BlogUpdate-Location-Request / Update-Location-Answer (ULR/ULA) - PART 1

Security & Hacking Tools & Reviews #4G #5G #2G/3G #Diameter

Bố cục bài viết

Update-Location-Request / Update-Location-Answer (ULR/ULA) Reference: 3GPP TS 29.272 R15 (29272-fa0), S6a/S6d interface 1. ULR — Update-Location-Request (§7.2.3) 1.1 ABNF / Message structure 1.2 Field table (Table 5.2.1.1.1/1) 1.3 ULR-Flags bitmask (§7.3.7) 2. ULA — Update-Location-Answer (§7.2.4) 2.1 ABNF / Message structure 2.2 Field table (Table 5.2.1.1.1/2) 2.3 ULA-Flags bitmask (§7.3.8) 3. Which fields matter most for security/CVD analysis

Trang này

Sunex 27/07/2026 · 7 phút đọc

Ngày tạo

27/07/2026

Cập nhật

27/07/2026

Lượt xem

Đọc

Update-Location-Request / Update-Location-Answer (ULR/ULA)

Reference: 3GPP TS 29.272 R15 (29272-fa0), S6a/S6d interface

Command-Code: 316, Application-ID: 16777251 (3GPP S6a/S6d)

ULR: R-bit set (Request), sent MME/SGSN → HSS
ULA: R-bit cleared (Answer), sent HSS → MME/SGSN

Cat. legend: M = Mandatory, C = Conditional, O = Optional

1. ULR — Update-Location-Request (§7.2.3)

1.1 ABNF / Message structure

<Update-Location-Request> ::= < Diameter Header: 316, REQ, PXY, 16777251 >
                               < Session-Id >
                               [ DRMP ]
                               [ Vendor-Specific-Application-Id ]
                               { Auth-Session-State }
                               { Origin-Host }
                               { Origin-Realm }
                               [ Destination-Host ]
                               { Destination-Realm }
                               { User-Name }
                               [ OC-Supported-Features ]
                              *[ Supported-Features ]
                               [ Terminal-Information ]
                               { RAT-Type }
                               { ULR-Flags }
                               [ UE-SRVCC-Capability ]
                               { Visited-PLMN-Id }
                               [ SGSN-Number ]
                               [ Homogeneous-Support-of-IMS-Voice-Over-PS-Sessions ]
                               [ GMLC-Address ]
                              *[ Active-APN ]
                               [ Equivalent-PLMN-List ]
                               [ MME-Number-for-MT-SMS ]
                               [ SMS-Register-Request ]
                               [ SGs-MME-Identity ]
                               [ Coupled-Node-Diameter-ID ]
                               [ Adjacent-PLMNs ]
                               [ Supported-Services ]
                              *[ AVP ]
                              *[ Proxy-Info ]
                              *[ Route-Record ]

{ } = Mandatory, [ ] = Optional/Conditional, *[ ] = zero or more instances.

1.2 Field table (Table 5.2.1.1.1/1)

IE (Info. Element)	Diameter AVP	Cat.	Meaning / When present
IMSI	User-Name	M	Subscriber IMSI, formatted per TS 23.003 §2.2. This is the key identifying the subscriber the update applies to.
Supported Features	Supported-Features	O	Feature list supported by origin host (per TS 29.229). Used for capability negotiation.
Terminal Information	Terminal-Information	O	UE equipment info. On S6a/S6d only IMEI and Software-Version sub-AVPs are used.
ULR Flags	ULR-Flags	M	Bitmask — see §1.3 below. Central control field: tells HSS what to do / what the requester is.
Visited PLMN Id	Visited-PLMN-Id	M	MCC+MNC of the visited network; used for roaming-based feature/policy decisions.
Equivalent PLMN List	Equivalent-PLMN-List	O	List of equivalent PLMNs for which CSG subscription data is requested.
RAT Type	RAT-Type	M	Radio access type UE is using (EUTRAN, UTRAN, GERAN, WLAN, etc.) — HSS may reject certain RAT types (`RAT_NOT_ALLOWED`).
SGSN number	SGSN-Number	C	ISDN number of SGSN. Required on S6d if SGSN supports LCS/SMS/Gs; may appear on S6a for combined MME/SGSN.
Homogeneous Support of IMS Voice Over PS Sessions	Homogeneous-Support-of-IMS-Voice-Over-PS-Sessions	O	Indicates whether IMS-VoPS is uniformly supported across all TAs/RAs of the serving node.
V-GMLC address	GMLC-Address	C	IPv4/IPv6 of Visited GMLC, if available (location services).
Active APN	Active-APN	O	List of APNs currently active at MME/SGSN + assigned PGW identity — used to restore PGW data in HSS after a Reset.
UE SRVCC Capability	UE-SRVCC-Capability	C	Whether UE supports SRVCC; present if serving node supports SRVCC and info is known.
MME Number for MT SMS	MME-Number-for-MT-SMS	C	ISDN number to route MT-SMS to MME; present if MME supports/wants SMS-in-MME.
SMS Register Request	SMS-Register-Request	C	MME/SGSN preference on SMS registration; present when SMS-in-MME or SMS-in-SGSN is supported and requested.
SGs MME identity	SGs-MME-Identity	O	MME identity used over SGs interface, if different from the S6a Diameter identity.
Coupled node’s Diameter identity	Coupled-Node-Diameter-ID	O	Diameter identity of the paired node (MME↔SGSN) for a combined MME/SGSN.
Adjacent PLMNs	Adjacent-PLMNs	O	List of PLMNs into which UE handover is statically expected (operator-configured).
Supported Services	Supported-Services	O	Services supported by MME/SGSN (per TS 29.336).

1.3 ULR-Flags bitmask (§7.3.7)

Bit	Name	Meaning
0	Single-Registration-Indication	HSS sends Cancel Location to SGSN. SGSN must not set this bit.
1	S6a/S6d-Indicator	Set = message on S6a (source is MME). Clear = message on S6d (source is SGSN).
2	Skip Subscriber Data	HSS may omit Subscription-Data in ULA — but must still send it if subscriber data changed since last successful update.
3	GPRS-Subscription-Data-Indicator	Requests HSS to include GPRS-Subscription-Data inside Subscription-Data. A standalone MME must not set this.
4	Node-Type-Indicator	Set = requesting node is combined MME/SGSN; clear = standalone MME or SGSN.
5	Initial-Attach-Indicator	HSS sends Cancel Location to any existing MME/SGSN registration.
6	PS-LCS-Not-Supported-By-UE	UE supports neither UE-Based nor UE-Assisted PS location methods.
7	SMS-Only-Indication	UE requested “SMS only” during combined attach/RAU.
8	Dual-Registration-5G-Indicator	Controls whether HSS+UDM sends `Nudm_UECM_DeregistrationNotification` to a registered AMF (TS 29.503).

Undefined bits: sender clears them, receiver discards them.

Practically important for your S6a work: ULR-Flags bit 1 (S6a/S6d-Indicator) and bit 4 (Node-Type-Indicator) are the fields a DRA-layer AVP-tampering attack would most plausibly target to make the HSS believe it’s talking to a different node type/interface than it actually is — worth including in your FS.19 gap-analysis threat enumeration alongside AMBR/APN-Configuration.

2. ULA — Update-Location-Answer (§7.2.4)

2.1 ABNF / Message structure

<Update-Location-Answer> ::= < Diameter Header: 316, PXY, 16777251 >
                              < Session-Id >
                              [ DRMP ]
                              [ Vendor-Specific-Application-Id ]
                              [ Result-Code ]
                              [ Experimental-Result ]
                              [ Error-Diagnostic ]
                              { Auth-Session-State }
                              { Origin-Host }
                              { Origin-Realm }
                              [ OC-Supported-Features ]
                              [ OC-OLR ]
                             *[ Load ]
                             *[ Supported-Features ]
                              [ ULA-Flags ]
                              [ Subscription-Data ]
                             *[ Reset-ID ]
                             *[ AVP ]
                              [ Failed-AVP ]
                             *[ Proxy-Info ]
                             *[ Route-Record ]

2.2 Field table (Table 5.2.1.1.1/2)

IE	Diameter AVP	Cat.	Meaning / When present
Supported Features	Supported-Features	O	Feature list supported by origin host.
Result	Result-Code / Experimental-Result	M	Outcome of the operation. `Result-Code` = base Diameter (RFC 6733) success/error. `Experimental-Result` = 3GPP-specific errors (Vendor-Id + Experimental-Result-Code), covering: User Unknown, Unknown EPS Subscription, RAT Not Allowed, Roaming Not Allowed.
Error-Diagnostic	Error-Diagnostic	O	Extra detail when Experimental-Result = “Unknown EPS Subscription” (whether GPRS data exists) or “Roaming Not Allowed” (ODB type).
ULA-Flags	ULA-Flags	C	Bitmask, present only when Result-Code = DIAMETER_SUCCESS — see §2.3.
Subscription-Data	Subscription-Data	C	Complete subscriber profile. Present if success is reported, unless the ULR explicitly requested “skip subscriber data” (ULR-Flags bit 2) and no change occurred. This is the payload carrying APN-Configuration-Profile, AMBR, QoS-Subscribed, Access-Restriction-Data, etc. — the object at the center of your “Kịch bản A/B” tampering scenarios.
Reset-IDs	Reset-ID	O	Identifies a fallible HSS resource the IMSI depends on; used so a later Reset message can target exactly the impacted subscribers.

2.3 ULA-Flags bitmask (§7.3.8)

Bit	Name	Meaning
0	Separation Indication	Set = HSS stores SGSN number and MME number in separate memory (Rel-8 HSS sets this; pre-Rel-8 IWF clears it).
1	MME Registered for SMS	Set = HSS has registered the MME for SMS.

3. Which fields matter most for security/CVD analysis

Priority	Field	Why
Critical	Subscription-Data (ULA)	Carries APN-Configuration-Profile, AMBR, QoS — direct target for your AMBR/APN-Config tampering scenarios. No integrity binding beyond Diameter/DRA hop-by-hop trust.
Critical	ULR-Flags bits 1/4 (ULR)	Determines interface interpretation (S6a vs S6d) and node type at the HSS — a tampering point for interface/role confusion.
High	Result-Code / Experimental-Result (ULA)	Determines MME/SGSN behavior on failure (e.g. forces detach on Roaming Not Allowed) — spoofable to cause DoS.
High	Visited-PLMN-Id (ULR)	Drives roaming policy decisions at HSS; tampering could bypass ODB/roaming restrictions.
Medium	RAT-Type (ULR)	Can trigger `RAT_NOT_ALLOWED` rejection if manipulated, or bypass RAT-based restrictions if spoofed.
Medium	Active-APN / Coupled-Node-Diameter-ID	Used to restore/redirect PGW bindings after Reset — relevant to your session-redirect (“Kịch bản A”) analysis.

Mandatory-field takeaway: Only IMSI, ULR-Flags, Visited-PLMN-Id, RAT-Type are hard-mandatory in ULR; everything else is conditional/optional, which is exactly the surface a DRA acting as a Proxy Agent (not pure Relay) can add, strip, or modify without violating the ABNF — consistent with your existing finding that no SEPP/PRINS-equivalent integrity mechanism exists for S6a.

Source: 3GPP TS 29.272 version 15 (29272-fa0), §5.2.1.1.1, §7.2.3, §7.2.4, §7.3.7, §7.3.8