27.5a Forbidden PLMNs, GPRS attach
3GPP51.010-1Mobile Station (MS) conformance specificationPart 1: Conformance specificationTS
27.5a.1 Definition
A list of forbidden PLMNs stored in the SIM and providing storage for up to 4 entries is managed by the MS. In automatic PLMN selection mode the MS controls registration attempts to appropriate networks with respect to this list of forbidden PLMNs. As a result of an ATTACH REJECT with the cause "PLMN not allowed" the MS stores the PLMN which rejected the ATTACH request in the SIM.
After a GPRS attach procedure, which does not have an authentication procedure, the cipher key sequence number indicates that the cipher key is undefined.
27.5a.2 Conformance requirement
1. The UE shall select and attempt registration on other PLMNs, if available and allowable, if the location area is not in the list of "forbidden LAs for roaming" and the tracking area is not in the list of "forbidden TAs for roaming" (see 3GPP TS 23.122 [3]), in the following order:
In the case of a UE operating in UE operation mode A or B, an allowable PLMN is one which is not in the "Forbidden PLMN" data field in the SIM/USIM . This data field may be extended in the ME memory.(see subclause 3.2.2.4). In the case of a UE operating in UE operation mode C, an allowable PLMN is one which is not in the "Forbidden PLMN" data field in the SIM/USIM or in the list of "forbidden PLMNs for GPRS service" in the ME.
3GPP TS 02.11 / 3GPP TS 22.011 subclause 3.2.2.2
3GPP TS 11.11 / 3GPP TS 51.011 subclauses 10.3.16 and 11.4.8
2. The MS receiving the ATTACH REJECT message, […] shall then take one of the following actions depending upon the reject cause:
[…]
# 11 (PLMN not allowed);
The MS shall delete any RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number stored, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2), shall reset the GPRS attach attempt counter and shall change to state GMM-DEREGISTERED.
The MS shall store the PLMN identity in the "forbidden PLMN list".
3GPP TS 04.08 / 3GPP TS 24.008 subclause 4.7.3.1.4
3. When four FPLMNs are held in the EF, and rejection of a further PLMN is received by the ME from the network, the ME shall modify the EF using the UPDATE command. This new PLMN shall be stored in the fourth position, and the existing list "shifted" causing the previous contents of the first position to be lost.
3GPP TS 11.11 / 3GPP TS 51.011 subclauses 10.3.16 and 11.4.8
27.5a.3 Test purpose
1) To verify that in automatic PLMN selection mode the MS does not attempt to access PLMNs stored in EFFPLMN on the SIM.
2) To verify that the EFFPLMN is correctly updated by the ME after receipt of an ATTACH REJECT message with cause "PLMN not allowed".
3) To verify that the EFKcGPRS has been correctly updated by the ME.
4) To verify that the EFLOCIGPRS has been correctly updated by the ME.
27.5a.4 Method of test
27.5a.4.1 Initial conditions
The SS transmits default message contents of Cell A, subclauses 40.1.1 and 40.2.1.1 on the BCCH, with the following exceptions:
RAI-MCC: 234
RAI-MNC 02 or 023 (see Note 0)
RAI-LAC: 0001
Access control: unrestricted.
Network Mode of Operation is set to NMO II.
The GPRS SIM is used with the following exception:
EFIMSI (IMSI)
Logically: 246811111111111 (2-digit MNC) or 246813111111111 (3-digit MNC)
Coding:
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
B8 |
B9 |
|
2-digit MNC |
08 |
29 |
64 |
18 |
11 |
11 |
11 |
11 |
11 |
3-digit MNC |
08 |
29 |
64 |
18 |
13 |
11 |
11 |
11 |
11 |
EFLOCIGPRS (GPRS Location Information)
Logically: RAI-MCC: 234
RAI-MNC: 01 or 012 (See Note 0)
RAI-LAC: 0000
RAI-RAC: 01
P-TMSI: "D7654321"
P-TMSI signature value: "443322"
Coding:
Coding: |
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
2-digit MNC |
D7 |
65 |
43 |
21 |
44 |
33 |
22 |
3-digit MNC |
D7 |
65 |
43 |
21 |
44 |
33 |
22 |
Coding: |
B8 |
B9 |
B10 |
B11 |
B12 |
B13 |
B14 |
2-digit MNC |
32 |
F4 |
10 |
00 |
00 |
01 |
00 |
3-digit MNC |
32 |
24 |
10 |
00 |
00 |
01 |
00 |
EFKcGPRS (Ciphering Key KcGPRS)
Logically: Key KcGPRS: undefined
Sequence No: 4
Coding:
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
B8 |
B9 |
xx |
xx |
xx |
Xx |
xx |
xx |
xx |
xx |
04 |
The SIM is installed into the ME and the MS is set to automatic PLMN selection mode.
27.5a.4.2 Procedure
a) The MS is powered on.
b) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:
RAI (MCC/MNC): 234/03 or 234/034 (see Note 0).
The SS then resumes RF output on the BCCH.
c) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:
RAI (MCC/MNC): 234/04 or 234/045 (see Note 0).
The SS then resumes RF output on the BCCH.
d) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:
RAI (MCC/MNC): 234/05 or 234/056 (see Note 0).
The SS then resumes RF output on the BCCH.
e) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:
RAI (MCC/MNC): 234/01 or 234/012 (see Note 0).
The SS then resumes RF output on the BCCH.
f) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.
g) After receipt of an ATTACH REQUEST from the MS, the SS sends ATTACH REJECT to the MS with cause "PLMN Not Allowed".
The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:
RAI (MCC/MNC): 234/06 or 234/067 (see Note 0).
The SS then resumes RF output on the BCCH.
h) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.
i) After receipt of an ATTACH REQUEST from the MS, the SS sends ATTACH ACCEPT with:
RAI-MCC: 234
RAI-MNC 06 or 067 (see Note 0)
RAI-LAC 0001
RAI-RAC 05
P-TMSI: "D8765432"
P- TMSI signature value: "554433"
to the MS.
j) The MS is soft powered down.
27.5a.5 Test requirement
1) After each of the steps a) to d) the MS shall not attempt a GPRS attach procedure.
2) After step f) the MS shall send ATTACH REQUEST to the SS.
3) After step h) the MS shall send ATTACH REQUEST to the SS.
4) After step i) the MS shall respond with ATTACH COMPLETE.
5) Before step j) the SIM shall contain the following values:
EFLOCIGPRS (GPRS Location Information)
Logically: RAI-MCC: 234
RAI-MNC: 06 or 067 (See Note 0)
RAI-LAC: 0001
RAI-RAC: 05
P-TMSI: "D8765432"
P-TMSI signature value: "554433"
Coding:
Coding: |
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
2-digit MNC |
D8 |
76 |
54 |
32 |
55 |
44 |
33 |
3-digit MNC |
D8 |
76 |
54 |
32 |
55 |
44 |
33 |
Coding: |
B8 |
B9 |
B10 |
B11 |
B12 |
B13 |
B14 |
2-digit MNC |
32 |
F4 |
60 |
00 |
01 |
05 |
00 |
3-digit MNC |
32 |
74 |
60 |
00 |
01 |
05 |
00 |
EFKcGPRS (Ciphering Key KcGPRS)
Logically: Key KcGPRS: xx
Sequence No: 7
Coding:
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
B8 |
B9 |
xx |
xx |
Xx |
xx |
xx |
xx |
xx |
xx |
07 |
EFFPLMN (Forbidden PLMNs)
Logically:
PLMN1 |
PLMN2 |
PLMN3 |
PLMN4 |
||
MCC |
234 |
234 |
234 |
234 |
|
MNC |
2-digit |
03 |
04 |
05 |
01 |
3-digit |
034 |
045 |
056 |
012 |
Coding:
B1 |
B2 |
B3 |
B4 |
B5 |
B6 |
B7 |
B8 |
B9 |
B10 |
B11 |
B12 |
|
2-digit MNC |
32 |
F4 |
30 |
32 |
F4 |
40 |
32 |
F4 |
50 |
32 |
F4 |
10 |
3-digit MNC |
32 |
44 |
30 |
32 |
54 |
40 |
32 |
64 |
50 |
32 |
24 |
10 |