ETSI TS 133 512 V16.3.0 (2020-08)

ETSI TS 133 512 V16.3.0 (2020-08)
TECHNICAL SPECIFICATION
5G;
5G Security Assurance Specification (SCAS);
Access and Mobility management Function (AMF)
(3GPP TS 33.512 version 16.3.0 Release 16)
---------------------- Page: 1 ----------------------
3GPP TS 33.512 version 16.3.0 Release 16 1 ETSI TS 133 512 V16.3.0 (2020-08)
Reference
DTS/TSGS-0333512vg30
Keywords
5G,SECURITY
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP).

The present document may refer to technical specifications or reports using their 3GPP identities. These shall be

The cross reference between 3GPP and ETSI identities can be found under http://webapp.etsi.org/key/queryform.asp.

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

Intellectual Property Rights ................................................................................................................................ 2

Legal Notice ....................................................................................................................................................... 2

Modal verbs terminology .................................................................................................................................... 2

Foreword ............................................................................................................................................................. 5

1 Scope ........................................................................................................................................................ 7

2 References ................................................................................................................................................ 7

3 Definitions of terms, symbols and abbreviations ..................................................................................... 7

3.1 Terms .................................................................................................................................................................. 7

3.2 Symbols .............................................................................................................................................................. 7

3.3 Abbreviations ..................................................................................................................................................... 7

4 AMF-specific security requirements and related test cases...................................................................... 8

4.1 Introduction ........................................................................................................................................................ 8

4.2 AMF-specific adaptations of security functional requirements and related test cases. ...................................... 8

4.2.1 Introduction................................................................................................................................................... 8

4.2.2 Security functional requirements on the AMF deriving from 3GPP specifications and related test

cases .............................................................................................................................................................. 8

4.2.2.1 Authentication and key agreement procedure ......................................................................................... 8

4.2.2.1.1 Synchronization failure handling ....................................................................................................... 8

4.2.2.1.2 RES* verification failure handling .................................................................................................... 9

4.2.2.2 Void....................................................................................................................................................... 11

4.2.2.3 Security mode command procedure ...................................................................................................... 11

4.2.2.3.1 Replay protection of NAS signalling messages ............................................................................... 11

4.2.2.3.2 NAS NULL integrity protection ...................................................................................................... 12

4.2.2.3.3 NAS integrity algorithm selection and use ...................................................................................... 13

4.2.2.4 Security in intra-RAT mobility ............................................................................................................. 13

4.2.2.4.1 Bidding down prevention in Xn-handover ...................................................................................... 13

4.2.2.4.2 NAS protection algorithm selection in AMF change ...................................................................... 14

4.2.2.5 5G-GUTI allocation .............................................................................................................................. 15

4.2.2.5.1 5G-GUTI allocation ......................................................................................................................... 15

4.2.2.6 Security in registration procedure ......................................................................................................... 16

4.2.2.6.1 Invalid or unacceptable UE security capabilities handling .............................................................. 16

4.2.3 Technical Baseline ...................................................................................................................................... 17

4.2.3.1 Introduction ........................................................................................................................................... 17

4.2.3.2 Protecting data and information............................................................................................................. 17

4.2.3.2.1 Protecting data and information – general ....................................................................................... 17

4.2.3.2.2 Protecting data and information – unauthorized viewing ................................................................ 17

4.2.3.2.3 Protecting data and information in storage ...................................................................................... 17

4.2.3.2.4 Protecting data and information in transfer ...................................................................................... 17

4.2.3.2.5 Logging access to personal data ...................................................................................................... 17

4.2.3.3 Protecting availability and integrity ....................................................................................................... 17

4.2.3.4 Authentication and authorization ........................................................................................................... 17

4.2.3.5 Protecting sessions ................................................................................................................................ 17

4.2.3.6 Logging ................................................................................................................................................. 18

4.2.4 Operating Systems ...................................................................................................................................... 18

4.2.5 Web Servers ................................................................................................................................................ 18

4.2.6 Network Devices ........................................................................................................................................ 18

4.3 AMF-specific adaptations of hardening requirements and related test cases ................................................... 18

4.3.1 Introduction................................................................................................................................................. 18

4.3.2 Technical baseline....................................................................................................................................... 18

4.3.3 Operating systems ....................................................................................................................................... 18

4.3.4 Web servers ................................................................................................................................................ 18

4.3.5 Network devices ......................................................................................................................................... 18

4.3.6 Network functions in service-based architecture ........................................................................................ 18

4.4 AMF-specific adaptations of basic vulnerability testing requirements and related test cases .......................... 18

Annex A (informative): Change history ............................................................................................... 19

History .............................................................................................................................................................. 20

This Technical Specification has been produced by the 3rd Generation Partnership Project (3GPP).

The contents of the present document are subject to continuing work within the TSG and may change following formal

TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections,

z the third digit is incremented when editorial only changes have been incorporated in the document.

The constructions "shall" and "shall not" are confined to the context of normative provisions, and do not appear in

The constructions "must" and "must not" are not used as substitutes for "shall" and "shall not". Their use is avoided

insofar as possible, and they are not used in a normative context except in a direct citation from an external, referenced,

non-3GPP document, or so as to maintain continuity of style when extending or modifying the provisions of such a

The construction "may not" is ambiguous and is not used in normative elements. The unambiguous constructions

"might not" or "shall not" are used instead, depending upon the meaning intended.

The constructions "can" and "cannot" are not substitutes for "may" and "need not".

will indicates that something is certain or expected to happen as a result of action taken by an agency

will not indicates that something is certain or expected not to happen as a result of action taken by an

might indicates a likelihood that something will happen as a result of action taken by some agency the

might not indicates a likelihood that something will not happen as a result of action taken by some agency

is not (or any other negative verb in the indicative mood) indicates a statement of fact

The present document contains objectives, requirements and test cases that are specific to the AMF network product

class. It refers to the Catalogue of General Security Assurance Requirements and formulates specific adaptions of the

requirements and test cases given there, as well as specifying requirements and test cases unique to the AMF network

The following documents contain provisions which, through reference in this text, constitute provisions of the present

- References are either specific (identified by date of publication, edition number, version number, etc.) or

- For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including

a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same

[2] 3GPP TS 33.501 (Release 15): "Security architecture and procedures for 5G system".

[5] 3GPP TS 24.501: "Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3".

[6] 3GPP TR 33.926: "Security Assurance Specification (SCAS) threats and critical assets in 3GPP

For the purposes of the present document, the terms given in 3GPP TR 21.905 [1] and the following apply. A term

defined in the present document takes precedence over the definition of the same term, if any, in 3GPP TR 21.905 [1].

For the purposes of the present document, the abbreviations given in 3GPP TR 21.905 [1] and the following apply. An

abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in

AMF specific security requirements include both requirements derived from AMF-specific security functional

requirements in relevant specifications as well as security requirements introduced in the present document derived

The present clause describes the security functional requirements and the corresponding test cases for AMF network

- Security functional requirements derived from TS 33.501 [2] and detailed in clause 4.2.2.

- General security functional requirements which include requirements not already addressed in TS 33.501 [2] but

whose support is also important to ensure that AMF conforms to a common security baseline detailed in

Requirement Description: "Upon receiving an authentication failure message with synchronisation failure (AUTS) from

the UE, the SEAF sends an Nausf_UEAuthentication_Authenticate Request message with a "synchronisation failure

An SEAF will not react to unsolicited "synchronisation failure indication" messages from the UE.

The SEAF does not send new authentication requests to the UE before having received the response to its

Nausf_UEAuthentication_Authenticate Request message with a "synchronisation failure indication" from the AUSF (or

1) The UE sends an authentication failure message to the SEAF/AMF with synchronisation failure (AUTS).

2) The SEAF/AMF sends a Nausf_UEAuthentication_Authenticate Request message with a "synchronisation

3) The AUSF sends a Nausf_UEAuthentication_Authenticate Response message to the SEAF/AMF immediately

after receiving the request from the SEAF/AMF, to make sure the SEAF/AMF will receive the response before

1) The UE sends an authentication failure message to the SEAF/AMF with synchronisation failure (AUTS).

2) The SEAF/AMF sends a Nausf_UEAuthentication_Authenticate Request message with a "synchronisation

3) The AUSF does not send a Nausf_UEAuthentication_Authenticate Response message to the SEAF/AMF before

Before receiving Nausf_UEAuthentication_Authenticate Response message from the AUSF and before the timer for

Nausf_UEAuthentication_Authenticate Request message from the AUSF in step 12 in Figure 6.1.3.2-1, proceed as

- if the AUSF has indicated in the Nausf_UEAuthentication_Authenticate Response message to the SEAF that the

then the SEAF shall either reject the authentication by sending an Authentication Reject to the UE if the SUCI was used

by the UE in the initial NAS message or the SEAF/AMF shall initiate an Identification procedure with the UE if the 5G-

GUTI was used by the UE in the initial NAS message to retrieve the SUCI and an additional authentication attempt may

Also, if the SEAF does not receive any Nausf_UEAuthentication_Authenticate Request message from the AUSF as

expected, then the SEAF shall either reject the authentication to the UE or initiate an Identification procedure with the

1) Verify that the SEAF/AMF correctly handles RES* verification failure detected in the SEAF/AMF or/and in the

2) Verify that the SEAF/AMF correctly handles RES* verification failure detected in the SEAF/AMF or/and in the

1) The UE sends RR with SUCI to the SEAF/AMF under test, to trigger the SEAF/AMF under test to initiate

the authentication, i.e. to send Nausf_UEAuthentication_Authenticate Request to the AUSF.

2) The AUSF, after receiving the request from the SEAF/AMF under test, responds with a

Nausf_UEAuthentication_Authenticate Response message with an authentication vector to the SEAF/AMF

3) The UE, after receiving the Authentication Request message from the SEAF/AMF under test, returns an

incorrect RES* to the SEAF/AMF under test in the NAS Authentication Response message, which will

trigger the AMF to compute HRES*, compare HRES* with HXRES* and send an authentication request to

4) The AUSF returns to the AMF under test the indication of RES* verification failure.

1) The UE sends RR with a 5G-GUTI to the SEAF/AMF under test, to trigger the SEAF/AMF under test to

initiate the authentication, i.e. to send Nausf_UEAuthentication_Authenticate Request to the AUSF.

2) The AUSF, after receiving the request from the SEAF/AMF under test, responds with a

Nausf_UEAuthentication_Authenticate Response message with an authentication vector to the SEAF/AMF

3) The UE, after receiving the Authentication Request message from the SEAF/AMF under test, returns an

incorrect RES* to the SEAF/AMF in the NAS Authentication Response message, which will trigger the

AMF to compute HRES* and compare HRES* with HXRES*, and send an authentication request to the

4) The AUSF returns to the AMF under test an indication of RES* verification failure.

1) The UE sends RR with SUCI to the SEAF/AMF under test, to trigger the SEAF/AMF under test to initiate

the authentication, i.e. to send Nausf_UEAuthentication_Authenticate Request to the AUSF.

2) The AUSF, after receiving the request from the SEAF/AMF under test, responds with a

Nausf_UEAuthentication_Authenticate Response message with an authentication vector to the SEAF/AMF

3) The UE returns RES* to the SEAF/AMF under test in the NAS Authentication Response message, which

will trigger the AMF to compute HRES*, compare HRES* with HXRES*, and send to the received RES* to

4) The AUSF returns to the AMF under test an indication of RES* verification failure.

1) The UE sends RR with 5G-GUTI to the SEAF/AMF under test, to trigger the SEAF/AMF under test to

initiate the authentication, i.e. to send Nausf_UEAuthentication_Authenticate Request to the AUSF.

2) The AUSF, after receiving the request from the SEAF/AMF under test, responds with a

Nausf_UEAuthentication_Authenticate Response message with an authentication vector to the SEAF/AMF

3) The UE returns RES* to the SEAF/AMF under test in the NAS Authentication Response message, which

will trigger the AMF to compute HRES*, compare HRES* with HXRES*, and send to the received RES* to

4) The AUSF returns to the AMF under test an indication of RES* verification failure.

For test case 1 and 2, the value for RES* in the Nausf_UEAuthentication_Authenticate Request message from the AMF

For test case 1 and 3, the SEAF/AMF rejects the authentication by sending an Authentication Reject to the UE.

For test case 2 and 4, the SEAF/AMF initiates an Identification procedure with the UE to retrieve the SUCI.

Evidence suitable for the interface, e.g., Screenshot containing the operational results.

Requirement Description: "AMF shall support replay protection of NAS signalling messages between UE and AMF on

Verify that the NAS signalling messages are replay protected by AMF over N1 interface between UE and AMF.

- Tester shall have access to the NAS signalling packets sent between UE and AMF over N1 interface.