Section: 10.2.2 Unauthenticated IMS Emergency Sessions 10.2.2.1 General
Content: There are many scenarios when an unauthenticated Emergency Session may be established without the network having to authenticate the UE or apply ciphering or integrity protection for either AS or NAS. For example: a) UEs that are in Limited service state UEs, as specified in clause 3.5 in TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  b) UEs that have valid subscription but SN cannot complete authentication because of network failure or other reasons TS 23.401[ General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access ]  clause 4.3.12.1 identifies four possible network behaviours of emergency bearer support. Amongst these, the following two cases are applicable for unauthenticated emergency sessions: a. IMSI required, authentication optional. These UEs shall have a SUPI. If authentication fails, the UE is granted access and the unauthenticated SUPI retained in the network for recording purposes. The PEI is used in the network as the UE identifier. PEI only UEs will be rejected (e.g. UICCless UEs). b. All UEs are allowed. Along with authenticated UEs, this includes UEs with a SUPI that cannot be authenticated and UEs with only an PEI. If an unauthenticated SUPI is provided by the UE, the unauthenticated SUPI is retained in the network for recording purposes. The PEI is used in the network to identify the UE. The network policy is configured to one of the above, and accordingly determine how emergency requests from the UE are treated. If the ME receives a NAS SMC selecting NIA0 (NULL integrity) for integrity protection, and NEA0 (NULL ciphering) for encryption protection, then: - the ME shall mark any stored native 5G NAS security context on the USIM /non-volatile ME memory as invalid; and - the ME shall not update the USIM/non-volatile ME memory with the current 5G NAS security context. These two rules override all other rules regarding updating the 5G NAS security context on the USIM/non-volatile ME memory, in the present document. If NIA0 is used, and the NAS COUNT values wrap around, and a new KAMF has not been established before the NAS COUNT wrap around, the NAS connection shall be kept. NOTE: For unauthenticated IMS emergency sessions, NIA0, i.e., null integrity algorithm, is used for integrity protection. Additionally, as the NAS COUNT values can wrap around, the initialization of the NAS COUNT values are not crucial. Uplink and downlink NAS COUNT are incremented for NAS message that use NIA0, as for any other NAS messages. A UE without a valid 5G subscription shall at an IRAT handover to 5G, when an IMS Emergency Service is active, be considered by the AMF to be unauthenticated. In such a scenario, EIA0 shall be used in 5G after handover if the target network policy allows unauthenticated IMS Emergency Sessions. A handover from 5G to another RAT, of an unauthenticated IMS Emergency Session, shall result in an unauthenticated IMS Emergency Session in the other RAT.