Section: 4.3.2.3 Secondary authorization/authentication by an DN-AAA Server during the PDU Session establishment
Content: The PDU Session establishment authentication/authorization is optionally triggered by the SMF during a PDU Session establishment and performed transparently via a UPF or directly with the DN-AAA Server without involving the UPF if the DN-AAA Server is located in the 5GC and reachable directly, as described in clause 5.6.6 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. In the case of Home Routed Roaming, unless specified otherwise, the SMF in the information flow defined in this clause is the H-SMF. Figure 4.3.2.3-1: PDU Session Establishment authentication/authorization by a DN-AAA Server NOTE 1: Steps 2, 3a, 3f and 4 are not defined in this specification. Steps 3 can be repeated depending on the mechanism used. NOTE 2: When the SMF directly communicates with the DN-AAA Server without involving the UPF, Step 1 is skipped and Step 2, 3a, 3f, 4 and 6 are executed without involving the UPF. 0. The SMF determines that it needs to contact the DN-AAA Server. The SMF identifies the DN-AAA Server based on local configuration or using the DN-specific identity (TS 33.501[ Security architecture and procedures for 5G System ]  [15]) provided by the UE inside the SM PDU DN Request Container provided by the UE in the PDU Session Establishment request or inside the EAP message in the PDU Session Authentication Complete message (TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [25]). NOTE 3: The content of the SM PDU DN Request Container is defined in TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [25]. NOTE 4: When secondary authentication, using Default UE credentials for secondary authentication, is used in the context of the UE onboarding architecture in Figure 5.30.2.10.2.2-3 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2], the DCS can act as the DN-AAA server. 1. If there is no existing N4 session that can be used to carry DN-related messages between the SMF and the DN, the SMF selects a UPF and triggers N4 session establishment. 2. The SMF initiates the authentication procedure with the DN-AAA via the UPF to authenticate the DN-specific identity provided by the UE as specified in TS 29.561[ 5G System; Interworking between 5G Network and external Data Networks; Stage 3 ]  [63]. When available, the SMF provides the GPSI in the signalling exchanged with the DN-AAA. The UPF transparently relays the message received from the SMF to the DN-AAA Server. 3a. The DN-AAA Server sends an Authentication/Authorization message towards the SMF. The message is carried via the UPF. 3b. Transfer of DN Request Container information received from DN-AAA towards the UE. In non-roaming and LBO cases, the SMF invokes the Namf_Communication_N1N2MessageTransfer service operation on the AMF to transfer the DN Request Container information within N1 SM information sent towards the UE. In the case of Home Routed roaming, the H-SMF initiates a Nsmf_PDUSession_Update service operation to request the V-SMF to transfer DN Request Container to the UE and the V-SMF invokes the Namf_Communication_N1N2MessageTransfer service operation on the AMF to transfer the DN Request Container information within N1 SM information sent towards the UE. In Nsmf_PDUSession_Update Request, the H-SMF additionally includes the H-SMF SM Context ID. 3c: The AMF sends the N1 NAS message to the UE 3d-3e. Transfer of DN Request Container information received from UE towards the DN-AAA. When the UE responds with a N1 NAS message containing DN Request Container information, the AMF informs the SMF by invoking the Nsmf_PDUSession_UpdateSMContext service operation. The SMF issues an Nsmf_PDUSession_UpdateSMContext response. In the case of Home Routed roaming, the V-SMF relays the N1 SM information to the H-SMF using the information of PDU Session received in step 3b via a Nsmf_PDUSession_Update service operation. 3f: The SMF (In HR case it is the H-SMF) sends the content of the DN Request Container information (authentication message) to the DN-AAA Server via the UPF. Step 3 may be repeated until the DN-AAA Server confirms the successful authentication/authorization of the PDU Session. 4. The DN-AAA Server confirms the successful authentication/authorization of the PDU Session. The DN-AAA Server may provide: - an SM PDU DN Response Container to the SMF to indicate successful authentication/authorization; - DN Authorization Data as defined in clause 5.6.6 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]; - a request to get notified with the IP address(es) allocated to the PDU Session and/or with N6 traffic routing information or MAC address(es) used by the UE for the PDU Session; and - an IP address (or IPV6 Prefix) for the PDU Session. The N6 traffic routing information is defined in clause 5.6.7 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. After the successful DN authentication/authorization, a session is kept between the SMF and the DN-AAA. If the SMF receives a DN Authorization Data, the SMF uses the DN Authorization Profile Index to apply the policy and charging control (see clause 5.6.6 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]). 5. The PDU Session establishment continues and completes. In the step 7b of the Figure 4.3.2.2.1-1, if the SMF receives the DN Authorization Profile Index in DN Authorization Data from the DN-AAA, it sends the DN Authorization Profile Index to retrieve the PDU Session related policy information (described in clause 6.4 of TS 23.503[ Policy and charging control framework for the 5G System (5GS); Stage 2 ]  [20]) and the PCC rule(s) (described in clause 6.3 of TS 23.503[ Policy and charging control framework for the 5G System (5GS); Stage 2 ]  [20]) from the PCF. If the SMF receives the DN authorized Session AMBR in DN Authorization Data from the DN-AAA, it sends the DN authorized Session AMBR within the Session AMBR to the PCF to retrieve the authorized Session AMBR (described in clause 6.4 of TS 23.503[ Policy and charging control framework for the 5G System (5GS); Stage 2 ]  [20]). For PDU Session of Ethernet type, the SMF may instruct the UPF to handle VLAN information of the Ethernet frames related with the PDU Session received and sent on N6 or N19 or internal interface, as described in clause 5.6.10.2 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. 6. If requested so in step 4 or if configured so by local policies, the SMF notifies the DN-AAA with the IP/MAC address(es) and/or with N6 traffic routing information allocated to the PDU Session together with the GPSI. Later on the SMF notifies the DN-AAA if the DN-AAA had requested to get notifications about: - allocation or release of an IPV6 Prefix for the PDU Session of IP type or addition or removal of source MAC addresses for the PDU Session of Ethernet type (e.g. using IPV6 multi-homing as defined in clause 5.6.4.3 of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]); - Change of N6 traffic routing information. When later on the PDU Session gets released as described in clause 4.3.4, the SMF notifies the DN-AAA. The DN-AAA Server may revoke the authorization for a PDU Session or update DN authorization data for a PDU Session. According to the request from DN-AAA Server, the SMF may release or update the PDU Session. At any time after the PDU Session establishment, the DN-AAA Server or SMF may initiate Secondary Re-authentication procedure for the PDU Session as specified in clause 11.1.3 of TS 33.501[ Security architecture and procedures for 5G System ]  [15]. Step 3a to step 3f are performed to transfer the Secondary Re-authentication message between the UE and the DN-AAA Server. The Secondary Re-authentication procedure may start from step 3a (DN-AAA initiated Secondary Re-authentication procedure) or step 3b (SMF initiated Secondary Re-authentication procedure). For the DN-AAA Server initiated Secondary Re-authentication, the message in step 3a shall include GPSI, if available and the IP/MAC address(es) of the PDU session, for SMF to identify the corresponding UE and PDU session. If the Re-authentication result is unsuccessful then SMF may release the PDU session and notify the DN-AAA Server. During Secondary Re-authentication, if the SMF receives an indication from the AMF that the UE is unreachable then it informs the DN-AAA Server that UE is not reachable for re-authentication. Based on this indication from SMF, the DN-AAA Server may decide to keep the PDU Session or request to release the PDU session. DN-AAA may initiate DN-AAA Re-authorization without performing re-authentication based on local policy. DN-AAA Re-authorization procedure may start from step 4. During Secondary Re-authentication/Re-authorization, if the SMF receives DN Authorization Profile Index and/or DN authorized Session AMBR, the SMF reports the received value(s) to the PCF (as described in TS 23.501[ System architecture for the 5G System (5GS) ]  [2]) by triggering the Policy Control Request Trigger as described in TS 23.503[ Policy and charging control framework for the 5G System (5GS); Stage 2 ]  [20].