Section: 4.1.1.6A Specific requirements for the MS when receiving non-integrity protected reject messages
Content: This subclause specifies the requirements for an MS that is not configured to use timer T3245 (see 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [135] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [112]) and receives a LOCATION UPDATING REJECT, CM SERVICE REJECT, ABORT, ATTACH REJECT, ROUTING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with specific MM or GMM causes. NOTE 1: Additional MS requirements for this case, requirements for other MM or GMM causes, and requirements for the case when the MS receives a successfully integrity checked reject message are specified in subclauses 4.4.4.7, 4.5.1.1, 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4. The present subclause is applicable to A/Gb mode and Iu mode. In A/Gb mode, - for the CS domain, as integrity protection is not supported, all messages received by the MS are considered to be received "before the network has activated the integrity protection"; and - for the PS domain, if integrity protection is not required (see subclause 4.7.1.2a.), all messages received by the MS are considered to be received "before the network has activated the integrity protection". The MS may maintain a list of PLMN-specific attempt counters and a list of PLMN-specific PS-attempt counters. The maximum number of possible entries in each list is implementation dependent. Additionally, the MS may maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events and one counter for "SIM/USIM considered invalid for GPRS services" events. If the MS maintains the above lists of attempt counters and the event counters, a MS supporting N1 mode, shall store them in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of power saving mode. The MS may also maintain a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services". If the MS is in a location area which is included in the list of "forbidden location areas for non-GPRS services", the MS shall not initiate any MM procedure. If the MS is in a location area which is included in the list of "forbidden location areas for GPRS services", the MS shall not initiate any GMM, SM, SMS or SS procedure for GPRS services. If the MS receives a LOCATION UPDATING REJECT message without integrity protection with MM cause value #2, #3, #6, #11, #12, #13 or #15 before the network has activated the integrity protection for the CS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and take the following actions: 1) if the MM cause value received is #3 or #6, and a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall: i) delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2); delete the list of equivalent PLMNs; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; store the current LAI in the list of "forbidden location areas for roaming"; and search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121]; or ii) proceed as specified in subclause 4.4.4.7 and; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and b) else the MS shall proceed as specified in subclause 4.4.4.7; 2) if the MM cause value received is #2, and a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall: i) delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2); delete the list of equivalent PLMNs; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows: if the current LAI is already included in the list of "forbidden location areas for GPRS services" or the MS is not operating in MS operation mode A or B, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for non-GPRS services"; and attempt to select a suitable cell according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121], different from the cell where the LOCATION UPDATING REJECT was received; or NOTE 2: The cell on which the reject was received could still be a suitable cell. ii) proceed as specified in subclause 4.4.4.7 and; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and b) else the MS shall proceed as specified in subclause 4.4.4.7; 3) if the MM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in subclause 4.4.4.7; 4) if the MM cause value received is #11 and the MS is in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present): the MS shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2). Additionally, the MS shall store the current LAI in the list of "forbidden location areas for roaming"; and the MS shall search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121]; and 5) if the MM cause value received is #11 and if the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), in addition to the MS requirements specified in subclause 4.4.4.7, - if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific attempt counter for the PLMN. If the MS receives a CM SERVICE REJECT or ABORT message with MM cause value #6 without integrity protection before the network has activated the integrity protection for the CS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and a) if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall: i) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively with the exception that the MS shall not consider the SIM/USIM as invalid for non-GPRS services and; delete the list of equivalent PLMNs; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; reset the location update attempt counter; store the current LAI in the list of "forbidden location areas for roaming"; and search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121]; or ii) proceed as specified in subclauses 4.5.1.1 or 4.3.5.2 respectively and; in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection; in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and b) else the MS shall proceed as specified in subclause 4.5.1.1 or 4.3.5.2 respectively. If the MS receives an ATTACH REJECT or ROUTING AREA UPDATE REJECT message without integrity protection with GMM cause value #3, #6, #7, #8, #11, #12, #13, #14 or #15 before the network has activated the integrity protection for the PS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and shall take the following actions: 6) if the GMM cause value received is #3, #6, or #8, and a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall: i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number; delete the list of equivalent PLMNs; increment the counter for "SIM/USIM considered invalid for GPRS services" events; if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, set the update status to U3 ROAMING NOT ALLOWED, delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. In Iu mode, the MS shall increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection. In A/Gb mode, the MS shall increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt counter or the routing area updating attempt counter, respectively; if S1 mode is supported by the MS, handle the EMM parameters attach attempt counter or tracking area updating attempt counter, EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when an EPS attach or tracking area update procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection; store the current LAI in the list of "forbidden location areas for roaming" and enter the state GMM-DEREGISTERED.LIMITED-SERVICE; and search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121]; or ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; increment the counter for "SIM/USIM considered invalid for GPRS services" events; and if the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and the counter has a value less than an MS implementation-specific maximum value: in Iu mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events, if not already incremented over the same RRC connection in A/Gb mode, increment the counter for "SIM/USIM considered invalid for non-GPRS services" events; and b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; 7) if the GMM cause value received is #7, and a) if the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than an MS implementation-specific maximum value, the MS shall: i) set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number; delete the list of equivalent PLMNs; increment the counter for "SIM/USIM considered invalid for GPRS services" events; - if a GPRS attach or routing area updating procedure was performed, reset the GPRS attach attempt counter or the routing area updating attempt counter, respectively; if S1 mode is supported by the MS, handle the EMM parameters attach attempt counter or tracking area updating attempt counter, EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when an EPS attach or tracking area update procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection; enter the state GMM-DEREGISTERED.LIMITED-SERVICE; if the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows: if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services"; and attempt to select a suitable cell according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121], different from the cell where the ATTACH REJECT or ROUTING AREA UPDATING REJECT was received; or NOTE 3: The cell on which the reject was received could still be a suitable cell. ii) proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; and increment the counter for "SIM/USIM considered invalid for GPRS services" events; and b) else the MS shall proceed as specified in subclause 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; 8) if the GMM cause value received is #12, #13 or #15, the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4; 9) if the GMM cause value received is #11 or #14 and the MS is in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present): - the MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number. The MS shall delete the list of equivalent PLMNs. Additionally, if a GPRS attach or the routing area updating procedure was performed, the MS shall reset the GPRS attach attempt counter or the routing area updating attempt counter respectively; - for GMM cause value #11, the MS shall store the current LAI in the list of "forbidden location areas for roaming", and enter the state GMM-DEREGISTERED.LIMITED-SERVICE; - for GMM cause value #14, the MS shall enter the state GMM-DEREGISTERED.LIMITED-SERVICE. If the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows: if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services"; - if S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter or tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when the procedure is rejected with the EMM cause with the same value without integrity protection; and - the MS shall search for a suitable cell in another location area or in another tracking area according to 3GPP TS 43.022[ None ]  [82] and 3GPP TS 25.304[ None ]  [98] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [121]. 10) if the GMM cause value received is #11 and the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, 4.7.5.2.4 and 4.7.13.4: - Furthermore, if the MS maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific attempt counter for the PLMN. 11) if the GMM cause value received is #14 and the MS is not in its HPLMN or in a PLMN that is within the EHPLMN list (if the EHPLMN list is present), the MS shall additionally proceed as specified in subclauses 4.7.3.1.4, 4.7.3.2.4, 4.7.5.1.4, and 4.7.5.2.4: - Furthermore, if the MS maintains a list of PLMN-specific PS-attempt counters and the PLMN-specific PS-attempt counter for the PLMN sending the reject message has a value less than an MS implementation-specific maximum value, the MS shall increment the PLMN-specific PS-attempt counter for the PLMN. - If the MS maintains a list of "forbidden location areas for non-GPRS services" and a list of "forbidden location areas for GPRS services", proceed as follows: if the current LAI is already included in the list of "forbidden location areas for non-GPRS services" or the MS is operating in MS operation mode C, store the current LAI in the list of "forbidden location areas for roaming"; otherwise store the current LAI in the list of "forbidden location areas for GPRS services" and the MS shall enter the state GMM-DEREGISTERED.LIMITED-SERVICE. If the MS receives a SERVICE REJECT message without integrity protection with GMM cause value #3, #6, #7, #8, #11, #12, #13 or #15 before the network has activated the integrity protection for the PS domain, the MS shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and proceed as specified under items 6, 7, 8, 9 and 10 above. Upon expiry of timer T3247, the MS shall: - erase the list of "forbidden location areas for regional provision of service" and the list of "forbidden location areas for roaming"; - set the SIM/USIM to valid for non-GPRS services, if - the MS does not maintain a counter for "SIM/USIM considered invalid for non-GPRS services" events; or - the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and this counter has a value less than an MS implementation-specific maximum value. - set the SIM/USIM to valid for GPRS services, if - the MS does not maintain a counter for "SIM/USIM considered invalid for GPRS services" events; or - the MS maintains a counter for "SIM/USIM considered invalid for GPRS services" events and this counter has a value less than an MS implementation-specific maximum value. - erase the list of "forbidden location areas for non-GPRS services" and the list of "forbidden location areas for GPRS services", if the MS maintains these lists; - if the MS maintains a list of PLMN-specific attempt counters, for each PLMN-specific attempt counter that has a value greater than zero and less than an MS implementation-specific maximum value, remove the respective PLMN from the extension of the "forbidden PLMNs" list; - if the MS maintains a list of PLMN-specific PS-attempt counters, for each PLMN-specific PS-attempt counter that has a value greater than zero and less than an MS implementation-specific maximum value, remove the respective PLMN from the "forbidden PLMNs for GPRS service" list. If the resulting "forbidden PLMNs for GPRS service" list is empty and the MS is supporting S1 mode, the MS re-enables the E-UTRA capability as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when timer T3247 expires; - if the MS is supporting S1 mode, perform the actions as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [120] for the case when timer T3247 expires; - if the MS is supporting N1 mode, perform the actions as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [167] for the case when timer T3247 expires; and - initiate a location updating procedure, GPRS attach procedure or routing area updating procedure, if still needed, dependent on MM state and update status, and GMM state and GPRS update status, or perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [14]. If the MS maintains a list of PLMN-specific attempt counters and PLMN-specific PS-attempt counters, when the MS is switched off, the MS shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the MS implementation-specific maximum value, remove the respective PLMN from the forbidden PLMN list. When the SIM/USIM is removed, the MS should perform this action. NOTE 4: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [14] the MS will delete the contents of this extension when the MS is switched off or the SIM/USIM is removed.