS 38.508-1 [4].

9.2.6.2.2.3.2 Test procedure sequence

Table 9.2.6.2.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	SS sends a DEREGISTRATION REQUEST message indicates no 5GMM cause IE, "re-registration not required" and the de-registration request is for non 3GPP access	<–	NR 5GMM: DEREGISTRATION REQUEST	–	–
2	Check: Does the UE transmit an DEREGISTRATION ACCEPT message?	–>	NR 5GMM: DEREGISTRATION ACCEPT	1	P
3	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
4	Cause UE to initiate registration.	–	–	–	–
5-15	The registration procedure is completed by executing steps 1-10 of the UE registration procedure in TS 38.508-1 [4] table 4.5.2.2-3.	–	–	1	P
16	SS sends a DEREGISTRATION REQUEST message indicates no 5GMM cause IE, "re-registration not required", 5GMM Cause set to #7 (5GS services not allowed) and the de-registration request is for non 3GPP access	<–	NR 5GMM: DEREGISTRATION REQUEST	–	–
17	Check: Does the UE transmit an DEREGISTRATION ACCEPT message?	–>	NR 5GMM: DEREGISTRATION ACCEPT	2	P
18	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
19	Check for 60 seconds if UE initiates Registration procedure	–	NR 5GMM: REGISTRATION REQUEST	2	F
20	The UE is switched off.	–	–	–	–
21	The UE is switched on.	–	–	–	–
22-31	The registration procedure is completed by executing steps 1-10 of the UE registration procedure in TS 38.508-1 [4] table 4.5.2.2-3.	–	–	–	–
32	SS sends a DEREGISTRATION REQUEST message indicates no 5GMM cause IE, "re-registration not required", 5GMM Cause set to #72 (Non-3GPP access to 5GCN not allowed) and the de-registration request is for non 3GPP access	<–	NR 5GMM: DEREGISTRATION REQUEST	–	–
33	Check: Does the UE transmit an DEREGISTRATION ACCEPT message?	–>	NR 5GMM: DEREGISTRATION ACCEPT	3	P
34	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
35	Check for 60 seconds if UE initiates Registration procedure	–	NR 5GMM: REGISTRATION REQUEST	3	F
36	The UE is switched off.	–	–	–	–

9.2.6.2.2.3.3 Specific message contents

Table 9.2.6.2.2.3.3-1: Message DEREGISTRATION REQUEST (step 1, Table 9.2.6.2.2.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-12
Information Element	Value/remark	Comment	Condition
De-registration type
Switch off	‘0’B	Normal de-registration
Re-registration required	‘0’B	re-registration not required
Access type	‘01’B	3GPP access
5GMM cause	Not Present

Table 9.2.6.2.2.3.3-2: Message REGISTRATION REQUEST (step 8, Table 9.2.6.2.2.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-6
Information Element	Value/Remark	Comment	Condition
ngKSI
NAS key set identifier	‘111’B	no key is available (UE to network)
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111"
5GS mobile identity	The valid SUCI
Last visited registered TAI	Not present

Table 9.2.6.2.2.3.3-2: Message ATTACH REQUEST (step 28, Table 9.2.6.2.2.3.2-1)

Derivation Path: TS 36.508 [7], Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI1
Last visited registered TAI	Not present

9.2.7 Service request

9.2.7.1 Service request / IDLE mode uplink user data transport / Rejected / Restricted service area, Abnormal / T3517

9.2.7.1.1 Test Purpose (TP)

Same test purposes as clause 9.1.7.1.1

9.2.7.1.2 Conformance requirements

Same conformance requirements as in clause 9.1.7.1.2

9.2.7.1.3 Test description

9.2.7.1.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state 3W-A with PDU session Active state according to TS 38.508-1 [4]

9.2.7.1.3.2 Test procedure sequence

Table 9.2.7.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
2	Trigger UE to initiate IPSec SA (Note 1)	–	–	–	–
–	Exception: In parallel to steps 3, the UE initiates an IPsec security association and one child security association as defined in TS 24.502 [35] clause 7.3.2	–	–	–	–
3	Check: Does UE transmit a SERVICE REQUEST message with Service type IE set to ‘data’?	–>	SERVICE REQUEST	1	P
4	The SS transmits a SERVICE REJECT message with 5GMM cause = "Restricted service area ".	<–	SERVICE REJECT	–	–
5-6	Void.	–	–	–	–
6A	The SS starts timer 5 sec. Note: An arbitraty chosen timer to avoid message crossing.	–	–	–	–
–	EXCEPTION: Steps 6Ba1 to 6Bb3 describe behaviour that depends on the UE implementation; the "lower case letter" identifies a step sequence that take place if the UE is implemented in a certain way.	–	–	–	–
–	Exception: In parallel to steps 6Ba1 to 8B, the UE initiates an IPsec security association as defined in TS 24.502 [35] clause 7.3.2	–	–	–	–
6Ba1	Check: Does the UE transmit REGISTRATION REQUEST for mobility registration? NOTE: Allowed for Rel-15 UEs.	–>	REGISTRATION REQUEST	2	P
6Ba2	Stop timer 5 sec.	–	–	–	–
6Bb1	Timer 5 sec expires.	–	–	–	–
6Bb2	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
6Bb3	Check: Does the UE transmit REGISTRATION REQUEST for mobility registration over a new signalling connection?	–>	REGISTRATION REQUEST	2	P
7-8	Void.	–	–	–	–
8A	SS stops transmitting UL grant.	–	–	–	–
8B	SS sends a REGISTRATION ACCEPT message containing a 5G-GUTI.	<–	REGISTRATION ACCEPT	–	–
8C	SS trasnmits one UL grant, for the UE to transmit the REGISTRATION COMPLETE message at step 8D.	–	–	–	–
8D	The UE send a REGISTRATION COMPLETE.	–>	REGISTRATION COMPLETE	–	–
8E	The generic procedure for SS-requested IPsec Secure tunnel disconnection, specified in subclause 4.5A.3 of TS 38.508-1 [4], takes place performing disconnection of security association.	–	–	–	–
8F	The SS resumes UL grant transmission.	–	–	–	–
8G	The UE transmits a SERVICE REQUEST message over a new signalling connection.	–>	SERVICE REQUEST	–	–
8H	The SS does not respond to SERVICE REQUEST message. Note: The UE locally releases the signalling connection after T3517 expiry.	–	–	–	–
–	EXCEPTION: Steps 9 to 10 are repeated for 4 times.	–	–	–	–
9	Check: does the UE transmits a SERVICE REQUEST message after T3517 expiry but before 60s over a new signalling connection?	–>	SERVICE REQUEST	3	P
10	The SS does not respond to SERVICE REQUEST message. Note: The UE locally releases the signalling connection after T3517 expiry.	–>	SERVICE REQUEST	–	–
11	Check: Does the UE transmits a SERVICE REQUEST message within 60 seconds (minimum value of T3525) over a new signalling connection?	–>	SERVICE REQUEST	3,4	F
12	The SS starts timer 10 sec after Step 11 to see if UE performs the optional Steps listed below.	–	–	–	–
–	EXCEPTION: Steps 12a1 to 12a7a2 describe behaviour that depends on the UE implementation; the "lower case letter" identifies a step sequence that take place if the UE is implemented in a certain way.	–	–	–	–
12a1	Trigger UE to initiate IPSec SA (Note 1)	–	–	–	–
	Exception: In parallel to steps 12a2 to 12a5, the UE initiates an IPsec security association and one child security association as defined in TS 24.502 [35] clause 7.3.2	–	–	–	–
12a2	The UE transmits a SERVICE REQUEST message after T3525 expiry over a new signalling connection.	–>	SERVICE REQUEST	–	–
12a3-12a7a2	Steps 5 to 9a2 of the NR RRC_CONNECTED procedure in TS 38.508-1 [4] Table 4.5.4.2-3 are executed.	–	–	–	–
Note 1: This could be done by e.g. MMI or by AT command +CGACT.

9.2.7.1.3.3 Specific message contents

Table 9.2.7.1.3.3-3: SERVICE REQUEST (steps 3, 8G and 9, Table 9.2.7.1.3.2-1)

Derivation Path: TS 38.508-1 [4] Table 4.7.1-16
Information Element	Value/remark	Comment	Condition
Service type
Service type value	‘0001’B	data

Table 9.2.7.1.3.3-4: SERVICE REJECT (step 4, Table 9.2.7.1.3.2-1)

Derivation Path: TS 38.508-1 [4] Table 4.7.1-18
Information Element	Value/remark	Comment	Condition
5GMM cause	‘0001 1100’B	Restricted service area

9.2.7.2 Service request / CMM CONNECTED mode/uplink user data transport / Abnormal / T3517

9.2.7.2.1 Test Purpose (TP)

(1)

with { the UE is in 5GMM-REGISTERED state and 5GMM-CONNECTED mode over 3GPP access }

ensure that {

when { the UE has user data pending due to no user-plane resources established for PDU session(s) used for user data transport }

then { the UE sends a SERVICE REQUEST message }

}

(2)

with { the UE sends a SERVICE REQUEST message in 5GMM-CONNECTED mode }

ensure that {

when { T3517 expired }

then { the UE stays in 5GMM-CONNECTED mode }

}

9.2.7.2.2 Conformance requirements

Same conformance requirements as in clause 9.1.7.2.2

9.2.7.2.3 Test description

9.2.7.2.3.1 Pre-test conditions

System Simulator:

– WLAN Cell 27

UE:

– None.

Preamble:

– The UE is in state 3W-A with PDU session (with PDU session ID X where 1 <= X <= 15) Active state according to TS 38.508-1 [4]

9.2.7.2.3.2 Test procedure sequence

Table 9.2.7.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS initiated child SA deletion procedure sec tunnel as defined in TS 24.502 [33] clause 7.7.2	–	–	–	–
2	Trigger UE to send a ICMP ECHO REQUEST (pc_IPv4 = TRUE)_or ICMPv6 ECHO REQUEST (pc_IPv6 = TRUE) (Note 2)	–	–	–	–
3	The UE transmits a SERVICE REQUEST message.	–>	NR 5GMM: SERVICE REQUEST	1	P
4	The SS does not respond to the SERVICE REQUEST message.	–	–	–	–
5	Wait for T3517 seconds (Note 1).	–	–	–	–
6	The UE transmit a SERVICE REQUEST message.	–>	NR 5GMM: SERVICE REQUEST	–	–
7	The SS sends an IDENTITY REQUEST message.	<–	NR 5GMM: IDENTITY REQUEST	–	–
8	Check: Does the UE transmit an IDENTITY RESPONSE message?	–>	NR 5GMM: IDENTITY RESPONSE	2	P
–	Exception: In parallel to steps 9, the SS initiates one child security association as defined in TS 24.502 [33] clause 7.5	–	–	–	–
9	The SS transmits SERVICE ACCEPT message to setup User-plane resources for the PDU session X.	<–	NR 5GMM: SERVICE ACCEPT
–	EXCEPTION: Steps 10a1 to 10b2 describe behaviour that depends on the UE implementation; the "lower case letter" identifies a step sequence that take place depending on the UE implementation.	–	–	–	–
10a1	IF (pc_IPv4 = TRUE) THEN, check that the UE sends an ICMP Echo request to the SS?	–>	ICMP ECHO REQUEST	1	P
10a2	The SS sends an ICMP Echo reply	<–	ICMP ECHO REPLY	–
10b1	ELSE IF (pc_IPv4 = FALSE AND pc_IPv6 = TRUE) THEN, check the UE sends an ICMPv6 Echo request to the SS?	–>	ICMPv6 ECHO REQUEST	1	P
10b2	The SS sends an ICMPv6 Echo reply	<–	ICMPv6 ECHO REPLY	–	–
Note 1: T3517 expires after 15 seconds. Note 2: This could be done by a MMI command

9.2.7.2.3.3 Specific message contents

Table 9.2.7.2.3.3-1: SERVICE REQUEST (step 3, 6, Table 9.2.7.2.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-16
Information Element	Value/Remark	Comment	Condition
Service type	‘0001’B	data
Uplink data status
PSI(X)	‘1’B	PSI(X) is set to 1 indicates that uplink data are pending for the PDU session X activated in preamble.

Table 9.2.7.2.3.3-2: IDENTITY REQUEST (step 7, Table 9.2.7.2.3.2-1)

Derivation Path: TS 38.508-1 [4] table 4.7.1-21
Information Element	Value/remark	Comment	Condition
Identity type	‘0010’B	5G-GUTI

Table 9.2.7.2.3.3-3: IDENTITY RESPONSE (step 8, Table 9.2.7.2.3.2-1)

Derivation Path: TS 38.508-1 [4] table 4.7.1-22
Information Element	Value/remark	Comment	Condition
Mobile identity	5G-GUTI

Table 9.2.7.2.3.3-4: SERVICE ACCEPT (step 9, Table 9.2.7.2.3.2-1)

Derivation path: TS 38.508-1 [4], table 4.7.1-17
Information Element	Value/Remark	Comment	Condition
PDU session reactivation result
PSI(X)	‘0’B	PSI(X) is set to 0 indicates that establishment of user-plane resource of the PDU session X activated in preamble is successful.

9.2.8 SMS over NAS

9.2.8.1 SMS over NAS / MO SMS over NAS – 5GMM-Idle mode

9.2.8.1.1 Test Purpose (TP)

(1)

with { the UE in switched off state with valid USIM inserted }

ensure that {

when { the UE requests initial registration for SMS over NAS }

then { the UE shall send REGISTRATION REQUEST message with SMS requested bit of the 5GS registration type IE "SMS over NAS supported" }

}

(2)

with { the UE in 5GMM_Connected state with 5GMM-Idle mode and the UE has sent a SERVICE REQUEST message triggered by initiating MO SMS}

ensure that {

when { UE receives a SERVICE ACCEPT message from SS }

then { UE sends CP-DATA containing RP-DATA RPDU (SMS SUBMIT TPDU) encapsulated in an Uplink NAS transport message }

}

(3)

with { UE has sent CP-DATA containing an RP-DATA RPDU (SMS SUBMIT TPDU) encapsulated in an Uplink NAS transport message }

ensure that {

when { UE receives a CP-DATA containing an RP-ACK RPDU encapsulated in a Downlink NAS transport message }

then { UE sends a CP-ACK encapsulated in an Uplink NAS Transport message }

9.2.8.1.2 Conformance requirements

Same conformance requirements as in clause 9.2.8.1.2

9.2.8.1.3 Test description

9.2.8.1.3.1 Pre-test conditions

System Simulator:

WLAN Cell 27;

UE:

The UE does not have any stored SMS message.

Preamble:

The UE is in state Switched OFF (state-0W-B) according to TS 38.508-1 [4].

9.2.8.1.3.2 Test procedure sequence

Table 9.2.8.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched ON	–	–	–	–
2-3	Steps 1-2 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
–	Exception: The UE establishes an IPsec tunnel in parallel to 5GC registration steps 4 to 8 as per the IKEv2 protocol as defined in 3GPP TS 23.502 [31] clause 4.12.2.2 figure 4.12.2.2-1.	–	–	–	–
4	Check: Does UE transmit a REGISTRATION REQUEST message including 5GS update type IE with SMS requested bit set to "SMS over NAS supported"?	–>	REGISTRATION REQUEST	1	P
5 – 8	Steps 4-5 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
9	SS transmits REGISTRATION ACCEPT message including 5GS registration result with SMS allowed bit set to “SMS over NAS allowed”.	<–	REGISTRATION ACCEPT	–	–
10 -12	Steps 9-11 of the generic procedure for UE registration specified in TS 38.508-1 [4] table 4.5.2.2-3 are performed.	–	–	–	–
13	Sending of a 160 character MO SMS is initiated at the UE via MMI or AT command	–	–	–	–
14	UE transmits establishes a IPSEC SA and NAS signalling connection as per generic procedure in table 4.5A.4.2.2-1 of 38.508-1 [4]”.	–	–	–	–
15	Check: Does the UE transmit a CP-DATA containing an RP-DATA RPDU (SMS SUBMIT TPDU) encapsulated in an Uplink NAS transport message?	–>	UPLINK NAS TRANSPORT	2	P
16	The SS transmits a CP-ACK encapsulated in a Downlink NAS Transport message.	<–	DOWNLINK NAS TRANSPORT	–	–
17	The SS transmits a CP-DATA containing an RP-ACK RPDU encapsulated in a Downlink NAS transport message	<–	DOWNLINK NAS TRANSPORT	–	–
18	Check: Does the UE transmit a CP-ACK encapsulated in an Uplink NAS Transport message?	–>	UPLINK NAS TRANSPORT	3	P

9.2.8.1.3.3 Specific message contents

Table 9.2.8.1.3.3-1: REGISTRATION REQUEST (step 4, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-6
Information Element	Value/remark	Comment	Condition
5GS registration type
5GS registration type value	‘001’B		INITIAL
5GS update type
SMS requested	SMS over NAS supported

Table 9.2.8.1.3.3-2: REGISTRATION ACCEPT (step 9, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-7
Information Element	Value/remark	Comment	Condition
5GS registration result
SMS allowed	SMS over NAS allowed
T3512 value
Timer value	‘00011’B
Unit	‘101’B

Table 9.2.8.1.3.3-3: UL NAS TRANSPORT (step 15, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-10
Information Element	Value/remark	Comment	Condition
Payload container type	‘0010’B	SMS
Payload container	CP-DATA	RP-DATA RPDU

Table 9.2.8.1.3.3-3a:Message CP-DATA (step 15, Table 9.2.8.1.3.2-1)

Information Element	Value/remark	Comment	Condition
CP-User data	RP-DATA

Table 9.2.8.1.3.3-4: DL NAS TRANSPORT (step 16, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-11
Information Element	Value/remark	Comment	Condition
Payload container type	‘0010’B	SMS
Payload container	CP-ACK

Table 9.2.8.1.3.3-5: DL NAS TRANSPORT (step 17, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-11
Information Element	Value/remark	Comment	Condition
Payload container type	‘0010’B	SMS
Payload container	CP-DATA	RP-ACK RPDU

Table 9.2.8.1.3.3-5a:Message CP-DATA (step 17, Table 9.2.8.1.3.2-1)

Information Element	Value/remark	Comment	Condition
CP-User data	RP-DATA

Table 9.2.8.1.3.3-6: UL NAS TRANSPORT (step 18, Table 9.2.8.1.3.2-1)

Derivation path: TS 38.508-1 [4], Table 4.7.1-10
Information Element	Value/remark	Comment	Condition
Payload container type	‘0010’B	SMS
Payload container	CP-ACK