Section: 6.1.5.2 Security mechanisms
Content: The UDM may initiate primary authentication based on procedures initiated by the UE (e.g. UE registration in 5GC) or towards the UE (e.g. SoR/UPU) or events from other NFs, considering the local policy into account as well. Figure 6.1.5.2-1 Home Network triggered primary authentication procedure 0a. The UDM may be pre-configured with an operator authentication policy in order to determine when to trigger a primary authentication procedure. 0b. The UE registers to the network. As part of the registration, the serving AMF registers the UE with the UDM via the Nudm_UECM_Registration as per TS 23.502[ Procedures for the 5G System (5GS) ]  [8], clause 4.2.2.2.2. The AMF shall provide a callback URI within the AMF registration for the UDM to create an implicit subscription to later notify the AMF for potential home network triggered re-authentication using the Nudm_UECM_Re-AuthenticationNotification service operation as in step 2. 1a-c. The UDM decides itself based on events (e.g., SoR/UPU or NF requests such as AAnF requests as defined in TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [91]) or authentication policy and performs home network triggered primary authentication as described in the following steps. The NF such as the AAnF considers based on operator's local authentication policy described in TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [91] to send Nudm_UECM_AuthTrigger request to the UDM for primary authentication using the UDM services as described in clause 14.2.6. The NF may send a Nudm_UECM_AuthTrigger Request message to the UDM with the SUPI of the target UE. NOTE A: For the NF (e.g., AAnF) request event, the UDM can decide not to proceed with triggering the primary authentication based on the UDM’s local authentication policy. In case of AAnF being the NF, as AAnF sets the AF key expiry based on operator’s local authentication policy, no frequent AF key expiry can happen and there is no risk of signalling overload. Based on a received event and the local operator authentication policy, if there is no ongoing primary authentication for the UE, and if the UDM determines to trigger the primary authentication, the UDM determines the serving AMF/SEAF of the target UE. If there are different AMFs registered in the UDM for different access, the UDM shall select one AMF to perform the re-authentication. The criteria for selecting the AMF are dependent of the local UDM authentication policy. NOTE 1: The reasons for the UDM determining that the UE needs to be authenticated can be different. For example, the UDM can determine to initiate a primary authentication when the AMF registers the UE upon the Registration procedure during the mobility from EPC or when SoR/UPU counters are about to wrap around, or when required based on authentication policy, or based on the request from AAnF. The UDM behaviour is determined by operator policy which takes into account the support of certain features in the PLMN. For example, if the PLMN does not support the SoR/UPU feature, then SoR/UPU counter wrap around will not happen and primary authentication will not be required for this case. The UDM acknowledges the Nudm_UECM_AuthTrigger Response. 2. The UDM sends a Nudm_UECM_Re-AuthenticationNotification message to the AMF/SEAF with the UE’s SUPI. 3. After receiving the Nudm_UECM_Re-AuthenticationNotification message from the UDM, the AMF/SEAF shall decide whether to run the primary authentication procedure based on its own local authentication policy, and the UE state (e.g. , if the UE is under handover, or if the UE is already under authentication by the AMF before receiving the authentication notification from the UDM). If the AMF/SEAF determines that it cannot run a primary authentication as described in step 4 (e.g., due to local policy), the AMF/SEAF sends the authentication response message to the UDM with a failure cause else it acknowledges the request. If the AMF/SEAF acknowledged the request but the AMF/SEAF is not able to initiate the primary authentication towards the UE (e.g. if UE is not reachable), the AMF/SEAF shall set the authentication pending flag. When UE re-attaches to the same AMF or becomes reachable, the AMF checks the authentication pending flag and performs the reauthentication if needed. Once UE reauthentication is done, the AMF resets the authentication pending flag. NOTE B: In the case that the UE attaches to a new AMF, the new AMF will register to the UDM using the NudM_UECM_Registration message. In this case, the UDM can determine again on whether to trigger the primary authentication as described in 1b. Upon receiving a failure from the AMF, the UDM may check if another AMF is available over the other access. If available, the UDM may select another AMF and retry Step 2. 4. The AMF/SEAF starts the primary authentication procedure as defined in clause 6.2.1 of the present document. The UDM may execute other procedures (e.g. SoR/UPU) depending on the reason that motivated the UDM triggered (re-)authentication procedure in step 1.