27.5a Forbidden PLMNs, GPRS attach

3GPP51.010-1Mobile Station (MS) conformance specificationPart 1: Conformance specificationTS

27.5a.1 Definition

A list of forbidden PLMNs stored in the SIM and providing storage for up to 4 entries is managed by the MS. In automatic PLMN selection mode the MS controls registration attempts to appropriate networks with respect to this list of forbidden PLMNs. As a result of an ATTACH REJECT with the cause "PLMN not allowed" the MS stores the PLMN which rejected the ATTACH request in the SIM.

After a GPRS attach procedure, which does not have an authentication procedure, the cipher key sequence number indicates that the cipher key is undefined.

27.5a.2 Conformance requirement

1. The UE shall select and attempt registration on other PLMNs, if available and allowable, if the location area is not in the list of "forbidden LAs for roaming" and the tracking area is not in the list of "forbidden TAs for roaming" (see 3GPP TS 23.122 [3]), in the following order:

In the case of a UE operating in UE operation mode A or B, an allowable PLMN is one which is not in the "Forbidden PLMN" data field in the SIM/USIM . This data field may be extended in the ME memory.(see subclause 3.2.2.4). In the case of a UE operating in UE operation mode C, an allowable PLMN is one which is not in the "Forbidden PLMN" data field in the SIM/USIM or in the list of "forbidden PLMNs for GPRS service" in the ME.

3GPP TS 02.11 / 3GPP TS 22.011 subclause 3.2.2.2

3GPP TS 11.11 / 3GPP TS 51.011 subclauses 10.3.16 and 11.4.8

2. The MS receiving the ATTACH REJECT message, […] shall then take one of the following actions depending upon the reject cause:

[…]

# 11 (PLMN not allowed);

The MS shall delete any RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number stored, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2), shall reset the GPRS attach attempt counter and shall change to state GMM-DEREGISTERED.

The MS shall store the PLMN identity in the "forbidden PLMN list".

3GPP TS 04.08 / 3GPP TS 24.008 subclause 4.7.3.1.4

3. When four FPLMNs are held in the EF, and rejection of a further PLMN is received by the ME from the network, the ME shall modify the EF using the UPDATE command. This new PLMN shall be stored in the fourth position, and the existing list "shifted" causing the previous contents of the first position to be lost.

3GPP TS 11.11 / 3GPP TS 51.011 subclauses 10.3.16 and 11.4.8

27.5a.3 Test purpose

1) To verify that in automatic PLMN selection mode the MS does not attempt to access PLMNs stored in EFFPLMN on the SIM.

2) To verify that the EFFPLMN is correctly updated by the ME after receipt of an ATTACH REJECT message with cause "PLMN not allowed".

3) To verify that the EFKcGPRS has been correctly updated by the ME.

4) To verify that the EFLOCIGPRS has been correctly updated by the ME.

27.5a.4 Method of test

27.5a.4.1 Initial conditions

The SS transmits default message contents of Cell A, subclauses 40.1.1 and 40.2.1.1 on the BCCH, with the following exceptions:

RAI-MCC: 234

RAI-MNC 02 or 023 (see Note 0)

RAI-LAC: 0001

Access control: unrestricted.

Network Mode of Operation is set to NMO II.

The GPRS SIM is used with the following exception:

EFIMSI (IMSI)

Logically: 246811111111111 (2-digit MNC) or 246813111111111 (3-digit MNC)

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

2-digit MNC

08

29

64

18

11

11

11

11

11

3-digit MNC

08

29

64

18

13

11

11

11

11

EFLOCIGPRS (GPRS Location Information)

Logically: RAI-MCC: 234

RAI-MNC: 01 or 012 (See Note 0)

RAI-LAC: 0000

RAI-RAC: 01

P-TMSI: "D7654321"

P-TMSI signature value: "443322"

Coding:

Coding:

B1

B2

B3

B4

B5

B6

B7

2-digit MNC

D7

65

43

21

44

33

22

3-digit MNC

D7

65

43

21

44

33

22

Coding:

B8

B9

B10

B11

B12

B13

B14

2-digit MNC

32

F4

10

00

00

01

00

3-digit MNC

32

24

10

00

00

01

00

EFKcGPRS (Ciphering Key KcGPRS)

Logically: Key KcGPRS: undefined

Sequence No: 4

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

xx

xx

xx

Xx

xx

xx

xx

xx

04

The SIM is installed into the ME and the MS is set to automatic PLMN selection mode.

27.5a.4.2 Procedure

a) The MS is powered on.

b) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

RAI (MCC/MNC): 234/03 or 234/034 (see Note 0).

The SS then resumes RF output on the BCCH.

c) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

RAI (MCC/MNC): 234/04 or 234/045 (see Note 0).

The SS then resumes RF output on the BCCH.

d) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

RAI (MCC/MNC): 234/05 or 234/056 (see Note 0).

The SS then resumes RF output on the BCCH.

e) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

RAI (MCC/MNC): 234/01 or 234/012 (see Note 0).

The SS then resumes RF output on the BCCH.

f) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.

g) After receipt of an ATTACH REQUEST from the MS, the SS sends ATTACH REJECT to the MS with cause "PLMN Not Allowed".

The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the MS. The BCCH is changed to contain:

RAI (MCC/MNC): 234/06 or 234/067 (see Note 0).

The SS then resumes RF output on the BCCH.

h) After receipt of a CHANNEL REQUEST from the MS, the SS sends IMMEDIATE ASSIGNMENT to the MS.

i) After receipt of an ATTACH REQUEST from the MS, the SS sends ATTACH ACCEPT with:

RAI-MCC: 234

RAI-MNC 06 or 067 (see Note 0)

RAI-LAC 0001

RAI-RAC 05

P-TMSI: "D8765432"

P- TMSI signature value: "554433"

to the MS.

j) The MS is soft powered down.

27.5a.5 Test requirement

1) After each of the steps a) to d) the MS shall not attempt a GPRS attach procedure.

2) After step f) the MS shall send ATTACH REQUEST to the SS.

3) After step h) the MS shall send ATTACH REQUEST to the SS.

4) After step i) the MS shall respond with ATTACH COMPLETE.

5) Before step j) the SIM shall contain the following values:

EFLOCIGPRS (GPRS Location Information)

Logically: RAI-MCC: 234

RAI-MNC: 06 or 067 (See Note 0)

RAI-LAC: 0001

RAI-RAC: 05

P-TMSI: "D8765432"

P-TMSI signature value: "554433"

Coding:

Coding:

B1

B2

B3

B4

B5

B6

B7

2-digit MNC

D8

76

54

32

55

44

33

3-digit MNC

D8

76

54

32

55

44

33

Coding:

B8

B9

B10

B11

B12

B13

B14

2-digit MNC

32

F4

60

00

01

05

00

3-digit MNC

32

74

60

00

01

05

00

EFKcGPRS (Ciphering Key KcGPRS)

Logically: Key KcGPRS: xx

Sequence No: 7

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

xx

xx

Xx

xx

xx

xx

xx

xx

07

EFFPLMN (Forbidden PLMNs)

Logically:

PLMN1

PLMN2

PLMN3

PLMN4

MCC

234

234

234

234

MNC

2-digit

03

04

05

01

3-digit

034

045

056

012

Coding:

B1

B2

B3

B4

B5

B6

B7

B8

B9

B10

B11

B12

2-digit MNC

32

F4

30

32

F4

40

32

F4

50

32

F4

10

3-digit MNC

32

44

30

32

54

40

32

64

50

32

24

10