RRC 5G UE -> gNB 3GPP TS 38.331

5G NR - SecurityModeComplete

Uplink NR RRC message used by the UE to confirm successful activation of the selected AS security configuration.

Message Fact Sheet

Protocol	rrc	Network	5g
Spec	3GPP TS 38.331	Spec Section	5.3.4, 6.2.2, Annex B.1
Direction	UE -> gNB	Message Type	Security Control

Full message name	5G NR - SecurityModeComplete
Protocol	RRC
Technology	5G
Direction	UE -> gNB
Interface	Uu
Signaling bearer / channel	SRB1 / UL-DCCH
Typical trigger	The UE successfully verifies SecurityModeCommand and activates the selected NR AS security algorithms.
Main purpose	Confirms that the UE accepted and applied the AS security configuration commanded by the gNB so later protected RRC signaling can continue.
Procedures where used	Initial AS Security Activation, Initial Registration, Connected-Mode Security Setup
Related timers	T380
Related cause values	No explicit cause IE is carried in SecurityModeComplete, Failures are usually inferred from the absence of this message or the presence of SecurityModeFailure
Main specification	3GPP TS 38.331, 5.3.4, 6.2.2, Annex B.1

What this message does in simple terms

Uplink NR RRC message used by the UE to confirm successful activation of the selected AS security configuration.

Confirms that the UE accepted and applied the AS security configuration commanded by the gNB so later protected RRC signaling can continue.

Why this message matters

SecurityModeComplete is the UE saying that it successfully applied the security settings requested by the gNB.

Where this message is used

Initial AS Security Activation

Call flow position: UE confirmation message sent after successfully processing SecurityModeCommand.

Typical state: UE is in RRC_CONNECTED and has just transitioned into AS-protected RRC operation.

Preconditions:

SecurityModeCommand was received and verified successfully.
The UE accepted the selected security algorithms.
AS security activation completed locally at the UE.

Next likely message: RRCReconfiguration or other later protected dedicated RRC signaling

5G Initial Registration

Call flow position: Appears after SecurityModeCommand in the radio-side security activation stage of the wider registration path.

Typical state: The registration path is progressing with AS security now active for later RRC signaling.

Preconditions:

Initial radio connection setup completed successfully.
The network initiated AS security activation.

Next likely message: RRCReconfiguration or continued protected RRC handling

Full Procedure Context

Previous message(s): SecurityModeCommand

Next message(s): RRCReconfiguration, Other protected connected-mode RRC signaling

Message Direction and Transport

Sender and receiver: UE -> gNB

Interface: Uu

Domain: Access-side radio control under activated AS security context

Signaling bearer: SRB1

Logical channel: UL-DCCH

Transport / encapsulation: RRC over DCCH on SRB1 after SecurityModeCommand and before later protected connected-mode RRC procedures continue

Security context: SecurityModeComplete is sent after the UE has successfully applied the selected AS security configuration. It is part of the secured connected-mode signaling path.

Message Structure Overview

SecurityModeComplete is structurally very small. Its main practical meaning is procedural rather than payload-heavy.
The important question is not complex IE decoding, but whether the UE sent it at all and whether it correctly matches the preceding SecurityModeCommand transaction.
Once this message is sent successfully, later RRC signaling is expected to continue under the activated AS security context.

ASN.1 for 5G NR - SecurityModeComplete

SecurityModeComplete ::= SEQUENCE {
  rrc-TransactionIdentifier RRC-TransactionIdentifier,
  criticalExtensions CHOICE {
    securityModeComplete SecurityModeComplete-IEs,
    criticalExtensionsFuture SEQUENCE {}
  }
}

SecurityModeComplete-IEs ::= SEQUENCE {
  lateNonCriticalExtension OCTET STRING OPTIONAL,
  nonCriticalExtension     SEQUENCE {} OPTIONAL
}

How to read this ASN.1

This is a confirmation message, so most engineering value comes from procedure correlation, transaction matching, and verifying that protected RRC signaling continues afterward.

Decoded Message Dump

UL-DCCH-Message
  message: securityModeComplete
    rrc-TransactionIdentifier: 2
    criticalExtensions:
      securityModeComplete:
        lateNonCriticalExtension: absent
        nonCriticalExtension: absent

How to read this dump

The transaction identifier should match the preceding SecurityModeCommand.
A clean SecurityModeComplete usually means the UE accepted and activated the selected AS security configuration.
The next useful check is whether later RRC signaling, such as RRC Reconfiguration, is protected and proceeds normally.

Information Elements

IE	Required	Description
`rrc-TransactionIdentifier`	Yes	Transaction identifier that matches the SecurityModeCommand transaction being completed.
`criticalExtensions`	Yes	Versioned wrapper around the SecurityModeComplete payload and future extensions.
`lateNonCriticalExtension`	Optional	Extension container used for later release evolution and compatibility handling.
`nonCriticalExtension`	Optional	Forward-compatible extension branch for later additions.

Detailed field explanation

`rrc-TransactionIdentifier`

Transaction identifier that matches the SecurityModeCommand transaction being completed.

Presence: Required

`criticalExtensions`

Versioned wrapper around the SecurityModeComplete payload and future extensions.

Presence: Required

`lateNonCriticalExtension`

Extension container used for later release evolution and compatibility handling.

Presence: Optional

`nonCriticalExtension`

Forward-compatible extension branch for later additions.

Presence: Optional

What to check in logs and traces

Confirm the message follows SecurityModeCommand and uses SRB1 / UL-DCCH.
Verify the transaction identifier matches the preceding command.
Check that the UE did not send SecurityModeFailure instead.
Inspect whether later RRC messages are protected and decoded as expected after this point.
If the message is missing, inspect UE integrity verification and algorithm acceptance behavior.

Common Issues and Troubleshooting

SecurityModeCommand is present but SecurityModeComplete never arrives.

Likely cause: The UE may have failed integrity verification, rejected the selected algorithm set, or failed during AS security activation.

What to inspect: Check transaction matching, UE security capability assumptions, integrity verification, and any immediate release or failure behavior.

Next step: Compare with a successful security activation trace and check for SecurityModeFailure or silent drop behavior.

SecurityModeComplete is present but later RRC signaling still fails.

Likely cause: The confirmation alone does not guarantee the rest of the protected signaling path is healthy.

What to inspect: Check whether later messages such as RRCReconfiguration are integrity protected and decoded consistently.

Next step: Walk forward from SecurityModeComplete into the first protected follow-up message.

Transaction identifiers do not line up.

Likely cause: The UE response may not correspond to the expected SecurityModeCommand transaction.

What to inspect: Correlate the command and complete message pair carefully in repeated or retried procedures.

Next step: Verify whether multiple security transactions or trace reordering are confusing the decode.

Engineers expect detailed security parameters in SecurityModeComplete.

Likely cause: SecurityModeComplete is intentionally lightweight and mainly confirms acceptance rather than restating the configuration.

What to inspect: Read the selected algorithm details from SecurityModeCommand instead.

Next step: Use SecurityModeComplete as a procedural checkpoint, not as the main algorithm container.

Detailed explanation

5G NR - SecurityModeComplete Message Explained

The SecurityModeComplete message is the UE’s positive response to SecurityModeCommand in 5G NR. It confirms that the UE successfully accepted and applied the selected AS security configuration.

In simple terms, this is the UE saying: the requested RRC security settings were understood, activated, and the connection can now continue with protected connected-mode signaling.

This page covers the NR RRC SecurityModeComplete from 3GPP TS 38.331. It is part of the NR RRC security activation procedure, not NAS security signaling.

Why SecurityModeComplete matters

SecurityModeComplete is one of the clearest confirmation points in the NR RRC security procedure.

It matters because it tells you:

the UE accepted the network’s AS security configuration
the transaction reached a successful UE-side confirmation
later RRC signaling can now continue under the activated protection context
the failure, if any, may now be in later protected signaling rather than in the security command itself

If this message is missing after SecurityModeCommand, the security activation path did not complete cleanly.

Where SecurityModeComplete appears in the call flow

A common success path is:

RRC Setup from gNB to UE
RRCSetupComplete from UE to gNB
SecurityModeCommand from gNB to UE
SecurityModeComplete from UE to gNB
RRC Reconfiguration or other later protected RRC signaling

This means SecurityModeComplete is not the start of security activation. It is the successful completion checkpoint from the UE side.

Call flow position

A compact NR signaling view is:

UE                              gNB
|                               |
|----- RRCSetupComplete ------->|
|                               |
|<---- SecurityModeCommand -----|
|                               |
|---- SecurityModeComplete ---->|
|                               |
|<----- RRCReconfiguration -----|
|                               |

This sequence shows the normal success path:

SecurityModeCommand selects and activates AS security from the network side
SecurityModeComplete confirms the UE accepted and applied that configuration
RRC Reconfiguration and later protected signaling continue afterward

For the full procedure walkthrough, see:

5G Security Mode Command Procedure

Transport characteristics

For trace analysis, the transport profile is:

Direction: UE to gNB
Bearer: SRB1
Logical channel: UL-DCCH
RLC mode: AM
Protocol layer: NR RRC

By the time this message is sent, the UE is already operating in the connected-mode control path where AS security activation has just succeeded.

What engineers should inspect first

When SecurityModeComplete appears, inspect in this order:

Did it follow the expected SecurityModeCommand?
Does the transaction identifier match?
Did the UE send it on SRB1 / UL-DCCH?
Does later protected RRC signaling continue cleanly?
If it is missing, did the UE send a failure or simply stop responding?

Practical troubleshooting guidance

This message is most useful when read together with:

If the security procedure is unhealthy, the main engineering questions are:

did the UE actually accept the commanded security configuration?
is the SecurityModeComplete missing, delayed, or mismatched?
did later protected signaling continue correctly after this point?
is the real failure in security activation or in the first protected follow-up procedure?

5G NR - SecurityModeCommand for the network-side command that this message confirms
5G NR - RRCSetupComplete for the earlier UE message that usually appears just before AS security activation
5G NR - RRC Reconfiguration for the later protected RRC procedure that often follows

Summary

SecurityModeComplete is the UE-side confirmation that NR RRC AS security activation succeeded.

The key engineering points are:

it confirms successful handling of SecurityModeCommand
it is a small confirmation message, not the main algorithm container
it is sent on SRB1 / UL-DCCH
it is a strong checkpoint that later protected RRC signaling should now work
troubleshooting usually depends on pairing it with the preceding command and the first later protected message

FAQ

What does SecurityModeComplete do in 5G NR?

It confirms that the UE successfully applied the AS security configuration requested by SecurityModeCommand.

Who sends SecurityModeComplete?

The UE sends SecurityModeComplete to the gNB.

What comes before SecurityModeComplete?

SecurityModeCommand comes immediately before it in the normal success path.

What comes after SecurityModeComplete?

Later protected connected-mode RRC signaling such as RRCReconfiguration usually follows.

Does SecurityModeComplete contain the algorithm list?

No. The selected security algorithms are carried in SecurityModeCommand, not repeated in detail here.

Why is SecurityModeComplete important in traces?

It shows that the UE accepted the commanded AS security activation and that later protected RRC signaling can proceed.

Summary

Uplink NR RRC message used by the UE to confirm successful activation of the selected AS security configuration.

Advanced Engineer Notes

SecurityModeComplete is one of the clearest checkpoints that the UE has crossed from early setup signaling into stable AS-protected RRC operation.
Because the message itself is small, engineers should focus on pairing it with SecurityModeCommand and validating the next protected message.
If later protected signaling fails immediately after SecurityModeComplete, the problem may still be in security activation or in the first protected follow-up procedure.

LTE / 5G / Variant Comparison

Compared with SecurityModeCommand

SecurityModeCommand carries the selected AS security configuration from the gNB. SecurityModeComplete is the UE-side confirmation that the configuration was accepted and applied.

Related Messages

Related Procedures

Related Tools

Use This Reference in Practice

Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.

5G NR - SecurityModeComplete

Message Fact Sheet

What this message does in simple terms

Why this message matters

Where this message is used

Initial AS Security Activation

5G Initial Registration

Full Procedure Context

Message Direction and Transport

Message Structure Overview

ASN.1 for 5G NR - SecurityModeComplete

How to read this ASN.1

Decoded Message Dump

How to read this dump

Information Elements

Detailed field explanation

rrc-TransactionIdentifier

criticalExtensions

lateNonCriticalExtension

nonCriticalExtension

What to check in logs and traces

Common Issues and Troubleshooting

SecurityModeCommand is present but SecurityModeComplete never arrives.

SecurityModeComplete is present but later RRC signaling still fails.

Transaction identifiers do not line up.

Engineers expect detailed security parameters in SecurityModeComplete.

Detailed explanation

5G NR - SecurityModeComplete Message Explained

Why SecurityModeComplete matters

Where SecurityModeComplete appears in the call flow

Call flow position

Transport characteristics

What engineers should inspect first

Practical troubleshooting guidance

Related message pages

Summary

FAQ

What does SecurityModeComplete do in 5G NR?

Who sends SecurityModeComplete?

What comes before SecurityModeComplete?

What comes after SecurityModeComplete?

Does SecurityModeComplete contain the algorithm list?

Why is SecurityModeComplete important in traces?

Summary

Advanced Engineer Notes

LTE / 5G / Variant Comparison

Compared with SecurityModeCommand

Related Messages

Related Procedures

Related Tools

Use This Reference in Practice

`rrc-TransactionIdentifier`

`criticalExtensions`

`lateNonCriticalExtension`

`nonCriticalExtension`