Section: Y.2 Authentication and authorization between MSGin5G client and MSGin5G Server
Content: The Authentication and authorization between MSGin5G Client and MSGin5G Server shall be based on AKMA, which is specified in TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [91]. Before initiating communication with MSGin5G Server, the UE needs to have performed primary authentication and registered with the 5GC, resulting in the successful generation of KAKMA and A-KID at both MSGin5G Client and the 5GC as specified in clause 6.1, TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [91]. Once the UE is registered in 5GC, the MSGin5G Client in the UE and the MSGin5G Server may use TLS for authentication as specified in Annex B of TS 33.535[ Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS) ]  [91] with the MSGin5G Server taking the role of AKMA AF. Methods other than TLS with AKMA may be used for authentication between the MSGin5G Client and MSGin5G Server, depending on the Ua* protocols. When MSGin5G service is used with SEAL, the application architecture described in TS 23.554[ Application architecture for MSGin5G Service; Stage 2 ]  [106] is followed. In this case, authorization of the MSGin5G UE by the MSGin5G server is performed by validating the association between the UE service ID and UE ID (SUPI/GPSI). The UE service ID is acquired via the MSGin5G registration request, as specified in TS 23.554[ Application architecture for MSGin5G Service; Stage 2 ]  [106]. The Configuration Management server or MSGin5G Configuration Function maintains association of the assigned UE service ID with the UE ID. The MSGin5G server retrieves the association from the Configuration Management server or MSGin5G Configuration Function using the UE ID received from the AAnF and verifies whether the UE service ID received in the registration request message is associated with the UE ID in the retrieved association information. For constrained UE, the Gateway/Proxy UE shall perform authentication and authorization on behalf of the constrained UE with MSgin5G Server based on AKMA as specified above.