Section: 4.7.7.5 Authentication not accepted by the network
Content: If the authentication response (RES or SRES) is not valid, the network response depends upon the type of identity used by the MS in the first message: - If the P-TMSI has been used, the network may decide to initiate the identification procedure. If the IMSI given by the MS differs from the one the network had associated with the P-TMSI, the authentication should be restarted with the correct parameters. If the IMSI provided by the MS is the expected one (i.e. authentication has really failed), the network should send an AUTHENTICATION AND CIPHERING REJECT message to the mobile station. - If the IMSI has been used, or the network decides not to try the identification procedure, an AUTHENTICATION AND CIPHERING REJECT message should be transferred to the MS. Upon receipt of an AUTHENTICATION AND CIPHERING REJECT message, a) if the message has been successfully integrity checked by the lower layers, the MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED and shall delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number stored. If available, also the TMSI, LAI and ciphering key sequence number shall be deleted and the update status shall be set to U3 ROAMING NOT ALLOWED. The SIM/USIM shall be considered as invalid until switching off or the SIM/USIM is removed. If the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific maximum value. If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value. If S1 mode is supported by the MS, the MS shall in addition handle the EMM parameters EMM state, EPS update status, last visited registered TAI, TAI list, GUTI and KSIASME as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when an EPS authentication is not accepted by the network. b) if the message is received without integrity protection, then the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running (see subclause 4.1.1.6A). Additionally, the MS shall: - if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, proceed as specified in subclause 4.1.1.6A, list item 6.a) for the case an ATTACH REJECT or ROUTING AREA UPDATE REJECT message is received without integrity protection; and - otherwise proceed as specified under list item a) above for the case that the message has been successfully checked by the lower layers. List item b) above is also applicable, if the message is received in A/Gb mode. If the AUTHENTICATION AND CIPHERING REJECT message is received, the MS shall abort any GMM procedure, shall stop any of the retransmission timers that are running (e.g. T3310, T3317, T3330, T3321, T3318 or T3320 and shall enter state GMM-DEREGISTERED. In UTRAN Iu mode, depending on local regulations or operator preference for emergency bearer services, if the MS has a PDN connection for emergency bearer services established or is establishing a PDN connection for emergency bearer services, the SGSN need not follow the procedures specified for the authentication failure in the present subclause, the SGSN can continue with the ongoing GMM specific procedure or Session Management procedure. Upon completion of the GMM procedure or Session management procedure, the SGSN shall deactivate all non-emergency PDP contexts, if any, by initiating a PDP context deactivation procedure. The network shall consider the MS to be attached for emergency bearer services only.