6.3.1.2.1 PDU EAP message reliable transport procedure initiation

In order to initiate the PDU EAP message reliable transport procedure, the SMF shall create a PDU SESSION AUTHENTICATION COMMAND message.

The SMF shall set the PTI IE of the PDU SESSION AUTHENTICATION COMMAND message to "No procedure transaction identity assigned".

The SMF shall set the EAP message IE of the PDU SESSION AUTHENTICATION COMMAND message to the EAP-request message provided by the DN or generated locally.

The SMF shall send the PDU SESSION AUTHENTICATION COMMAND message, and the SMF shall start timer T3590 (see example in figure 6.3.1.1).

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided a DNN during the PDU session establishment, the UE shall stop timer T3396, if it is running for the DNN provided by the UE. If the UE did not provide a DNN during the PDU session establishment, the UE shall stop the timer T3396 associated with no DNN if it is running. In an SNPN, the timer T3396 to be stopped includes:

• the timer T3396 applied for all the equivalent SNPNs, associated with the RSNPN or an equivalent SNPN, and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3396 applied for the registered SNPN, associated with the RSNPN, and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI and a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the [S-NSSAI of the PDU session, DNN] combination. If the UE provided a DNN but did not provide an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, DNN] combination provided by the UE. If the UE provided an S-NSSAI but did not provide a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [S-NSSAI, no DNN] combination provided by the UE. If the UE provided neither a DNN nor an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, no DNN] combination provided by the UE. The timer T3584 to be stopped includes:

• in a PLMN:
• the timer T3584 applied for all the PLMNs, if running; and
• the timer T3584 applied for the registered PLMN, if running; or
• in an SNPN:
• the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI during the PDU session establishment, the UE shall stop timer T3585, if it is running for the S-NSSAI of the PDU session. If the UE did not provide an S-NSSAI during the PDU session establishment, the UE shall stop the timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

• in a PLMN:
• the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, if running;
• the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;
• the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, if running; and
• the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
• in an SNPN:
• the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
• the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
• the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

NOTE 1: Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3396 associated with the DNN (or no DNN, if no DNN was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3396 and the timer T3584.

NOTE 2: Upon receipt of the PDU SESSION AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3585 associated with the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3585 and the timer T3584.

Upon receipt of a PDU SESSION AUTHENTICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in clause 5.4.5, the UE passes to the upper layers the EAP message received in the EAP message IE of the PDU SESSION AUTHENTICATION COMMAND message. Apart from this action and the stopping of timers T3396, T3584 and T3585 (if running), the authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.