3GPP TS 33.515
5G Security Assurance Specification (SCAS) for the Access and Mobility Management Function (AMF) network product class
V18.3.0 (2024-06) — Release 18 SCAS Product Class 1. Scope
▶Defines security requirements and test cases for the AMF network product class. The AMF manages UE access control, NAS signalling security, authentication initiation, and mobility management in 5GC.
Extends TS 33.117.
2. References
▶| Ref | Document | Title |
|---|---|---|
| [1] | TS 33.117 | General SCAS Requirements |
| [2] | TS 33.501 | 5G Security Architecture (§7: NAS, §8: AS) |
| [3] | TR 33.926 | Threats and Critical Assets |
| [4] | TS 24.501 | NAS Protocol for 5GS |
4. AMF Network Product Class Definition
▶
┌──────┐ ┌──────────┐
│ UE │──NR-Uu──►┌──────┐──N2──────►│ AMF │
└──────┘ │ gNB │ (NGAP) │ (this) │
└──────┘ │ │
│ NAS │
│ security│
└──┬───┬───┘
Namf │ │ Nausf
┌───────────┘ └─────────┐
▼ ▼
┌──────────┐ ┌──────────┐
│ SMF │ │ AUSF │
└──────────┘ └──────────┘
| Interface | Peer | Protocol | Function |
|---|---|---|---|
| N1 | UE (via gNB) | NAS | NAS signalling (registration, SMC, auth) |
| N2 | gNB | NGAP/SCTP | AN signalling |
| Namf | NFs (SMF etc.) | SBI (HTTP/2) | AMF services |
| Nausf | AUSF | SBI (HTTP/2) | Authentication initiation |
5. AMF-Specific Threats
▶TR 33.926 §5.3.3 MITM on N1/N2 signalling ▶
TR 33.926 §5.3.4 DoS via NAS flooding or NGAP overload ▶
TR 33.926 §5.3.5 Unauthorized registration bypassing authentication ▶
- NAS Security Mode bypass: Attempting to force null ciphering/integrity algorithms
- Rogue gNB N2: Malicious gNB sending forged NGAP messages
- TMSI/5G-GUTI tracking: Insufficient GUTI reallocation enabling subscriber tracking
- Bidding-down attack: Forcing weaker security algorithms than supported
6. Security Requirements and Test Cases
▶6.1 NAS Security
▶ TC_AMF_NAS_SMC
CRITICAL
Procedure
- Verify NAS Security Mode Command includes replayed UE security capabilities
- Verify NAS integrity protection is activated before any NAS message carrying user data
- Verify AMF rejects NAS messages with invalid MAC
- Verify NAS COUNT is properly maintained (anti-replay)
- Verify AMF does not select NEA0/NIA0 unless explicitly configured for emergency
TC_AMF_BIDDING_DOWN
CRITICAL
Procedure
- Verify AMF selects the strongest algorithm mutually supported by UE and network
- Verify UE security capabilities are replayed in SMC for UE verification
- Send modified UE capabilities → verify AMF detects mismatch
6.2 N2 Interface Security
▶ TC_AMF_N2_NGAP
HIGH
Procedure
- Verify N2 (NGAP/SCTP) is protected by IPsec per TS 33.210
- Send NGAP Initial UE Message from unknown gNB IP → verify REJECTED
- Verify SCTP association requires configured peer addresses
6.3 Registration Security
▶ TC_AMF_REGISTRATION
CRITICAL
Procedure
- Verify AMF initiates primary authentication before any service access
- Verify 5G-GUTI is reallocated at registration to prevent tracking
- Verify registration rejects unknown SUCI protection schemes
- Verify AMF enforces configured UE re-authentication policy
6.4 SBI Interface Security
▶ TC_AMF_SBI_AUTH
CRITICAL
Procedure
- Verify Namf APIs require mTLS + OAuth 2.0 token
- Verify AMF validates NF instance ID in access token claims
- Verify Nausf calls include proper scope for authentication service
TR 33.926 §6.3.1 SBI interface threats ▶
7. SCAS Test Case Summary
▶| Test Case ID | Category | Priority |
|---|---|---|
| TC_AMF_NAS_SMC | NAS Security | CRITICAL |
| TC_AMF_BIDDING_DOWN | Algorithm Selection | CRITICAL |
| TC_AMF_N2_NGAP | N2 Security | HIGH |
| TC_AMF_REGISTRATION | Registration | CRITICAL |
| TC_AMF_SBI_AUTH | SBI Security | CRITICAL |
| Plus ALL test cases from TS 33.117 | ||