Section: 4.2.2.2.4 Registration with Onboarding SNPN
Content: This clause specifies how a UE can register to an ON-SNPN for provisioning the UE with SO-SNPN credentials and other information to enable SNPN access as defined in clause 5.30.2.10 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. The Registration procedure for Onboarding SNPN over 3GPP access shall be supported as specified in clause 4.2.2.2.2 with the following changes compared to the steps in the call flow represented in Figure 4.2.2.2.2-1, covering three cases, i.e. when DCS is hosting AAA Server and when DCS is hosting AUSF/UDM and when DCS is not involved, as shown in Figure 4.2.2.2.4-1. The Registration procedure for Onboarding SNPN over untrusted non-3GPP access shall be supported as specified in clause 4.12.2.2. The Registration procedure for Onboarding SNPN over trusted non-3GPP access shall be supported as specified in clause 4.12a.2.2. Figure 4.2.2.2.4-1: UE Registration with ON-SNPN 1. UE to NG-RAN: AN parameters shall include Onboarding indication if the UE is accessing 5GS for Onboarding. The Registration Type "SNPN Onboarding" indicates that the UE wants to perform SNPN Onboarding Registration (i.e. allows the UE to access an ON-SNPN for the purpose of provisioning the UE with SO-SNPN credentials). For SNPN Onboarding Registration, a SUCI generated from a SUPI derived from Default UE Credentials shall be included as described in clause 5.30.2.10.2.6 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. If the UE has registered in the ON-SNPN for onboarding, the UE can perform a Mobility Registration Update, or a Periodic Registration Update as specified in clause 4.2.2.2.2. If the onboarding registered UE wants to perform a Mobility Registration Update the AN parameters shall also include an Onboarding indication that the UE is registered for onboarding. NOTE: When the UE is performing Registration for Onboarding to an ON-SNPN, the UE does not include a Requested NSSAI as the UE is not pre-configured with a S-NSSAI for the purpose of UE onboarding in the ON-SNPN. 2. Based on the Onboarding indication in step 1, the NG-RAN selects an AMF as described in clause 6.3.5 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. 3. NG-RAN to AMF: The N2 message contains the Registration Request as described in step 1. 4. [Conditional] new AMF to old AMF: Namf_Communication_UEContextTransfer (complete Registration Request). 5. [Conditional] old AMF to new AMF: Response to Namf_Communication_UEContextTransfer (SUPI, UE Context in AMF (as per Table 5.2.2.2.2-1)). Once the registration is completed successfully, the new AMF may start an implementation specific deregistration timer for when to deregister the onboarding registered UE if the UE context contains the indication that the UE is registered for onboarding. 6-7. Skipped. 8. When the AMF receives a NAS Registration Request with the 5GS Registration Type set to "SNPN Onboarding", the AMF applies locally configured AMF Configuration Data for Onboarding in order to restrict UE network usage to only onboarding and stores in the UE Context in AMF an indication that the UE is registered for onboarding. The AMF selects an AUSF as described in clause 5.30.2.10.2.6 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. Based on ON-SNPN policies, the AMF may start an implementation specific deregistration timer configured for UE Onboarding as described in TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. 9. The authentication is performed as described in TS 33.501[ Security architecture and procedures for 5G System ]  [15]. For DCS hosting AAA Server as shown in step 9-1, based on local configuration (e.g. using the realm part of the SUCI), the AUSF sends the SUPI towards the AAA Server in the DCS domain via the NSSAAF, then the AAA Server in the DCS domain authenticates the UE based on received data from AUSF. During authentication procedure the AAA Server in the DCS domain may provide PVS FQDN(s) and/or PVS IP address(es) for the UE to the AUSF via the NSSAAF, the AUSF then provides PVS FQDN(s) and/or PVS IP address(es) to the AMF. For DCS hosting AUSF/UDM as shown in step 9-2, the AUSF in DCS domain performs UDM selection. The AMF sends the SUCI and Default UE credentials received from the UE towards the AUSF in DCS domain, which authenticates the UE based on received data from AMF and subscription data from the UDM in DCS domain. During authentication procedure, the AUSF in the DCS domain provides PVS FQDN(s) and/or PVS IP address(es) to the AMF. When DCS is not involved during primary authentication as shown in step 9-3, the AMF selects a local AUSF as defined in clause 6.3.4 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2] and performs primary authentication towards the local AUSF using Default UE credentials as described in TS 33.501[ Security architecture and procedures for 5G System ]  [15]. 10. [Conditional] new AMF to old AMF: Namf_Communication_RegistrationStatusUpdate. 11. [Conditional] AMF to UE: Identity Request/Response (PEI). If the PEI was not provided by the UE, the Identity Request procedure is initiated by AMF sending an Identity Request message to the UE to retrieve the PEI. 12. Optionally the new AMF initiates ME identity check by invoking the N5g-eir_EquipmentIdentityCheck_Get service operation (see clause 5.2.4.2.2). The PEI check is performed as described in clause 4.7. 13-20. Skipped. 21. AMF to UE: The AMF sends a Registration Accept message to the UE indicating that the Registration Request for Onboarding SNPN has been accepted. The Allowed NSSAI containing the S-NSSAI from the AMF Onboarding Configuration Data is included in the N2 message to NG-RAN. 21b. Skipped. 22. UE to AMF: The UE sends a Registration Complete message to the AMF. 23-25. Skipped.