libvlr: fix is_ciph_required(): always send SecModeCmd for UTRAN

Ciphering is optional in both GERAN and UTRAN, however for the later
it's *required* to enable integrity protection for the signalling.
Thus we must always send Security Mode Command in UTRAN, even in
case if ciphering is disabled (UEA0) in the configuration.

The actual decision whether to send CMC/SMC or not is taken in:

  * vlr_access_req_fsm.c / _proc_arq_vlr_node2(), and
  * vlr_lu_fsm.c / vlr_loc_upd_post_auth().

depending on the value returned by is_ciph_required().  Let's
rename this function to is_cmc_smc_required() and ensure that
it always returns true in UTRAN.

This change fixes the Iu test cases in ttcn3-msc-test.

Change-Id: I6205f13453eff7afbf25e013d72ae98a78fcd31b
Fixes: OS#5333

src/libvlr/vlr_access_req_fsm.c

@@ -267,9 +267,12 @@ static void _proc_arq_vlr_node2_post_ciph(struct osmo_fsm_inst *fi)
 	_proc_arq_vlr_node2_post_vlr(fi);
 }
 
-static bool is_ciph_required(struct proc_arq_priv *par)
+/* Determine if sending of CMC/SMC is required */
+static bool is_cmc_smc_required(struct proc_arq_priv *par)
 {
-	return par->ciphering_required;
+	/* UTRAN: always send SecModeCmd, even if ciphering is not required.
+	 * GERAN: avoid sending CiphModeCmd if ciphering is not required. */
+	return par->is_utran || par->ciphering_required;
 }
 
 static void _proc_arq_vlr_node2(struct osmo_fsm_inst *fi)
@@ -280,7 +283,7 @@ static void _proc_arq_vlr_node2(struct osmo_fsm_inst *fi)
 
 	LOGPFSM(fi, "%s()\n", __func__);
 
-	if (!is_ciph_required(par)) {
+	if (!is_cmc_smc_required(par)) {
 		_proc_arq_vlr_node2_post_ciph(fi);
 		return;
 	}

src/libvlr/vlr_lu_fsm.c

@@ -702,10 +702,12 @@ static bool is_auth_required(struct lu_fsm_priv *lfp)
 		(lfp->ciphering_required && !auth_try_reuse_tuple(lfp->vsub, lfp->key_seq));
 }
 
-/* Determine if ciphering is required */
+/* Determine if sending of CMC/SMC is required */
-static bool is_ciph_required(struct lu_fsm_priv *lfp)
+static bool is_cmc_smc_required(struct lu_fsm_priv *lfp)
 {
-	return lfp->ciphering_required;
+	/* UTRAN: always send SecModeCmd, even if ciphering is not required.
+	 * GERAN: avoid sending CiphModeCmd if ciphering is not required. */
+	return lfp->is_utran || lfp->ciphering_required;
 }
 
 /* Determine if a HLR Update is required */
@@ -853,7 +855,7 @@ static void vlr_loc_upd_post_auth(struct osmo_fsm_inst *fi)
 
 	OSMO_ASSERT(vsub);
 
-	if (!is_ciph_required(lfp)) {
+	if (!is_cmc_smc_required(lfp)) {
 		vlr_loc_upd_post_ciph(fi);
 		return;
 	}

tests/msc_vlr/msc_vlr_test_umts_authen.c

@@ -124,31 +124,38 @@ static void _test_umts_authen(enum osmo_rat_type via_ran)
 	VERBOSE_ASSERT(auth_request_sent, == true, "%d");
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
-	if (encryption) {
+	switch (via_ran) {
-		if (via_ran == OSMO_RAT_GERAN_A) {
+	case OSMO_RAT_GERAN_A:
+		if (encryption) {
 			btw("Test code not implemented");
 			OSMO_ASSERT(false);
-		} else {
-			/* On UTRAN */
-			btw("Encryption enabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
-			ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
-			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
-			VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
-
-			btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
-			gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
-			ms_sends_security_mode_complete(1);
-			VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
-			VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 		}
-	} else {
+
-		/* Encryption disabled */
 		btw("Encryption disabled. MS sends Authen Response, VLR accepts and sends GSUP LU Req to HLR");
 		gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
 		ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
 		VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
 		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+		break;
+	case OSMO_RAT_UTRAN_IU:
+		/* Even if encryption is disabled (UEA0), we still expect a SecurityModeControl
+		 * message indicating UIA, because integrity protection is mandatory in UTRAN. */
+		btw("Encryption %sabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl",
+		    encryption ? "en" : "dis");
+		expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
+		ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
+		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+
+		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
+		gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
+		ms_sends_security_mode_complete(encryption ? 0x01 : 0x00);
+		VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
+		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+		break;
+	default:
+		btw("Unhandled RAT %s", osmo_rat_type_name(via_ran));
+		OSMO_ASSERT(false);
 	}
 
 	btw("HLR sends _INSERT_DATA_REQUEST, VLR responds with _INSERT_DATA_RESULT");
@@ -198,28 +205,35 @@ static void _test_umts_authen(enum osmo_rat_type via_ran)
 	EXPECT_ACCEPTED(false);
 	thwart_rx_non_initial_requests();
 
-	if (encryption) {
+	switch (via_ran) {
-		if (via_ran == OSMO_RAT_GERAN_A) {
+	case OSMO_RAT_GERAN_A:
+		if (encryption) {
 			btw("Test code not implemented");
 			OSMO_ASSERT(false);
-		} else {
-			/* On UTRAN */
-			btw("Encryption enabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
-			ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
-			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
-			VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
-
-			btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
-			ms_sends_security_mode_complete(1);
-			VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 		}
-	} else {
+
-		/* Encryption disabled */
 		btw("Encryption disabled. MS sends Authen Response, VLR accepts with a CM Service Accept");
 		gsup_expect_tx(NULL);
 		ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
 		VERBOSE_ASSERT(cm_service_result_sent, == RES_ACCEPT, "%d");
+		break;
+	case OSMO_RAT_UTRAN_IU:
+		/* Even if encryption is disabled (UEA0), we still expect a SecurityModeControl
+		 * message indicating UIA, because integrity protection is mandatory in UTRAN. */
+		btw("Encryption %sabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl",
+		    encryption ? "en" : "dis");
+		expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
+		ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
+		VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
+
+		btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
+		ms_sends_security_mode_complete(encryption ? 0x01 : 0x00);
+		VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
+		break;
+	default:
+		btw("Unhandled RAT %s", osmo_rat_type_name(via_ran));
+		OSMO_ASSERT(false);
 	}
 
 	/* Release connection */
@@ -265,27 +279,34 @@ static void _test_umts_authen(enum osmo_rat_type via_ran)
 	EXPECT_ACCEPTED(false);
 	thwart_rx_non_initial_requests();
 
-	if (encryption) {
+	switch (via_ran) {
-		if (via_ran == OSMO_RAT_GERAN_A) {
+	case OSMO_RAT_GERAN_A:
+		if (encryption) {
 			btw("Test code not implemented");
 			OSMO_ASSERT(false);
-		} else {
-			/* On UTRAN */
-			btw("Encryption enabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			expect_security_mode_ctrl(NULL, "eb50e770ddcc3060101d2f43b6c2b884");
-			ms_sends_msg("0554" "706f9967" "2104" "19ba609c"); /* 3nd vector's res, s.a. */
-			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
-
-			btw("MS sends SecurityModeControl acceptance, VLR accepts and sends SMS");
-			dtap_expect_tx(sms);
-			ms_sends_security_mode_complete(1);
 		}
-	} else {
+
-		/* Encryption disabled */
 		btw("Encryption disabled. MS sends Authen Response, VLR accepts and sends pending SMS");
 		dtap_expect_tx(sms);
 		ms_sends_msg("0554" "706f9967" "2104" "19ba609c"); /* 3nd vector's res, s.a. */
 		VERBOSE_ASSERT(dtap_tx_confirmed, == true, "%d");
+		break;
+	case OSMO_RAT_UTRAN_IU:
+		/* Even if encryption is disabled (UEA0), we still expect a SecurityModeControl
+		 * message indicating UIA, because integrity protection is mandatory in UTRAN. */
+		btw("Encryption %sabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl",
+		    encryption ? "en" : "dis");
+		expect_security_mode_ctrl(NULL, "eb50e770ddcc3060101d2f43b6c2b884");
+		ms_sends_msg("0554" "706f9967" "2104" "19ba609c"); /* 3nd vector's res, s.a. */
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
+
+		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends SMS");
+		dtap_expect_tx(sms);
+		ms_sends_security_mode_complete(encryption ? 0x01 : 0x00);
+		break;
+	default:
+		btw("Unhandled RAT %s", osmo_rat_type_name(via_ran));
+		OSMO_ASSERT(false);
 	}
 
 	btw("SMS was delivered, no requests pending for subscr");
@@ -516,31 +537,38 @@ static void _test_umts_authen_resync(enum osmo_rat_type via_ran)
 	VERBOSE_ASSERT(auth_request_sent, == true, "%d");
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
-	if (encryption) {
+	switch (via_ran) {
-		if (via_ran == OSMO_RAT_GERAN_A) {
+	case OSMO_RAT_GERAN_A:
+		if (encryption) {
 			btw("Test code not implemented");
 			OSMO_ASSERT(false);
-		} else {
-			/* On UTRAN */
-			btw("Encryption enabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			expect_security_mode_ctrl(NULL, "8a90c769b7272f3bb7a1c1fbb1ea9349");
-			ms_sends_msg("0554" "1df5f0b4" "2104" "f22b696e");
-			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
-			VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
-
-			btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
-			gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
-			ms_sends_security_mode_complete(1);
-			VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
-			VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 		}
-	} else {
+
-		/* Encryption disabled */
 		btw("Encryption disabled. MS sends Authen Response, VLR accepts and sends GSUP LU Req to HLR");
 		gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
 		ms_sends_msg("0554" "1df5f0b4" "2104" "f22b696e");
 		VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
 		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+		break;
+	case OSMO_RAT_UTRAN_IU:
+		/* Even if encryption is disabled (UEA0), we still expect a SecurityModeControl
+		 * message indicating UIA, because integrity protection is mandatory in UTRAN. */
+		btw("Encryption %sabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl",
+		    encryption ? "en" : "dis");
+		expect_security_mode_ctrl(NULL, "8a90c769b7272f3bb7a1c1fbb1ea9349");
+		ms_sends_msg("0554" "1df5f0b4" "2104" "f22b696e");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
+		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+
+		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
+		gsup_expect_tx("04010809710000000156f0" CN_DOMAIN VLR_TO_HLR);
+		ms_sends_security_mode_complete(encryption ? 0x01 : 0x00);
+		VERBOSE_ASSERT(gsup_tx_confirmed, == true, "%d");
+		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
+		break;
+	default:
+		btw("Unhandled RAT %s", osmo_rat_type_name(via_ran));
+		OSMO_ASSERT(false);
 	}
 
 	btw("HLR sends _INSERT_DATA_REQUEST, VLR responds with _INSERT_DATA_RESULT");

tests/msc_vlr/msc_vlr_test_umts_authen.err

@@ -660,7 +660,7 @@ DREF VLR subscr IMSI-901700000010650 - vlr_gsup_rx: now used by 1 (active-conn)
 <-- GSUP rx OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT: vlr_gsupc_read_cb() returns 0
   auth_request_sent == 1
   lu_result_sent == 0
-- Encryption disabled. MS sends Authen Response, VLR accepts and sends GSUP LU Req to HLR
+- Encryption disabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl
   MSC <--UTRAN-Iu-- MS: GSM48_MT_MM_AUTH_RESP
 DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: + rx_from_ms: now used by 2 (lu,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN decode: DTAP
@@ -675,18 +675,28 @@ DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED
 DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Removing from parent vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU)
 DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_ciph()
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
+DMSC msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN encode: CIPHER_MODE_COMMAND on UTRAN-Iu
+- sending SecurityModeControl: ik=27497388b6cb044648f396aa155b95ef
+DMSC dummy_msc_i(IMSI-901700000010650:UTRAN-Iu:LU){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
+DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Deallocated
+DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (lu)
+  security_mode_ctrl_sent == 1
+  lu_result_sent == 0
+- MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
+DIUCS msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN decode: CIPHER_MODE_COMPLETE
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: Received Event VLR_ULA_E_CIPH_RES
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: vlr_loc_upd_post_ciph()
 DMSC msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN encode: COMMON_ID on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:UTRAN-Iu:LU){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_node_4()
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: vlr_loc_upd_node_4()
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_HLR_UPD
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: state_chg to VLR_ULA_S_WAIT_HLR_UPD
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: Allocated
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: is child of vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU)
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: Received Event UPD_HLR_VLR_E_START
 GSUP --> HLR: OSMO_GSUP_MSGT_UPDATE_LOCATION_REQUEST: 04010809710000000156f02801020a0101
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: state_chg to UPD_HLR_VLR_S_WAIT_FOR_DATA
-DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Deallocated
-DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (lu)
   gsup_tx_confirmed == 1
   lu_result_sent == 0
 - HLR sends _INSERT_DATA_REQUEST, VLR responds with _INSERT_DATA_RESULT
@@ -864,7 +874,7 @@ DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVIC
 DRLL msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: Dispatching 04.08 message: SMS SMS:0x01
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: Message not permitted for initial conn: SMS:0x01
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN decode error (rc=-13) for DTAP from MSC-I
-- Encryption disabled. MS sends Authen Response, VLR accepts with a CM Service Accept
+- Encryption disabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl
   MSC <--UTRAN-Iu-- MS: GSM48_MT_MM_AUTH_RESP
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: + rx_from_ms: now used by 2 (cm_service_sms,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN decode: DTAP
@@ -879,25 +889,31 @@ DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu
 DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){VLR_SUB_AS_AUTHENTICATED}: Removing from parent Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ)
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: Received Event PR_ARQ_E_AUTH_RES
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2_post_ciph()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN encode: CIPHER_MODE_COMMAND on UTRAN-Iu
+- sending SecurityModeControl: ik=1159ec926a50e98c034a6b7d7c9f418d
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
+DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){VLR_SUB_AS_AUTHENTICATED}: Deallocated
+DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (cm_service_sms)
+  security_mode_ctrl_sent == 1
+  cm_service_result_sent == 0
+- MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN decode: CIPHER_MODE_COMPLETE
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: Received Event PR_ARQ_E_CIPH_RES
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_node2_post_ciph()
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN encode: COMMON_ID on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2_post_vlr()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_node2_post_vlr()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_pres()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_pres()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_trace()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_trace()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_imei()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_imei()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: proc_arq_fsm_done(PASSED)
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: proc_arq_fsm_done(PASSED)
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_DONE
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_WAIT_CIPH}: state_chg to PR_ARQ_S_DONE
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){PR_ARQ_S_DONE}: Process Access Request result: PASSED
-DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: Sending DTAP: MM GSM48_MT_MM_CM_SERV_ACC
-DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: RAN encode: DTAP on UTRAN-Iu
-- DTAP --UTRAN-Iu--> MS: GSM48_MT_MM_CM_SERV_ACC: 0521
-DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: Received Event MSC_A_EV_AUTHENTICATED
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTH_CIPH}: state_chg to MSC_A_ST_AUTHENTICATED
-DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){VLR_SUB_AS_AUTHENTICATED}: Deallocated
+  cm_service_result_sent == 0
-DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTHENTICATED}: - rx_from_ms: now used by 1 (cm_service_sms)
-  cm_service_result_sent == 1
 - Concluding CM Service Request
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTHENTICATED}: - cm_service_sms: now used by 0 (-)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_AUTHENTICATED}: Received Event MSC_A_EV_UNUSED
@@ -1020,7 +1036,7 @@ DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RE
 DRLL msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: Dispatching 04.08 message: SMS SMS:0x01
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: Message not permitted for initial conn: SMS:0x01
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: RAN decode error (rc=-13) for DTAP from MSC-I
-- Encryption disabled. MS sends Authen Response, VLR accepts and sends pending SMS
+- Encryption disabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl
   MSC <--UTRAN-Iu-- MS: GSM48_MT_MM_AUTH_RESP
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: + rx_from_ms: now used by 2 (paging-response,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: RAN decode: DTAP
@@ -1035,22 +1051,33 @@ DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu
 DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){VLR_SUB_AS_AUTHENTICATED}: Removing from parent Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: Received Event PR_ARQ_E_AUTH_RES
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2_post_ciph()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
+DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: RAN encode: CIPHER_MODE_COMMAND on UTRAN-Iu
+- sending SecurityModeControl: ik=eb50e770ddcc3060101d2f43b6c2b884
+DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
+DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){VLR_SUB_AS_AUTHENTICATED}: Deallocated
+DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (paging-response)
+  security_mode_ctrl_sent == 1
+- MS sends SecurityModeControl acceptance, VLR accepts and sends SMS
+DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: RAN decode: CIPHER_MODE_COMPLETE
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: Received Event PR_ARQ_E_CIPH_RES
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_node2_post_ciph()
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: RAN encode: COMMON_ID on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2_post_vlr()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_node2_post_vlr()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_pres()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_pres()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_trace()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_trace()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_post_imei()
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: _proc_arq_vlr_post_imei()
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: proc_arq_fsm_done(PASSED)
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: proc_arq_fsm_done(PASSED)
-DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_DONE
+DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_WAIT_CIPH}: state_chg to PR_ARQ_S_DONE
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_DONE}: Process Access Request result: PASSED
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: Received Event MSC_A_EV_AUTHENTICATED
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTH_CIPH}: state_chg to MSC_A_ST_AUTHENTICATED
 DPAG Paging: IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 for MT-SMS: Paging Response action (success)
 DPAG Paging: IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 for MT-SMS: Removing Paging Request
 DLSMS trans(SMS IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x40000002 tid-0) mmsms_paging_cb(success)
-DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: + sms: now used by 3 (paging-response,rx_from_ms,sms)
+DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: + sms: now used by 2 (paging-response,sms)
 DLSMS SMC(0) message MMSMS-EST-CNF received in state MM_CONN_PENDING
 DLSMS SMC(0) send CP data
 DLSMS SMC(0) new CP state MM_CONN_PENDING -> WAIT_CP_ACK
@@ -1062,10 +1089,7 @@ DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RES
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - Paging: now used by 4 (attached,SMS-receiver,SMS,active-conn)
-DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: - paging-response: now used by 2 (rx_from_ms,sms)
+DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: - paging-response: now used by 1 (sms)
-DVLR VLR_Authenticate(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){VLR_SUB_AS_AUTHENTICATED}: Deallocated
-DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: - rx_from_ms: now used by 1 (sms)
-  dtap_tx_confirmed == 1
 - SMS was delivered, no requests pending for subscr
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + _test_umts_authen: now used by 5 (attached,SMS-receiver,SMS,active-conn,_test_umts_authen)
   llist_count(&vsub->cs.requests) == 0
@@ -1136,7 +1160,7 @@ DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x0302010
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_DONE}: Removing from parent msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DVLR Process_Access_Request_VLR(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){PR_ARQ_S_DONE}: Deferring: will deallocate with msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP)
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASED}: Removing from parent msub_fsm
-DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASED}: max total use count was 3
+DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASED}: max total use count was 2
 DMSC msub_fsm{active}: Received Event MSUB_EV_ROLE_TERMINATED
 DMSC msub(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100) MSC-A terminated
 DMSC msub(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100) 1 MSC-I still active
@@ -2158,7 +2182,7 @@ DREF VLR subscr IMSI-901700000010650 - vlr_gsup_rx: now used by 1 (active-conn)
 <-- GSUP rx OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT: vlr_gsupc_read_cb() returns 0
   auth_request_sent == 1
   lu_result_sent == 0
-- Encryption disabled. MS sends Authen Response, VLR accepts and sends GSUP LU Req to HLR
+- Encryption disabled. MS sends Authen Response, VLR accepts and sends SecurityModeControl
   MSC <--UTRAN-Iu-- MS: GSM48_MT_MM_AUTH_RESP
 DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: + rx_from_ms: now used by 2 (lu,rx_from_ms)
 DIUCS msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN decode: DTAP
@@ -2173,18 +2197,28 @@ DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED
 DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Removing from parent vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU)
 DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_ciph()
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
+DMSC msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN encode: CIPHER_MODE_COMMAND on UTRAN-Iu
+- sending SecurityModeControl: ik=8a90c769b7272f3bb7a1c1fbb1ea9349
+DMSC dummy_msc_i(IMSI-901700000010650:UTRAN-Iu:LU){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
+DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Deallocated
+DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (lu)
+  security_mode_ctrl_sent == 1
+  lu_result_sent == 0
+- MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
+DIUCS msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN decode: CIPHER_MODE_COMPLETE
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: Received Event VLR_ULA_E_CIPH_RES
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: vlr_loc_upd_post_ciph()
 DMSC msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: RAN encode: COMMON_ID on UTRAN-Iu
 DMSC dummy_msc_i(IMSI-901700000010650:UTRAN-Iu:LU){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_node_4()
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: vlr_loc_upd_node_4()
-DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_HLR_UPD
+DVLR vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU){VLR_ULA_S_WAIT_CIPH}: state_chg to VLR_ULA_S_WAIT_HLR_UPD
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: Allocated
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: is child of vlr_lu_fsm(IMSI-901700000010650:UTRAN-Iu:LU)
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: Received Event UPD_HLR_VLR_E_START
 GSUP --> HLR: OSMO_GSUP_MSGT_UPDATE_LOCATION_REQUEST: 04010809710000000156f02801020a0101
 DVLR upd_hlr_vlr_fsm(IMSI-901700000010650:UTRAN-Iu:LU){UPD_HLR_VLR_S_INIT}: state_chg to UPD_HLR_VLR_S_WAIT_FOR_DATA
-DVLR VLR_Authenticate(IMSI-901700000010650:UTRAN-Iu:LU){VLR_SUB_AS_AUTHENTICATED}: Deallocated
-DREF msc_a(IMSI-901700000010650:UTRAN-Iu:LU){MSC_A_ST_AUTH_CIPH}: - rx_from_ms: now used by 1 (lu)
   gsup_tx_confirmed == 1
   lu_result_sent == 0
 - HLR sends _INSERT_DATA_REQUEST, VLR responds with _INSERT_DATA_RESULT