Section: I.10.5.1 NSWO support in SNPN using CH with AAA server
Content: The reference architecture to support authentication for Non-seamless WLAN offload using SNPN credentials from Credentials Holder using AAA Server is specified in Figure 4.2.15-3b of TS 23.501[ System architecture for the 5G System (5GS) ]  [2]. This clause applies to UEs that support NSWO in SNPN with any key generating EAP method by using the SNPN credentials with CH AAA server (i.e., the MSK indication described in step 0 of clause I.2.2.2.2 is configured on the UE). The UE shall reuse 5G NSWO procedures defined in Annex S.3.2 with WLAN access network for NSWO authentication with the same key generating EAP method that is used by the SNPN over 3GPP access with the following exception: - The EAP authentication is performed between the UE and the CH AAA with no involvement of NSWOF/AUSF/UDM. - The construction of SUCI described in this document is not applicable. NOTE: The requirement to use the same key generating EAP method includes the EAP identity privacy mechanism used by the SNPN over 3GPP access. This implies that for NSWO support in SNPN using CH with AAA server the identity privacy is achieved at the EAP layer via EAP method specific means. I.10.5.2 NSWO support in SNPN without CH 5G NSWO procedures are defined in Annex S.3.2. For SNPN the procedures are extended to usage of any key-generating EAP-method as follows: Steps 1-2 are performed as described in Annex S.3.2. In step 3, the SUCI can be of type anonymous SUCI if the construction of SUCI as described in clause 6.12 cannot be used and if the employed EAP method supports SUPI privacy. Steps 4-6 are performed as described in Annex S.3.2. 7. Upon reception of the Nudm_UEAuthentication_Get Request, the UDM invokes SIDF to de-conceal SUCI to gain SUPI if the received SUCI is not an anonymous SUCI. For selection of authentication methods, the statements in Annex I.2.2.1 apply. In case of SNPN, the UDM selects authentication method based on the NSWO indicator, subscription data and/or local configuration. The authentication method may include EAP-AKA’ or any other key-generating EAP authentication method. The UDM returns the selected authentication method to the AUSF. 8. Authentication is performed between the AUSF and UE using the selected EAP method. After a successful authentication the AUSF derives the MSK key and does not generate the KAUSF, as indicated by the NSWO indicator and as described for the PLMN case in Annex S.3.2. Steps 9-11 are performed as described in steps 16-18 of Annex S.3.2.