Section: 5.4.2.5 Authentication not accepted by the network
Content: If the authentication response (RES) returned by the UE is not valid, the network response depends upon the type of identity used by the UE in the initial NAS message, that is: - if the GUTI was used; or - if the IMSI was used. If the GUTI was used, the network should initiate an identification procedure. If the IMSI given by the UE during the identification procedure differs from the IMSI the network had associated with the GUTI, the authentication should be restarted with the correct parameters. Otherwise, if the IMSI provided by the UE is the same as the IMSI stored in the network (i.e. authentication has really failed), the network should send an AUTHENTICATION REJECT message to the UE. If the IMSI was used for identification in the initial NAS message, or the network decides not to initiate the identification procedure after an unsuccessful authentication procedure, the network should send an AUTHENTICATION REJECT message to the UE. The network shall maintain, if any, the EMM-context and EPS security context unchanged. Upon receipt of an AUTHENTICATION REJECT message, a) if the message has been successfully integrity checked by the NAS, the UE shall set the update status to EU3 ROAMING NOT ALLOWED, delete the stored GUTI, TAI list, last visited registered TAI and KSIASME. The USIM shall be considered invalid until switching off the UE or the UICC containing the USIM is removed. If the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If A/Gb or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number and the MM parameters update status, TMSI, LAI and ciphering key sequence number as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the authentication and ciphering procedure is not accepted by the network. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the authentication procedure performed over 3GPP access is not accepted by the network; and b) if the message is received without integrity protection and if timer T3416, T3418 or T3420 is running, the UE shall start timer T3247 (see 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running (see clause 5.3.7b). Additionally, the UE shall: - if the UE maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than a UE implementation-specific maximum value, proceed as specified in clause 5.3.7b, list item 1a for the case that the EMM cause value received is #3; and - otherwise proceed as specified under list item a above for the case that the message has been successfully integrity checked. If the AUTHENTICATION REJECT message is received by the UE, the UE shall abort any EMM signalling procedure, stop any of the timers T3410, T3416, T3417, T3430, T3421, T3418 or T3420 (if they were running) and enter state EMM-DEREGISTERED. Depending on local requirements or operator preference for emergency bearer services, if the UE has a PDN connection for emergency bearer services established or is establishing a PDN connection for emergency bearer services, the MME need not follow the procedures specified for the authentication failure in the present clause. The MME may continue a current EMM specific procedure or PDN connectivity request procedure. Upon completion of the authentication procedure, if not initiated as part of another procedure, or upon completion of the EMM procedure or PDN connectivity request procedure, the MME shall deactivate all non-emergency EPS bearers, if any, by initiating an EPS bearer context deactivation procedure. The network shall consider the UE to be attached for emergency bearer services only. Depending on local regulation and operator policy, if the UE is requesting attach for access to RLOS, the MME need not follow the procedures specified for the authentication failure in the present clause. The MME may continue a current EMM specific procedure.