Section: 5.4.1.2.3C Procedures related to EAP methods used for primary authentication of an AUN3 device
Content: 5.4.1.2.3C.1 General This subclause applies when an EAP method is used for primary authentication of an AUN3 device, when a 5G-RG supports acting on behalf of the AUN3 device, the AMF supports serving the 5G-RG acting on behalf of the AUN3 device and the AUSF supports authentication of the AUN3 device. EAP-AKA' and EAP-TLS are examples of such EAP method. The AUSF supporting authentication of the AUN3 device shall support acting as EAP server of at least one such EAP method as specified in annex Z of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [24]. The 5G-RG acting on behalf of the AUN3 device provides to the AUN3 device an EAP-request message, an EAP-success message or an EAP-failure message received from the network according to subclause 5.4.1.2.1 and sends to the network according to subclause 5.4.1.2.1 an EAP-response provided by the AUN3 device. Details of communication between the AUN3 device and the 5G-RG acting on behalf of the AUN3 device are out of scope of this specification. When initiating an EAP based primary authentication and key agreement procedure using such EAP method, the network shall select an ngKSI value. The network shall send the selected ngKSI value to the 5G-RG acting on behalf of the AUN3 device along with each EAP message. The network shall send the ABBA value as described in subclause 9.11.3.10 to the 5G-RG acting on behalf of the AUN3 device along with the EAP-request message and EAP-success message. The 5G-RG acting on behalf of the AUN3 device shall not forward the ngKSI value or the ABBA value to the AUN3 device. NOTE 1: The network provides the ngKSI value and the ABBA value since the ngKSI IE and the ABBA IE are mandatory IEs in AUTHENTICATION REQUEST message. The 5G-RG acting on behalf of the AUN3 device does not use the ngKSI value or the ABBA value provided by the network. If the 5G-RG acting on behalf of the AUN3 device is informed by AUN3 about failure to authenticate the network, the 5G-RG acting on behalf of the AUN3 device shall start timer T3520 when the AUTHENTICATION RESPONSE message containing the EAP-response message is sent. Furthermore, the 5G-RG acting on behalf of the AUN3 device shall stop any of the retransmission timers that are running (e.g. T3510, T3517 or T3521). Upon receiving an AUTHENTICATION REQUEST message with the EAP message IE containing an EAP-request message from the network, the 5G-RG acting on behalf of the AUN3 device shall stop timer T3520, if running, and then provides the EAP-request message to the AUN3 device as normally. If the network fails to authenticate the AUN3 device, the network handling depends upon the type of identity used by the 5G-RG acting on behalf of the AUN3 device in the initial NAS message, that is: a) if the 5G-GUTI was used; or b) if the SUCI was used. If the 5G-GUTI was used, the network should transport the EAP-failure message in the AUTHENTICATION RESULT message as specified in the EAP result message transport procedure, initiate an identification procedure to retrieve SUCI from the 5G-RG acting on behalf of the AUN3 device and restart the EAP based primary authentication and key agreement procedure with the received SUCI. If the SUCI was used for identification in the initial NAS message or in a restarted EAP based primary authentication and key agreement procedure, or the network decides not to initiate the identification procedure to retrieve SUCI from the 5G-RG acting on behalf of the AUN3 device after an unsuccessful EAP based primary authentication and key agreement procedure, the network should transport the EAP-failure message in an AUTHENTICATION REJECT message as specified in the EAP result message transport procedure. If the EAP-failure message is received in an AUTHENTICATION REJECT message, the 5G-RG acting on behalf of the AUN3 device shall start timer T3247 with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running (see subclause 5.3.20). Additionally, the 5G-RG acting on behalf of the AUN3 device shall: a) if the counter for "USIM considered invalid for 5GS services over non-3GPP access" events has a value less than a 5G-RG implementation-specific maximum value, proceed as specified in list item 1)-b) of subclause 5.3.20.2 for the case that the 5GMM cause value received is #3; or b) otherwise, set the update status to 5U3 ROAMING NOT ALLOWED, delete the stored 5G-GUTI, TAI list, last visited registered TAI and ngKSI. The USIM shall be considered invalid for 5GS services via non-3GPP access until switching off or the UICC containing the USIM is removed. If the AUTHENTICATION REJECT message is received by the 5G-RG acting on behalf of the AUN3 device, the 5G-RG acting on behalf of the AUN3 device shall abort any 5GMM signalling procedure, stop any of the timers T3510, T3517, T3519 or T3521 (if they were running), enter state 5GMM-DEREGISTERED and delete any stored SUCI. Upon receiving an EAP-success message from the network, the 5G-RG acting on behalf of the AUN3 device shall consider the procedure complete. The network shall provide: a) the Master session key, if the AUN3 device does not support 5G key hierarchy; or b) the KWAGF key, if the AUN3 device supports 5G key hierarchy; to the 5G-RG along with the EAP-success message as specified in subclauses 5.4.1.2.5.2 and 5.4.2.2. The 5G-RG acting on behalf of the AUN3 device shall derive the Pairwise master key from the Master session key or the KWAGF key as specified in subclause 7B.7 of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [24]. The 5G-RG acting on behalf of the AUN3 device provides the EAP-success message to the AUN3 device. NOTE 2: The network is aware from the AUN3 device subscription data in UDM whether the AUN3 device supports 5G key hierarchy or not as specified in subclause 7B.7 of 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [24]. Upon receiving an EAP-failure message from the network, the 5G-RG acting on behalf of the AUN3 device shall consider the procedure complete.