LTE/NR中的相应cause场景【原创】

通信人马丁

已于 2023-09-07 11:22:57 修改

阅读量1k

点赞数 1

文章标签：网络协议 5G

于 2023-09-02 17:37:52 首次发布

本文链接：https://blog.csdn.net/2301_79567300/article/details/132631236

版权

1.背景

实网分析终端被拒等问题，经常遇到各类cause，其会对应不同的终端限制行为。查找已有资料后理解没有很深，自行总结本文用于梳理现象，如有错误敬请指正，转载请注明出处。

本文用于记录协议Ts 24.301及Ts 24.501中的cause及其对应行为。

已总结的cause值：

LTE：#2/#3/#6/#8/#7/#12/#13/#14/#15/#16/#17/#22/#19/#95/#96/#97/#99/#111
NR：#27/#111

2.LTE EMM cause

2.0 写在最前

24.301中的cause分为以下几种情况下触发，触发后的行为很类似，本文以一个为准分析

5.5.1.2.5 Attach not accepted by the network

5.5.1.3.5 Combined attach not accepted by the network

5.5.2.3.2 Network initiated detach procedure completion by the UE //这里包含#2

5.5.3.2.5 Normal and periodic tracking area updating procedure not accepted by the network

5.5.3.3.5 Combined tracking area updating procedure not accepted by the network

5.6.1.5 Service request procedure not accepted by the network

每个cause下发后都会改动到EMMstate（如进入DEREGISTERED/LIMITED/PLMN-SEARCH），从终端角度还感受不到含义，本文暂不描述

2.1 特殊处理的cause

第一梯队

#3/#6/#8

CS和PS域都被认为是无服务，除非下电/移除SIM卡/T3245超时后恢复
删除EPLMN列表，进入去注册状态，卡片进入无效卡状态
若有完整性保护，cs invalid和ps invalid counter都置成最大（counter for "SIM/USIM considered invalid for GPRS/non-GPRS services"）

协议原文见：CH 5.5.1.2.

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services and non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a. Additionally, the UE shall delete the list of equivalent PLMNs and enter state EMM-DEREGISTERED.NO-IMSI.

If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

相当于#3/#6/#8只禁一半（PS）

协议原文见：CH 5.5.1.2.5

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a. Additionally, the UE shall enter state EMMDEREGISTERED.

If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

相当于#3/#6/#8只禁另一半（CS）

暂时不翻协议补充了，且其常用在GSM中出现，会意即可

第二梯队

#11/#35

暂时没遇到，先不总结

#12（#12~#15一起看）

删除：any GUTI, last visited registered TAI, TAI list and eKSI
重置：attach次数(attach attempt counter)
把当前TAI放到"forbidden tracking areas for regional provision of service"

协议原文：

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter.

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service" and enter the state EMM-DEREGISTERED.LIMITED-SERVICE. If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden track ing areas for regional provision of service" for non-integrity protected NAS reject message.

#13

在#12的基础上改为

把当前TAI放到"forbidden tracking areas for roaming"
再删除：delete the list of equivalent PLMNs（和15不同）

协议原文：

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall delete the list of equivalent PLMNs and reset the attach attempt counter.

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for roaming". If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message.

#14

在#12的基础上改为

把当前TAI放到"forbidden PLMNs for GPRS service"（和13不同）
再删除：delete the list of equivalent PLMNs（同13）
额外跑T3245
- 格外注意，23.122规定，HPLMN不会被放到FPLMN中，所以#14不会应用在HPLMN，更多用于VPLMN，用在漫游场景

协议原文：

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall delete the list of equivalent PLMNs and reset the attach attempt counter.

In S1 mode, the UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list. Additionally, the UE shall enter state EMM-DEREGISTERED.PLMN-SEARCH and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in subclause 5.3.7a.

#15

在#12的基础上改为

把当前TAI放到"forbidden tracking areas for roaming"（同13）

协议原文：

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter.

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming". If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message.

对于#12~#15的总结

同：

#12~#15都会reset the attach attempt counter.
都会祖传删any GUTI, last visited registered TAI, TAI list and eKSI.

异：

禁止列表方面
- #12是forbidden tracking areas for regional provision of service"
- #13/#15都是"forbidden tracking areas for roaming"
- #14是"forbidden PLMNs for GPRS service"，且HPLMN不生效不进，所以针对VPLMN
- #13/#14在12的基础上，delete the list of equivalent PLMNs
timer方面：#14会额外跑T3245

重要：当#12, #13 or #15 没做完整性保护时，这几个被拒后还是可以搜其他的TA

协议原文：

if the EMM cause value received is #12, #13 or #15, the UE shall additionally proceed as specified in subclauses 5.5.1, 5.5.3 and 5.6.1;

#22

一般是NAS层面处理错误（5.5.1.2.5），但这个区分情况会有不同的行为

在attach/TAU失败的情况，即如下章节，给出的行为是

5.5.1.2.5 Attach not accepted by the network

5.5.1.3.5 Combined attach not accepted by the network

5.5.2.3.2 Network initiated detach procedure completion by the UE //这里包含#2

5.5.3.2.5 Normal and periodic tracking area updating procedure not accepted by the network

5.5.3.3.5 Combined tracking area updating procedure not accepted by the network

5.6.1.5 Service request procedure not accepted by the network

终止attach行为，重置attach attempt counter
可以基于待在当前服务小区，并尝试正常的小区重选行为
起T3346（依据是否有完整性保护，其取值来源不同）

协议原文：

The UE shall abort the attach procedure, reset the attach attempt counter

If the ATTACH REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008.

The UE stays in the current serving cell and applies the normal cell reselection process

在attach/TAU成功但SMS服务失败的情况，即如下章节，给出的行为是

5.5.1.2.4A Attach successful for EPS services and not accepted for SMS services

5.5.1.3.4.3 Combined attach successful for EPS services only

5.5.3.2.4A Tracking area updating successful for EPS services and not accepted for SMS services

5.5.3.3.4.3 Combined tracking area updating successful for EPS services only

attach/TAU尝试次数置为5，重启T3402

协议原文：

The tracking area updating attempt counter shall be set to 5. The UE shall start the timer T3402

#25/#42/#31

暂时没遇到，先不总结

#9/#10/#40（TAU reject比attach多的特定三个cause）

暂时没遇到，先不总结

2.2 非特殊处理的cause

#95, #96,#97, #99 and #111

只要不是只建立紧急服务承载相关的attach req，收到这几个cause立刻将attach尝试次数置为5（后续起T3402 12mins）

协议原文：

If the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the attach attempt counter to 5.

#16/#17

这两个cause对应的并不是被拒而是attach/TAU accept

处理方式和reject情况的非第一梯队的cause相同。会进入T3411/T3402的逻辑中。

协议原文：

The UE shall stop timer T3410 if still running, and shall enter state MM IDLE. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

- the UE shall start timer T3411

When timer T3411 expires the combined tracking area updating procedure...... is triggered.

If the tracking area updating attempt counter is equal to 5:

- shall start timer T3402,

When timer T3402 expires the combined tracking area updating procedure ..... is triggered;

对应章节为

5.5.1.3.4.3 Combined attach successful for EPS services only

5.5.3.3.4.3 Combined tracking area updating successful for EPS services only

#19

attach失败，且失败原因是default EPS bearer建立失败/ESM流程失败/运营商barring，这三种情况一般会报#19 "ESM failure"

对于非特殊处理的cause，一般会要求遵循T3411/T3402的逻辑。

协议原文：

If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, the attach request included a PDN CONNECTIVITY REQUEST message, the attach procedure fails due to:

- a default EPS bearer setup failure;

- an ESM procedure failure; or

- operator determined barring is applied on default EPS bearer context activation during attach procedure

In this case the EMM cause value in the ATTACH REJECT message shall be set to #19 "ESM failure"

对应章节为

5.5.1.2.5 Attach not accepted by the network

5.5.1.3.5 Combined attach not accepted by the network

3.NR cause

#27 N1_MODE_NOT_ALLOWED

有两种禁用

若无完整性保护，此时会起T3247，半小时，禁用当前TA接入
无论是否有完整性保护，#27本身会禁用当前PLMN的NR RAT，这个timer一般是小时级别

协议原文：

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter and shall enter the state 5GMM-DEREGISTERED.LIMITED SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set:

1) the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or

2) the SNPN-specific attempt counter for 3GPP access for the current SNPN in case of SNPN and the SNPN specific attempt counter for non-3GPP access for the current SNPN;

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for the specific access type for which the message was received -- 这句说明禁用NR PLMN

无完整性保护情况下原文

If the UE receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with 5GMM cause value #3, #6, #7, #11, #12, #13, #15, #27, #31, #62, #72 or #73 before the network has established secure exchange of NAS messages for the N1 NAS signalling connection, the UE shall stop timer T3510 or T3517 if running and start timer T3247 (see 3GPP TS 24.008 [12]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes