Section: 5.4.2.3 Authentication response by the UE
Content: The UE shall respond to an AUTHENTICATION REQUEST message. With the exception of the cases described in clauses 5.4.2.6 and 5.4.2.7 case k, the UE shall process the authentication challenge data and respond with an AUTHENTICATION RESPONSE message to the network. Upon a successful EPS authentication challenge, the UE shall determine the PLMN identity to be used for the calculation of the new KASME from the authentication challenge data according to the following rules: a) When the UE moves from EMM-IDLE mode to EMM-CONNECTED mode, until the first handover, the UE shall use the PLMN identity of the selected PLMN; and b) After handover or inter-system handover to S1 mode, - if the target cell is not a shared network cell, the UE shall use the PLMN identity received as part of the broadcast system information; - if the target cell is a shared network cell and the UE has a valid GUTI, the UE shall use the PLMN identity that is part of the GUTI; and - if the target cell is a shared network cell, the UE does not have a valid GUTI and, - the EPS authentication challenge is performed after inter-system handover from A/Gb mode to S1 mode or from Iu mode to S1 mode and the UE has a valid P-TMSI and RAI, the UE shall use the PLMN identity that is part of the RAI; or - the EPS authentication challenge is performed after inter-system handover from N1 mode to S1 mode and the UE has a valid 5G-GUTI, the UE shall use the PLMN identity that is part of the 5G-GUTI. Upon a successful EPS authentication challenge, the new KASME calculated from the authentication challenge data shall be stored in a new EPS security context in the volatile memory of the ME. The USIM will compute the authentication response (RES) using the authentication challenge data received from the ME, and pass RES to the ME. In order to avoid a synchronisation failure, when the UE receives an AUTHENTICATION REQUEST message, the UE shall store the received RAND together with the RES returned from the USIM in the volatile memory of the ME. When the UE receives a subsequent AUTHENTICATION REQUEST message, if the stored RAND value is equal to the new received value in the AUTHENTICATION REQUEST message, then the ME shall not pass the RAND to the USIM, but shall send the AUTHENTICATION RESPONSE message with the stored RES. If there is no valid stored RAND in the ME or the stored RAND is different from the new received value in the AUTHENTICATION REQUEST message, the ME shall pass the RAND to the USIM, shall override any previously stored RAND and RES with the new ones and start, or reset and restart timer T3416. The RAND and RES values stored in the ME shall be deleted and timer T3416, if running, shall be stopped: - upon receipt of a - SECURITY MODE COMMAND, - SERVICE REJECT, - SERVICE ACCEPT, - TRACKING AREA UPDATE REJECT, - TRACKING AREA UPDATE ACCEPT, or - AUTHENTICATION REJECT message; - upon expiry of timer T3416; - if the UE enters the EMM state EMM-DEREGISTERED or EMM-NULL; or - if the UE enters EMM-IDLE mode.