Section: 28.7.7 NAI used by N5CW devices via trusted non-3GPP access 28.7.7.0 General
Content: While performing the EAP authentication procedure when a non 5G capable over WLAN (N5CW) device attempts to register to 5GCN via a trusted non-3GPP access network in a selected PLMN (see clause 4.12 b in 3GPP TS 23.502[ Procedures for the 5G System (5GS) ]  [120]), the N5CW device shall derive a NAI from the identity of the selected PLMN in the following format: "<5G_device_unique_identity>@nai.5gc-nn.mnc<MNC>.mcc<MCC>.3gppnetwork.org"; where: a) the username part <5G_device_unique_identity> is to identify the N5CW device and contains either: - SUCI as defined as the username part of the NAI format in clause 28.7.3, if the UE is not registered to 5GCN via NG-RAN; or - 5G-GUTI as defined as the username part of the NAI format in clause 28.7.8, if the N5CW device is registered to 5GCN via NG-RAN; and b) the label '5gc-nn' in the realm part indicates the NAI is used by N5CW devices via trusted non-3GPP access. <MNC> and <MCC> identify the PLMN (either HPLMN or VPLMN) to which the N5CW device attempts to connect via the trusted non-3GPP access network as described in clause 6.3.12 in 3GPP TS 23.501[ System architecture for the 5G System (5GS) ]  [119]. While performing the EAP authentication procedure when a non 5G capable over WLAN (N5CW) device attempts to register to 5GCN via a trusted non-3GPP access network in a selected SNPN (see clause 5.30.2.13 in 3GPP TS 23.501[ System architecture for the 5G System (5GS) ]  [119]), the N5CW device shall derive a NAI from the identity of the selected SNPN in the following format: "<5G_device_unique_identity>@nai.5gc-nn.nid<NID>.mnc<MNC>.mcc<MCC>.3gppnetwork.org"; where: a) the username part <5G_device_unique_identity> is to identify the N5CW device and contains either: - SUCI as defined as the username part of the NAI format in clause 28.7.3; or - 5G-GUTI as defined as the username part of the NAI format in clause 28.7.8, if the N5CW device is registered to 5GCN via NG-RAN; and b) the label '5gc-nn' in the realm part indicates the NAI is used by N5CW devices via trusted non-3GPP access. <MNC>, <MCC> and <NID> identify the SNPN to which the N5CW device attempts to connect via the trusted non-3GPP access network. NOTE: As defined in 3GPP TS 33.501[ Security architecture and procedures for 5G System ]  [124], an N5CW device is authenticated using EAP-AKA', thus, it has a USIM that stores the HPLMN identity. In roaming scenarios, the NAI shall use the decorated NAI format as specified in clause 28.7.7.1 or 28.7.7.2.