27.5 Forbidden PLMNs, location updating and undefined cipher key

3GPP51.010-1Mobile Station (MS) conformance specificationPart 1: Conformance specificationTS

27.5.1 Definition

A list of forbidden PLMNs stored in the SIM and providing storage for up to 4 entries is managed by the MS. In automatic PLMN selection mode the MS controls location updating attempts to appropriate networks with respect to this list of forbidden PLMNs. As a result of a location update reject with the cause "PLMN not allowed" the MS stores the PLMN which rejected the update request in the SIM.

After a location update, which is not followed by an authentication procedure, the cipher key sequence number indicates that the cipher key is undefined.

27.5.2 Conformance requirement

1. In automatic PLMN selection mode the MS shall only attempt a LOCATION UPDATE if it receives a BCCH containing a LAI that is not indicated in the EFFPLMN in the SIM.

3GPP TS 02.11, subclause 2.3, 3GPP TS 11.11, subclauses 11.2.1 and 11.4.8.

2. After receipt of a LOCATION UPDATE REJECT message with the cause "PLMN not allowed" the ME shall update the EFFPLMN in the SIM.

3GPP TS 02.11, subclause 2.3, 3GPP TS 11.11, subclauses 11.2.1 and 11.4.8.

3. After call termination the SIM shall contain the correct cipher key sequence number.

3GPP TS 11.11, subclauses 11.2.2, 11.4.5 and 11.4.6, 3GPP TS 02.17, subclause 6.1.

4. After call termination the SIM shall contain the correct TMSI and location information received by the MS.

3GPP TS 11.11, subclauses 11.2.2, 11.4.5 and 11.4.6, 3GPP TS 02.17, subclause 6.1.

27.5.3 Test purpose

1) To verify that in automatic PLMN selection mode the MS does not attempt to access PLMNs stored in EFFPLMN on the SIM.

2) To verify that the EFFPLMN is correctly updated by the ME after receipt of a LOCATION UPDATE REJECT message with cause "PLMN not allowed".

3) To verify that the EFKc has been correctly updated by the ME.

4) To verify that the EFLOCI has been correctly updated by the ME.

27.5.4 Method of test

27.5.4.1 Initial conditions

The SS transmits on the BCCH, with the following network parameters:

Attach/detach: disabled.

LAI-MCC: 234

LAI-MNC 02 or 023 (see Note 0)

LAI-LAC: 0001

Access control: unrestricted.

The default SIM is used with the following exception:

EFIMSI (IMSI)

Logically: 246811111111111 (2-digit MNC) or 246813111111111 (3-digit MNC)

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

2-digit MNC

08

29

64

18

11

11

11

11

11

3-digit MNC

08

29

64

18

13

11

11

11

11

EFLOCI (Location Information)

Logically: LAI-MCC: 234

LAI-MNC: 01 or 012 (See Note 0)

LAI-LAC: 0000

TMSI: "32547698"

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

B10

B11

32

54

76

98

32

F4

10

00

00

FF

00

The SIM is installed into the ME and the MS is set to automatic PLMN selection mode.

EFKc (Ciphering Key Kc)

Logically: Key Kc: undefined

Sequence No: 2

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

xx

xx

xx

xx

xx

xx

xx

xx

02

27.5.4.2 Procedure

a) The MS is powered on.

b) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

LAI (MCC/MNC): 234/03 or 234/034 (see Note 0).

The SS then resumes RF output on the BCCH.

c) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

LAI (MCC/MNC): 234/04 or 234/045 (see Note 0).

The SS then resumes RF output on the BCCH.

d) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

LAI (MCC/MNC): 234/05 or 234/056 (see Note 0).

The SS then resumes RF output on the BCCH.

e) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

LAI (MCC/MNC): 234/01 or 234/012 (see Note 0).

The SS then resumes RF output on the BCCH.

f) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.

g) After receipt of a LOCATION UPDATE REQUEST from the MS, the SS sends LOCATION UPDATE REJECT to the MS with cause "PLMN Not Allowed", followed by CHANNEL RELEASE.

The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

LAI (MCC/MNC): 234/06 or 234/067 (see Note 0).

The SS then resumes RF output on the BCCH.

h) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.

i) After receipt of a LOCATION UPDATE REQUEST from the MS, the SS sends LOCATION UPDATE ACCEPT with:

LAI-MCC: 234

LAI-MNC 06 or 067 (see Note 0)

TMSI: "43658709".

to the MS.

j) After receipt of a TMSI REALLOCATION COMPLETE from the MS, the SS sends CHANNEL RELEASE to the MS.

k) The MS is soft powered down.

27.5.5 Test requirement

1) After each of the steps a) to d) the MS shall not attempt a LOCATION UPDATE.

2) After step f) the MS shall send LOCATION UPDATE REQUEST to the SS.

3) After step h) the MS shall send LOCATION UPDATE REQUEST to the SS.

4) After step i) the MS shall respond with TMSI REALLOCATION COMPLETE.

5) After step k) the SIM shall contain the following values:

EFLOCI (Location Information)

Logically: LAI-MCC: 234

LAI-MNC: 06 or 067 (See Note 0)

TMSI: "43658709"

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

B10

B11

2-digit MNC

43

65

87

09

32

F4

60

xx

xx

xx

00

3-digit MNC

43

65

87

09

32

74

60

xx

xx

xx

00

EFKc (Ciphering Key Kc)

Logically: Key Kc: xx

Sequence No: 7

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

xx

xx

xx

xx

xx

xx

xx

xx

07

EFFPLMN (Forbidden PLMNs)

Logically:

PLMN1

PLMN2

PLMN3

PLMN4

MCC

234

234

234

234

MNC

2-digit

03

04

05

01

3-digit

034

045

056

012

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

B10

B11

B12

2-digit MNC

32

F4

30

32

F4

40

32

F4

50

32

F4

10

3-digit MNC

32

44

30

32

54

40

32

64

50

32

24

10