This clause describes the format of the parameters needed to access the 3GPP system supporting the WLAN interworking. For further information on the use of the parameters see TS 24.234. For more information on the ".3gppnetwork.org" domain name and its applicability, see Annex D of the present document.

The home network realm shall be in the form of an Internet domain name, e.g. operator.com, as specified in RFC 1035. When attempting to authenticate within WLAN access, the WLAN UE shall derive the home network domain name from the IMSI as described in the following steps:

1. take the first 5 or 6 digits, depending on whether a 2 or 3 digit MNC is used (see TS 31.102, TS 51.011) and separate them into MCC and MNC; if the MNC is 2 digits then a zero shall be added at the beginning;
2. use the MCC and MNC derived in step 1 to create the "mnc<MNC>.mcc<MCC>. 3gppnetwork.org" domain name;
3. add the label "wlan." to the beginning of the domain name.

An example of a WLAN NAI realm is: Which gives the home network domain name: wlan.­mnc015.­mcc234.­3gppnetwork.­org.

The Root NAI shall take the form of a NAI, and shall have the form username@realm as specified in Section 2.1 of RFC 4282. The username part format of the Root NAI shall comply with RFC 4187 when EAP AKA authentication is used and with RFC 4186, when EAP SIM authentication is used. When the username part includes the IMSI, the Root NAI shall be built according to the following steps:

1. Generate an identity conforming to NAI format from IMSI as defined in EAP SIM [51] and EAP AKA [50] as appropriate;
2. Convert the leading digits of the IMSI, i.e. MNC and MCC, into a domain name, as described in clause 14.2.

The result will be a root NAI of the form: For example, for EAP AKA authentication: If the IMSI is 234150999999999 (MCC = 234, MNC = 15), the root NAI then takes the form 0234150999999999@­wlan.­mnc015.­mcc234.­3gppnetwork.­org.

The Decorated NAI shall take the form of a NAI and shall have the form 'homerealm!username@otherrealm' as specified in Section 2.7 of the RFC 4282. The realm part of Decorated NAI consists of 'otherrealm', see the RFC 4282. 'Homerealm' is the realm as specified in clause 14.2, using the HPLMN ID ('homeMCC' + 'homeMNC)'. 'Otherrealm' is the realm built using the PLMN ID (visitedMCC + visited MNC) of the PLMN selected as a result of WLAN PLMN selection (see TS 24.234). The username part format of the Root NAI shall comply with RFC 4187 when EAP AKA authentication is used and with RFC 4186, when EAP SIM authentication is used. When the username part of Decorated NAI includes the IMSI, it shall be built following the same steps specified for Root NAI in clause 14.3. The result will be a decorated NAI of the form: "wlan.­mnc<homeMNC>.­mcc<homeMCC>.­3gppnetwork.­org!0<IMSI>­@wlan.­mnc<visitedMNC>.­mcc<visitedMCC>.­3gppnetwork.org", for EAP AKA authentication and "wlan.mnc<homeMNC>.mcc<homeMCC>.3gppnetwork.org !1<IMSI>@wlan.mnc<visitedMNC>.mcc<visitedMCC>.3gppnetwork.org", for EAP SIM authentication

The Fast Re-authentication NAI in both EAP-SIM and EAP-AKA shall take the form of a NAI as specified in Section 2.1 of RFC 4282. If the 3GPP AAA server does not return a complete NAI, the Fast Re-authentication NAI shall consist of the username part of the fast re-authentication identity as returned from the 3GPP AAA server and the same realm as used in the permanent user identity. If the 3GPP AAA server returns a complete NAI as the re-authentication identity, then this NAI shall be used. The username part of the fast re-authentication identity shall be decorated as described in 14.4 if the Selected PLMN is different from the HPLMN. EXAMPLE 1: If the fast re-authentication identity returned by the 3GPP AAA Server is 458405627015 and the IMSI is 234150999999999 (MCC = 234, MNC = 15), the Fast Re-authentication NAI for the case when NAI decoration is not used takes the form: 458405627015@­wlan.­mnc015.­mcc234.­3gppnetwork.­org EXAMPLE 2: If the fast re-authentication identity returned by the 3GPP AAA Server is "458405627015@aaa1.­wlan.­mnc015.­mcc234.­3gppnetwork.­org" and the IMSI is 234150999999999 (MCC = 234, MNC = 15), the Fast Re-authentication NAI for the case when NAI decoration is not used takes the form: 458405627015@­aaa1.­wlan.­mnc015.­mcc234.­3gppnetwork.­org EXAMPLE 3: If the fast re-authentication identity returned by the 3GPP AAA Server is 458405627015 and the IMSI is 234150999999999 (MCC = 234, MNC = 15), and the PLMN ID of the Selected PLMN is MCC = 610, MNC = 71, the Fast Re-authentication NAI takes the form: wlan.mnc015.mcc234.3gppnetwork.org !458405627015@­wlan.­mnc071.­mcc610.­3gppnetwork.­org

The Temporary identities (Pseudonyms and re-authentication identities) shall take the form of a NAI username as specified in Section 2.1 of RFC 4282. Temporary identity shall be generated as specified in clause 6.4.1 of TS 33.234. This part of the temporary identity shall follow the UTF-8 transformation format specified in RFC 2279 except for the following reserved hexadecimal octet value: When the temporary identity username is coded with FF, this reserved value is used to indicate the special case when no valid temporary identity exists in the WLAN UE (see TS 24.234). The network shall not allocate a temporary identity with the whole username coded with the reserved hexadecimal value FF. For EAP-AKA authentication, the username portion of the pseudonym identity shall be prepended with the single digit "2" and the username portion of the fast re-authentication identity shall be prepended with the single digit "4" as specified in Section 4.1.1.7 of RFC 4187. For EAP-SIM authentication, the username portion of the pseudonym identity shall be prepended with the single digit "3" and the username portion of the fast re-authentication identity shall be prepended with the single digit "5" as specified in Section 4.2.1.7 of RFC 4186.

The Alternative NAI shall take the form of a NAI, i.e. 'any_username@REALM' as specified of RFC 4282. The Alternative NAI shall not be routable from any AAA server. The Alternative NAI shall contain a username part which is not derived from the IMSI. The username part shall not be a null string. The REALM part of the NAI shall be "unreachable.­3gppnetwork.­org". The result shall be an NAI in the form of: "<any_non_null_string>@unreachable.­3gppnetwork.­org"

The W-APN is composed of two parts as follows:

• The W-APN Network Identifier; this defines to which external network the PDG is connected.
• The W-APN Operator Identifier; this defines in which PLMN the PDG serving the W-APN is located.

The W-APN Operator Identifier is placed after the W-APN Network Identifier. The W-APN consisting of both the Network Identifier and Operator Identifier corresponds to a FQDN of a PDG; the W-APN has, after encoding as defined in the paragraph below, a maximum length of 100 octets. The structure of the W-APN shall follow the Name Syntax defined in RFC 2181, RFC 1035 and RFC 1123. The W-APN consists of one or more labels. When encoded as a sequence of octets, each label is coded as a one octet length field followed by that number of octets coded as 8 bit ASCII characters. When encoded as text string and for the purpose of presentation, a W-APN is usually displayed as a string in which the labels are separated by dots (e.g. "Label1.Label2.Label3") Following RFC 1035 the labels shall consist only of the alphabetic characters (A-Z and a-z), digits (0-9) and the hyphen (-). Following RFC 1123, the label shall begin and end with either an alphabetic character or a digit. The case of alphabetic characters is not significant. The W-APN is not terminated by a length byte of zero. The W-APN for the support of IMS Emergency calls shall take the form of a common, reserved Network Identifier described in clause 14.7.1 together with the usual W-APN Operator Identifier as described in clause 14.7.2. Different stage 3 protocol specifications may specify different ways of W-APN encoding taking precedence over definitions from this clause.

The emergency realm shall be of the form of a home network realm as described in clause 14.2 prefixed with the label "sos." at the beginning of the domain name. An example of a WLAN emergency NAI realm is: Where: Which gives the home network domain name: sos.­wlan.­mnc015.­mcc234.­3gppnetwork.­org. The NAI for emergency cases shall be of the form as specified in clauses 14.3 and 14.4, with the addition of the emergency realm as described above for PLMNs where the emergency realm is supported. When UE is using I-WLAN as the access network for IMS emergency calls and IMSI is not available, the Emergency NAI shall be an NAI compliant with RFC 4282 consisting of username and realm, either constructed with IMEI or MAC address, as specified in TS 33.234. The exact format shall be: or if IMEI is not available, The realm part of the above NAI consists of the realm built using the PLMN ID (visitedMCC + visitedMNC) of the PLMN selected as a result of the network selection procedure, as specified in clause 5.2.5.4 of TS 24.234. The MNC and MCC shall be with 3 digits coded. If there are only 2 significant digits in the MNC, one "0" digit shall be inserted at the left side to fill the 3 digits coding of MNC in the realm of the NAI. For example, if the IMEI is 219551288888888, and the selected PLMN is with MCC 345 and MNC 12, the Emergency NAI then takes the form of imei219551288888888@sos.wlan.mnc012.mcc345.3gppnetwork.org. For example, if the MAC address is 44-45-53-54-00-AB, and the selected PLMN is with MCC 345 and MNC 12, the Emergency NAI then takes the form of mac4445535400AB@­sos.­wlan.­mnc012.­mcc345.­3gppnetwork.­org, where the MAC address is represented in hexadecimal format without separators.