Review TP_5GNAS_AMF_SEC_COM_01 and TC_5GNAS_AMF_SEC_COM_01 (dde2245a) · Commits · INT - Core Network and Interoperability Testing / 5G Core / NAS

captures/TC_5GNAS_AMF_SEC_COM_01.pcap

0 → 100644

+4.39 KiB

File added.

No diff preview for this file type.

test_purposes/TP_AMF_NGNAS.tdltx

+6 −3

Changes for test_purposes/TP_AMF_NGNAS.tdltx: 6 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -341,7 +341,9 @@ Package TP_AMF_NGNAS {
		NAS_PDU containing {
		extended_protocol_discriminator set to 5GS_MOBILITY_MANAGEMENT_MESSAGES, //!reference ts_124007v180200p: Table 11.2.3.1.1A.1: EPD values
		security_header_type set to NOT_SECURITY_PROTECTED,
		message_type set to AUTHENTICATION_RESPONSE}} //!reference ts_124007v180200p: Table 11.2.3.1.1A.1: EPD values
		message_type set to AUTHENTICATION_RESPONSE,
		authentication_response_parameter containing {
		RES set to RV_RES_STAR}}} //!the valid RES* computed from RV_Authentication_parameter_RAND and RV_Authentication_parameter_AUTN
		from the GNB entity
		}
		then {
		@@ -354,8 +356,9 @@ Package TP_AMF_NGNAS {
		type_of_ciphering_algorithm set to PX_SELECTED_NAS_CIPHERING_ALGORITHM,
		type_of_integrity_algorithm set to PX_SELECTED_NAS_INTEGRITY_ALGORITHM},
		ngKSI containing {
		nas_key_set_identifier set to "111"},
		replayed_UE_security_capabilities set to PX_UE_SECURITY_CAPABILITIES}} //! UE security capability 9.11.3.54
		type_of_security_context set to NATIVE_SECURITY_CONTEXT,
		nas_key_set_identifier set to RV_NGKSI}, //!the ngKSI of the AUTHENTICATION_REQUEST
		replayed_UE_security_capabilities set to PX_UE_SECURITY_CAPABILITIES}} //!UE security capability 9.11.3.54: the value of the initial REGISTRATION_REQUEST
		to the GNB entity
		}
		}

ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn

+7 −0

Changes for ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn: 7 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -45,6 +45,13 @@ module NG_NAS_Pics {
		*/
		modulepar boolean PICS_NAS_A4_1_2_4 := true;

		/**
		* @desc Does the IUT initiate the security mode control procedure to take a 5G NAS security context into use, and
		* initialise and start NAS signalling security? (TS 24.501 clause 5.4.2)
		* @see ETSI TS 103 921-1 Table A.4 (PICS_NAS_A4_2_1)
		*/
		modulepar boolean PICS_NAS_A4_2_1 := true;

		} // End of group PICS_

		} // End of module NG_NAS_Pics
		No newline at end of file

ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn

+12 −0

Changes for ttcn/Ats_NG_NAS/NG_NAS_Steps.ttcn: 12 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -211,6 +211,18 @@ module NG_NAS_Steps {
		}
		} // End of function f_NG_NAS_amf_UE_AuthenticationFailure

		/**
		* @desc AUTHENTICATION RESPONSE with the valid RES* (offline: read from the capture). The AUTHENTICATION REQUEST was
		* received before (f_await_authentication_request).
		*/
		function f_NG_NAS_amf_UE_AuthenticationResponse() runs on aMF_NGNAS_NGAPComponent {
		if (PICS_OFFLINE_MODE) {
		f_await_authentication_response();
		} else {
		f_send_authentication_response();
		}
		} // End of function f_NG_NAS_amf_UE_AuthenticationResponse

		/**
		* @desc Test body of the AUTHENTICATION FAILURE / identification test cases (TC_5GNAS_AMF_AUT_REQ_04 cause #20,
		* TC_5GNAS_AMF_AUT_ABN_01 cause #26): AUTHENTICATION FAILURE with the 5GMM cause p_cause, then a plain IDENTITY

ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn

+41 −23

Changes for ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn: 41 added lines, 23 removed lines.
Original line number	Diff line number	Diff line
		@@ -429,49 +429,67 @@ module NG_NAS_TCFunctions {

		/**
		* @desc Testcase function for TC_5GNAS_AMF_SEC_COM_01
		* @see TP_5GNAS_AMF_SEC_COM_01: the AUTHENTICATION RESPONSE with the valid RES* is answered by a SECURITY MODE
		* COMMAND integrity protected with the new 5G NAS security context (security header type 3, MAC checked with
		* the new K_NAS_int), with the ngKSI of the AUTHENTICATION REQUEST, the replayed UE security capability of
		* the REGISTRATION REQUEST and algorithms supported by the UE (PX_SELECTED_NAS_CIPHERING_ALGORITHM,
		* PX_SELECTED_NAS_INTEGRITY_ALGORITHM).
		*/
		function f_TC_5GNAS_AMF_SEC_COM_01() runs on aMF_NGNAS_NGAPComponent {
		// Local variables
		var NG_NAS_DL_Message_Type v_message;
		var NG_UE_SecurityCapability v_ueCap := valueof(m_ng_ue_security_capability); // as sent in the REGISTRATION REQUEST
		var integer v_sht;
		var bitstring v_ngea := oct2bit(v_ueCap.ngeaCap);
		var bitstring v_ngia := oct2bit(v_ueCap.ngiaCap);

		// Preamble
		// Preamble: NG SETUP, initial REGISTRATION REQUEST with the SUCI, AUTHENTICATION REQUEST (RES* computed)
		f_NGNAS_amf_init();
		f_NG_NAS_amf_UE_Register();
		f_NG_NAS_amf_UE_Authentication();
		f_await_authentication_request();
		f_selfOrClientSyncAndVerdict(c_prDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Preamble done. *");

		// Test Body
		// Await SecurityModeCommand
		f_NG_NAS_amf_UE_AuthenticationResponse();
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		?,//PX_AMF_UE_NGAP_ID,
		PX_RAN_UE_NGAP_ID,
		? // Security mode command
		vc_AMF_UE_ID,
		vc_RAN_UE_ID,
		? // SecurityModeCommand
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		var NG_NAS_DL_Message_Type v_message;
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_SECURITY_MODE_COMMAND,
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("* " & __SCOPE__ & ": FAIL: Unexpected NG_SECURITY_MODE_COMMAND *");
		setverdict(fail);
		v_sht := bit2int(substr(oct2bit(vc_recvNAS_PDU[1]), 4, 4)); // TS 24.501 clause 9.3: octet 2, bits 4 to 1
		if (v_sht != 3) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: security header type " & int2str(v_sht) & ", 3 (integrity protected with new 5G NAS security context) expected *");
		} else if (not f_Check_5GAKA_NAS_DL_Message(vc_recvNAS_PDU, mw_NG_SECURITY_MODE_COMMAND, vc_ng_nas_security_params_type, vc_previous_nas_count_dl, v_message, vc_inner_message)) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: SECURITY MODE COMMAND expected, with a MAC valid for the new 5G NAS security context *");
		} else if (not match(v_message.security_Mode_Command.ngNasKSI, cr_NAS_KeySetIdentifier(vc_ngKSI, tsc_NasKsi_NativeSecurityContext))) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: the ngKSI is not the native ngKSI of the AUTHENTICATION REQUEST *");
		} else if ((v_message.security_Mode_Command.ueSecurityCapability.ngeaCap != v_ueCap.ngeaCap) or
		(v_message.security_Mode_Command.ueSecurityCapability.ngiaCap != v_ueCap.ngiaCap) or
		(ispresent(v_message.security_Mode_Command.ueSecurityCapability.eeaCap) != isvalue(v_ueCap.eeaCap)) or
		(ispresent(v_message.security_Mode_Command.ueSecurityCapability.eiaCap) != isvalue(v_ueCap.eiaCap))) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: the replayed UE security capability differs from the REGISTRATION REQUEST *");
		} else if ((v_ngea[bit2int(v_message.security_Mode_Command.nasSecurityAlgorithms.cipheringType)] != '1'B) or
		(v_ngia[bit2int(v_message.security_Mode_Command.nasSecurityAlgorithms.integrityType)] != '1'B)) { // bit 8 of the octet: 5G-EA0 / 5G-IA0
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: selected NAS security algorithms not supported by the UE *");
		} else if (not match(v_message.security_Mode_Command.nasSecurityAlgorithms.cipheringType, PX_SELECTED_NAS_CIPHERING_ALGORITHM) or
		not match(v_message.security_Mode_Command.nasSecurityAlgorithms.integrityType, PX_SELECTED_NAS_INTEGRITY_ALGORITHM)) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: selected NAS security algorithms differ from PX_SELECTED_NAS_CIPHERING_ALGORITHM / PX_SELECTED_NAS_INTEGRITY_ALGORITHM *");
		} else {
		log("* " & __SCOPE__ & ": PASS: Expected NG_SECURITY_MODE_COMMAND *");
		log("*** " & __SCOPE__ & ": PASS: Expected NG_SECURITY_MODE_COMMAND, 5G-EA", bit2int(v_message.security_Mode_Command.nasSecurityAlgorithms.cipheringType),
		", 5G-IA", bit2int(v_message.security_Mode_Command.nasSecurityAlgorithms.integrityType), ", ngKSI ", vc_ngKSI, " ***");
		setverdict(pass);
		}
		f_selfOrClientSyncAndVerdict(c_tbDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Testbody done. *");

		// Postamble
		// Terminate call with rejection
		f_send_NasAuthenticationFailure();
		f_send_ue_context_release_request_await_ue_context_release_response(m_cause_nas(authentication_failure));
		f_selfOrClientSyncAndVerdict(c_poDone, e_success);
		// Postamble: the SECURITY MODE COMMAND is left unanswered, release of the UE context
		f_NG_NAS_amf_UE_ReleaseContext(false);
		f_postamble_NGAP_AMF();
		f_selfOrClientSyncAndVerdict(c_poDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Postamble done. *");
		} // End of function f_TC_5GNAS_AMF_SEC_COM_01