Purpose of T3460: Timer T3460 is used in the NAS procedures to ensure proper communication between the network (MME) and the UE during critical signaling exchanges, such as Authentication and Security Mode Control. It sets a time limit for the UE to respond to network-initiated messages like AUTHENTICATION REQUEST or SECURITY MODE COMMAND. If the timer expires without a response, the network takes specific recovery actions.

T3460 is critical for:

• Ensuring timely responses from the UE.
• Recovering from transient communication failures through retransmissions.
• Providing a controlled mechanism to terminate stalled procedures, maintaining the efficiency and reliability of the network.

T3460 is a network timer in the MME, and its value is 6 s. One timer serves two different procedures. So an attach with authentication and security mode control starts T3460 twice, once for the challenge and once for the security mode command.

• Key Scenarios Involving T3460
• What values does T3460 take, and how long can the MME wait?
• What stops T3460 besides the expected answer?
• Reference

Key Scenarios Involving T3460

T3460 always follows a message that the MME sends and the UE must answer. The authentication procedure and the NAS security mode control procedure both start it. Let's take the two procedures one at a time, and then look at the cases where neither answer arrives.

Authentication Procedure:

In the authentication procedure the MME sends the challenge and waits for the result. Two answers are possible, and both stop T3460. An AUTHENTICATION RESPONSE carries RES, and an AUTHENTICATION FAILURE carries the reason why the UE rejected the challenge.

• Initiation: When the network sends an AUTHENTICATION REQUEST, it starts timer T3460. The timer runs until the network receives a response (AUTHENTICATION RESPONSE or AUTHENTICATION FAILURE).
• Completion: Upon receiving the response, the network stops T3460 and processes the received data (e.g., verifying the response).
• Expiry: If T3460 expires before receiving a response:
• The network retransmits the AUTHENTICATION REQUEST and restarts T3460.
• This process is repeated four times. If T3460 expires a fifth time, the network:
• Aborts the authentication procedure.
• Ends any ongoing EMM-specific procedures.
• Releases the NAS signaling connection.

The diagram below shows T3460 in an authentication that fails once and then succeeds. The network runs T3460 for each AUTHENTICATION REQUEST. Between the two challenges it also runs an identification procedure, while the UE runs T3418.

Each AUTHENTICATION REQUEST gets its own T3460. A failure answer stops T3460 in the same way as a successful response does.

• First T3460 : the upper bracket at the right. It starts with Authentication Request, and Authentication Failure with cause MAC Failure stops it.
• T3470 : the middle bracket at the right. It belongs to the identification procedure, which the drawing labels Indentity Request. The T3470 page covers it.
• T3418 : the long arrow at the left. It runs in the UE while the network checks the IMSI. The T3418 page covers it.
• Second T3460 : the lower bracket at the right. The new Authentication Request starts it, and Authentication Response stops it.

Security Mode Control Procedure:

After a successful authentication, the MME takes the new EPS security context into use with a SECURITY MODE COMMAND. The MME also uses this procedure to change the NAS algorithms of a context already in use, or to ask for the UE radio capability ID. T3460 supervises it in every case.

• Initiation: The network starts T3460 after sending a SECURITY MODE COMMAND to the UE.
• Completion: T3460 is stopped when the network receives a SECURITY MODE COMPLETE message. After this, all signaling is protected using the selected integrity and encryption algorithms.
• Abnormal Cases:
• If T3460 expires, the network retransmits the SECURITY MODE COMMAND and restarts the timer. This is repeated up to four times. After the fifth expiry:
• The network aborts the security mode control procedure.
• Any related EMM-specific procedures are stopped.

A SECURITY MODE REJECT also stops T3460. The UE sends it with a cause that is typically #23 "UE security capabilities mismatch" or #24 "security mode rejected, unspecified". The MME then aborts the procedure that triggered the security mode control.

Note one difference between the two expiry rules. For authentication, 24.301 clause 5.4.2.7 says that the network aborts any ongoing EMM specific procedure and releases the NAS signalling connection. For security mode control, clause 5.4.3.7 only says that the procedure is aborted. 24.301 does not say what the MME does next with the triggering procedure.

Handling Abnormal Scenarios

The two procedures share the same abnormal cases on the network side. A lower layer failure ends the procedure at once, and repeated expiries end it after five tries. The last bullet below concerns the security context, which 24.301 states most directly for a rejected security mode command.

• Lower Layer Failures: If a failure occurs at lower layers before receiving the expected response (e.g., AUTHENTICATION RESPONSE or SECURITY MODE COMPLETE), the network stops T3460 and aborts the procedure.
• Retries and Abortion: The network ensures multiple retries to accommodate temporary issues, but after five failures (T3460 expiries), the procedure is deemed unsuccessful, and the connection or process is terminated.
• EPS Security Context: If a security mode or authentication procedure is aborted, both the UE and network revert to the last known EPS security context (if available) to maintain communication integrity.

24.301 states the security context rule most directly for SECURITY MODE REJECT. Both the UE and the MME then use the EPS security context that was in use before the procedure, if any, to protect the reject and later messages.

• Two procedures share one timer : AUTHENTICATION REQUEST and SECURITY MODE COMMAND both start T3460.
• Any answer stops T3460 : AUTHENTICATION FAILURE and SECURITY MODE REJECT stop it just like the successful answers.
• Four retransmissions, then abort : the fifth expiry ends the procedure.
• Only the authentication rule releases the connection : the security mode control rule only aborts the procedure.

What values does T3460 take, and how long can the MME wait?

T3460 is short compared with the UE procedure timers, so the MME can retransmit several times. Let's check the numbers, because the MME retransmissions and the UE timers do not always fit together.

24.301 Table 10.2.2 gives T3460 a value of 6 s. For a UE in CE mode A or CE mode B that supports CE mode B, and for MEO and GEO satellite access, the value is 24 s. In NB-S1 mode the MME adds 240 s to the table value, so T3460 is 246 s. The table below adds up the time from the first message to the abort on the fifth expiry.

Now compare the first row with the UE side. During an attach, the UE runs T3410 with 15 s, and receiving an AUTHENTICATION REQUEST does not stop it. After two T3460 expiries, 12 s have passed, and T3410 expires 3 s later. So during an attach the UE can abort and count a failed attempt before the MME reaches its fifth T3460 expiry. The later retransmissions then arrive at a UE that no longer runs the attach.

Table 10.2.2 marks the fifth expiry as the typical point of abort, and it allows exceptions in the procedure text. For T3460 there is no exception. Both clause 5.4.2.7 and clause 5.4.3.7 abort on the fifth expiry.

• T3460 is 6 s : 24 s in WB-S1/CE mode and 246 s in NB-S1 mode.
• Five expiries take 30 s : the MME gives up 30 s after the first message with default values.
• T3410 can end first : a UE in an attach aborts after 15 s, before the MME has used all its retransmissions.

What stops T3460 besides the expected answer?

A retransmission timer assumes that the message was lost. But the UE may also be busy with a procedure of its own, or the message may be held up by a handover. 24.301 handles both situations without waiting for T3460 to expire.

For security mode control, clause 5.4.3.7 lists two collision cases. The UE can start an attach, a service request, a TAU or a detach that is not a switch off. The MME then aborts the security mode control procedure and runs the UE procedure. With any other EMM procedure, the MME runs both procedures.

Handover is the second situation. An intra MME handover can prevent delivery of the AUTHENTICATION REQUEST or the SECURITY MODE COMMAND. In that case the MME retransmits the message after the handover succeeds, provided the target TA is in the TAI list. If the handover fails and the S1 signalling connection still exists, the MME also retransmits the message. These retransmissions come from a lower layer indication, not from a T3460 expiry.

One detail matters for inter-system change from A/Gb mode or Iu mode. If the SECURITY MODE COMMAND creates a mapped EPS security context, a retransmission after a T3460 expiry keeps the same nonceMME and nonceUE. The MME does not generate new values.

• A UE procedure wins over security mode control : attach, service request, TAU and detach abort the security mode control procedure.
• Other EMM procedures run in parallel : the MME progresses both procedures.
• Handover triggers its own retransmission : the MME resends the message after a lower layer reports non-delivery.
• A retransmitted mapped-context command keeps its nonces : nonceMME and nonceUE do not change.

Reference

[1] 3GPP TS 24.301 v20.0.0 - clause 5.4.2, EPS authentication and key agreement procedure, clause 5.4.3, Security mode control procedure, clause 4.7 and 4.8, and Table 10.2.2