3GPP TS 33.516 V18 — 5G SCAS for AUSF

Q: What does the Scope section cover in 3GPP TS 33.516 V18 — 5G SCAS for AUSF?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.516 V18 — 5G SCAS for AUSF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the AUSF Network Product Class Definition section cover in 3GPP TS 33.516 V18 — 5G SCAS for AUSF?

The AUSF Network Product Class Definition section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.516 V18 — 5G SCAS for AUSF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the AUSF-Specific Threats section cover in 3GPP TS 33.516 V18 — 5G SCAS for AUSF?

The AUSF-Specific Threats section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.516 V18 — 5G SCAS for AUSF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Requirements and Test Cases section cover in 3GPP TS 33.516 V18 — 5G SCAS for AUSF?

The Security Requirements and Test Cases section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.516 V18 — 5G SCAS for AUSF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the SCAS Test Case Summary section cover in 3GPP TS 33.516 V18 — 5G SCAS for AUSF?

The SCAS Test Case Summary section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.516 V18 — 5G SCAS for AUSF. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.516

5G Security Assurance Specification (SCAS) for the Authentication Server Function (AUSF) network product class

V18.3.0 (2024-06) — Release 18 SCAS Product Class

1. Scope

▶

Defines security requirements and test cases for the AUSF network product class. The AUSF executes 5G-AKA and EAP-AKA' authentication protocols, deriving K_AUSF for the key hierarchy.

Extends TS 33.117.

4. AUSF Network Product Class Definition

▶

┌──────┐ Nausf ┌──────────┐ Nudm ┌──────────┐ │ AMF │─────────►│ AUSF │─────────►│ UDM │ └──────┘ auth │ (this) │ AV req │ │ │ │ │ K, SQN │ │ K_AUSF │ └──────────┘ └──────────┘

Interface	Peer	Function
Nausf	AMF	Authentication initiation and result
Nudm	UDM	AV retrieval, SQN sync, SUCI resolution

5. AUSF-Specific Threats

▶

TR 33.926 §5.3.5 Unauthorized authentication bypass ▶

TR 33.926 §6.3.1 SBI interface threats on Nausf ▶

Key leakage: K_AUSF exposure enables complete session key derivation
Auth result forgery: Spoofed Nausf response to AMF → false authentication success
AV replay: Stolen AV reuse to impersonate subscriber

6. Security Requirements and Test Cases

▶

6.1 5G-AKA Handling

▶

TC_AUSF_5G_AKA

CRITICAL

Procedure

Verify AUSF computes HXRES* correctly from XRES* and validates RES* from AMF
Verify AUSF rejects incorrect RES* (authentication failure)
Verify AUSF stores K_AUSF only for the duration of the authentication procedure
Verify AUSF validates serving network name in auth request

6.2 EAP-AKA' Handling

▶

TC_AUSF_EAP_AKA

CRITICAL

Procedure

Verify AUSF acts as EAP server per RFC 9048
Verify AT_KDF attribute is included and validated
Verify EAP-Success is only sent after successful verification
Verify EAP-Failure terminates the session and cleans up key material

6.3 K_AUSF and Key Material Protection

▶

TC_AUSF_KEY_PROTECTION

CRITICAL

Procedure

Verify K_AUSF is stored in protected memory/HSM during authentication
Verify K_AUSF is deleted after K_SEAF derivation and delivery
Verify key material is never logged or exposed via debug interfaces
Verify K_SEAF is delivered only to the authenticated AMF

6.4 SBI Interface Security

▶

TC_AUSF_SBI

CRITICAL

Procedure

Verify Nausf API requires mTLS + OAuth 2.0 token with scope "nausf-auth"
Verify unauthorized NF cannot invoke Nausf_UEAuthentication
Verify AUSF validates NF type of caller (only AMF should call Nausf)

TR 33.926 §6.3.1 SBI interface threats ▶

7. SCAS Test Case Summary

▶

Test Case ID	Category	Priority
TC_AUSF_5G_AKA	Authentication	CRITICAL
TC_AUSF_EAP_AKA	Authentication	CRITICAL
TC_AUSF_KEY_PROTECTION	Key Management	CRITICAL
TC_AUSF_SBI	SBI Security	CRITICAL
Plus ALL test cases from TS 33.117

3GPP TS 33.516

1. Scope

4. AUSF Network Product Class Definition

5. AUSF-Specific Threats

6. Security Requirements and Test Cases

6.1 5G-AKA Handling

6.2 EAP-AKA' Handling

6.3 K_AUSF and Key Material Protection

6.4 SBI Interface Security

7. SCAS Test Case Summary

3GPP TS 33.516 V18 — 5G SCAS for AUSF Summary

Key Sections