5G NAS - Service-level Authentication Complete

Message Fact Sheet

Protocol	nas	Network	5g
Spec	3GPP TS 24.501	Spec Section	8.3.18
Direction	UE to SMF via AMF	Message Type	5GSM service-level authentication

Full message name	5G NAS - Service-level Authentication Complete
Protocol	NAS
Technology	5G
Direction	UE to SMF via AMF
Interface	N1
Signaling bearer / channel	NAS signaling / Usually carried inside UL NAS Transport on the access side
Typical trigger	The UE received a Service-level Authentication Command and is now returning the service-level AA payload or response.
Main purpose	Confirms acceptance of the service-level authentication command and transports the UE's service-level AA payload back to the SMF.
Main specification	3GPP TS 24.501, 8.3.18
Release added	Release 17
Procedures where used	Service-level authentication and authorization procedure, DN-driven service authorization, Enterprise or application-specific service onboarding
Related timers	T3594

What is Service-level Authentication Complete in simple terms?

Service-level Authentication Complete is the 5GSM message the UE sends in response to Service-level Authentication Command and uses to return the service-level AA payload or response.

Confirms acceptance of the service-level authentication command and transports the UE's service-level AA payload back to the SMF.

Why this message matters

Service-level Authentication Complete is the UE's reply to the service-level authentication command, and it carries the service response back to the network.

Where this message appears in the call flow

Service-level authentication and authorization procedure

Call flow position: UE response step that answers the service-level authentication command.

Typical state: The UE has already received the command and is returning the service-level AA payload or response.

Preconditions:

The SMF sent Service-level Authentication Command.
The UE has processed the service-level AA container or received service-level AA data from upper layers.

Next likely message: The SMF processes the response and may continue with service-level AA handling or a final session outcome

5G PDU Session Establishment

Call flow position: May appear in the service-authenticated establishment branch before the final accept or reject result is delivered.

Typical state: The UE is still in the middle of completing the service-level auth exchange.

Preconditions:

A PDU session establishment request is active.
The service-level authentication branch has been selected.

Next likely message: PDU Session Establishment Accept or PDU Session Establishment Reject with service-level response context

Call flow position

Previous message(s): Service-level Authentication Command, UL NAS Transport, UE processed service-level AA container

Next message(s): Service-level AA result handling, PDU Session Establishment Accept, PDU Session Modification Command, PDU Session Release Command

Message direction and transport

Sender and receiver: UE to SMF via AMF

Interface: N1

Domain: Core-side service-level authentication completion with access-side NAS delivery dependency

Signaling bearer: NAS signaling

Logical channel: Usually carried inside UL NAS Transport on the access side

Transport / encapsulation: 5GSM NAS message transported end-to-end from the UE to the SMF through AMF mediation

Security context: Normally delivered while NAS security is already active, so engineers usually expect protected uplink NAS handling.

ASN.1 Message Syntax for 5G NAS - Service-level Authentication Complete

This message is not typically analyzed as ASN.1 on the wire. It is usually read as a NAS or protocol field structure instead.

This is a 5GSM NAS message defined by structured information elements in 3GPP TS 24.501 rather than ASN.1 syntax.

5G NAS - Service-level Authentication Complete - Example Dump

Service-level Authentication Complete
  Extended Protocol Discriminator: 5G Session Management
  PDU Session ID: 10
  PTI: 8
  Message Type: Service-level Authentication Complete
  Service-level AA container:
    Service-level device ID: device-001
    Service-level-AA payload type: response
    Service-level-AA payload: [opaque payload]

How to read this dump

Start with PDU Session ID so you know which session the UE is responding for.
Check PTI to correlate the completion with the correct service-level transaction.
The Service-level AA container is the important part of the message because it carries the response back to the SMF.
A response payload may be opaque at the 5GSM layer and should be interpreted by the upper-layer service logic.

Important Information Elements

IE	Required	Description
`PDU Session ID`	Yes	Identifies the PDU session associated with the service-level exchange.
`PTI`	Yes	Correlates the completion with the service-level authentication transaction.
`Service-level AA container`	Yes	Carries the service-level-AA payload from the UE or the upper layer back to the SMF.

Detailed field explanation

`PDU Session ID`

Identifies the PDU session associated with the service-level exchange.

Presence: Required

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

`PTI`

Correlates the completion with the service-level authentication transaction.

Presence: Required

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

`Service-level AA container`

Carries the service-level-AA payload from the UE or the upper layer back to the SMF.

Presence: Required

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

What to check in logs and traces

Confirm the completion follows a visible Service-level Authentication Command.
Verify `PDU Session ID` and `PTI` first so the completion matches the correct transaction.
Inspect the `Service-level AA container` and confirm the payload type and payload match the expected service response.
Check that the SMF stops `T3594` when the completion arrives.
Correlate the completion with the service backend or upper-layer service logs.
If the response is missing, verify UL NAS Transport and UE upper-layer handling.

Common Issues and Troubleshooting

The UE never sends the complete message.

Likely cause: The UE may not have received the command, may not have been able to process the payload, or upper-layer service logic may be blocked.

What to inspect: Check the command, UE state, UL NAS transport, and upper-layer service logs.

Next step: Trace the service-level AA payload from the UE input back to the SMF.

The network keeps waiting after the UE responds.

Likely cause: The completion may not have been correlated with the correct PTI, or `T3594` handling may be incorrect.

What to inspect: Check PTI correlation, timer handling, and SMF logs.

Next step: Validate that the SMF received and processed the same transaction the UE responded to.

The service still fails even though the completion was sent.

Likely cause: The payload may be correct at NAS level but rejected by the DN or upper-layer service application.

What to inspect: Check the service-level device ID, payload type, and service backend logs.

Next step: Correlate NAS with the service platform before treating it as a NAS failure.

FAQ

What does Service-level Authentication Complete do?

It confirms the UE accepted the service-level authentication command and returns the service-level AA payload or response.

Who sends Service-level Authentication Complete?

The UE sends it to the SMF via the AMF.

When is Service-level Authentication Complete sent?

It is sent after the UE receives and processes Service-level Authentication Command.

What are the important IEs in Service-level Authentication Complete?

Start with PDU Session ID and PTI, then inspect the Service-level AA container.

What happens after Service-level Authentication Complete?

The SMF stops T3594 and continues with service-level AA handling or the final session outcome.

Is this the same as PDU Session Authentication Complete?

No. It belongs to the later service-level authentication and authorization procedure.

Is ASN.1 used for Service-level Authentication Complete?

No. It is a 5GSM NAS message defined by structured information elements in 3GPP TS 24.501.

Can the Service-level AA container carry a response?

Yes. The container can carry the service-level-AA payload or response back to the SMF.

Related message pages

Related Procedures

Related Tools

Use This Reference in Practice

Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.