Authentication Token

In Release 15, the specifications for the AUTN function were updated with clarifications and corrections to several key authentication procedures. This included specific corrections to the secondary authentication procedure, the primary authentication framework, and the handling of unused 5G authentication vectors. Furthermore, the release introduced new details for token-based authorization and authentication within the Service-Based Architecture (SBA), including updates to the Access Token Request mechanism.

• Rules on concurrent running of authentication and NAS SMC procedure TS 33.501CR0004
• Clarifications to: Protection at the network or transport layer, Authorization and authentication between network functions and the NRF TS 33.501CR0147
• Corrections to secondary authentication procedure TS 33.501CR0064
• Corrections related to authentication related services TS 33.501CR0080
• Clarifications to: Initiation of authentication and selection of authentication method TS 33.501CR0084
• Clarifications to: Authentication procedures TS 33.501CR0115

+ 29 more changes

In Release 16, the scope of the AUTN function was expanded beyond primary user authentication to explicitly include new token-based authorization procedures for indirect communication between network functions, such as SeCoPs. The release also introduced specific enhancements for authentication and authorization within Network Slice selection and for Private Non-Public Networks (PNI-NPN). Furthermore, it added support for using symmetric keys for Access Token signatures and detailed the re-use and verification parameters for these tokens in delegated discovery scenarios.

• Authentication and authorization between SeCoP and network functions TS 33.501CR0693
• Authentication and authorization between SeCoPs TS 33.501CR0694
• Resource Level Authorization using Access Tokens TS 33.501CR0755
• Authentication in indirect communication scenarios TS 33.501CR0808
• Network slice specific authentication and authorization clauses TS 33.501CR0853
• Token-based authorization in indirect communication scenarios TS 33.501CR0854

+ 16 more changes

In Release 17, the enhancements to the AUTN function and related authentication procedures included clarifications on authentication for User Equipment behind 5G-RG and FN-RG, and the introduction of authentication in the user plane procedure for Multicast/Broadcast Services (MBS). The release also provided corrections and clarifications for secondary authentication during UE onboarding and revised the procedures for network slice re-authentication and revocation by the AAA-S. Furthermore, it introduced mechanisms for access token misuse prevention and clarified the support for authentication methods within a Standalone Non-Public Network (SNPN).

• Update of HTTP Digest Access Authentication and reference update for HTTP/1.1 protocol TS 24.109CR0069
• GBA-based shared secret with PSK authentication in TLS 1.3 TS 24.109CR0071
• Change the procedure of network slice re-authentication and revocation by AAA-S TS 33.501CR1091
• Removing Editor's note on Credentials Holder using AUSF and UDM for primary authentication TS 33.501CR1307
• Usage of AN ID for NSWO authentication TS 33.501CR1317
• Corrections and clarifications to secondary authentication during UE onboarding TS 33.501CR1388

+ 13 more changes

In Release 18, the authentication token (AUTN) function was enhanced to support new scenarios like primary authentication triggered by the home network and the authentication of devices behind a Residential Gateway (RG). It also introduced clarifications and validations for access token requests in roaming, hierarchical NRF deployments, and interconnect scenarios, strengthening the security framework for service-based interfaces.

• Authentication for UE behind 5G-RG and FN-RG using NSWO TS 33.501CR1593
• Authentication of AUN3 devices behind RG TS 33.501CR1614
• Introducing Home Trigger primrary authentication procedure TS 33.501CR1670
• Use of NF Instance ID in the mutual authentication between the NF Consumer and NRF TS 33.501CR1761
• Access token request handling by NRF TS 33.501CR1667
• Clarification on access token request for accessing services TS 33.501CR1728

+ 13 more changes

In Release 19, key enhancements to the Authentication Token (AUTN) function included support for the `iat` claim in the access token and the introduction of public key distribution for issuer claim verification. The release also clarified token-based authorization for indirect communication when a Network Function is selected at the target PLMN and refined the access token's handling of S-NSSAI lists. Furthermore, Release 19 deprecated the use of the `requesterPlmnList` in the Access Token Request.

• Support iat claim in the access token TS 33.501CR2051
• Token-based authorization for indirect communication scenarios when NF is selected at target PLMN TS 33.501CR2135
• Public key distribution and Issuer claim verification of the Access Token TS 33.501CR2152
• Correct mutual authentication requirement TS 33.501CR2163
• Clarification on access token with respect to a list of S-NSSAIs TS 33.501CR2187
• Deprecation of the use of the requesterPlmnList in the Access Token Request TS 33.501CR2192

In Release 20, the primary update to the Authentication Token (AUTN) function was a correction for roaming scenarios to ensure proper alignment with network procedures. Specifically, the change replaced the method of appending PLMN ID claims within the access token with the use of distinct PLMN ID-specific claims. This refinement aimed to improve the clarity and correctness of the authentication and registration process for roaming user equipment.

• Correction of misalignment with TS 29.510: Replace appended PLMN ID access token claims with PLMN ID specific claims in roaming TS 33.501CR2214