States secondary authentication of a user equipment

A network node comprising:

• processing circuitry and memory, the memory containing instructions executable by the processing circuitry whereby the network node is configured to:
• operate a Session Management Function (SMF) in a control plane of a core network of a wireless communication network in support of wireless communication;
• authenticate a User Equipment (UE) with an Extensible Authentication Protocol (EAP) server in a secondary authentication process that uses the SMF as an EAP authenticator, the EAP server being comprised in an external network outside of the core network and the UE being separately authenticated with a further network node in the control plane of the core network via a primary authentication process, wherein to authenticate the UE in the secondary authentication process the network node is configured to exchange EAP messages between the SMF and the UE and between the SMF and the EAP server;
• authorize, by the SMF, a data session between the UE and the external network through a user plane of the core network based on the UE having successfully authenticated via both the primary authentication process and the secondary authentication process.

A network node comprising:

• processing circuitry and memory, the memory containing instructions executable by the processing circuitry whereby the network node is configured to:
• exchange, with a Session Management Function (SMF) comprised in a control plane of a core network of a wireless communication network supporting wireless communication and from an external network outside of the core network, Extensible Authentication Protocol (EAP) messages to authenticate a User Equipment (UE) in a secondary authentication process that uses the SMF as an EAP authenticator, the UE being separately authenticated with a further network node in the control plane of the core network via a primary authentication process;
• and
• authorizing a data session, through a user plane of the core network and to the external network, that requires successful authentication of the UE via both the primary authentication process and the secondary authentication process.