Section: 6.1.4.2 Guidance on linking authentication confirmation to Nudm_UECM_Registration procedure from AMF
Content: This sub-clause gives informative guidance on how a home operator could link authentication confirmation (or the lack thereof) to subsequent Nudm_UECM_Registration procedures from AMF to achieve protection against certain types of fraud, as mentioned in the preceding sub-clause. Approach 1: The home network records the time of the most recent successfully verified authentication confirmation of the subscriber together with the identity of the 5G visited network that was involved in the authentication. When a new Nudm_UECM_Registration Request arrives from a visited network, the home network checks whether there is a sufficiently recent authentication of the subscriber by this visited network. If not, the Nudm_UECM_Registration Request is rejected. The rejection message may include, according to the home networks policy, an indication that the visited network should send a new Nausf_UEAuthentication_Authenticate Request (cf. sub-clause 6.1.2 of the present document) for fetching a new authentication vector before repeating the Nudm_UECM_Registration Request. NOTE 1: With this approach, the authentication procedure and the Nudm_UECM_Registration procedure are performed independently. They are coupled only through linking information in the home network. NOTE 2: It is up to the home network to set the time threshold to define what 'sufficiently recent' is. Approach 2: As a variant of the above Approach 1, Approach 2 is based on a more fine-grained policy applied by the home network; the home network could classify roaming partners into different categories, depending on the trust - e.g. derived from previous experience placed in them, for example as follows: - For a visited network in the first category, the home network would require a successful authentication 'immediately preceding' the Nudm_UECM_Registration Request from an AMF. - For a visited network in the second category, the home network would only check that an authentication in a network visited by the subscriber was sufficiently recent (taking into account that there may have been a security context transfer between the visited networks). - For a visited network in the third category, the home network would perform no checks regarding Nudm_UECM_Registration Requests and authentication at all. Further approaches are possible, depending on the home operator's policy.