Section: 5.4.2.6 Authentication not accepted by the UE
Content: In an EPS authentication challenge, the UE shall check the authenticity of the core network by means of the AUTN parameter received in the AUTHENTICATION REQUEST message. This enables the UE to detect a false network. During an EPS authentication procedure, the UE may reject the core network due to an incorrect AUTN parameter (see 3GPP TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [19]). This parameter contains three possible causes for authentication failure: a) MAC code failure: If the UE finds the MAC code (supplied by the core network in the AUTN parameter) to be invalid, the UE shall send an AUTHENTICATION FAILURE message to the network, with the EMM cause #20 "MAC failure". The UE shall then follow the procedure described in clause 5.4.2.7, item c. b) Non-EPS authentication unacceptable: If the UE finds that the "separation bit" in the AMF field of AUTN supplied by the core network is 0, the UE shall send an AUTHENTICATION FAILURE message to the network, with the EMM cause #26 "non-EPS authentication unacceptable" (see clause 6.1.1 in 3GPP TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [19]). The UE shall then follow the procedure described in clause 5.4.2.7, item d. c) SQN failure: If the UE finds the SQN (supplied by the core network in the AUTN parameter) to be out of range, the UE shall send an AUTHENTICATION FAILURE message to the network, with the EMM cause #21 "synch failure" and a re-synchronization token AUTS provided by the USIM (see 3GPP TS 33.102[ 3G security; Security architecture ]  [18]). The UE shall then follow the procedure described in clause 5.4.2.7, item e. If the UE returns an AUTHENTICATION FAILURE message to the network, the UE shall delete any previously stored RAND and RES and shall stop timer T3416, if running. If the UE has a PDN connection for emergency bearer services established or is establishing such a PDN connection, additional UE requirements are specified in clause 5.4.2.7, under "for items c, d, e". If the UE is attached for access to RLOS and has a PDN connection for RLOS established or is establishing such a PDN connection, additional UE requirements are specified in clause 5.4.2.7, under "for items c, d, e".