Section: 6.16.1.1 Security procedures for Small Data Transfer in Control Plane CIoT 5GS Optimisation
Content: The Control Plane Optimisation for 5GS CIoT is used to exchange small user data or SMS as payload of a NAS message in both uplink and downlink directions. The UE and the AMF perform integrity protection and ciphering for the small user data or SMS using NAS security context specific to the NAS connection. If UE uses Control Plane optimisation for 5GS CIoT for Mobile Originated data transport, the UE sends a Control Plane Service Request message including a container for small user data or SMS transport. The Control Plane Service Request message shall be partially ciphered (i.e. the container including uplink user data or SMS is ciphered, and non-cleartext remains unciphered) and integrity protected by the current 5G NAS security context specific to the NAS connection if such exists as depicted in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35]. Upon reception of the Control Plane Service Request message with the ciphered container for small user data or SMS transport, the AMF shall verify integrity of the whole Control Plane Service Request message and decipher the ciphered container to obtain the small user data or SMS. When applying NAS ciphering/deciphering mechanism for the container, the LENGTH value shall be set to the length of the container contents. Additionally, if UE uses Control Plane optimisation for 5GS CIoT for Mobile Originated data transport, the UE in CM-CONNECTED mode sends small user data or SMS in UL NAS transport message to the AMF. The UL NAS transport message shall be ciphered and integrity protected with the current 5G NAS security context specific to the NAS connection. Upon reception of the UL NAS transport message for small user data or SMS transport, the AMF shall verify integrity and decipher the UL NAS transport message to obtain the small user data or SMS. If UE uses Control Plane optimisation for 5GS CIoT for Mobile Terminated data transport, the UE obtains small user data or SMS in DL NAS transport message from the AMF. The DL NAS transport message shall be ciphered and integrity protected with the current 5G NAS security context specific to the NAS connection. Upon reception of the DL NAS transport message for small user data or SMS transport, the UE shall verify integrity and decipher the DL NAS transport message to obtain the small user data or SMS.