N3IWF: bringing Wi-Fi into the 5G core

The 5G core expects to authenticate a subscriber and manage sessions. It does not, in principle, require that the subscriber arrived over 3GPP radio. The non-3GPP interworking function is what allows a device on a Wi-Fi network to present itself to the core as though it had.

The device establishes a secure tunnel to the interworking function over whatever IP connectivity it has. Signalling that would normally traverse the radio interface is carried inside that tunnel, and once established the core treats the session much as it would a cellular one — same identity, same policy, same session management.

The distinction that matters is trusted against untrusted access. Untrusted access assumes the intervening network is hostile and secures everything end to end to the interworking function. Trusted access, where the operator has a relationship with the access network, permits a lighter arrangement. Most enterprise deployments are untrusted, because the operator does not control the Wi-Fi.

To the core, the interworking function is an access network — not a core element. That is the shift from earlier Wi-Fi interworking, where the gateway (the ePDG, in the 4G core) sat inside the core itself. Treating the function as access means the same procedures run over Wi-Fi as over the radio: one registration, one authentication, one way to manage sessions.

A device registers through the AMF and is authenticated by the AUSF with 5G credentials — EAP-AKA′ or 5G-AKA — exactly as a cellular device would be. Before registration completes, an IPsec security association is established between the device and the interworking function, and from that point the NAS signalling, both mobility and session management, travels inside it.

Sessions follow the same path. Over that signalling association the device runs NAS session management with the SMF, via the AMF, to establish a PDU session. For each session the function sets up IPsec child associations — one per QoS flow — toward the device, and a GTP-U tunnel toward the user-plane function. User data then rides inside IPsec between device and function, and inside GTP-U between the function and the UPF.

The reference points are worth knowing, because they name every leg of that path: NWu is the secure tunnel between device and function; Y1 and Y2 sit on either side of the Wi-Fi access point; N1 is the NAS link to the AMF, N2 the control-plane link from the function to the AMF, and N3 the user-plane link to the UPF.

Because the function behaves like access, a device can hold PDU sessions over the radio and over Wi-Fi at once, and move a session between them — the basis for offloading to Wi-Fi without losing identity or policy. A few things do not carry over, though: over untrusted Wi-Fi there is no paging, no mobility registration and no periodic registration, so the patterns that rely on the network reaching a sleeping device simply do not apply.

N3IWF handles the untrusted case — the operator does not control the Wi-Fi, so everything is secured end to end to the function. When the operator does control the access network, the trusted non-3GPP gateway function (TNGF) takes its place, with a lighter arrangement because the access is already trusted. Two relatives complete the family: the trusted WLAN interworking function (TWIF) carries devices that cannot speak 5G NAS themselves, and the wireline access gateway function (W-AGF) brings fixed broadband into the same core. Different trust, different medium — the same idea of making non-3GPP access look like access.

Moving a session between Wi-Fi and the radio is the simple case. The richer one is using both at once. A multi-access PDU session terminates on a single UPF but reaches the device over the 3GPP and non-3GPP access together, and Access Traffic Steering, Switching and Splitting (ATSSS) decides, per flow, how to use them.

Steering chooses which access a new flow should take. Switching moves a live flow from one access to the other — when Wi-Fi drops, the flow continues on the radio without the application noticing. Splitting divides a single flow across both accesses at once, for throughput or resilience, with the device and the UPF reordering at each end. Core policy and measured link conditions drive the choice; round-trip time and simple reachability are the usual inputs.

This is where convergence stops being a diagram and becomes a scheduling problem — in the device modem, in the UPF, and in the policy that governs both. The interworking function itself is well specified; steering a real workload across two links that fail independently is the part that takes the engineering.