Section: 8.3 Authentication
Content: The 5G system shall support an efficient means to authenticate a user to an IoT device (e.g. biometrics). The 5G system shall be able to support authentication over a non-3GPP access technology using 3GPP credentials. The 5G system shall support operator-controlled alternative authentication methods (i.e. alternative to AKA) with different types of credentials for network access for IoT devices in isolated deployment scenarios (e.g. for industrial automation). The 5G system shall support a suitable framework (e.g. EAP) allowing alternative (e.g. to AKA) authentication methods with non-3GPP identities and credentials to be used for UE network access authentication in non-public networks. NOTE: Non-public networks can use 3GPP authentication methods, identities, and credentials for a UE to access network. Non-public networks are also allowed to utilize non-AKA based authentication methods such as provided by the EAP framework, for which the credentials can be stored in the ME. Subject to an agreement between an MNO and a 3rd party, the 5G system shall support a mechanism for the PLMN to authenticate and authorize UEs for access to both a hosted non-public network and private slice(s) of the PLMN associated with the hosted non-public network. The 5G network shall support a 3GPP supported mechanism to authenticate legacy non-3GPP devices for 5G LAN-VN access. The 5G system shall support a mechanism for the non-public network to authenticate and authorize UEs for access to network slices of that non-public network. The 5G system shall enable an NPN to be able to request a third-party service provider to perform NPN access network authentication of a UE based on non-3GPP identities and credentials supplied by the third-party service provider. The 5G system shall enable an NPN to be able to request a PLMN to perform NPN access network authentication of a UE based on 3GPP identities and credentials supplied by the PLMN.