N) DL Info Transport USIM: Check AUTN, USIM: Generate RES* Return RES* K to ME Compute K AUSF UL Info Tansport Slice Select GPSI - AM Data SM Data UE CNTX in UL NAS Xport NAS: Authentication Responses (RES*) Subscriber UE Cntx Event UE Authn Data Mgmt Notify UE Authentication Compute HRES* Verify HRES* == HXRES* Authentication Request (SUCI, VPLMN ID) Authentication Response (SUPI, R, AUTN, HXRES*) Derive K AMF' Authentication Confirm (SUPI) Provide KAMF' SUPI to AMF SIDF: Subscription Identifier De-concealing Funtion SEAF: SEcurity Anchor Funtion Figure 11.5 - UE registration - part 2: authentication 5G SA network design fundamentals The gNB then sends an initial UE message to the selected AMF (AMF selection is explained in detail in the 3GPP specification 23.501 section 6.3.5). This message carries the Registration Request message that was sent to the AMF from the UE via the gNB. This message also contains the RAN UE NGAP ID and the RRC establishment cause. The AMF sends the UE authentication request to the AUSF to receive the authentication vectors and algorithm information. The AUSF sends an Authentication Request to the UDM to get the vectors for authentication. The UDM generates authentication vectors and sends them to the AUSF (SUPI, R, AUTN, Kausf, and XRES*). 10. The AUSF sends the master key to the AMF, which is used by the AMF to derive the other security-related keys (r, auth, and xhres*). The SUPI is also returned to the AMF. 11. The AMF sends a downlink NAS Transport Message to the gNB carrying the NAS authentication request. 12. The NAS message is transported to the UE by the gNB. The UE checks the AUTN and generates the RES* and Kausf. 13. The Uplink Information message is sent to the gnB from the UE, which carries the RES* computed by the UE. 14. The AMF computes the HRES* and compares HRES* with HXRES*. The Uplink NAS transport message carries the RES* to the AMF. 15. The AMF sends an authentication request to the AUSF and sends the RES* that was received from the UE. The AUSF compares RES* with