## 3 Overview of 3 GPP AKMA
### AKMA Architecture and Operation  
#### 3.1.1 AKMA Architecture  
As shown in Figure 2, the AKMA architecture, defined in 3 GPP TS 33.535 [4], is composed of the two new network functions, i.e., AAnF and Application Function (AF), and 3 GPP 5G standard ones, including Authentication Server Function (AUSF), Network Exposure Function (NEF), Unified Data Management (UDM), and so on. To enable the UE to send its AKMA Key Identifier (A-KID) to the AF and protect the path between these twoentities, the AKMA architecture specifies the Ua* protocol and recommends using TLS as a major candidate. Specifically, since it is required that the Ua* be secured with AKMA credentials, TLS options based on pre-shared secret keys are considered.  
**AKMA Anchor Function (AAnF):** he AAnF plays a central role in the 5G AKMA framework by managing key generation, storage, and distribution essential for securing communications between the involved UE and AF. In more detail, counting on this anchor function, the AF, which is a 5G cApp itself or runs on behalf of its affiliated 5G cAPP(s), can perform secure mutual authentication, key exchange, and data transmission with its UEs. In order to achieve such a core role, the AAnF manages the UE's AKMA contexts, including the Subscription Permanent Identifier (SUPI), Generic Public Subscription Identifier (GPSI), A-KID, and AKMA anchor key (\(K_{AKMA}\)), which are forwarded by the AUSF after the 5G primary authentication. More importantly, on receiving an application session establishment request, it applies the UE's SUPI and \(K_{AKMA}\) to derive the application-specific key (\(K_{AF}\)), which is then distributed to the AF. It also coordinates with the AUSF, NEF, and UDM to accomplish secure communication and key management.  
**Application Function (AF):** The AF requests the application-specific key (\(K_{AF}\)), which is then utilized by the Ua* protocol to secure message exchange with the UE. Accordingly, it interacts with AAnF for the application-specific keys that are utilized for authentication of every application session and encryption, presuming that AF has already undergone authentication and network authorization. Meanwhile, security keys are obtained by external applications through the NEF.  
**Network Exposure Function (NEF):** The NEF is a gateway for external AFs to access AKMA services securely. It enables and authorizes external AFs to request the application-specific keys from the AAnF. The NEF forwards the request to the appropriate AAnF and ensures that the communication between external AFs and the AAnF is secure and authenticated.  
**Authentication Server Function (AUSF):** The AUSF is pivotal for running the 5G primary authentication and generating key material for the AKMA process. During the 5G primary authentication, the AUSF interacts with the UDM to retrieve necessary authentication vectors and determines whether the AKMA Anchor Key \(K_{AKMA}\) needs to be generated. Once the primary authentication is successful, it then derives the \(K_{AKMA}\) and A-KID from the master session key \(K_{AUSF}\) and securely transmits these to the AAnF.  
**Unified Data Management (UDM):** The UDM stores and manages subscriber data, including AKMA subscription information and Routing Indicator (RID). It supports the primary authentication process by providing the AUSF with necessary authentication vectors and indicating whether the AKMA Anchor Key \(K_{AKMA}\) needs to be generated. Addition  
Figure 2: AKMA architecture in reference point representation for (**a**) internal AFs of HPLMN and (**b**) external AFs.  
ally, the UDM handles key management tasks such as triggering primary authentication for key refreshes and providing identifiers like SUPI and GPSI to the AUSF and AAnF.