Unified User Authentication and Authorization for Mobility Management

Description

UUAA-MM refers to the Unified User Authentication and Authorization procedure as applied to Mobility Management (MM) during registration to a 5G System (5GS). It is part of the broader Unified User Authentication and Authorization (UUAA) framework introduced in 3GPP Release 19, which aims to unify and streamline the authentication and authorization of users and User Equipment (UE) across different access types and service domains in 5G. The UUAA-MM procedure is optionally performed during the registration procedure to a 5GS, meaning it can be invoked when the network or UE requires additional user-level authentication and authorization beyond the standard 5G-AKA or EAP-AKA' primary authentication.

In traditional 5G security, the primary authentication during registration authenticates the UE (and indirectly the subscriber) using credentials stored in the UE's USIM and the network's UDM/ARPF. However, there are scenarios where additional user authentication and authorization is needed — for example, when the user needs to be authenticated by an external entity, when the UE is used by multiple users, or when access to specific services requires separate authorization. The UUAA framework addresses these scenarios by providing a unified mechanism for user authentication and authorization that can be integrated into the registration procedure.

The UUAA-MM procedure, as the mobility management variant, is specifically concerned with the registration to 5GS. It is described as optionally performed, indicating that it is not mandatory for all registrations but is invoked when the relevant conditions or policies apply. This optionality allows the network to support UUAA where needed without imposing the overhead on all registrations. The procedure is specified in 3GPP TS 23.256 (Unified User Authentication and Authorization; Stage 2) and TS 33.256 (Unified User Authentication and Authorization; Security aspects), which together define the architecture, procedures, and security mechanisms.

The introduction of UUAA in Release 19 reflects the growing need for flexible, user-centric authentication in 5G networks. As 5G expands into enterprise, industrial, and vertical domains, the ability to authenticate and authorize users — not just devices — becomes increasingly important. UUAA-MM provides a standardized way to perform this during registration, ensuring that the user's identity and permissions are established as part of the mobility management procedure. This integration with registration ensures that subsequent service access can rely on the established user authentication and authorization state.

UUAA-MM was introduced in Release 19 and is specified in Release 19 only in the available data. It represents an evolution of 5G security toward unified, user-aware authentication and authorization, complementing existing device-level authentication mechanisms. Its optional nature ensures backward compatibility and allows gradual deployment as the ecosystem matures.

Purpose & Motivation

UUAA-MM exists to address the need for user-level authentication and authorization during 5G registration, beyond the device-level authentication provided by standard 5G security procedures. Traditional 5G primary authentication authenticates the UE and the subscriber credentials, but does not necessarily authenticate the human user or authorize the user for specific services. In many emerging 5G use cases — such as enterprise networks, multi-user devices, and vertical applications — there is a need to authenticate and authorize the user as part of network registration.

Before UUAA, user authentication and authorization was often handled by application-layer mechanisms or separate procedures, leading to fragmentation and lack of integration with network access. The UUAA framework, introduced in Release 19, unifies these functions into a single, standardized procedure that can be integrated with registration. UUAA-MM specifically applies this to mobility management, allowing the network to perform user authentication and authorization as an optional part of the 5GS registration procedure.

The optional nature of UUAA-MM is important: it allows operators to deploy the capability where needed without forcing all registrations to incur the additional signaling and processing. This supports a wide range of deployment scenarios, from traditional mobile broadband where UUAA may not be needed, to enterprise and vertical deployments where user authentication is essential. By standardizing the procedure in TS 23.256 and TS 33.256, 3GPP ensures interoperability and provides a foundation for secure, user-aware 5G services.