Security Mode Complete is the NAS message the UE sends to confirm that it accepted the selected NAS security algorithms and has switched into the commanded protected signaling state.
Message Fact Sheet
Protocol
nas
Network
5g
Spec
3GPP TS 24.501
Spec Section
8.2.21
Direction
UE to AMF
Message Type
5GMM signaling
Full message name
5G NAS - Security Mode Complete
Protocol
NAS
Technology
5G
Direction
UE to AMF
Interface
N1
Signaling bearer / channel
NAS signaling / Dedicated NAS message, commonly transported via UL Information Transfer
Typical trigger
Sent immediately after the UE successfully processes Security Mode Command and activates the selected NAS security algorithms.
Main purpose
Confirms successful activation of the NAS security configuration chosen by the AMF so the registration or service procedure can continue securely.
Main specification
3GPP TS 24.501, 8.2.21
Release added
Release 15
Procedures where used
5G Initial Registration, Mobility Registration Update, Service handling with security context establishment
Related timers
T3560
What is Security Mode Complete in simple terms?
Security Mode Complete is the NAS message the UE sends to confirm that it accepted the selected NAS security algorithms and has switched into the commanded protected signaling state.
Confirms successful activation of the NAS security configuration chosen by the AMF so the registration or service procedure can continue securely.
Why this message matters
Security Mode Complete is the UE confirming that it accepted the NAS security settings chosen by the network.
Where this message appears in the call flow
5G Initial Registration
Call flow position: UE confirmation step after Security Mode Command and before Registration Accept.
Typical state: NAS security is active and the procedure is ready to move into final registration acceptance.
Preconditions:
The UE has received and accepted Security Mode Command.
The selected NAS algorithms and ngKSI context are usable.
Next likely message: Registration Accept
Mobility Registration Update
Call flow position: UE security confirmation point before the update procedure continues with later mobility-management handling.
Typical state: NAS signaling is now protected according to the selected security context.
Preconditions:
The AMF has commanded NAS security activation.
Next likely message: Configuration Update Command or later procedure-specific NAS handling
Domain: Core-side mobility management signaling with radio-side NAS transport
Signaling bearer: NAS signaling
Logical channel: Dedicated NAS message, commonly transported via UL Information Transfer
Transport / encapsulation: NAS 5GS message carried end-to-end between UE and AMF
Security context: This message confirms that the UE has accepted the selected NAS security context and is now operating with that protected state.
Message Structure Overview
Security Mode Complete is the UE-side confirmation that the commanded NAS security context is now active.
In practice, engineers read it as the handoff point from security activation into the next protected NAS procedure step.
ASN.1 Message Syntax for 5G NAS - Security Mode Complete
This message is not typically analyzed as ASN.1 on the wire. It is usually read as a NAS or protocol field structure instead.
Security Mode Complete follows NAS 24.501 IE structure and is not an ASN.1 message.
5G NAS - Security Mode Complete - Example Dump
Security Mode Complete
Extended Protocol Discriminator: 5G Mobility Management
Security Header Type: Integrity protected and ciphered with new 5G NAS security context
Message Type: Security Mode Complete
IMEISV: not present
How to read this dump
The message is usually compact because its real meaning is procedural: the UE accepted NAS security and continued.
If IMEISV is present, check that it matches the request sent in Security Mode Command.
Important Information Elements
IE
Required
Description
IMEISV
Optional
Returned when the network requested IMEISV as part of the NAS security procedure.
Detailed field explanation
IMEISV
Returned when the network requested IMEISV as part of the NAS security procedure.
Presence: Optional
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
What to check in logs and traces
Confirm the message appears immediately after Security Mode Command.
Verify that the message uses the expected protected NAS security header treatment.
Check whether IMEISV is present when the command requested it.
Correlate the message with the next protected NAS step such as Registration Accept.
Common Issues and Troubleshooting
Security Mode Command is sent but Security Mode Complete never arrives.
Likely cause: The UE may have failed to activate the requested security context or the uplink protected NAS message was not delivered.
What to inspect: Check UE handling of the selected algorithms, lower-layer delivery, and whether Security Mode Reject appears instead.
Next step: Correlate with RRC transport, NAS protection state, and any immediate registration abort.
Security Mode Complete arrives but later registration still fails.
Likely cause: NAS security activation succeeded, so the root cause is likely in later registration contents, policy handling, or core-side acceptance logic.
What to inspect: Move analysis to Registration Accept, Registration Reject, or Configuration Update handling rather than staying on the security step.
Next step: Use this message as the boundary marker that proves NAS security activation was not the main failure point.
FAQ
What does Security Mode Complete do in 5G NAS?
It tells the network that the UE accepted the selected NAS security configuration and is ready to continue with protected signaling.
What usually comes after Security Mode Complete?
The next step is often Registration Accept, though other protected NAS messages can follow depending on the procedure.
Does Security Mode Complete mean registration is finished?
No. It means NAS security activation succeeded. Registration still needs the remaining procedure steps to complete.
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.