Authentication and Key Agreement

In Release 15, key enhancements to the AKA function included the addition of the ABBA parameter to the 5G primary authentication procedure and the introduction of a stage 2 solution for Steering of Roaming (SOR) based on authentication during registration. The release also provided clarifications and corrections for the EAP-based primary authentication procedure and specified rules for the concurrent running of authentication and NAS security mode control procedures. Furthermore, it standardized the authentication response parameter information element to be of a fixed length.

• UE configuration for NAS signalling low priority via OMA-DM or USIM not applicable in 5GS TS 24.501CR0084
• Preferred list terminating at ME or USIM TS 24.501CR0212
• Stage 2 solution of Steering Of Roaming (SOR) based on Authentication procedure during Registration (Alternative 3) TS 24.890CR0013
• Rules on concurrent running of authentication and NAS SMC procedure TS 33.501CR0004
• Clarifications to: Protection at the network or transport layer, Authorization and authentication between network functions and the NRF TS 33.501CR0147
• Baseline CR for June version of RAN2 TS 38.300 (RAN3 part) covering agreements of RAN3#100 TS 38.300CR0041

+ 68 more changes

In Release 16, the AKA function was enhanced to support network slice-specific authentication and authorization, including procedures for failure and revocation, and introduced the use of a pending NSSAI. It also expanded primary authentication to formally support EAP methods beyond EAP-AKA' and EAP-TLS, and added specific handling for authentication in Restricted Local Operator Services (RLOS) scenarios. Furthermore, the release defined new authentication procedures for indirect communication and for devices accessing the 5G Core (N5GC).

• Authentication and security handling for restricted local operator services TS 24.301CR3162
• Abnormal case handling when authentication is not accepted TS 24.301CR3193
• RLOS integrity and authentication handling TS 24.301CR3266
• Authentication and security handling for RLOS TS 24.301CR3334
• Slice-specific authentication and authorization procedure TS 24.501CR1450
• Primary authentication using EAP methods other than EAP-AKA' and EAP-TLS TS 24.501CR1510

+ 43 more changes

In Release 17, key AKA enhancements included the introduction of Authentication and Key Management for Applications (AKMA) and new procedures for Multi-USIM UEs, such as using the Service Request to remove paging restrictions. The release also expanded authentication methods by defining EAP-TTLS with two phases of authentication and specifying authentication and key agreement for 5G ProSe UE-to-network relays. Furthermore, it introduced the usage of an indication to derive KAUSF from an MSK following a successful primary authentication and key agreement procedure.

• Update of HTTP Digest Access Authentication and reference update for HTTP/1.1 protocol TS 24.109CR0069
• GBA-based shared secret with PSK authentication in TLS 1.3 TS 24.109CR0071
• Using Service Request procedure for removing paging restrictions in EPS for a Multi-USIM UE TS 24.301CR3517
• Leaving procedure and Reject Paging Indication for Multi-USIM UEs in EPS TS 24.301CR3534
• Multi-USIM UE support indications in EPS TS 24.301CR3514
• UUAA re-authentication, re-authorization, and revocation TS 24.301CR3628

+ 79 more changes

In Release 18, the AKA function was extended to support new scenarios including the authentication of AUN3 devices behind a Residential Gateway (RG) and the authentication and key agreement procedure for 5G ProSe UE-to-UE relays. It also introduced the Home Network triggered primary authentication procedure and clarified the handling of authentication failures, such as defining a specific ESM cause for user authentication or authorization failure. Additionally, enhancements were made for scenarios involving Non-Seamless WLAN Offload (NSWO) and for the mutual authentication between network functions using the NF Instance ID.

• Authentication for AUN3 devices supporting 5G key hierarchy TS 24.501CR5811
• Impact on NAS signalling for supporting authentication of AUN3 devices supporting and not supporting 5G key hierarchy TS 24.501CR5812
• Authentication and key agreement procedure for 5G ProSe UE-to-UE relay TS 24.501CR5820
• Authentication for UE behind 5G-RG and FN-RG using NSWO TS 33.501CR1593
• Authentication of AUN3 devices behind RG TS 33.501CR1614
• Introducing Home Trigger primrary authentication procedure TS 33.501CR1670

+ 22 more changes

In Release 19, the AKA function was updated with specific corrections to the handling of the AUTHENTICATION REJECT message, particularly for a UE configured to use the T3245 timer, and to the requirements for resetting the attempt counter upon an authentication reject. Additionally, the release included a correction to the Information Element length for the Service-level AA container used in Service-level authentication command and complete messages.

• Corrected requirements for attempt counter reset at authentication reject TS 24.301CR4214
• Correction in handling AUTHENTICATION REJECT message by a UE configured to use T3245 TS 24.301CR4599
• Corrected requirements for attempt counter reset at authentication reject TS 24.501CR6675
• Correction in handling AUTHENTICATION REJECT message by a UE configured to use T3245 TS 24.501CR7066
• Correction of IE length for Service-level AA container in Service-level authentication command/complete message TS 24.501CR7092
• Correct mutual authentication requirement TS 33.501CR2163

+ 1 more changes