PDU Session Authentication

PDU Session Authentication and Authorization is a 5GSM procedure used when the network needs additional data-network specific authentication before allowing a PDU session. This is separate from 5GMM primary authentication. The SMF can use this procedure to exchange EAP information with the UE through NAS before the PDU session is accepted.

Signaling Sequence

#	Direction	5GSM Message	Comment
1	NW -> UE	PDU Session Authentication Command	Network sends authentication material, normally EAP.
2	UE -> NW	PDU Session Authentication Complete	UE returns authentication response material.
3	NW -> UE	PDU Session Authentication Result	Network reports the final authorization result.

Message Structure

The main payload in this procedure is the EAP message. The 5GSM header identifies the PDU session and procedure transaction, and the EAP message carries the actual authentication exchange.

Example : PDU Session Authentication Command

The checked Amarisoft MME logs did not contain this procedure, so the following is a constructed full-message example.

[NAS] DL 5GSM: PDU session authentication command
        Protocol discriminator = 0x2e (5GS Session Management)
        PDU session identity = 1
        Procedure transaction identity = 51
        Message type = 0xc5 (PDU session authentication command)
        EAP message:
          Code = 1 (Request)
          Identifier = 1
          Length = example
          Type = example
          Data = example

Example : PDU Session Authentication Complete

The following constructed example shows the UE response carrying EAP response information.

[NAS] UL 5GSM: PDU session authentication complete
        Protocol discriminator = 0x2e (5GS Session Management)
        PDU session identity = 1
        Procedure transaction identity = 51
        Message type = 0xc6 (PDU session authentication complete)
        EAP message:
          Code = 2 (Response)
          Identifier = 1
          Length = example
          Type = example
          Data = example

Example : PDU Session Authentication Result

The following constructed example shows the final result from the network.

[NAS] DL 5GSM: PDU session authentication result
        Protocol discriminator = 0x2e (5GS Session Management)
        PDU session identity = 1
        Procedure transaction identity = 51
        Message type = 0xc7 (PDU session authentication result)
        EAP message:
          Code = 3 (Success)
          Identifier = 1
          Length = example