AUSF — Authentication Server Function — the function that decides the device is who it claims
The core network
Where it sits
What it is
What it is. The Authentication Server Function — the function that decides a device is who it claims to be. TS 23.501 §6.2.8, and it has the shortest functionality list in the entire specification:
Supports authentication for 3GPP access and untrusted non-3GPP access, as specified in TS 33.501 · supports authentication of a device for Disaster Roaming.
Two lines, both of which say "see the security specification". That is not an oversight: the architecture specification declines to describe authentication, because 5G AKA is defined in TS 33.501 §6.1.3.2 and duplicating it here would create two texts that could disagree.
Why it is separate from the UDM at all. The UDM generates the authentication credentials; the AUSF runs the procedure with the serving network and decides the outcome. Splitting them puts a boundary between the store of long-term secrets and the thing that talks to a possibly-foreign network — so the function exposed to a visited PLMN's requests is not the function holding the subscriber database.
And why it is in the home network. The AUSF is the point at which the home operator, not the visited one, decides whether to admit a device. In roaming that is the whole game: the serving AMF can neither authenticate the device itself nor read its SUCI — it relays to the home AUSF and is told yes or no, plus a key.
Where it sits in the chain. The AMF (acting as SEAF, the security anchor) sends the authentication request to the AUSF over N12; the AUSF fetches a vector from the UDM over N13; the resulting anchor key comes back to the AMF, which derives everything below it. So authentication terminates at the AUSF, and the key hierarchy is rooted at the AMF — see 5G AKA for the sequence.
Read on
This concept is read as part of one argument in ref-core, alongside the rest of its group.
Before this concept, the hierarchy says to learn the following — the full chain, in order: