This clause describes the format of the UE identification needed to access the 3GPP EPC from both 3GPP and non-3GPP accesses. The NAI is generated respectively by the S-GW at the S5/S8 reference point and by the UE for the S2a, S2b and S2c reference points. The NAI shall be generated as follows:

• based on the IMSI when the UE is performing a non-emergency Attach;
• based on the IMEI when the UE is performing an emergency attach and IMSI is not available (see clause 19.3.6); or
• based on the IMSI or the IMEI (depending on the interface and information element) when the UE is performing an emergency attach and IMSI is available in the UE, as follows:
  • a UE that has an IMSI shall construct an Emergency NAI based on IMSI (see clause 4.6.1 of TS 23.402 and clause 19.3.9 of this specification);
  • if the IMSI is not authenticated by the network, the network requests the IMEI from the UE and the network shall then construct a NAI based on the IMEI for identifying the user in the EPC (see TS 29.273).

For further information on the use of the parameters see the clauses below and TS 33.402 and TS 29.273.

The Root NAI shall take the form of an NAI, and shall have the form username@realm as specified in Section 2.1 of RFC 4282. When the username part is the IMSI, the realm part of Root NAI shall be built according to the following steps:

1. Convert the leading digits of the IMSI, i.e. MNC and MCC, into a domain name, as described in clause 19.2.
2. Prefix domain name with the label of "nai".

The resulting realm part of the Root NAI will be in the form: When including the IMSI, the Root NAI is prepended with a specific leading digit when used for EAP authentication (see TS 29.273) in order to differentiate between EAP authentication method. The leading digit is:

• "0" when used in EAP-AKA, as specified in RFC 4187
• "6" when used in EAP-AKA', as specified in RFC 5448.

The resulting Root NAI will be in the form: For example, if the IMSI is 234150999999999 (MCC = 234, MNC = 15), the Root NAI takes the form 0234150999999999@­nai.­epc.­mnc015.­mcc234.­3gppnetwork.­org for EAP AKA authentication and the Root NAI takes the form 6234150999999999@­nai.­epc.­mnc015.­mcc234.3gppnetwork.org for EAP AKA' authentication. The NAI sent in the Mobile Node Identifier field in PMIPv6 shall not include the digit prepended in front of the IMSI based username that is described above.

The Decorated NAI shall take the form of a NAI and shall have the form 'homerealm!username@otherrealm' or 'Visitedrealm!homerealm!username@otherrealm' as specified in Section 2.7 of RFC 4282. The realm part of Decorated NAI consists of 'otherrealm', see the RFC 4282. 'Homerealm' is the realm as specified in clause 19.2, using the HPLMN ID ('homeMCC' + 'homeMNC)'. 'Visitedrealm' is the realm built using the VPLMN ID ('VisitedMCC' + 'VisitedMNC)', 'Otherrealm' is:

• the realm built using the PLMN ID (visitedMCC + visited MNC) if the service provider selected as a result of the service provider selection (see TS 24.302) has a PLMN ID; or
• a domain name of a service provider if the selected service provider does not have a PLMN ID (TS 24.302).

When the username part of Decorated NAI includes the IMSI and the service provider has a PLMN ID, the Decorated NAI shall be built following the same steps as specified for Root NAI in clause 19.3.2. The result will be a decorated NAI of the form:

• nai.epc.mnc<homeMNC>.mcc<homeMCC>.3gppnetwork.org !0<IMSI>@nai.epc.mnc<visitedMNC>.mcc<visitedMCC>.3gppnetwork.org for EAP AKA authentication.
  or
• nai.epc.mnc<homeMNC>.mcc<homeMCC>.3gppnetwork.org !6<IMSI>@nai.epc.mnc<visitedMNC>.mcc<visitedMCC>.3gppnetwork.org for EAP AKA' authentication.

For example, if the service provider has a PLMN ID and the IMSI is 234150999999999 (MCC = 234, MNC = 15) and the PLMN ID of the Selected PLMN is MCC = 610, MNC = 71, then the Decorated NAI takes the form either as:

• nai.epc.mnc015.­mcc234.­3gppnetwork.­org!­0234150999999999@nai.­epc.­mnc071.­mcc610.­3gppnetwork.­org for EAP AKA authentication

• nai.­epc.­mnc015.­mcc234.­3gppnetwork.­org!­6234150999999999@­nai.­epc.­mnc071.­mcc610.­3gppnetwork.­org for EAP AKA' authentication.

For example, if the domain name of a service provider is 'realm.org' and IMSI-based permanent username is used, then the Decorated NAI takes the form either as: If the UE has selected a WLAN that directly interworks with a service provider in the Equivalent Visited Service Providers (EVSP) list provided by the RPLMN, see clause 4.8.2b of TS 23.402, then the decorated NAI is constructed to include the realm of this service provider and the realm of RPLMN. If the domain name of a service provider is 'realm.org' and IMSI-based permanent username is used, then the Decorated NAI with double decoration takes the form either as: When the username part of Decorated NAI includes a Fast Re-authentication NAI, the Decorated NAI shall be built following the same steps as specified for the Fast Re-authentication NAI in clause 19.3.4. When the username part of Decorated NAI includes a Pseudonym, the Decorated NAI shall be built following the same steps as specified for the Pseudonym identity in clause 19.3.5.

The Fast Re-authentication NAI shall take the form of a NAI as specified in Section 2.1 of RFC 4282. If the 3GPP AAA server does not return a complete NAI, the Fast Re-authentication NAI shall consist of the username part of the fast re-authentication identity as returned from the 3GPP AAA server and the same realm as used in the permanent user identity. If the 3GPP AAA server returns a complete NAI as the re-authentication identity, then this NAI shall be used. The username part of the fast re-authentication identity shall be decorated as described in clause 19.3.3 if the Selected PLMN is different from the HPLMN. For EAP-AKA authentication, the username portion of the fast re-authentication identity shall be prepended with the single digit "4" as specified in Section 4.1.1.7 of RFC 4187. For EAP AKA', see RFC 5448, the Fast Re-authentication NAI shall comply with RFC 4187 except that the username part of the NAI shall be prepended with single digit "8".

The pseudonym shall take the form of an NAI, as specified in Section 2.1 of RFC 4282. The pseudonym shall be generated as specified in clause 6.4.1 of TS 33.234. This part of the pseudonym shall follow the UTF-8 transformation format specified in RFC 2279 except for the following reserved hexadecimal octet value: When the pseudonym username is coded with FF, this reserved value is used to indicate the special case when no valid temporary identity exists in the UE (see TS 24.234 for more information). The network shall not allocate a temporary identity with the whole username coded with the reserved hexadecimal value FF. The username portion of the pseudonym identity shall be prepended with the single digit "2" as specified in Section 4.1.1.7 of RFC 4187 for EAP-AKA. For EAP AKA', see RFC 5448, the pseudonym NAI shall comply with RFC 4187 except that the username part of the NAI shall be prepended with single digit "7".

This clause describes the format of the UE identification needed to access the 3GPP EPC from both 3GPP and non-3GPP accesses, when UE is performing an emergency attach and IMSI is not available or not authenticated (see clause 19.3.1). For more information, see clauses 4.6.1 and 5.2 of TS 23.402. The Emergency NAI for Limited Service State shall take the form of an NAI, and shall have the form username@realm as specified in Section 2.1 of RFC 4282. The exact format shall be: or For example, if the IMEI is 219551288888888, the Emergency NAI for Limited Service State then takes the form of imei219551288888888@­sos.­invalid. For example, if the MAC address is 44-45-53-54-00-AB, the Emergency NAI for Limited Service State then takes the form of mac4445535400AB@­sos.­invalid, where the MAC address is represented in hexadecimal format without separators.

The Alternative NAI shall take the form of a NAI, i.e. 'any_username@REALM' as specified of RFC 4282. The Alternative NAI shall not be routable from any AAA server. The Alternative NAI shall contain a username part which is not derived from the IMSI. The username part shall not be a null string. The REALM part of the NAI shall be "unreachable.­3gppnetwork.­org". The result shall be an NAI in the form of:

The keyname NAI shall take the form of an NAI, and shall have the form username@realm as specified in Section 2.1 of RFC 4282. The username part is the EMSK name as defined in RFC 6696. For ERP exchange with an ER server located in the 3GPP AAA Server, the realm part of the keyname NAI shall be the realm part of the Root NAI of the UE as described in clause 19.3.2, i.e. the realm part of the keyName-NAI will be in the form: For ERP exchange with an ER server located in the TWAP or in the 3GPP AAA Proxy, the realm part of the keyname NAI shall be the realm discovered by the UE in the non-3GPP access network (received at the lower layer or through an ERP exchange as described in RFC 6696).

This clause describes the format of the UE identification needed to access the 3GPP EPC from non-3GPP accesses, when UE is performing an emergency attach and IMSI is available. For more information, see clause 4.4.1 of TS 24.302. The IMSI-based Emergency NAI shall take the form of an NAI and shall be encoded as the Root NAI as specified in clause 19.3.2, but with the realm name prepended by the "sos" label. The resulting realm part of the IMSI-based Emergency NAI will be in the form: The resulting IMSI-based Emergency NAI will be in the form: For example, if the IMSI is 234150999999999 (MCC = 234, MNC = 15), the IMSI-based Emergency NAI takes the form 0234150999999999@­sos.­nai.­epc.­mnc015.­mcc234.­3gppnetwork.­org for EAP AKA authentication and it takes the form 6234150999999999@­sos.­nai.­epc.­mnc015.­mcc234.­3gppnetwork.­org for EAP AKA' authentication.

This clause describes the format of the indication needed to convey High Priority Access configuration information to the network. When the UE is configured to use AC11 - 15 in selected PLMN, as defined in TS 24.301, and the UE is configured, as specified in TS 24.368, to apply NAI decoration for MPS, the username part of the NAI shall be appended with #hpa. This is needed to convey high priority access configuration information to the network when connected via non-3GPP access. For example, if the username part is 6234150999999999 and the realm part is @nai.epc.mnc015.mcc234.3gppnetwork.org, if the UE is configured for Access Control Class 14, the NAI takes the form: