Section: 4.4.2.3 Establishment of secure exchange of NAS messages
Content: Secure exchange of NAS messages via a NAS signalling connection is usually established by the MME during the attach procedure by initiating a security mode control procedure. After successful completion of the security mode control procedure, all NAS messages exchanged between the UE and the MME are sent integrity protected using the current EPS security algorithms, and except for the messages specified in clause 4.4.5, all NAS messages exchanged between the UE and the MME are sent ciphered using the current EPS security algorithms. During inter-system handover from A/Gb mode to S1 mode or Iu mode to S1 mode, secure exchange of NAS messages is established between the MME and the UE by: - the transmission of NAS security related parameters encapsulated in the AS signalling from the MME to the UE triggering the inter-system handover (see 3GPP TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [19]). The UE uses these parameters to generate the mapped EPS security context; and, - after the handover, the transmission of a TRACKING AREA UPDATE REQUEST message from the UE to the MME. The UE shall send this message integrity protected using the mapped EPS security context, but unciphered. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected using the mapped EPS security context, and except for the messages specified in clause , all NAS messages exchanged between the UE and the MME are sent ciphered using the mapped EPS security context. During inter-system change from N1 mode to S1 mode in EMM-CONNECTED mode, secure exchange of NAS messages is established between the MME and the UE by: - the transmission of NAS security related parameters encapsulated in the AS signalling from the AMF to the UE triggering the inter-system handover (see 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]). The UE uses these parameters to generate the mapped EPS security context (see clause 8.6.1 of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]); and - after the handover, the transmission of a TRACKING AREA UPDATE REQUEST message from the UE to the MME. The UE shall send this message integrity protected using the mapped EPS security context, but unciphered. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected using the mapped EPS security context, and except for the messages specified in clause 4.4.5, all NAS messages exchanged between the UE and the MME are sent ciphered using the mapped EPS security context. During inter-system change from N1 mode to S1 mode in EMM-IDLE mode, if the UE is operating in the single-registration mode and: 1) if the tracking area updating procedure is initiated as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54], the UE shall transmit a TRACKING AREA UPDATE REQUEST message integrity protected with the current 5G NAS security context and the UE shall derive a mapped EPS security context (see clause 8.6.1 of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]). The UE shall set the uplink and downlink NAS COUNT counters to the uplink and downlink NAS COUNT counters of the current 5G NAS security context respectively. The UE shall include the eKSI indicating the 5G NAS security context value in the TRACKING AREA UPDATE REQUEST message. After receiving the TRACKING AREA UPDATE REQUEST message including the eKSI, the MME forwards the TRACKING AREA UPDATE REQUEST message to the source AMF, if possible, to obtain the mapped EPS security context from the AMF as specified in 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]. The MME shall store the mapped EPS NAS security context with the uplink and downlink NAS COUNT counters associated with the derived K'ASME key set to the uplink and downlink NAS COUNT counters of the mapped EPS NAS security context respectively. The MME re-establishes the secure exchange of NAS messages by either: - replying with a TRACKING AREA UPDATE ACCEPT message that is integrity protected and ciphered using the mapped EPS security context. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected and except for the messages specified in clause 4.4.5, all NAS messages exchanged between the UE and the MME are sent ciphered; or - initiating a security mode control procedure. This can be used by the MME to take a non-current EPS security context into use or to modify the current EPS security context by selecting new NAS security algorithms; or 2) if the attach procedure is initiated as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] and: a) if the UE has received an "interworking without N26 interface not supported" indication from the network and the UE has a valid 5G NAS security context, the UE shall send an ATTACH REQUEST message integrity protected with the current 5G NAS security context and the UE shall derive a mapped EPS security context (see clause 8.6.1 of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]). The UE shall set the uplink and downlink NAS COUNT counters to the uplink and downlink NAS COUNT counters of the current 5G NAS security context respectively. The UE shall include the eKSI indicating the 5G NAS security context value in the ATTACH REQUEST message. After receiving the ATTACH REQUEST message including the eKSI, the MME forwards the ATTACH REQUEST message to the source AMF, if possible, to obtain the mapped EPS security context from the AMF as specified in 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [56]. The MME shall store the mapped EPS NAS security context with the uplink and downlink NAS COUNT counters associated with the derived K'ASME key set to the uplink and downlink NAS COUNT counters of the mapped EPS NAS security context respectively. The MME re-establishes the secure exchange of NAS messages by either: - replying with an ATTACH ACCEPT message that is integrity protected and ciphered using the mapped EPS NAS security context. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected and except for the messages specified in clause 4.4.5, all NAS messages exchanged between the UE and the MME are sent ciphered; or - initiating a security mode control procedure. This can be used by the MME to modify the current EPS security context by selecting new NAS security algorithms; or b) otherwise: i) if the UE has a valid native EPS security context, the UE shall send an ATTACH REQUEST message integrity protected with the native EPS security context. The UE shall include the eKSI indicating the native EPS security context value in the ATTACH REQUEST message. After receiving the ATTACH REQUEST message including the eKSI, the MME shall check whether the eKSI included in the initial NAS message belongs to an EPS security context available in the MME, and shall verify the MAC of the NAS message. If the verification is successful, the MME re-establishes the secure exchange of NAS messages by either: - replying with an ATTACH ACCEPT message that is integrity protected and ciphered using the current EPS security context. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected and except for the messages specified in clause , all NAS messages exchanged between the UE and the MME are sent ciphered; or - initiating a security mode control procedure. This can be used by the MME to modify the current EPS security context by selecting new NAS security algorithms; or ii) if the UE has no valid native EPS security context, the UE shall send an ATTACH REQUEST message without integrity protection and encryption. The secure exchange of NAS messages shall be continued after S1 mode to S1 mode handover. It is terminated after inter-system handover from S1 mode to A/Gb mode or Iu mode or when the NAS signalling connection is released. When a UE in EMM-IDLE mode establishes a new NAS signalling connection and has a valid current EPS security context, secure exchange of NAS messages can be re-established in the following ways: 1) Except for the cases described in items 3 and 4 below, the UE shall transmit the initial NAS message integrity protected with the current EPS security context, but unciphered. The UE shall include the eKSI indicating the current EPS security context value in the initial NAS message. The MME shall check whether the eKSI included in the initial NAS message belongs to an EPS security context available in the MME, and shall verify the MAC of the NAS message. If the verification is successful, the MME may re-establish the secure exchange of NAS messages: - by replying with a NAS message that is integrity protected and ciphered using the current EPS security context. From this time onward, all NAS messages exchanged between the UE and the MME are sent integrity protected and except for the messages specified in clause , all NAS messages exchanged between the UE and the MME are sent ciphered; or - by initiating a security mode control procedure. This can be used by the MME to take a non-current EPS security context into use or to modify the current EPS security context by selecting new NAS security algorithms; or 2) If the initial NAS message was a SERVICE REQUEST message or EXTENDED SERVICE REQUEST message, secure exchange of NAS messages is triggered by the indication from the lower layers that the user plane radio bearers are successfully set up. After successful completion of the procedure, all NAS messages exchanged between the UE and the MME are sent integrity protected and except for the messages specified in clause , all NAS messages exchanged between the UE and the MME are sent ciphered. 3) If the UE has no current EPS security context and performs a tracking area updating procedure after an inter-system change in idle mode from A/Gb mode to S1 mode or Iu mode to S1 mode, the UE shall send the TRACKING AREA UPDATE REQUEST message without integrity protection and encryption. The UE shall include a nonce and a GPRS ciphering key sequence number for creation of a mapped EPS security context. The MME creates a fresh mapped EPS security context and takes this context into use by initiating a security mode control procedure and this context becomes the current EPS security context in both the UE and the MME. This re-establishes the secure exchange of NAS messages. 4) If the initial NAS message is a CONTROL PLANE SERVICE REQUEST message, the UE shall send the message integrity protected. If an ESM message container information element or a NAS message container information element is included the message shall be sent partially ciphered (see clause 4.4.5), otherwise the message shall be sent unciphered. Secure exchange of NAS messages is re-established in the UE: - by the indication from the lower layers that the user plane radio bearers are successfully set up; - upon receipt of a NAS message (e.g. a SERVICE ACCEPT message or ESM DATA TRANSPORT message) that is integrity protected and ciphered using the current EPS security context; or - upon receipt of a SECURITY MODE COMMAND message that has successfully passed the integrity check.