Skip to main content

OmniAUSF

OmniAUSF implements the Authentication Server Function (AUSF) of the 5G Core. It orchestrates primary authentication between the AMF (over the N12 interface) and the UDM (over the N13 interface), executing the 5G-AKA authentication method defined in TS 33.501. The AUSF requests an authentication vector from the UDM, returns the RAND/AUTN challenge (and a hash of the expected response) to the AMF, verifies the response the UE ultimately produces, derives the anchor key K_SEAF for the serving network, and records the authentication result back in the UDM.

Each authentication exchange is tracked by an in-memory UE authentication context, keyed by a generated authCtxId (UUID). The context holds the vector material (RAND, XRES*, HXRES*, K_AUSF, K_SEAF) for the lifetime of the exchange and is deleted on completion (success or failure), on explicit deregistration, or on process restart. In addition, a supervised context reaper periodically garbage-collects idle or abandoned contexts once they exceed a configurable TTL, so a context the AMF initiates but never confirms does not linger indefinitely. Outbound SBI calls to the UDM target a UDM discovered from the NRF (Nnrf_NFDiscovery), falling back to the static udm_uri only when discovery yields nothing; the AUSF also registers with the NRF and sends heartbeats. OmniAUSF serves the nausf-auth service (nausf-auth/v1) and consumes the UDM's nudm-ueau service (nudm-ueau/v1).

Documentation​

  • Operations - 3GPP references, interfaces and SBI endpoints, and the key authentication procedures with their sequence diagrams.
  • Configuration - full configuration reference with parameter tables, the Management/OAM API endpoints, and logging notes.
  • Metrics - Prometheus metrics exposed by the AUSF and example PromQL queries.
  • Troubleshooting - common failure symptoms with remedies.

Architecture Overview​

Features Overview​

  • 5G-AKA primary authentication (TS 33.501 6.1.3) end-to-end: vector retrieval, challenge relay, response verification, and result reporting.
  • K_SEAF derivation (TS 33.501 A.6) bound to the serving network name, returned to the AMF on successful authentication.
  • HXRES* computation (TS 33.501 A.5) returned to the AMF in the initiation response.
  • Authentication result reporting to the UDM (auth-events) for both success and failure.
  • SQN resynchronisation handling: resynchronizationInfo (RAND + AUTS) is detected, validated, and relayed to the UDM; malformed resync input is dropped.
  • UE security context removal - deregister and per-context delete endpoints.
  • Defensive vector/response decoding - malformed UDM vectors and malformed resStar are handled as clean errors, never crashes.
  • NRF registration and heartbeat.
  • Runtime OAM - inspect sessions/statistics, adjust config and log level, and force NRF re-registration over the HTTPS management API.
  • Prometheus metrics for authentication outcomes (including SQN resync), NRF status, and BEAM VM health. The live in-flight context count is available via the OAM API.

Quick Start​

Configuration is read from the application environment key :omniausf, populated from config/runtime.exs. Every runtime key is backed by an OS environment variable read at startup.

config :omniausf,
  udm_uri:                 "http://127.0.0.12:7777",
  sbi_scheme:              "http",
  sbi_addr:                "127.0.0.19",
  sbi_port:                7777,
  nrf_uri:                 "http://127.0.0.1:7777",
  mcc:                     "999",
  mnc:                     "70",
  prometheus_metrics_port: 9568,
  heartbeat_interval:      10_000

config :logger, :default_formatter,
  format: {OmniLogger.JsonFormatter, :format},
  metadata: :all

Full parameter documentation, including types, defaults, and environment variables, lives in configuration.md.

Last updated on