Section: 6.16.1.2 Security procedures for RRCConnectionRe-establishment Procedure in Control Plane CIoT 5GS Optimization
Content: If the UE experience a RLF when using Control Plane CIoT 5GS optimisation only, the AS layer of the UE may trigger an RRCConnectionReestablishment procedure. As there is no AS security available, this procedure can not be protected as described in subclause 6.11. In order to protect the the re-establishment procedure, the AS part of the UE triggers the NAS part of the UE to provide the UL_NAS_MAC and XDL_NAS_MAC. These parameter are used to show that the UE is requesting the re-establishment and that the UE is talking to a genuine network respectively. The UE calculates a UL_NAS_MAC and XDL_NAS_MAC by using the curently used NAS integrity algorithm with the following inputs, KNASint as the key, the uplink NAS COUNT that would be used for the next uplink NAS message, the DIRECTION bit set to 0 and the target Cell-ID as the message to be protected to calculate NAS-MAC (see Annex D.3.1). The uplink NAS COUNT is increased by the UE in exactly the same way as if it had sent a NAS message. The first 16 bits of NAS-MAC form UL_NAS_MAC and the last 16 bits form XDL_NAS_MAC, which is stored by the UE. The UE shall send the RRCConnectionRestablishmentRequest message to the target ng-eNB and shall include the Truncated 5G-S-TMSI (as described in TS 23.501[ System architecture for the 5G System (5GS) ]  [2], TS 23.003[ Numbering, addressing and identification ]  [19] and TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [69]), the 5 least significant bits (LSB) of the NAS COUNT that was used to calculate NAS-MAC and UL_NAS_MAC in the message. The target ng-eNB recognises the RRCConnectionRestablishmentRequest message sent by a UE relates to the Control Plane CIoT 5GS optimisation based on the presence of the Truncated 5G-S-TMSI in the message. The target ng-eNB shall recreate the 5G-S-TMSI from the Truncated 5G-S-TMSI (as described in TS 23.501[ System architecture for the 5G System (5GS) ]  [2], TS 23.003[ Numbering, addressing and identification ]  [19] and TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [69]). The target ng-eNB shall send the 5G-S-TMSI, LSB of NAS COUNT, UL_NAS_MAC and target Cell-ID in the CP Relocation Indication message to the AMF that is serving the UE (this can be deteremined by the S-TMSI). The AMF uses LSB of NAS COUNT to estimate the full uplink NAS COUNT and calculates XNAS-MAC (see Annex D.3.1) using the same inputs (i.e. estimated uplink NAS COUNT, DIRECTION bit set to 0 and the target Cell-ID as the message) as the UE used for calculating NAS-MAC. The AMF then compares the received UL_NAS_MAC with the first 16 bits of XNAS-MAC and if these are equal the network is sure that the geniune UE sent the RRCConnectionRestablishmentRequest message. The stored uplink NAS COUNT in the AMF is set as though the AMF received a sucessfully protected NAS message using that NAS COUNT. The AMF shall set DL_NAS_MAC to the last 16 bits of already calculated XNAS-MAC and send DL_NAS_MAC to the target ng-eNB in the Connection Establishment Indication message. The target ng-eNB shall send the DL_NAS_MAC to the UE in the RRCConnectionReestablisment message. The UE shall check that the received DL_NAS_MAC equal to the stored XDL_NAS_MAC. If so, the UE shall complete the re-establishment procedure. 6.16.2 Security handling in User Plane CIoT 5GS Optimization