Section: 11.1.3 Re-Authentication
Content: Figure 11.1.3-1: EAP Re-Authentication with an external AAA server This procedure concerns both roaming and non-roaming scenarios. In the non-roaming and LBO roaming cases, only one SMF is involved. In the HR roaming case, the V-SMF shall proxy the signalling between the AMF in the VPLMN and the H-SMF in the HPLMN. 1-3 Secondary Authentication has been established according to procedures specified in clause 11.1.2, Initial EAP Authentication with an external AAA server. Secondary Re-authentication may either be initiated by SMF or the external DN/AAA server. If Re-authentication is initiated by SMF, the procedure proceeds with step 4 (skipping steps 4a and 4b). If Re-authentication is initiated by the external DN/AAA server, the procedure proceeds with the alternative steps 4a and 4b. 4. The SMF decides to initiate Secondary Re-Authentication. 4a. The DN AAA server decides to initiate Secondary Re-Authentication. 4b. The DN AAA shall send a Secondary Re-Authentication request to UPF, and the UPF forwards it to SMF. The Secondary Re-authentication request contains the GPSI, if available, and the IP/MAC address of the UE allocated to the PDU Session and the MAC address if the PDU session is of Ethernet PDU type. 5. The SMF shall send an EAP Request/Identity message to the UE. 6. The UE shall respond with an EAP Response/Identity message (with Fast-Reauth Identity). 7. The SMF forwards the EAP Response/Identity to UPF, selected during initial authentication, over N4 interface. This establishes an end-to-end connection between the SMF and the external DN-AAA server for EAP exchange. 8. The UPF shall forward the EAP Response/Identity message to the DN AAA Server. 9. The DN AAA server and the UE shall exchange EAP messages as required by the EAP method. 10. After the completion of the authentication procedure, DN AAA server either sends EAP Success or EAP Failure message to the SMF. 11. This completes the Re-authentication procedure at the SMF. 12-13. If the authentication is successful, EAP-Success shall be sent to UE. 12-14. If authentication is not successful, the SMF notifies failure to UPF. Upon completion of a N4 Session Modification procedure with the selected UPF, SMF sends EAP-Failure to UE via AMF.