Concealed Identifier (SUCI)). It provides access authentication based on the user subscription - for example, for roaming users, it verifies whether the subscriber has roaming privileges in the requested network. It manages the users serving NF registration by storing and retrieving the AMF for the UE and storing SMFs for UE PDU sessions. It maintains the SMF/Data Network Name (DNN) assignment for the UE and thereby helps maintain the session continuity in the case of handovers and SO on. It also supports lawful interception. The UDM may use subscriber information stored in the UDR - in which case, the UDM only implements the application logic and does not need to store data. The AUSF The AUSF supports authentication for 3GPP access and non-3GPP access; it is responsible for storing keys and implementing an EAP authentication server. The N3IWF The N3 Interworking Function (N3IWF) enables the 5GS system to work with untrusted non-3GPP access networks. It supports the establishment of IPsec tunnels connected to the UE. The N3IWF terminates the IKEv2/IPSec protocols with the UE over the NWu. The information needed to authenticate and authorize the UE within the 5GS is relayed over N2. It terminates the N2 and N3 interfaces of the 5G core network for the control plane and user plane. It relays UL/DL NAS signaling between the UE and the AMF. It handles N2 messages from the SMF, which are transparently carried by the AMF and related to the UE. It carries user traffic from non-3GPP access networks into the 5GS. It enforces the QoS relayed in the N2 message. It terminates the data path between N3 and the UPF. It also serves as the local mobility anchor within the untrusted 3GPP networks. A classic example of the use of the N3IWF is WLAN support in a 5GS, where the WAN (which is untrusted) is able to work with the 5GS. The AF The AF interacts with 3GPP packet core NFs to support application's influence on traffic routing. It has access to the NEF and interacts with the policy framework for policy control and IMS interacti