触发原因:
UE被LTE以cause#3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35被拒,attach过程中完整性保护都不做,或者鉴权被拒,鉴权过程没有完整性保护
UE被NR以#3, #6, #7, #11, #12, #13, #15, #27, #31, #62, #72 or #73被拒,且不做完整性保护
T3247启动,禁当前TA 随机30~60mins,
超时行为:
删掉所有被禁的TA list(of "forbidden tracking areas for regional provision of service and of “forbidden tracking areas for roaming”)
UE行为:
3GPP协议没有具体规定UE的后续行为,主要看芯片厂商实现!
如何清除:
- 重启UE
- 定时器自动超时
协议原文 24.301 5.3.7b
If the UE receives an ATTACH REJECT, TRACKING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with EMM cause value #3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35 before the network has established secure exchange of NAS messages for the NAS signalling connection, the UE shall start timer T3247 (see 3GPP TS 24.008 [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes
- if the EMM cause value received is #12, #13 or #15, the UE shall additionally proceed as specified in subclauses 5.5.1, 5.5.3 and 5.6.1;
24.301 5.4.2.5
Upon receipt of an AUTHENTICATION REJECT message,
b) if the message is received without integrity protection, the UE shall start timer T3247 (see 3GPP TS 24.008 [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes
- otherwise, the UE shall search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304
Upon expiry of timer T3247, the UE shall
- remove all tracking areas from the list of “forbidden tracking areas for regional provision of service” and the list of “forbidden tracking areas for roaming”,