4.21 Authentication and key management for applications (AKMA)

The UE may support AKMA.

The purpose of AKMA is to provide authentication and key management to applications based on 3GPP credentials used for 5GS access as specified in 3GPP TS 33.535 [24A], which allows the UE to securely exchange data with an AKMA application function.

Upon receiving a request from the upper layers to obtain AKMA Anchor Key (KAKMA) and AKMA Key Identifier (A-KID), the UE supporting AKMA shall derive the KAKMA and the AKMA Temporary Identifier (A-TID) from the valid KAUSF if available as specified in 3GPP TS 33.535 [24A], shall further derive the A-KID from the A-TID as specified in 3GPP TS 33.535 [24A] and shall provide KAKMA and A-KID to the upper layers.

The UE supporting AKMA shall notify the upper layers whenever there is a change of the KAUSF upon reception of an EAP-success message in clauses 5.4.1.2.2.8, 5.4.1.2.3.1 and 5.4.1.2.3A.1 or upon reception of SECURITY MODE COMMAND message in clauses 5.4.2.3.

During an ongoing primary authentication and key agreement procedure (see clause 5.4.1), if the UE receives a request from upper layers to obtain KAKMA and A-KID, the UE shall derive the KAKMA and A-TID after the completion of the ongoing primary authentication and key agreement procedure, shall further derive the A-KID from the A-TID as specified in 3GPP TS 33.535 [24A] and shall provide KAKMA and A-KID to the upper layers.

NOTE 1: The upper layers derive the AKMA Application Key (KAF) from KAKMA as specified in 3GPP TS 33.535 [24A].

NOTE 2: The knowledge of whether a certain application needs to use AKMA or not is application specific and is out of the scope of 3GPP.

NOTE 3: The exact method of securing the data exchange at the upper layers using KAF is application specific and is out of the scope of 3GPP.

NOTE 4: The upper layers request the UE NAS layer to provide KAKMA and A-KID before the upper layers initiate communication with an AKMA application function.

NOTE 5: Upon receiving a request from the upper layers to obtain KAKMA and A-KID, if there is no KAUSF available, the UE NAS layer cannot derive the KAKMA and A-KID and provides an indication to the upper layers that KAKMA and A-KID cannot be generated.