| Protocol | nas | Network | 5g |
|---|---|---|---|
| Spec | 3GPP TS 24.501 | Spec Section | 8.3.4 |
| Direction | SMF to UE via AMF | Message Type | 5GSM signaling |
| Full message name | 5G NAS - PDU Session Authentication Command |
|---|---|
| Protocol | NAS |
| Technology | 5G |
| Direction | SMF to UE via AMF |
| Interface | N1 |
| Signaling bearer / channel | NAS signaling / Usually carried inside DL NAS Transport on the access side |
| Typical trigger | The SMF needs to deliver an EAP-request from the data network or local authorization logic during PDU session authentication and authorization. |
| Main purpose | Starts the PDU EAP message reliable transport procedure and delivers the EAP challenge to the UE so upper-layer authentication can continue. |
| Main specification | 3GPP TS 24.501, 8.3.4 |
| Release added | Release 15 |
| Procedures where used | 5G PDU Session Establishment, 5G PDU Session Authentication Procedure, PDU EAP message reliable transport procedure |
| Related timers | T3590 |
PDU Session Authentication Command is the 5GSM message that carries an EAP request from the SMF to the UE when session-level authentication or authorization is required.
Starts the PDU EAP message reliable transport procedure and delivers the EAP challenge to the UE so upper-layer authentication can continue.
Call flow position: Network-issued challenge step that delivers the EAP-request to the UE.
Typical state: The UE is already in the session establishment or session authentication branch and is waiting for the next 5GSM payload.
Preconditions:
Next likely message: PDU Session Authentication Complete
Call flow position: Optional branch inside the main establishment flow before the accept or reject can be finalized.
Typical state: The UE has already requested a PDU session and the network is still deciding whether the session can be fully activated.
Preconditions:
Next likely message: PDU Session Authentication Complete
Previous message(s): PDU Session Establishment Request, DL NAS Transport
Next message(s): PDU Session Authentication Complete, PDU Session Authentication Result, PDU Session Establishment Accept, PDU Session Establishment Reject
Security context: Normally sent after registration and NAS security establishment, so the payload is usually integrity protected and often ciphered even though the EAP exchange itself is transparent to the 5GSM layer.
This message is not typically analyzed as ASN.1 on the wire. It is usually read as a NAS or protocol field structure instead.
This is a 5GSM NAS message defined by ordered information elements in 3GPP TS 24.501 rather than ASN.1 syntax.
PDU Session Authentication Command
Extended Protocol Discriminator: 5G Session Management
PDU Session ID: 10
PTI: No procedure transaction identity assigned
Message Type: PDU Session Authentication Command
EAP Message:
Code: Request
Identifier: 7
Type: EAP-AKA'
Data: [authentication challenge]
Extended Protocol Configuration Options:
DNS IPv4 address: 10.1.1.1
DNS IPv6 address: 2001:db8::53
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.