Section: 4.2.9 Network Slice-Specific Authentication and Authorization procedure 4.2.9.1 General
Content: The Network Slice-Specific Authentication and Authorization procedure is triggered for an S-NSSAI requiring Network Slice-Specific Authentication and Authorization with an AAA Server (AAA-S) which may be hosted by the H-PLMN operator or by a third party which has a business relationship with the H-PLMN, using the EAP framework as described in TS 33.501[ Security architecture and procedures for 5G System ]  [15]. An AAA Proxy (AAA-P) in the HPLMN may be involved e.g. if the AAA Server belongs to a third party. This procedure is triggered by the AMF during a Registration procedure when some Network Slices require Slice-Specific Authentication and Authorization, when AMF determines that Network Slice-Specific Authentication and Authorization is requires for an S-NSSAI in the current Allowed NSSAI or Partially Allowed NSSAI (e.g. subscription change), or when the AAA Server that authenticated the Network Slice triggers a re-authentication. NOTE 1: The S-NSSAI in the procedure can be part of Allowed NSSAI, Mapping Of Allowed NSSAI, Partially Allowed NSSAI or Mapping Of Partially Allowed NSSAI. The AMF performs the role of the EAP Authenticator and communicates with the AAA-S via the Network Slice specific and SNPN Authentication and Authorization Function (NSSAAF). The NSSAAF undertakes any AAA protocol interworking with the AAA protocol supported by the AAA-S. The Network Slice-Specific Authentication and Authorization procedure requires the use of a GPSI. In other words, a subscription that contains S-NSSAIs subject to Network Slice-Specific Authentication and Authorization shall include at least one GPSI. After a successful or unsuccessful UE Network Slice-Specific Authentication and Authorization, the AMF store the NSSAA result status for the related S-NSSAI in the UE context. NOTE 2: If an S-NSSAI subject to the NSSAA is rejected due to Network Slice Admission Control (e.g. the maximum number of UEs per network slice has been reached), the NSSAA result status stored in the UE context is not impacted.