TS 33.512
5G Security Assurance Specification (SCAS) –
Access and Mobility management Function (AMF)
V18.2.0 (PDF)
2024/06 31 p.
V17.3.0
2022/03 26 p.
V16.6.0
2021/12 22 p.
- Rapporteur:
- Ms. Deng, Juan
HuaWei Technologies Co., Ltd
Content for TS 33.512 Word version: 18.2.0
1 Scope
2 References
3 Definitions of terms, symbols and abbreviations
4 AMF-specific security requirements and related test cases
$ Change history
1 Scope p. 7
The present document contains objectives, requirements and test cases that are specific to the AMF network product class. It refers to the Catalogue of General Security Assurance Requirements and formulates specific adaptions of the requirements and test cases given there, as well as specifying requirements and test cases unique to the AMF network product class.
2 References p. 7
3 Definitions of terms, symbols and abbreviations p. 7
4 AMF-specific security requirements and related test cases p. 8
4.1 Introduction p. 8
4.2 AMF-specific adaptations of security functional requirements and related test cases. p. 8
4.2.1 Introduction p. 8
4.2.2 Security functional requirements on the AMF deriving from 3GPP specifications and related test cases p. 8
4.2.2.0 General p. 8
4.2.2.1 Authentication and key agreement procedure p. 8
4.2.2.1.1 Synchronization failure handling p. 8
4.2.2.1.2 RES* verification failure handling p. 10
4.2.2.1.3 NAS based redirection from 5GS to EPS p. 13
4.2.2.1.4 NAS integrity failure p. 13
4.2.2.2 Void
4.2.2.3 Security mode command procedure p. 14
4.2.2.3.1 Replay protection of NAS signalling messages p. 14
4.2.2.3.2 NAS NULL integrity protection p. 15
4.2.2.3.3 NAS integrity algorithm selection and use p. 16
4.2.2.4 Security in intra-RAT mobility p. 17
4.2.2.4.1 Bidding down prevention in Xn-handover p. 17
4.2.2.4.2 NAS protection algorithm selection in AMF change p. 18
4.2.2.5 5G-GUTI allocation p. 19
4.2.2.6 Security in registration procedure p. 20
4.2.2.6.1 Invalid or unacceptable UE security capabilities handling p. 20
4.2.2.6.2 Correct transfer of UE security capabilities in AS security establishment p. 21
4.2.2.7 RRCRestablishment in Control Plane CIoT 5GS Optimization p. 22
4.2.2.8 Security in PDU session establishment procedure p. 23
4.2.2.9 Network Slice Specific Authentication and Authorization p. 24
4.2.3 Technical Baseline p. 25
4.2.3.1 Introduction p. 25
4.2.3.2 Protecting data and information p. 25
4.2.3.2.1 Protecting data and information - general p. 25
4.2.3.2.2 Protecting data and information - unauthorized viewing p. 25
4.2.3.2.3 Protecting data and information in storage p. 25
4.2.3.2.4 Protecting data and information in transfer p. 25
4.2.3.2.5 Logging access to personal data p. 25
4.2.3.3 Protecting availability and integrity p. 25
4.2.3.4 Authentication and authorization p. 25
4.2.3.5 Protecting sessions p. 25
4.2.3.6 Logging p. 25
4.2.4 Operating Systems p. 25
4.2.5 Web Servers p. 25
4.2.6 Network Devices p. 25
4.3 AMF-specific adaptations of hardening requirements and related test cases p. 26
4.3.1 Introduction p. 26
4.3.2 Technical baseline p. 26
4.3.3 Operating systems p. 26
4.3.4 Web servers p. 26
4.3.5 Network devices p. 26
4.3.6 Network functions in service-based architecture p. 26
4.4 AMF-specific adaptations of basic vulnerability testing requirements and related test cases p. 26
4.4.1 Introduction p. 26
4.4.2 Port Scanning p. 26
4.4.3 Vulnerability scanning p. 26
4.4.4 Robustness and fuzz testing p. 26
$ Change history p. 28
