Section: 7B.7.3 Authentication for AUN3 devices supporting 5G key hierarchy
Content: This clause specifies the how an AUN3 device supporting 5G key hierarchy behind 5G-RG shall be registered to the 5GC by the 5G-RG and shall be authenticated by 5GC using EAP-AKA’. Figure 7B.7.3-1 Authentication Procedure for AUN3 devices supporting 5G key hierarchy using EAP-AKA’ Steps 1-7 are the same as steps 1-7 in clause 7B.7.2. 8. The UDM shall send to the AUSF a Nudm_UEAuthentication_Get Response message, including the EAP-AKA’ authentication vector (RAND, AUTN, XRES, CK´ and IK´), the SUPI. Steps 9-15 are the same as steps 9-15 in clause 7B.7.2. 16. The AUSF shall verify the AKA’-Challenge message as described in RFC 5448[12]. If successful, the AUSF shall generate the KAUSF as defined in section 6.1.3.1. 17. The AUSF shall send to the AMF/SEAF an Nausf_UEAuthentication_Authenticate Response message including the EAP-Success, the Anchor key, and the SUPI. 18. In the final authentication message from the home network, if the AUSF has sent the anchor key KSEAF, the SEAF shall derive the KAMF from KSEAF and send it to the AMF. 19. The AMF shall derive KWAGF key. NOTE: Whether the key KWAGF is used by the 5G-RG and W-AGF is out of the scope of 3GPP. 20. Step 20 is the same as step 19 in clause 7B.7.2. 21a-21b. If the layer 2 connection is over WLAN (IEEE 802.11), the AUN3 device and the 5G-RG use KWAGF as the PMK, from which the WLAN keys are derived. 22. Step 22 is the same as step 21 in clause 7B.7.2.