3GPP TS 33.514
5G Security Assurance Specification (SCAS) for the Unified Data Management (UDM) network product class
V18.3.0 (2024-06) — Release 18 SCAS Product Class Critical Data: The UDM stores subscriber permanent keys (K), authentication vectors, and SUPI↔SUCI mappings. Compromise of UDM is the highest-impact single-node breach in 5G.
1. Scope
▶Defines security requirements and test cases for the UDM (Unified Data Management) network product class. The UDM provides subscriber data management, authentication credential handling, and subscription context storage for 5GC.
Extends TS 33.117. Closely related to TS 33.516 (AUSF SCAS).
2. References
▶| Ref | Document | Title |
|---|---|---|
| [1] | TS 33.117 | General SCAS Requirements |
| [2] | TS 33.501 | 5G Security Architecture (§6: Authentication) |
| [3] | TR 33.926 | Threats and Critical Assets |
| [4] | TS 29.503 | UDM Services (Nudm SBI API) |
4. UDM Network Product Class Definition
▶
┌──────────┐ ┌──────────┐ ┌──────────┐
│ AMF │ │ AUSF │ │ SMF │
└────┬─────┘ └────┬─────┘ └────┬─────┘
│ Nudm │ Nudm │ Nudm
└───────┬──────┘───────────────┘
│
┌──────▼──────┐
│ UDM │
│ (this) │
│ ┌────────┐ │
│ │ UDR │ │ (Unified Data Repository)
│ │ (K, │ │
│ │ SUPI, │ │
│ │ subs) │ │
│ └────────┘ │
└─────────────┘
| Service | Consumer | Functions |
|---|---|---|
| Nudm_UECM | AMF | UE context management, registration |
| Nudm_UEAuth | AUSF | Authentication vector generation (5G-AKA, EAP-AKA') |
| Nudm_SDM | AMF, SMF | Subscription data management |
| Nudm_PP | NEF | Parameter provisioning |
5. UDM-Specific Threats
▶TR 33.926 §5.3.5 Unauthorized access to subscriber permanent keys ▶
TR 33.926 §5.3.6 Information disclosure of SUPI, IMSI, subscription data ▶
TR 33.926 §6.3.1 SBI interface threats — unauthorized Nudm API calls ▶
TR 33.926 §5.3.8.1 Insider misuse — privileged access to subscriber keys ▶
- Key extraction: Compromise of K values enables full impersonation of any subscriber
- SUPI correlation: Mass de-concealment of SUCI→SUPI enables subscriber tracking
- Auth vector replay: Stolen AV enables session hijacking
6. Security Requirements and Test Cases
▶6.1 Subscription Data Protection
▶ TC_UDM_SUBSCRIPTION_DATA
CRITICAL
Procedure
- Verify permanent keys (K) are stored encrypted at rest (HSM or equivalent)
- Verify K values are never exposed via SBI APIs or logs
- Verify subscription data access requires NF authentication + authorization
- Verify audit logging for all subscription data access operations
- Verify data integrity protection for stored subscription records
6.2 Authentication Vector Security
▶ TC_UDM_AUTH_VECTOR
CRITICAL
Procedure
- Verify AV generation uses fresh random values (RAND) per request
- Verify SQN (sequence number) is properly managed to prevent replay
- Verify AVs are provided only to authenticated AUSF via Nudm_UEAuth
- Verify AVs are not cached or stored after delivery
6.3 SUPI / SUCI Handling
▶ TC_UDM_SUCI_DECONCEALMENT
HIGH
Procedure
- Verify SUCI de-concealment private key is stored securely (HSM)
- Verify de-concealment is only performed for authentication, not arbitrary lookups
- Verify SUPI is not logged in cleartext in system logs
- Verify ECIES Profile A/B key rotation procedures exist
6.4 SBI Interface Security
▶ TC_UDM_SBI_AUTH
CRITICAL
Procedure
- Verify all Nudm API calls require mTLS
- Verify OAuth 2.0 token validation with scope checking per service
- Send Nudm_UEAuth request with valid token but wrong scope → verify REJECTED
- Send Nudm_SDM request without token → verify 401 response
TR 33.926 §6.3.1 SBI interface threats ▶
7. SCAS Test Case Summary
▶| Test Case ID | Category | Priority |
|---|---|---|
| TC_UDM_SUBSCRIPTION_DATA | Data Protection | CRITICAL |
| TC_UDM_AUTH_VECTOR | Authentication | CRITICAL |
| TC_UDM_SUCI_DECONCEALMENT | Privacy | HIGH |
| TC_UDM_SBI_AUTH | SBI Security | CRITICAL |
| Plus ALL test cases from TS 33.117 | ||