Section: 4.7.7.6 Abnormal cases
Content: The following abnormal cases can be identified: a) Lower layer failure Upon detection of a lower layer failure before the AUTHENTICATION AND CIPHERING RESPONSE message is received, the network shall abort the procedure. b) Expiry of timer T3360 The network shall, on the first expiry of the timer T3360, retransmit the AUTHENTICATION AND CIPHERING REQUEST message and shall reset and start timer T3360. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3360, the procedure shall be aborted. c) Collision of an authentication and ciphering procedure with a GPRS attach procedure If the network receives an ATTACH REQUEST message before the ongoing authentication procedure has been completed and no GPRS attach procedure is pending on the network (i.e. no ATTACH ACCEPT/REJECT message has to be sent as an answer to an ATTACH REQUEST message), the network shall abort the authentication and ciphering procedure and proceed with the new GPRS attach procedure. d) Collision of an authentication and ciphering procedure with a GPRS attach procedure when the authentication and ciphering procedure has been caused by a previous GPRS attach procedure If the network receives an ATTACH REQUEST message before the ongoing authentication procedure has been completed and a GPRS attach procedure is pending (i.e. an ATTACH ACCEPT/REJECT message has still to be sent as an answer to an earlier ATTACH REQUEST message), then: - If one or more of the information elements in the ATTACH REQUEST message differs from the ones received within the previous ATTACH REQUEST message, the network shall not treat the authentication any further and proceed with the GPRS attach procedure; or - If the information elements do not differ, then the network shall not treat any further this new ATTACH REQUEST message. d1) Collision of an authentication and ciphering procedure with a GPRS detach procedure GPRS detach containing cause "power off": If the network receives a DETACH REQUEST message before the ongoing authentication and ciphering procedure has been completed, the network shall abort the authentication and ciphering procedure and shall progress the GPRS detach procedure. GPRS detach containing other causes than "power off": If the network receives a DETACH REQUEST message before the ongoing authentication and ciphering procedure has been completed, the network shall complete the authentication and ciphering procedure and shall respond to the GPRS detach procedure as described in subclause 4.7.4. e) Collision of an authentication and ciphering procedure with a routing area updating procedure If the network receives a ROUTING AREA UPDATE REQUEST message before the ongoing authentication procedure has been completed, the network shall progress both procedures. Figure 4.7.7/1 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ] : Authentication and ciphering procedure (f) Authentication failure (GMM cause #18 "MAC failure" or #21 "GSM authentication unacceptable") The MS shall send an AUTHENTICATION AND CIPHERING FAILURE message, with GMM cause 'MAC failure’ or 'GSM authentication unacceptable’ according to subclause 4.7.7.5.1, to the network and start timer T3318. Furthermore, the MS shall stop any of the retransmission timers that are running (e.g. T3310, T3321, T3330 or T3317). Upon the first receipt of an AUTHENTICATION AND CIPHERING FAILURE message from the MS with GMM cause 'MAC failure’ or 'GSM authentication unacceptable’ the network may initiate the identification procedure described in subclause 4.7.8. This is to allow the network to obtain the IMSI from the MS. The network may then check that the P-TMSI originally used in the authentication challenge corresponded to the correct IMSI. Upon receipt of the IDENTITY REQUEST message from the network, the MS shall send the IDENTITY RESPONSE message. NOTE: Upon receipt of an AUTHENTICATION AND CIPHERING FAILURE message from the MS with reject cause "MAC failure" or "GSM authentication unacceptable", the network may also terminate the authentication procedure (see subclause 4.7.7.5). If the P-TMSI/IMSI mapping in the network was incorrect, the network should respond by sending a new AUTHENTICATION AND CIPHERING REQUEST message to the MS. Upon receiving the new AUTHENTICATION AND CIPHERING REQUEST message from the network, the MS shall stop timer T3318, if running, and then process the challenge information as normal. If the P-TMSI/IMSI mapping in the network was correct, the network should terminate the authentication and ciphering procedure by sending an AUTHENTICATION AND CIPHERING REJECT message. If the network is validated successfully (an AUTHENTICATION AND CIPHERING REQUEST message that contains a valid SQN and MAC is received), the MS shall send the AUTHENTICATION AND CIPHERING RESPONSE message to the network and shall start any retransmission timers (e.g. T3310, T3321, T3330 or T3317), if they were running and stopped when the MS received the first failed AUTHENTICATION AND CIPHERING REQUEST message. If the MS receives the second AUTHENTICATION AND CIPHERING REQUEST message while T3318 is running and - the MAC value cannot be resolved; or - the message was received in UMTS and contains a GSM authentication challenge, the MS shall follow the procedure specified in this subclause (f), starting again from the beginning. If the SQN is invalid, the MS shall proceed as specified in (g). It can be assumed that the source of the authentication challenge is not genuine (authentication not accepted by the MS) if any of the following occurs: - the timer T3318 expires; - the MS detects any combination of the authentication failures: "MAC failure", "invalid SQN", and "GSM authentication unacceptable", during three consecutive authentication challenges. The authentication challenges shall be considered as consecutive only, if the authentication challenges causing the second and third authentication failure are received by the MS, while the timer T3318 or T3320 started after the previous authentication failure is running. The MS shall stop timer T3318, if the timer is running and the MS detects a lower layer failure, the network releases the PS signalling connection, the MS performs inter-system change to S1 mode, or the MS initiates a GPRS suspension procedure (see 3GPP TS 44.018[ None ]  [84]). When it has been deemed by the MS that the source of the authentication challenge is not genuine (authentication not accepted by the MS), the MS shall behave as described in subclause 4.7.7.6.1. Figure 4.7.7a/1 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ] : Authentication failure cause "MAC failure" or "GSM authentication unacceptable" (g) Authentication failure (GMM cause #19 "Synch failure"): The MS shall send an AUTHENTICATION AND CIPHERING FAILURE message, with the GMM cause "Synch failure", to the network and start the timer T3320. Furthermore, the MS shall stop any of the retransmission timers that are running (e.g. T3310, T3321, T3330 or T3317). Upon the first receipt of an AUTHENTICATION AND CIPHERING message from the MS with the GMM cause "synch failure", the network shall use the returned AUTS parameter from the authentication & ciphering failure parameter IE in the AUTHENTICATION AND CIPHERING FAILURE message, to re-synchronise. The re-synchronisation procedure requires the SGSN to delete all unused authentication vectors for that IMSI and obtain new vectors from the HLR. When re-synchronisation is complete, the network shall initiate the authentication & ciphering procedure. Upon receipt of the AUTHENTICATION AND CIPHERING REQUEST message, the MS shall stop timer T3320, if running. NOTE: Upon receipt of two consecutive AUTHENTICATION AND CIPHERING FAILURE messages from the MS with reject cause "synch failure", the network may terminate the authentication procedure by sending an AUTHENTICATION AND CIPHERING REJECT message. If the network is validated successfully (a new AUTHENTICATION AND CIPHERING REQUEST message is received which contains a valid SQN and MAC) while T3320 is running, the MS shall send the AUTHENTICATION AND CIPHERING RESPONSE message to the network and shall start any retransmission timers (i.e. T3310, T3321, T3330 or T3317), if they were running and stopped when the MS received the first failed AUTHENTICATION AND CIPHERING REQUEST message. If the MS receives the second AUTHENTICATION AND CIPHERING REQUEST message while T3320 is running and - the MAC value cannot be resolved; or - the message was received in Iu mode and contains a GSM authentication challenge, the MS shall proceed as specified in (f). If the SQN is invalid, the MS shall follow the procedure specified in this subclause (g), starting again from the beginning. The MS shall deem that the network has failed the authentication check and behave as described in subclause 4.7.7.6.1, if any of the following occurs: - the timer T3320 expires; - the MS detects any combination of the authentication failures: "MAC failure", "invalid SQN", and "GSM authentication unacceptable", during three consecutive authentication challenges. The authentication challenges shall be considered as consecutive only, if the authentication challenges causing the second and third authentication failure are received by the MS, while the timer T3318 or T3320 started after the previous authentication failure is running. The MS shall stop timer T3320, if the timer is running and the MS detects a lower layer failure, the network releases the PS signalling connection, the MS performs inter-system change to S1 mode, or the MS initiates a GPRS suspension procedure (see 3GPP TS 44.018[ None ]  [84]). When it has been deemed by the MS that the source of the authentication challenge is not genuine (authentication not accepted by the MS), the MS shall behave as described in subclause 4.7.7.6.1. Figure 4.7.7b/1 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ] : Authentication failure cause 'Synch failure’ Upon receipt of an AUTHENTICATION AND CIPHERING REJECT message, the UE shall perform the actions as specified in subclause 4.7.7.5. For items f and g: Depending on local requirements or operator preference for emergency bearer services, if the MS has a PDN connection for emergency bearer services established or is establishing such a PDN connection, the SGSN need not follow the procedures specified for the authentication failure specified in the present subclause and shall continue using the current security context, if any. The SGSN shall deactivate all non-emergency PDP contexts, if any, by initiating a PDP context deactivation procedure. If there is an ongoing session management procedure, the SGSN shall deactivate all non-emergency PDP contexts upon completion of the session management procedure. The network shall consider the MS to be attached for emergency bearer services only. If an MS has a PDN connection for emergency bearer services established or is establishing such a PDN connection when timer T3318 or T3320 expires, the MS shall not deem that the network has failed the authentication check and not behave as described in subclause 4.7.7.6.1. Instead the MS shall continue using the current security context, if any. The MS shall deactivate all non-emergency PDP contexts, if any, by initiating a PDP context deactivation procedure. If there is an ongoing session management procedure, the MS shall deactivate all non-emergency PDP contexts upon completion of the session management procedure. The MS shall start any retransmission timers (e.g. T3310, T3317, T3321 or T3330) if: - they were running and stopped when the MS received the AUTHENTICATION AND CIPHERING REJECT message and detected an authentication failure; and - the procedures associated with these timers have not yet been completed. The MS shall consider itself to be attached for emergency bearer services only.