name: ngKSI
full_form: Non-Globally Unique Key Identifier for KAMF
context: The NAS SMC shown in Figure 6.7.2-1 shall be used to establish NAS Security context between the UE and the AMF. This procedure consists of a roundtrip of messages between the AMF and the UE. The AMF sends the NAS Security Mode Command message to the UE and the UE replies with the NAS Security Mode Complete message. NOTE 1: The NAS SMC procedure is designed such that it protects the Registration Request against a man-in-the-middle attack where the attacker modifies the IEs containing the UE security capabilities provided by the UE in the Registration Request. It works as follows: if the method completes successfully, the UE is attached to the network knowing that no bidding down attack has happened. In case a bidding down attack was attempted, the verification of the NAS SMC will fail and the UE replies with a reject message meaning that the UE will not attach to the network. Figure 6.7.2-1: NAS Security Mode Command procedure 1a. The AMF activates the NAS integrity protection before sending the NAS Security Mode Command message. 1b. The AMF sends the NAS Security Mode Command message to the UE. The NAS Security Mode Command message shall contain: the replayed UE security capabilities, the selected NAS algorithms, and the ngKSI for identifying the KAMF. The NAS Security Mode Command message may contain: K_AMF_change_flag (carried in the additional 5G security parameters IE specified in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35]) to indicate a new KAMF is calculated, a flag requesting the complete initial NAS message (see subclause 6.4.6), Anti-Bidding down Between Architectures (ABBA) parameter. In the case of horizontal derivation of KAMF during mobility registration update or during multiple registration in same PLMN, K_AMF_change_flag shall be included in the NAS Security Mode Command message as described in clause 6.9.3. This message shall be integrity protected (but not ciphered) with NAS integrity key based on the KAMF indicated by the ngKSI in the NAS Security Mode Command message (see Figure 6.7.2-1). NOTE 2: Void. In case the network supports interworking using the N26 interface between MME and AMF, the AMF shall also include the selected EPS NAS algorithms (defined in Annex B of TS 33.401[ 3GPP System Architecture Evolution (SAE); Security architecture ]  [10]) to be used after mobility to EPS in the NAS Security Mode Command message (see clause 8.5.2). The UE shall store the algorithms for use after mobility to EPS using the N26 interface between MME and AMF. The AMF shall store the selected EPS NAS algorithms in the UE security context. NOTE 2a: When AMF change happens either due to N2-handover or idle mode mobility, the selected EPS NAS algorithms is always included in the 5G UE security context and provided to the target AMF as part of the 5G UE security context. 1c. The AMF activates NAS uplink deciphering after sending the NAS Security Mode Command message. 2a. The UE shall verify the NAS Security Mode Command message. This includes checking that the UE security capabilities sent by the AMF match the ones stored in the UE to ensure that these were not modified by an attacker and verifying the integrity protection using the indicated NAS integrity algorithm and the NAS integrity key based on the KAMF indicated by the ngKSI. In case the NAS Security Mode Command message includes a K_AMF_change_flag, the UE shall derive a new KAMF as described in Annex A.13 and set the NAS COUNTs to zero. If the verification of the integrity of the NAS Security Mode Command message is successful, the UE shall start NAS integrity protection and ciphering/deciphering with the security context indicated by the ngKSI. 2b. The UE sends the NAS Security Mode Complete message to the AMF ciphered and integrity protected. The NAS Security Mode Complete message shall include PEI in case AMF requested it in the NAS Security Mode Command message. The AMF shall set the NAS COUNTs to zero if horizontal derivation of KAMF is performed. The UE may include the complete initial NAS message (see subclause 6.4.6 for details). If the verification of the NAS Security Mode Command message is not successful in the UE, it shall reply with a NAS Security Mode Reject message (see TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [35]). The NAS Security Mode Reject message and all subsequent NAS messages shall be protected with the previous, if any, 5G NAS security context, i.e., the 5G NAS security context used prior to the failed NAS Security Mode Command message. If no 5G NAS security context existed prior to the NAS Security Mode Command message, the NAS Security Mode Reject message shall remain unprotected. NOTE 2b: Void. The AMF shall de-cipher and check the integrity protection on the NAS Security Mode Complete message using the key and algorithm indicated in the NAS Security Mode Command message. NAS downlink ciphering at the AMF with this security context shall start after receiving the NAS Security Mode Complete message. 1d. The AMF activates NAS downlink ciphering. NOTE 3: If the uplink NAS COUNT will wrap around by sending the NAS Security Mode Reject message, the UE releases the NAS connection instead of sending the NAS Security Mode Reject message. NOTE 4: If the AMF successfully validated the NAS SMC Complete message, the AMF has successfully confirmed the SUPI received from the home network and the SUPI used by the UE match (as required in clause 5.5.3). However, integrity check failure of the NAS SMC Complete message at the AMF could have other causes than a mismatch of the SUPIs.
description: NAS Security Mode Command procedure is used to establish a secure connection between the UE and the AMF, involving the exchange of messages including the NAS Security Mode Command message and the NAS Security Mode Complete message.
explanation: The NAS Security Mode Command procedure is classified under the entity type 'Procedure' because it outlines a specific series of steps or actions taken to achieve a particular goal, in this case, establishing a secure connection between the UE and the AMF.
section_title: 6.7.2 NAS security mode command procedure
biotag_Context: O,B-Protocol,B-Message,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Network Function,O,O,O,O,B-Network Function,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Device,O,O,B-Device,O,O,O,B-Protocol,O,O,O,O,O,O,O,B-Protocol,B-Message,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Device,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Network Function,O,O,B-Protocol,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Network Function,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,B-Device,O,O,O,O,B-Protocol,O,O,O,B-Parameter,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,O,O,B-Technology,O,O,B-Message,O,O,B-Specification,O,O,O,O,O,B-Technology,I-Technology,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,B-Parameter,I-Parameter,I-Parameter,I-Parameter,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,B-Parameter,O,O,O,B-Parameter,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Interface,O,O,B-Network Function,O,O,O,B-Network Function,O,O,O,O,O,B-Network,B-Protocol,O,O,O,O,O,O,B-Specification,O,B-Organization,B-Network Function,I-Network Function,I-Network Function,O,O,O,O,O,O,O,O,O,O,O,B-Network,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,B-Network,O,O,B-Interface,O,O,B-Network Function,O,O,O,B-Network Function,O,O,O,O,B-Network,B-Protocol,O,O,O,B-Device,O,O,O,O,O,B-Network Function,O,O,O,O,O,O,O,O,O,O,O,O,B-Network,B-Protocol,O,O,O,O,O,O,B-Technology,B-Device,O,O,O,O,O,O,O,B-Network Function,O,O,O,O,B-Technology,B-Device,O,O,O,O,B-Network Function,O,B-Protocol,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Device,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,B-Device,O,O,O,O,O,B-Network Function,O,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,B-Protocol,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,B-Device,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,B-Device,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Device,O,O,B-Protocol,O,O,O,O,O,O,B-Network Function,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Parameter,O,O,B-Network Function,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,B-Network Function,O,O,O,B-Protocol,O,O,O,O,O,O,O,B-Parameter,O,O,O,B-Device,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,B-Message,O,O,B-Specification,O,O,O,O,O,B-Technology,I-Technology,O,O,O,O,O,O,B-Protocol,O,O,B-Message,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,B-Technology,B-Protocol,O,O,O,O,B-Technology,B-Protocol,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Technology,B-Protocol,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,B-Protocol,O,O,B-Message,O,O,O,O,O,O,O,O,B-Network Function,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,B-Protocol,O,O,O,O,B-Network Function,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,B-Network Function,O,B-Protocol,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,B-Protocol,O,O,B-Message,O,O,B-Device,O,O,B-Protocol,O,O,O,O,O,B-Protocol,O,O,B-Message,O,O,O,O,O,B-Network Function,O,O,O,B-Protocol,B-Message,O,O,O,B-Network Function,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,B-Parameter,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,O,O,O,O,B-Network Function,O,O,O,O,O,O,O,O,O,O
biotag_Description: B-Protocol,B-Message,I-Message,I-Message,O,O,O,O,O,O,O,O,O,O,B-Device,O,O,O,O,O,O,O,O,O,O,B-Protocol,B-Message,I-Message,I-Message,O,O,O,B-Protocol,O,O,O,O