Registration & authentication

How a UE registers with the core and proves its identity over 5G-AKA, from SUCI de-concealment through NAS security setup.

Overview

Before a device can use the network it must register and be authenticated. In dflux TinyCore this is the 5GMM (5G Mobility Management) registration procedure carried over NAS, terminated by the AMF inside the DMF, with the authentication math run by the AUSF and UDM inside the DPF. The result is a mutually authenticated UE and an established NAS security context (integrity + ciphering) that protects every later message.

From SUCI to SUPI

A subscriber's permanent identity is its SUPI (an IMSI, e.g. imsi-001010000000001). To avoid sending the IMSI in the clear over the radio, the UE presents a SUCI — the SUPI concealed with the home network's public key. The de-concealment back to a SUPI is done by the SIDF (Subscription Identifier De-concealing Function) in the DPF.

dflux TinyCore's SIDF supports the standard SUCI protection schemes: the null scheme (the SUPI is carried unprotected, common in labs and test UEs), Profile A (X25519) and Profile B (secp256r1), both ECIES with AES-128-CTR and HMAC-SHA-256. If the UE registers without a usable identity, the AMF sends an Identity Request and the UE replies with its SUCI.

Where identities live

For the full picture of SUPI, SUCI and 5G-GUTI — and the credentials behind them — see Subscribers & identities.

5G-AKA and Milenage

Authentication uses 5G-AKA over the Milenage algorithm set. Each subscriber is provisioned with a 128-bit permanent key K and an operator key OPc (plus the AMF field and a sequence number SQN); the same secrets are held by the UE's SIM and by the UDM. From a random challenge RAND the UDM computes an authentication vector:

AUTN — the network authentication token (lets the UE verify it is talking to the real network and check the sequence number).
XRES* — the expected response the UE must reproduce.
KAUSF / KSEAF — anchor keys derived for the serving network.

The AMF sends RAND and AUTN to the UE in an Authentication Request. The UE checks AUTN, then runs Milenage with its own K/OPc and returns RES*. The AUSF confirms the response by deriving HRES* = SHA-256(RAND || RES*) and comparing it with the expected hash, then matching RES* against XRES* directly. A mismatch is an authentication failure; a match yields the anchor key the AMF uses next.

EAP-AKA'

5G-AKA is the default. Subscribers may instead be provisioned for EAP-AKA' (an EAP method also built on Milenage), used for non-3GPP / Wi-Fi-calling style access; the AUSF selects the method from the subscriber's provisioned authentication method.

NAS security setup

After a successful authentication, the AMF derives the NAS key hierarchy from KSEAF: KSEAF → KAMF → KnasInt (integrity) and KnasEnc (ciphering). It then runs the Security Mode Command / Complete exchange to activate the context and negotiate the algorithms. The default lab posture uses NIA2 for integrity and NEA0 (null) for ciphering. Once the context is active, every subsequent NAS message — including the Registration Accept that assigns the UE its 5G-GUTI — is integrity-protected (and ciphered when a non-null algorithm is selected).

Registration call flow

What comes next

A registered UE has mobility context but no data path yet. To carry user traffic it establishes a PDU session, which allocates an IP address and programs the user plane.