6.3.1A.2 Service-level authentication and authorization procedure initiation

In order to initiate the service-level authentication and authorization procedure, the SMF shall create a SERVICE-LEVEL AUTHENTICATION COMMAND message.

The SMF shall set the PTI IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message to "No procedure transaction identity assigned".

The SMF shall set the service-level-AA payload in the Service-level-AA container IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message to the payload provided by the DN via the NEF. If a payload type associated with the payload is provided by the DN via the NEF, the SMF shall set the service-level-AA payload type with the value set to the payload type.

NOTE 1: In case of UUAA, the service-level-AA payload is provided by the DN via the UAS-NF.

The SMF shall send the SERVICE-LEVEL AUTHENTICATION COMMAND message, and the SMF shall start timer T3594 (see example in figure 6.3.1A.1-1).

Upon receipt of the SERVICE-LEVEL AUTHENTICATION COMMAND message, if the UE provided a DNN during the PDU session establishment, the UE shall stop timer T3396, if it is running for the DNN provided by the UE. If the UE did not provide a DNN during the PDU session establishment, the UE shall stop the timer T3396 associated with no DNN if it is running. In an SNPN, the timer T3396 to be stopped includes:

• the timer T3396 applied for all the equivalent SNPNs, associated with the RSNPN or an equivalent SNPN, and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3396 applied for the registered SNPN, associated with the RSNPN, and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

Upon receipt of the SERVICE-LEVEL AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI and a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the [S-NSSAI of the PDU session, DNN] combination. If the UE provided a DNN but did not provide an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, DNN] combination provided by the UE. If the UE provided an S-NSSAI but did not provide a DNN during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [S-NSSAI, no DNN] combination provided by the UE. If the UE provided neither a DNN nor an S-NSSAI during the PDU session establishment, the UE shall stop timer T3584, if it is running for the same [no S-NSSAI, no DNN] combination provided by the UE. The timer T3584 to be stopped includes:

• in a PLMN:
• the timer T3584 applied for all the PLMNs, if running, and
• the timer T3584 applied for the registered PLMN, if running; or
• in an SNPN:
• the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

Upon receipt of the SERVICE-LEVEL AUTHENTICATION COMMAND message, if the UE provided an S-NSSAI during the PDU session establishment, the UE shall stop timer T3585, if it is running for the S-NSSAI of the PDU session. If the UE did not provide an S-NSSAI during the PDU session establishment, the UE shall stop the timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

• in a PLMN:
• the timer T3585 applied for all the PLMNs and for the access over which the SERVICE-LEVEL AUTHENTICATION COMMAND message is received, if running;
• the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;
• the timer T3585 applied for the registered PLMN and for the access over which the SERVICE-LEVEL AUTHENTICATION COMMAND message is received, if running; and
• the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
• in an SNPN:
• the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
• the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
• the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
• the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.

NOTE 2: Upon receipt of the SERVICE-LEVEL AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3396 associated with the DNN (or no DNN, if no DNN was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3396 and the timer T3584.

NOTE 3: Upon receipt of the SERVICE-LEVEL AUTHENTICATION COMMAND message for a PDU session, if the UE provided a DNN (or no DNN) and an S-NSSAI (or no S-NSSAI) when the PDU session is established, timer T3585 associated with the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, and timer T3584 associated with the DNN (or no DNN, if no DNN was provided by the UE) and the S-NSSAI (or no S-NSSAI, if no S-NSSAI was provided by the UE) is running, then the UE stops both the timer T3585 and the timer T3584.

Upon receipt of a SERVICE-LEVEL AUTHENTICATION COMMAND message and a PDU session ID, using the NAS transport procedure as specified in clause 5.4.5, the UE passes to the upper layers the service-level-AA payload received in the Service-level-AA container IE of the SERVICE-LEVEL AUTHENTICATION COMMAND message. Apart from this action, the service-level authentication and authorization procedure initiated by the DN is transparent to the 5GSM layer of the UE.