Section: 6.8.1.1.1 Transition from RM-REGISTERED to RM-DEREGISTERED
Content: There are different reasons for transition to the RM-DEREGISTERED state. If a NAS messages leads to state transition to RM-DEREGISTERED, it shall be security protected by the current 5G NAS security context (mapped or native), if such exists in the UE or the AMF. NOTE: The present document only considers the states RM-DEREGISTERED and RM REGISTERED and transitions between these two states. Other documents define additional RM states (see, e.g. 5GMM states in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35]). On transitioning to RM-DEREGISTERED, the UE and AMF shall do the following: 1. If they have a full non-current native 5G NAS security context and a current mapped 5G NAS security context, then they shall make the non-current native 5G NAS security context the current one. 2. They shall delete any mapped or partial 5G NAS security contexts they hold. Handling of the remaining security parameters for each of these cases are given below: 1. Registration reject: All remaining security parameters shall be removed from the UE and AMF 2. Deregistration: a. UE-initiated i. If the reason is switch off then all the remaining security parameters shall be removed from the UE and AMF with the exception of the current native 5G NAS security context (as in clause 6.1.1), which should remain stored in the AMF and UE. ii. If the reason is not switch off then AMF and UE shall keep all the remaining security parameters. b. AMF-initiated i. Explicit: all the remaining security parameters shall be kept in the UE and AMF if the de-registration type is "re-registration required". ii. Implicit: all the remaining security parameters shall be kept in the UE and AMF. c. UDM/ARPF-initiated: If the message is "subscription withdrawn" then all the remaining security parameters shall be removed from the UE and AMF. 3. Registration reject: There are various reasons for Registration reject. The action to be taken shall be as given in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35]. Storage of the full native 5G NAS security context including the pair(s) of distinct NAS COUNT values associated with each access together with respective NAS connection identifier, excluding the UE security capabilities and the keys KNASint and KNASenc, in the UE when the UE transitions to RM-DEREGISTERED state is done as follows: a) If the ME does not have a full native 5G NAS security context in volatile memory, any existing native 5G NAS security context stored on the USIM or in non-volatile memory of the ME shall be marked as invalid. b) If the USIM supports RM parameters storage, then the ME shall store the full native 5G NAS security context parameters on the USIM (except for KNASint and KNASenc), mark the native 5G NAS security context on the USIM as valid, and not keep any native 5G NAS security context in non-volatile ME memory. c) If the USIM does not support RM parameters storage, then the ME shall store the full native 5G NAS security context (except for KNASint and KNASenc) in a non-volatile part of its memory and mark the native 5G NAS security context in its non-volatile memory as valid. d) For the case that the AMF or the UE enter RM-DEREGISTERED state without using any of the above procedures, the handling of the remaining security parameters shall be as specified in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35].