4.4.6 Protection of initial NAS signalling messages

The 5GS supports protection of initial NAS messages as specified in 3GPP TS 33.501 [24]. The protection of initial NAS messages applies to the REGISTRATION REQUEST, DEREGISTRATION REQUEST, SERVICE REQUEST and CONTROL PLANE SERVICE REQUEST message, and is achieved as follows:

• If the UE does not have a valid 5G NAS security context, the UE sends a REGISTRATION REQUEST message including cleartext IEs only. After activating a 5G NAS security context resulting from a security mode control procedure:
• if the UE needs to send non-cleartext IEs, the UE shall include the entire REGISTRATION REQUEST message (i.e. containing both cleartext IEs and non-cleartext IEs) in the NAS message container IE and shall include the NAS message container IE in the SECURITY MODE COMPLETE message; or
• if the UE does not need to send non-cleartext IEs, the UE shall include the entire REGISTRATION REQUEST message (i.e. containing cleartext IEs only) in the NAS message container IE and shall include the NAS message container IE in the SECURITY MODE COMPLETE message.
• If the UE has a valid 5G NAS security context and:
• the UE needs to send non-cleartext IEs in a REGISTRATION REQUEST, DEREGISTRATION REQUEST, or SERVICE REQUEST message, the UE includes the entire REGISTRATION REQUEST, DEREGISTRATION REQUEST or SERVICE REQUEST message (i.e. containing both cleartext IEs and non-cleartext IEs) in the NAS message container IE and shall cipher the value part of the NAS message container IE. The UE shall then send a REGISTRATION REQUEST, DEREGISTRATION REQUEST, or SERVICE REQUEST message containing the cleartext IEs and the NAS message container IE;
• the UE needs to send non-cleartext IEs in a CONTROL PLANE SERVICE REQUEST message:
• if CIoT small data container IE is the only non-cleartext IE to be sent, the UE shall cipher the value part of the CIoT small data container IE. The UE shall then send a CONTROL PLANE SERVICE REQUEST message containing the cleartext IEs and the CIoT small data container IE;
• otherwise, the UE includes non-cleartext IEs in the NAS message container IE and shall cipher the value part of the NAS message container IE. The UE shall then send a CONTROL PLANE SERVICE REQUEST message containing the cleartext IEs and the NAS message container IE;
• the UE does not need to send non-cleartext IEs in a REGISTRATION REQUEST, DEREGISTRATION REQUEST, or SERVICE REQUEST message, the UE sends the REGISTRATION REQUEST, DEREGISTRATION REQUEST, or SERVICE REQUEST message without including the NAS message container IE; or
• the UE does not need to send non-cleartext IEs in a CONTROL PLANE SERVICE REQUEST message, the UE sends the CONTROL PLANE SERVICE REQUEST message without including the NAS message container IE and the CIoT small data container IE.

When the initial NAS message is a REGISTRATION REQUEST message, the cleartext IEs are:

• Extended protocol discriminator;
• Security header type;
• Spare half octet;
• Registration request message identity;
• 5GS registration type;
• ngKSI;
• 5GS mobile identity;
• UE security capability;
• Additional GUTI;
• UE status;
• EPS NAS message container;
• NID; and
• UE determined PLMN with disaster condition.

When the initial NAS message is a DEREGISTRATION REQUEST message, the cleartext IEs are:

• Extended protocol discriminator;
• Security header type;
• Spare half octet;
• De-registration request message identity;
• De-registration type;
• ngKSI; and
• 5GS mobile identity.

When the initial NAS message is a SERVICE REQUEST message, the cleartext IEs are:

• Extended protocol discriminator;
• Security header type;
• Spare half octet;
• ngKSI;
• Service request message identity;
• Service type; and
• 5G-S-TMSI.

When the initial NAS message is a CONTROL PLANE SERVICE REQUEST message, the cleartext IEs are:

• Extended protocol discriminator;
• Security header type;
• Spare half octet;
• ngKSI;
• Control plane service request message identity; and
• Control plane service type.

When the UE sends a REGISTRATION REQUEST, DEREGISTRATION REQUEST, SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message that includes a NAS message container IE, or a CONTROL PLANE SERVICE REQUEST message that includes a CIoT small data container IE, the UE shall set the security header type of the initial NAS message to "integrity protected".

When the AMF receives an integrity protected initial NAS message which includes a NAS message container IE, the AMF shall decipher the value part of the NAS message container IE. If the received initial NAS message is a REGISTRATION REQUEST, DEREGISTRATION REQUEST, or a SERVICE REQUEST message, the AMF shall consider the NAS message that is obtained from the NAS message container IE as the initial NAS message that triggered the procedure.

When the AMF receives a CONTROL PLANE SERVICE REQUEST message which includes a CIoT small data container IE, the AMF shall decipher the value part of the CIoT small data container IE and handle the message as specified in clause 5.6.1.4.2.

If the UE:

• has 5G-EA0 as a selected 5G NAS security algorithm; and
• selects a PLMN other than Registered PLMN and EPLMN over one access;

the UE shall send an initial NAS message including cleartext IEs only via the access type associated with the newly selected PLMN as described in this clause for the case when the UE does not have a valid 5G NAS security context.

If the UE:

• has 5G-EA0 as a selected 5G NAS security algorithm; and
• selects a PLMN other than Registered PLMN and EPLMN over one access, and the Registered PLMN or EPLMN is not registering or registered over other access;

the UE shall delete the 5G NAS security context.

NOTE: UE deletes the 5G NAS security context only if the UE is not in the connected mode.