3GPP 23.501 v20.2.0 — the document's own text

5.2.3 Identification and authentication

Taught in 7. Every name the system uses (The 5G system architecture, in depth), 4. Knowing who you are and where you are (The 5G system architecture, overview).

The network may authenticate the UE during any procedure establishing a NAS signalling connection with the UE. The security architecture is specified in TS 33.501 [29]. The network may optionally perform an PEI check with 5G-EIR.