## 4 Secure 5G Network Architecture for Mutual Authentication
The SMF checks with the local policy, whether the UE's request is legitimate. 12. If the UE request is justified, the SMF starts secondary authentication with DN-AAA. 13. The SMF delivers the EAP Request to the UE. The UE sends an EAP Response in response to this and transmits a message, including a network access identifier (NAI). 14. The SMF, having received the EAP Response from the UE, delivers the EAP Response message to the SAF existing in the neighbor node. 15. The SAF forwards the EAP Response message received from the SMF to the ADMF associated with it. 16. The ADMF checks the SUPI information of the NAI and the UE and the PDU Session Establishment Request message in the EAP Response received from the SMF. When a request for a service for which the user is authorized is confirmed, ADMF sends an EAP Response Verification message to the SMF. 17. The ADMF transmits the information on the UE for which authentication is requested to the DN-AAA server. 18. If ADMF confirms the suitability of authentication, SAF and UE exchange the EAP message. 19. If the EAP message is exchanged successfully, the SAF informs the SMF that the authentication was successful by sending an EAP Success message. 20. The SMF terminates the authentication procedure by storing the authentication details of the UE and the ID of the data network. 21. SMF delivers Nsmf PDU Session Response message to AMF. 22. The AMF informs the UE that the secondary authentication was successful by sending a PDU Session Establishment Response message. After that, the UE may access a data network and receive the service. The following describes the re-authentication procedure for secondary authentication described in Figure 3.  
1. The re-authentication process assumes that at least one initial secondary authentication should be performed beforehand. For initial authentication, the UE sends an initial authentication request message to the AMF. 2. UE and AUSF perform primary authentication. This process corresponds to procedure 7 of the initial secondary authentication process. 3. UE, SAF, and ADMF perform secondary authentication. This process corresponds to procedure 9 22 of initial authentication. After secondary authentication is successfully performed, the UE uses the service of DN. The secondary authentication established at this time may expire due to UE movement, timeout, change of policy of DN-AAA, and session coordination. 4. At any time, the UE and the DN-AAA server may request re-authentication, respectively. 5. If the DN-AAA requests re-authentication, the DN-AAA sends a message to the UPF. This message is transmitted via the N4 interface to send a re-authentication message to the SMF. UPF forwards this message to the SMF. If the UE requests a re-authentication process, this procedure is omitted. 6. The SMF delivers an EAP Request/Identity message to the UE to perform re-authentication, and the UE delivers an EAP Response/Identity message in response. 7. SMF delivers the EAP Response/Identity message to the SAF. 8. SAF forwards the EAP Response/Identity message to the ADMF. Figure 3: The Re-authentication of proposed secondary authentication framework. The ADMF confirms the suitability of the re-authentication request for the UE from the message sent from the SAF. If conformance is verified, ADMF forwards the EAP Response Verification message to the SAF. * DMF transmits the information of the UE requested to be re-authenticated to the DN-AAA server. * If ADMF confirms the suitability of authentication, the EAP message is exchanged between SAF and UE. * The SAF informs the SMF whether the EAP succeeds or fails. * If EAP authentication fails, authentication failure information for the UE is passed to the ADMF and DN-AAA server via SAF. This process is skipped if EAP authentication succeeds. * SMF delivers Nsmf PDU Session Response message to AMF. * The AMF terminates the re-authentication process by sending a PDU Session Establishment Response message to the UE.