Section: 6.16.2.2 Connection Suspend
Content: When the ng-eNB initiates the Connection Suspend procedure, it sends N2 Suspend Request message to the AMF. Upon reception of the N2 Suspend Request message, the AMF shall check its local policy. If the local policy indicates that a new NH derivation is needed, the AMF shall increase its locally kept NCC value by one and compute a fresh NH from its stored data using the function defined in Annex A.10. The AMF shall store that fresh {NH, NCC} pair and send it to the ng-eNB in the N2 Suspend Response message. Upon receipt of the N2 Suspend Response message from the AMF and if the message includes a {NH, NCC} pair, the ng-eNB shall store the fresh {NH, NCC} pair in the N2 Suspend Response message and remove any existing unused stored {NH, NCC} pairs. The ng-eNB shall send to the UE an RRC Release with releaseCause set to rrc-suspend message that is ciphered and integrity protected in PDCP layer using current AS security context. The ng-eNB shall include a fresh I-RNTI, and an NCC in that RRC Release message. The I-RNTI is used for context identification, and the UE ID part of the I-RNTI assigned by the ng-eNB shall be different in consecutive suspends of the same UE. This is to avoid tracking of UEs based on the I-RNTI. If the ng-eNB has a fresh and unused pair of {NCC, NH}, the ng-eNB shall include the NCC in the RRC Release message. Otherwise, the ng-eNB shall include the same NCC associated with the current KgNB in the RRC Release message. The NCC is used for AS security. The ng-eNB shall delete the current AS keys KRRCenc, KUPenc (if available), and KUPint (if available) after sending the RRC Release message to the UE, but shall keep the current AS key KRRCint. If the sent NCC value is fresh and belongs to an unused pair of {NCC, NH}, the ng-eNB shall save the pair of {NCC, NH} in the current UE AS security context and shall delete the current AS key KgNB. If the sent NCC value is equal to the NCC value associated with the current KgNB, the ng-eNB shall keep the current AS key KgNB and NCC. The ng-eNB shall store the sent I-RNTI together with the current UE context including the remainder of the AS security context. Upon receiving the RRC Release with releaseCause set to rrc-suspend message from the ng-eNB, the UE shall decrypt the RRC Release message using the KRRCenc key and verify that the integrity of the received the RRC Release message is correct by checking the PDCP MAC-I. If this verification is successful, then the UE shall take the received NCC value and save it as stored NCC with the current UE context.