Security Mode Setup is the 5GMM procedure where the AMF selects NAS ciphering and integrity algorithms and asks the UE to activate the selected NAS security context. This procedure normally follows successful authentication. Once completed, later NAS messages are integrity protected and usually ciphered.
Signaling Sequence
# |
Direction |
5GMM Message |
Comment |
1 | AMF -> UE | Security mode command | AMF selects NAS security algorithms and provides replayed UE security capabilities. |
2 | UE -> AMF | Security mode complete | UE confirms activation of the selected NAS security context. |
2a | UE -> AMF | Security mode reject | Sent instead of Complete when the UE cannot accept the command. |
Message Structure
Security Mode Command contains the selected NAS security algorithms, ngKSI, replayed UE security capabilities and optional requests such as IMEISV request. Security Mode Complete may include IMEISV and a NAS message container, for example a replayed Registration Request protected with the new security context.
Example : Security Mode Command
The following example is based on an Amarisoft MME log captured after successful primary authentication. The whole decoded NAS message is shown below.
04:09:34.041 [NAS] DL 0064 5GMM: Security mode command
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x3 (Integrity protected with new 5G NAS security context)
Auth code = 0xa34d93a1
Sequence number = 0x00
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x5d (Security mode command)
Selected NAS security algorithms = 0x02 (5G-EA0, 5G-IA2)
ngKSI:
TSC = 0
NAS key set identifier = 3
Replayed UE security capabilities:
0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)
0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)
0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
IMEISV request = 1
Additional 5G security information = 0x02 (RINMR=1, HDP=0)
Example : Security Mode Complete
The following example is based on the matching Security Mode Complete from the same Amarisoft MME log. The whole decoded NAS message is shown below.
04:09:34.081 [NAS] UL 0064 5GMM: Security mode complete
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x4 (Integrity protected and ciphered with new 5G NAS security context)
Auth code = 0x3308aa89
Sequence number = 0x00
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x5e (Security mode complete)
IMEISV:
IMEISV = 8690570563562913
NAS message container:
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x41 (Registration request)
5GS registration type:
Follow-on request bit = 1
Value = 1 (initial registration)
ngKSI:
TSC = 0
NAS key set identifier = 2
5GS mobile identity:
5G-GUTI
MCC = 001
MNC = 01
AMF Region ID = 128
AMF Set ID = 4
AMF Pointer = 1
5G-TMSI = 0x9c66ee06
5GMM capability:
0x03 (SGC=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0, RestrictEC=0, LPP=0, HO attach=1, S1 mode=1)
UE security capability:
0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)
0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)
0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
Requested NSSAI:
S-NSSAI
Length of S-NSSAI contents = 1 (SST)
SST = 0x01
Last visited registered TAI:
MCC = 001
MNC = 01
TAC = 0x000064
S1 UE network capability:
0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0xc0 (UEA0=1, UEA1=1, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x40 (UCS2=0, UIA1=1, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x19 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=1, LPP=1, LCS=0, 1xSRVCC=0, NF=1)
0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
0xb0 (15 bearers=1, SGC=0, N1mode=1, DCNR=1, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=0)
UE's usage setting = 0x01 (Data centric)
LADN indication:
Length = 0
Data =
Network slicing indication = 0x00 (DCNI=0, NSSCI=0)
5GS update type = 0x01 (EPS-PNB-CIoT=no additional information, 5GS-PNB-CIoT=no additional information, NG-RAN-RCU=0, SMS requested=1)