From 89ca89ea4b9bc52c7612f5b251aa8673c479b56e Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Mon, 22 Jul 2024 16:06:29 +0200 Subject: [PATCH] Address integrity failure after UE reconnects from RRC IDLE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After a new connection from RRC IDLE, an integrity failure occurs. This commit is addressing this issue to pass the integrity check. * Reset ciphering and integrity algorithms when going into RRC IDLE * Use uplink NAS COUNT in Registration Request for initial KgNB derivation * Temporarily deriving UP protection keys in Registration Request * Note: AS SMC handling should be done according to 33.501 ยง6.8.1.1.2.2 --- openair2/RRC/NR_UE/rrc_UE.c | 2 ++ openair3/NAS/NR_UE/nr_nas_msg.c | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/openair2/RRC/NR_UE/rrc_UE.c b/openair2/RRC/NR_UE/rrc_UE.c index 6b8a12e4cc..f61ce49494 100644 --- a/openair2/RRC/NR_UE/rrc_UE.c +++ b/openair2/RRC/NR_UE/rrc_UE.c @@ -2562,6 +2562,8 @@ void nr_rrc_going_to_IDLE(NR_UE_RRC_INST_t *rrc, // discard the keys (only kgnb is stored) memset(rrc->kgnb, 0, sizeof(rrc->kgnb)); + rrc->integrityProtAlgorithm = 0; + rrc->cipheringAlgorithm = 0; // release all radio resources, including release of the RLC entity, // the MAC configuration and the associated PDCP entity diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c index f78caf39f9..64a541aa78 100644 --- a/openair3/NAS/NR_UE/nr_nas_msg.c +++ b/openair3/NAS/NR_UE/nr_nas_msg.c @@ -663,6 +663,12 @@ void generateRegistrationRequest(as_nas_info_t *initialNasMsg, nr_ue_nas_t *nas, nasmessagecontainercontents->length = mm_msg_encode(&full_mm, nasmessagecontainercontents->value, size_nct); size += (nasmessagecontainercontents->length + 2); rr->presencemask |= REGISTRATION_REQUEST_NAS_MESSAGE_CONTAINER_PRESENT; + // Workaround to pass integrity in RRC_IDLE + uint8_t *kamf = nas->security.kamf; + uint8_t *kgnb = nas->security.kgnb; + derive_kgnb(kamf, nas->security.nas_count_ul, kgnb); + int nas_itti_kgnb_refresh_req(instance_t instance, const uint8_t kgnb[32]); + nas_itti_kgnb_refresh_req(nas->UE_id, nas->security.kgnb); } // Allocate buffer (including NAS message container size) initialNasMsg->nas_data = malloc_or_fail(size * sizeof(*initialNasMsg->nas_data));