Section: 6.1.2 Initiation of authentication and selection of authentication method
Content: The initiation of the primary authentication is shown in Figure 6.1.2-1. Figure 6.1.2-1: Initiation of authentication procedure and selection of authentication method The SEAF may initiate an authentication with the UE during any procedure establishing a signalling connection with the UE, according to the SEAF's policy. The UE shall use SUCI or 5G-GUTI in the Registration Request. The SEAF shall invoke the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate Request message to the AUSF whenever the SEAF wishes to initiate an authentication. The Nausf_UEAuthentication_Authenticate Request message shall contain either: - SUCI, as defined in the current specification, or - SUPI, as defined in TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. The SEAF shall include the SUPI in the Nausf_UEAuthentication_Authenticate Request message in case the SEAF has a valid 5G-GUTI and re-authenticates the UE. Otherwise the SUCI is included in Nausf_UEAuthentication_Authenticate Request. SUPI/SUCI structure is part of stage 3 protocol design. The Nausf_UEAuthentication_Authenticate Request shall furthermore contain: - the serving network name, as defined in sub-clause 6.1.1.4 of the present document. NOTE 2: The local policy for the selection of the authentication method does not need to be on a per-UE basis, but can be the same for all UEs. The Nausf_UEAuthentication_Authenticate Request may furthermore contain: - Disaster Roaming service indication, as specified in TS 23.502[ Procedures for the 5G System (5GS) ] [8] clause 4.2.2.2. Upon receiving the Nausf_UEAuthentication_Authenticate Request message, the AUSF shall check that the requesting SEAF in the serving network is entitled to use the serving network name in the Nausf_UEAuthentication_Authenticate Request by comparing the serving network name with the expected serving network name. The AUSF shall store the received serving network name temporarily. If the serving network is not authorized to use the serving network name, the AUSF shall respond with "serving network not authorized" in the Nausf_UEAuthentication_Authenticate Response. NOTE 2: The AUSF and the UDM may be configured with Disaster Condition via OAM based on operator policy and the request by the government agencies. For the Disaster Roaming, the AUSF shall check the local configuration and, if allowed, the AUSF sends Nudm_UEAuthentication_Get Request to the UDM. The Nudm_UEAuthentication_Get Request sent from AUSF to UDM includes the following information: - SUCI or SUPI; - the serving network name; - if received from SEAF, Disaster Roaming service indication; Upon reception of the Nudm_UEAuthentication_Get Request, the UDM shall invoke SIDF if a SUCI is received. SIDF shall de-conceal SUCI to gain SUPI before UDM can process the request. Based on SUPI, the UDM/ARPF shall choose the authentication method. NOTE 3: The Nudm_UEAuthentication_Get Response in reply to the Nudm_UEAuthentication_Get Request and the Nausf_UEAuthentication_Authenticate Response message in reply to the Nausf_UEAuthentication_Authenticate Request message are described as part of the authentication procedures in clause 6.1.3. For the Disaster Roaming, the UDM shall check the local configuration and, if allowed, the UDM proceeds with the chosen authentication method.