OmniUDM Operations

1. Component Overview

OmniUDM is the Unified Data Management (UDM) function for the Omnitouch 5G core. It provides subscriber data management, UE authentication data generation (Nudm_UEAU), UE context management (Nudm_UECM), and subscriber data management (Nudm_SDM).

Architecture note: AUSF and UDR are now separate standalone NFs (OmniAUSF and OmniUDR respectively). OmniUDM no longer co-locates AUSF or UDR. UDM calls UDR via SBI for all subscriber data retrieval (authentication subscriptions, AM data, SM data). Per-UE runtime state (registration contexts, SDM subscriptions) is held in in-memory Agent processes.

2. 3GPP Role and Spec References

Aspect	Reference
UDM functional definition	TS 23.501 Section 6.2.7
Nudm_UEAU service	TS 29.503 Section 5.2.2
Nudm_UECM service	TS 29.503 Section 5.3
Nudm_SDM service	TS 29.503 Section 5.2.3
Nudr_DataRepository service	TS 29.504
5G-AKA authentication	TS 33.501 Section 6.1.3
Milenage algorithm	TS 35.206
SUCI concealment / de-concealment	TS 23.003 Section 2.2B, TS 33.501 Section 6.12
SQN resynchronisation	TS 33.102 Section 6.3.5, TS 33.501 Section 6.1.3.4
Key derivation (Kausf, Kseaf, HXRES*)	TS 33.501 Annex A

3. SBI Endpoints

All endpoints are HTTP/1.1 with Content-Type: application/json.

Nudm_UEAU (TS 29.503 Section 5.2.2)

Method	Path	Description	Success
POST	/nudm-ueau/v1/{supiOrSuci}/security-information/generate-auth-data	Generate 5G-AKA authentication vector	200 OK
POST	/nudm-ueau/v1/{supi}/auth-events	Store authentication result event	201 Created
DELETE	/nudm-ueau/v1/{supi}/auth-events/{authEventId}	Delete authentication event	204 No Content

Nudm_UECM (TS 29.503 Section 5.3)

Method	Path	Description	Success
PUT	/nudm-uecm/v1/{supi}/registrations/amf-3gpp-access	AMF registers 3GPP access for a UE	200 OK
GET	/nudm-uecm/v1/{supi}/registrations/amf-3gpp-access	Retrieve AMF 3GPP access registration	200 OK
PUT	/nudm-uecm/v1/{supi}/registrations/smf-registrations/{pduSessionId}	SMF registers PDU session context	200 OK
DELETE	/nudm-uecm/v1/{supi}/registrations/smf-registrations/{pduSessionId}	SMF deregisters PDU session context	204 No Content

Nudm_SDM (TS 29.503 Section 5.2.3)

Method	Path	Description	Success
GET	/nudm-sdm/v2/{supi}/nssai	Network slice subscription data	200 OK
GET	/nudm-sdm/v2/{supi}/am-data	Access and mobility subscription data	200 OK
GET	/nudm-sdm/v2/{supi}/smf-select-data	SMF selection subscription data	200 OK
GET	/nudm-sdm/v2/{supi}/sm-data	Session management subscription data	200 OK
POST	/nudm-sdm/v2/{supi}/sdm-subscriptions	Subscribe to subscriber data change notifications	201 Created
DELETE	/nudm-sdm/v2/{supi}/sdm-subscriptions/{subscriptionId}	Unsubscribe	204 No Content

4. Configuration Reference

OmniUDM is configured via Elixir application environment under the :omniudm key.

Example Configuration

config :omniudm,
  sbi_scheme: "http",
  sbi_addr: "127.0.0.12",
  sbi_port: 7777,
  nrf_uri: "http://127.0.0.10:7777",
  udr_uri: "http://127.0.0.22:7777",
  mcc: "999",
  mnc: "70",
  heartbeat_interval: 10_000,
  hnet_key_dir: "/etc/omniudm/hnet"

Parameter Table

Parameter	Type	Default	Description
sbi_scheme	string	"http"	URI scheme for the SBI HTTP server
sbi_addr	string	"127.0.0.12"	IP address the SBI HTTP server binds to
sbi_port	integer	7777	TCP port the SBI HTTP server listens on
nrf_uri	string	"http://127.0.0.10:7777"	Base URI of the NRF for NF registration and heartbeat
mcc	string	"999"	Mobile Country Code for the serving PLMN; used in serving network name construction for key derivation
mnc	string	"70"	Mobile Network Code for the serving PLMN
heartbeat_interval	integer (ms)	10000	Interval at which OmniUDM sends NRF heartbeat PATCH requests
udr_uri	string	"http://127.0.0.22:7777"	Base URI of the standalone UDR (OmniUDR). UDM calls UDR via SBI for authentication subscription data, AM data, SM data, and SQN updates. Previously, a co-located UDR proxy called OmniHSS directly; that functionality is now in OmniUDR
hnet_key_dir	string	"/etc/omniudm/hnet"	Directory containing home network private keys for ECIES SUCI de-concealment. Each key file is named <key_id>.<curve>.key where curve is x25519 (Profile A) or secp256r1 (Profile B). File contents are hex-encoded or raw binary private key material. Set via HNET_KEY_DIR environment variable

5. Key Procedures

5.1 Authentication Data Generation (Nudm_UEAU)

UDM generates authentication vectors on request from AUSF. AUSF is now a standalone NF (OmniAUSF) and calls UDM over SBI.

5.2 SQN Resynchronisation

When the UE detects an SQN mismatch it sends an Authentication Failure with AUTS. On the next authentication attempt the AMF includes resynchronizationInfo in the AuthenticationInfo body.

5.3 UE Context Registration (AMF → UDM)

After authentication succeeds and the Security Mode is complete, the AMF registers itself for the UE at UDM.

5.4 Subscriber Data Management (SDM)

After UE context registration, the AMF fetches subscription data.

6. Known Limitations

ID	Area	Description
UDM-M6	In-memory state	All UDM contexts (UE registration, SDM subscriptions) are stored in memory only. State is lost on process restart

7. Prometheus Metrics

UDM Metrics

Metric	Type	Tags	Description
omni_udm.auth.requests.count	counter	supi, result	Authentication data requests
omni_udm.uecm.amf_registration.count	counter	supi	AMF registration requests
omni_udm.auth.result.count	counter	supi, result	Authentication result events
omni_udm.auth_vector_generations.total	counter	result	Total auth vector generation attempts
omni_udm.uecm_registrations.total	counter	result	Total UECM AMF registrations
omni_udm.sdm_queries.total	counter	data_type	Total SDM data queries
omni_udm.active_ue_contexts.count	gauge	--	Number of active UE contexts
omni_udm.nrf.registration.status	gauge	nf_type	NRF registration status (1=registered, 0=not)

BEAM VM Metrics

Metric	Type	Description
beam.memory.total	gauge	Total BEAM memory in bytes
beam.memory.processes	gauge	Memory used by Erlang processes
beam.memory.processes_used	gauge	Memory actually used by processes
beam.memory.system	gauge	System memory (ETS, atoms, code)
beam.memory.atom	gauge	Total atom memory
beam.memory.atom_used	gauge	Used atom memory
beam.memory.binary	gauge	Binary memory
beam.memory.code	gauge	Code memory
beam.memory.ets	gauge	ETS table memory
beam.processes.count	gauge	Number of Erlang processes
beam.ports.count	gauge	Number of Erlang ports
beam.atom.count	gauge	Number of atoms
beam.vm.uptime	gauge	VM uptime in seconds

8. Troubleshooting

Authentication fails with 404 User Not Found

OmniUDM requests auth subscription data from OmniUDR via SBI. Confirm:

1. udr_uri is reachable from the OmniUDM host.
2. OmniUDR can reach OmniHSS and the subscriber IMSI exists.
3. The SUCI presented by the AMF/AUSF is correctly formatted. OmniUDM de-conceals SUCI to SUPI before the UDR lookup; if de-concealment fails, the request is rejected with 403 rather than forwarding the raw SUCI to UDR.

Authentication fails with 403 SUCI De-concealment Failed

OmniUDM could not de-conceal the SUCI received from AUSF. Check:

1. Home network private keys are deployed to the hnet_key_dir directory (default /etc/omniudm/hnet).
2. Key files are named <key_id>.<curve>.key — e.g. 1.x25519.key for Profile A, 2.secp256r1.key for Profile B. The key ID must match the home_network_public_key_id provisioned on the SIM.
3. The key file contains the correct private key material (hex-encoded string or raw binary).
4. Check logs for SUCI de-concealment failed with the specific error: :unknown_home_network_key_id (key not loaded), :ecies_mac_verification_failed (wrong key or corrupted SUCI), or scheme output too short (truncated SUCI).

Authentication fails with 401 Authentication Failure

The AUSF computed HRES* from the received RES* and it did not match the stored HXRES*. This indicates the UE's Milenage credentials (Ki, OPc) do not match those stored in OmniHSS, or the RAND/AUTN were corrupted in transit.

SQN desynchronisation causes repeated authentication failures

If the UE sends an Authentication Failure with AUTS, the AMF must pass resynchronizationInfo in the next authentication request. OmniAMF now handles this (AMF-H7 resolved). The AUSF forwards the resync info to UDM, which recovers the correct SQN via UDR/HSS.

AMF data fetch returns stale NSSAI

The GET /nudm-sdm/v2/{supi}/nssai endpoint returns hardcoded NSSAI values (sst=1, sst=2) regardless of subscriber configuration (UDM-C4). To change the served NSSAI, modify the hardcoded values in NudmSDM.get_nssai/1. Per-subscriber NSSAI from OmniHSS is not used until UDM-C4 is resolved.

UE context not found after process restart

All UE context data is in-memory (UDM-M6). After a restart, the AMF must re-register each UE by re-sending PUT /nudm-uecm/v1/{supi}/registrations/amf-3gpp-access. UEs will re-register naturally as they send periodic registration updates or power cycle.

SDM data change notification not received

Confirm the callbackReference URI in the SDM subscription is reachable from the OmniUDM host. Notifications are sent asynchronously via Task.start; check for SDM notification to {uri} failed warning log entries. Note that GET /nudm-sdm/v2/{supi}/sdm-subscriptions/{id} does not exist (UDM-L3); subscriptions cannot be inspected via SBI.

SMF registration appears lost after restart

SMF registrations are stored in memory only. After a restart, the SMF must re-register its PDU session contexts. This happens automatically when the SMF re-establishes SM contexts following AMF-triggered PDU session re-establishment.