Section: 4.4.4.3 Integrity checking of NAS signalling messages in the MME
Content: Except the messages listed below, no NAS signalling messages shall be processed by the receiving EMM entity in the MME or forwarded to the ESM entity, unless the secure exchange of NAS messages has been established for the NAS signalling connection: - EMM messages: - ATTACH REQUEST; - IDENTITY RESPONSE (if requested identification parameter is IMSI); - AUTHENTICATION RESPONSE; - AUTHENTICATION FAILURE; - SECURITY MODE REJECT; - DETACH REQUEST; - DETACH ACCEPT; - TRACKING AREA UPDATE REQUEST. NOTE 1: The TRACKING AREA UPDATE REQUEST message is sent by the UE without integrity protection, if the tracking area updating procedure is initiated due to an inter-system change in idle mode and no current EPS security context is available in the UE. The other messages are accepted by the MME without integrity protection, as in certain situations they are sent by the UE before security can be activated. NOTE 2: The DETACH REQUEST message can be sent by the UE without integrity protection, e.g. if the UE is attached for emergency bearer services or access to RLOS and there is no shared EPS security context available, or if due to user interaction an attach procedure is cancelled before the secure exchange of NAS messages has been established. For these cases the network can attempt to use additional criteria (e.g. whether the UE is subsequently still performing periodic tracking area updating or still responding to paging) before marking the UE as EMM-DEREGISTERED. All ESM messages are integrity protected except a PDN CONNECTIVITY REQUEST message if it is sent piggybacked in ATTACH REQUEST message and NAS security is not activated. Once a current EPS security context exists, until the secure exchange of NAS messages has been established for the NAS signalling connection, the receiving EMM entity in the MME shall process the following NAS signalling messages, even if the MAC included in the message fails the integrity check or cannot be verified, as the EPS security context is not available in the network: - ATTACH REQUEST; - IDENTITY RESPONSE (if requested identification parameter is IMSI); - AUTHENTICATION RESPONSE; - AUTHENTICATION FAILURE; - SECURITY MODE REJECT; - DETACH REQUEST; - DETACH ACCEPT; - TRACKING AREA UPDATE REQUEST; - SERVICE REQUEST; - EXTENDED SERVICE REQUEST; - CONTROL PLANE SERVICE REQUEST. NOTE 3: These messages are processed by the MME even when the MAC that fails the integrity check or cannot be verified, as in certain situations they can be sent by the UE protected with an EPS security context that is no longer available in the network. If an ATTACH REQUEST message is received without integrity protection or fails the integrity check and it is not an attach request for emergency bearer services and it is not an attach request for access to RLOS, the MME shall authenticate the subscriber before processing the attach request any further. Additionally, if the MME initiates a security mode control procedure, the MME shall include a HASHMME IE in the SECURITY MODE COMMAND message as specified in clause 5.4.3.2. If authentication procedure is not successful the MME shall maintain, if any, the EMM-context and EPS security context unchanged. For the case when the attach procedure is for emergency bearer services see clause 5.5.1.2.3 and clause 5.4.2.5. If a DETACH REQUEST message fails the integrity check, the MME shall proceed as follows: - If it is not a detach request due to switch off, and the MME can initiate an authentication procedure, the MME should authenticate the subscriber before processing the detach request any further. - If it is a detach request due to switch off, or the MME does not initiate an authentication procedure for any other reason, the MME may ignore the detach request and remain in state EMM-REGISTERED. NOTE 4: The network can attempt to use additional criteria (e.g. whether the UE is subsequently still performing periodic tracking area updating or still responding to paging) before marking the UE as EMM-DEREGISTERED. If a TRACKING AREA UPDATE REQUEST message is received without integrity protection or fails the integrity check and the UE provided a nonceUE, GPRS ciphering key sequence number, P-TMSI and RAI in the TRACKING AREA UPDATE REQUEST message, the MME shall initiate a security mode control procedure to take a new mapped EPS security context into use; otherwise, if the UE has only a PDN connection for non-emergency bearer services established and the PDN connection is not for RLOS, the MME shall initiate an authentication procedure. Additionally, if the MME initiates a security mode control procedure, the MME shall include a HASHMME IE in the SECURITY MODE COMMAND message as specified in clause 5.4.3.2. If authentication procedure is not successful the MME shall maintain, if any, the EMM-context and EPS security context unchanged. For the case when the UE has a PDN connection for emergency bearer services or for RLOS see clause 5.5.3.2.3 and clause 5.4.2.5. If a SERVICE REQUEST, EXTENDED SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message fails the integrity check and the UE has only PDN connections for non-emergency bearer services established and the PDN connections are not for RLOS, the MME shall send the SERVICE REJECT message with EMM cause #9 "UE identity cannot be derived by the network" and keep the EMM-context and EPS security context unchanged. For the case when the UE has a PDN connection for emergency bearer services or RLOS and integrity check fails, the MME may skip the authentication procedure even if no EPS security context is available and proceed directly to the execution of the security mode control procedure as specified in clause . After successful completion of the service request procedure, the network shall deactivate all non-emergency EPS bearers locally which are not EPS bearers for RLOS. The emergency EPS bearers shall not be deactivated. The network may deactivate the EPS bearers for RLOS. Once the secure exchange of NAS messages has been established for the NAS signalling connection, the receiving EMM or ESM entity in the MME shall not process any NAS signalling messages unless they have been successfully integrity checked by the NAS. If any NAS signalling message, having not successfully passed the integrity check, is received, then the NAS in the MME shall discard that message. If any NAS signalling message is received, as not integrity protected even though the secure exchange of NAS messages has been established, then the NAS shall discard this message.