3GPP 24.501 v20.0.0 — the document's own text
5.4.1.2.1 General
Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).
The purpose of the EAP based primary authentication and key agreement procedure is to provide mutual authentication between the UE and the network and to agree on the keys KAUSF, KSEAF and KAMF (see 3GPP TS 33.501 [24]).
Extensible authentication protocol (EAP) as specified in IETF RFC 3748 [34] enables authentication using various EAP methods.
EAP defines four types of EAP messages:
- an EAP-request message;
- an EAP-response message;
- an EAP-success message; and
- an EAP-failure message.
Several rounds of exchanges of an EAP-request message and a related EAP-response message can be required to achieve the authentication (see example in figure 5.4.1.2.1.1).
The EAP based primary authentication and key agreement procedure is always initiated and controlled by the network.
The EAP-request message, the ngKSI and the ABBA are transported from the network to the UE using the AUTHENTICATION REQUEST message of the EAP message reliable transport procedure.
The EAP-response message is transported from the UE to the network using the AUTHENTICATION RESPONSE message of the EAP message reliable transport procedure.
If the authentication of the UE completes successfully, the serving AMF intends to initiate a security mode control procedure after the EAP based primary authentication and key agreement procedure and the security mode control procedure intends to bring into use the partial native 5G NAS security context created by the EAP based primary authentication and key agreement procedure, then the EAP-success message and the ngKSI are transported from the network to the UE using the SECURITY MODE COMMAND message of the security mode control procedure (see clause 5.4.2).
If the authentication of the UE completes successfully and the serving AMF does not intend to initiate a security mode control procedure bringing into use the partial native 5G NAS security context created by the EAP based primary authentication and key agreement procedure, then the EAP-success message, and the ngKSI are transported from the network to the UE using the AUTHENTICATION RESULT message of the EAP result message transport procedure.
NOTE 1: The serving AMF will not initiate a security mode control procedure after the EAP based primary authentication and key agreement procedure e.g. in case of AMF relocation during registration procedure.
If the authentication of the UE completes unsuccessfully, the EAP-failure message is transported from the network to the UE using the AUTHENTICATION RESULT message or the AUTHENTICATION REJECT message of the EAP result message transport procedure or in a response of the initial 5GMM procedure as part of which the EAP based primary authentication and key agreement procedure is performed.
The AMF shall set the authenticator retransmission timer specified in IETF RFC 3748 [34] clause 4.3 to infinite value.
NOTE 2: The EAP message reliable transport procedure provides a reliable transport of EAP messages and therefore retransmissions at the EAP layer do not occur.
The AUSF and the AMF support exchange of EAP messages using N12.
The UE shall detect and handle any duplication of EAP message as specified in IETF RFC 3748 [34].
