TS 33.501 — Security architecture and procedures for 5G System⚓︎
Release: Rel 16 · Version assessed: 16.5.0 · Network: 5G · Applies to: AMF, SMF, UPF, AUSF, UDM, UDR, NRF
Mandatory items: 82, of which 40 supported, 26 partially supported, 6 not supported and 10 not applicable. A further 209 clauses of the specification carry no conformance requirement and are not listed.
Mandatory items⚓︎
| Ref. | Item | Status | Support | Remarks |
|---|---|---|---|---|
| 5.1.2 | Authentication and Authorization | Mandatory | Partial | Emergency services not supported. |
| 5.1.3 | Requirements on 5GC and NG-RAN related to keys | Mandatory | Supported | |
| 5.5 | Requirements on the AMF | Mandatory | Partial | Assessed per sub-clause. |
| 5.5.1 | Signalling data confidentiality | Mandatory | Partial | Supporting NEA0 , 128-NEA1 and 128-NEA2 algorithms. |
| 5.5.2 | Signalling data integrity | Mandatory | Partial | NIA0, 128-NIA1 and 128-NIA2 is supported. |
| 5.5.3 | Subscriber privacy | Mandatory | Supported | |
| 5.6 | Requirements on the SEAF | Mandatory | Supported | |
| 5.8 | Requirements on the UDM | Mandatory | Partial | Only UDM Env supported |
| 5.8.1 | Generic requirements | Mandatory | Supported | |
| 5.8.2 | Subscriber privacy related requirements to UDM and SIDF | Mandatory | Partial | The home network private key is stored unencrypted. |
| 5.8 a | Requirements on AUSF | Mandatory | Supported | |
| 5.11 | Requirements for algorithms, and algorithm selection | Mandatory | Partial | Assessed per sub-clause. |
| 5.11.1 | Algorithm identifier values | Mandatory | Partial | Assessed per sub-clause. |
| 5.11.1.1 | Ciphering algorithm identifier values | Mandatory | Partial | Supporting NEA0 , 128-NEA1 and 128-NEA2 algorithms. |
| 5.11.1.2 | Integrity algorithm identifier values | Mandatory | Partial | Supporting NIA0, 128-NIA and 128-NIA2 algorithms |
| 5.11.2 | Requirements for algorithm selection | Mandatory | Partial | AMF support section B only AMF support negotiation for NAS Security algorithm between configured algos on AMF and algos received in UE Security Algo. It negotiates from NEA0 to NEA4 sequence for ciphering. Similarly for NIA0 to NIA4 sequence for integrity |
| 6.0 | Security procedures between UE and 5G network functions | Mandatory | Partial | 1. 5G AKA authentication method is supported 2. Simultaneous connection over 3gpp Access and non-3gpp access with same AMF is not supported. E.g: UE can be connected either with 3gpp Access or Non-3GPP Access. This is applicable for all non-3gpp related sections and sub-sections |
| 6.0 | General | Mandatory | Partial | 5G AKA authentication method is supported |
| 6.1 | Primary authentication and key agreement | Mandatory | Partial | 5G AKA authentication method is supported |
| 6.1.1 | Authentication framework | Mandatory | Partial | 5G AKA is supported; the EAP framework (EAP-AKA') is not supported on the AMF. |
| 6.1.1.1 | General | Mandatory | Partial | 5G AKA is supported; the EAP framework (EAP-AKA') is not supported on the AMF. |
| 6.1.1.3 | Granularity of anchor key binding to serving network | Mandatory | Supported | |
| 6.1.1.4 | Construction of the serving network name | Mandatory | Supported | |
| 6.1.1.4.1 | Serving network name | Mandatory | Supported | |
| 6.1.1.4.2 | Construction of the serving network name by the UE | Mandatory | Supported | |
| 6.1.1.4.3 | Construction of the serving network name by the SEAF | Mandatory | Supported | |
| 6.1.2 | Initiation of authentication and selection of authentication method | Mandatory | Supported | |
| 6.1.3.2 | Authentication procedure for 5G AKA | Mandatory | Supported | |
| 6.1.3.2.0 | 5G AKA | Mandatory | Supported | |
| 6.1.3.2.2 | RES* verification failure in SEAF or AUSF or both | Mandatory | Supported | |
| 6.1.3.3 | Synchronization failure or MAC failure | Mandatory | Partial | Assessed per sub-clause. |
| 6.1.3.3.2 | Synchronization failure recovery in Home Network | Mandatory | Partial | Authentication Failure using 5G-AKA is supported |
| 6.2 | Key hierarchy, key derivation, and distribution scheme | Mandatory | Supported | |
| 6.3 | Security contexts | Mandatory | Supported | |
| 6.3.1 | Distribution of security contexts | Mandatory | Supported | |
| 6.3.1.1 | General | Mandatory | Supported | |
| 6.3.2 | Multiple registrations in same or different serving networks | Mandatory | Not applicable (Non-3GPP access) | |
| 6.3.2.0 | General | Mandatory | Not applicable (Non-3GPP access) | |
| 6.3.2.1 | Multiple registrations in different PLMNs | Mandatory | Not applicable (Non-3GPP access) | |
| 6.3.2.2 | Multiple registrations in the same PLMN | Mandatory | Not applicable (Non-3GPP access) | |
| 6.4.2 | Security for multiple NAS connections | Mandatory | Not applicable (Non-3GPP access) | |
| 6.4.2.1 | Multiple active NAS connections with different PLMNs | Mandatory | Not applicable (Non-3GPP access) | |
| 6.4.2.2 | Multiple active NAS connections in the same PLMN's serving network | Mandatory | Not applicable (Non-3GPP access) | |
| 6.4.3 | NAS integrity mechanisms | Mandatory | Supported | |
| 6.4.3.0 | General | Mandatory | Supported | |
| 6.4.3.1 | NAS input parameters to integrity algorithm | Mandatory | Supported | |
| 6.4.3.2 | NAS integrity activation | Mandatory | Supported | |
| 6.4.3.3 | NAS integrity failure handling | Mandatory | Supported | |
| 6.4.6 | Protection of initial NAS message | Mandatory | Supported | |
| 6.4.7 | Security aspects of SMS over NAS | Mandatory | Not applicable (SMS on the private radio path) | |
| 6.7.1 | Procedures for NAS algorithm selection | Mandatory | Supported | |
| 6.7.1.1 | Initial NAS security context establishment | Mandatory | Supported | |
| 6.7.2 | NAS security mode command procedure | Mandatory | Supported | |
| 6.8.1.1.1 | Transition from RM-REGISTERED to RM-DEREGISTERED | Mandatory | Partial | Currently, current, mapped and full-native security context is supported only. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.1.2 | Transition from RM-DEREGISTERED to RM-REGISTERED | Mandatory | Partial | Currently, current, mapped and full-native security context is supported only. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.1.2.1 | General | Mandatory | Partial | Currently, current, mapped and full-native security context is supported only. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.1.2.2 | Full native 5G NAS security context available | Mandatory | Partial | Currently, current, mapped and full-native security context is supported only. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.1.2.3 | Full native 5G NAS security context not available | Mandatory | Partial | Currently, current, mapped and full-native security context is supported only. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.1.2.4 | UE registration over a second access type to the same AMF | Mandatory | Not applicable (Non-3GPP access) | |
| 6.8.1.2 | Key handling at transitions between CM-IDLE and CM-CONNECTED states | Mandatory | Partial | Currently, current, mapped and full-native security context is supported. During handling of deregistration, AMF deleted the security context and on re-registration the security context is created again |
| 6.8.1.2.0 | General | Mandatory | Partial | See 6.8.1.2. |
| 6.8.1.2.1 | Transition from CM-IDLE to CM-CONNECTED | Mandatory | Partial | See 6.8.1.2. |
| 6.8.1.2.2 | Establishment of keys for cryptographically protected radio bearers in 3GPP access | Mandatory | Supported | |
| 6.8.1.2.3 | Establishment of keys for cryptographically protected traffic in non-3GPP access | Mandatory | Not applicable (Non-3GPP access) | |
| 6.8.1.2.4 | Transition from CM-CONNECTED to CM-IDLE | Mandatory | Supported | |
| 6.9.2.2 | Key derivations for context modification procedure | Mandatory | Supported | |
| 6.9.2.3.2 | Xn-handover | Mandatory | Supported | |
| 6.9.2.3.3 | N2-Handover | Mandatory | Supported | |
| 6.12 | Subscription identifier privacy | Mandatory | Supported | |
| 6.12.1 | Subscription permanent identifier | Mandatory | Supported | |
| 6.12.2 | Subscription concealed identifier | Mandatory | Supported | |
| 6.12.3 | Subscription temporary identifier | Mandatory | Supported | |
| 6.14 | Steering of roaming security mechanism | Mandatory | Not supported | Steering of roaming is not supported. |
| 6.14.1 | General | Mandatory | Not supported | Steering of roaming is not supported. |
| 6.14.2 | Security mechanisms | Mandatory | Not supported | Steering of roaming is not supported. |
| 6.14.2.1 | Procedure for steering of UE in VPLMN during registration | Mandatory | Not supported | Steering of roaming is not supported. |
| 6.14.2.2 | Procedure for steering of UE in VPLMN after registration | Mandatory | Not supported | Steering of roaming is not supported. |
| 6.14.2.3 | SoR Counter | Mandatory | Not supported | Steering of roaming is not supported. |
| 14.1.2 | Nausf_UEAuthentication service | Mandatory | Supported | |
| 14.2.1 | General | Mandatory | Supported | |
| 14.2.2 | Nudm_UEAuthentication_Get service operation | Mandatory | Supported | |
| 14.2.3 | Nudm_UEAuthentication_ResultConfirmation service operation | Mandatory | Supported |
Optional items⚓︎
The specification leaves these 143 items to the implementation; 42 are supported or partially supported. An item marked Not applicable belongs to an area the platform does not provide, named in the Support column. Expand for the full list.
143 optional items
| Ref. | Item | Support | Remarks |
|---|---|---|---|
| 5.1.1 | Mitigation of bidding down attacks | Supported | Implemented Authentication/Nas Ciphering Interigty Algo as per 3GPP. Integrity is mandatory and ciphering is optional |
| 5.9.2.1 | Security Requirements for service registration, discovery and authorization | Supported | |
| 5.9.2.2 | NRF security requirements | Supported | |
| 6.1.1.2 | EAP framework | Not supported | |
| 6.1.3 | Authentication procedures | Partial | Only Authentication procedure for 5G-AKA is supported |
| 6.1.3.1 | Authentication procedure for EAP-AKA' | Partial | Supported in AUSF and UDM but not in AMF |
| 6.1.3.3.1 | Synchronization failure or MAC failure in USIM | Partial | Authentication Failure using 5G-AKA is supported |
| 6.1.4 | Linking increased home control to subsequent procedures | Supported | |
| 6.1.4.1 | Introduction | Supported | |
| 6.1.4.1 a | Linking authentication confirmation to Nudm_UECM_Registration procedure from AMF | Not supported | |
| 6.1.4.2 | Guidance on linking authentication confirmation to Nudm_UECM_Registration procedure from AMF | Supported | |
| 6.2.1 | Key hierarchy | Partial | KNasInt, KGnb, KNasEnc and Kamf derivation is supported In case of EAP-AKA', the keys CK', IK' are derived from CK, IK |
| 6.2.2.1 | Keys in network entities | Partial | KNasInt, KGnb, KNasEnc and Kamf derivation is supported In case of EAP-AKA', the keys CK', IK' are derived from CK, IK |
| 6.2.3.1 | Key setting | Partial | 5G AKA & Knas-enc, Knas-int, Kgnb generation Supported |
| 6.2.3.2 | Key identification | Supported | ngKSI and mapped ngKSI supported. KN3IWF not supported |
| 6.2.3.3 | Key lifetimes | Partial | Knas-int, Knas-enc and Kgnb derivation is supported Kamf creation for interworking procedure with EPS is supported |
| 6.3.1.2 | Distribution of subscriber identities and security data within one 5G serving network domain | Supported | |
| 6.3.1.3 | Distribution of subscriber identities and security data between 5G serving network domains | Supported | |
| 6.3.1.4 | Distribution of subscriber identities and security data between 5G and EPS serving network domains | Supported | |
| 6.4 | NAS security mechanisms | Partial | Only 3GPP Single NAS connection Supported |
| 6.4.1 | General | Supported | |
| 6.4.4 | NAS confidentiality mechanisms | Supported | |
| 6.4.4.0 | General | Supported | |
| 6.4.4.1 | NAS input parameters to confidentiality algorithm | Supported | |
| 6.4.4.2 | NAS confidentiality activation | Supported | |
| 6.4.5 | Handling of NAS COUNTs | Supported | |
| 6.7.1.2 | AMF change | Supported | |
| 6.8.1.1.0 | General | Supported | |
| 6.8.1.3 | Key handling for the Registration procedure when registered in NG-RAN | Partial | See 6.8.1.2. |
| 6.9.2.1.1 | Access stratum | Supported | |
| 6.9.2.1.2 | Non access stratum | Supported | |
| 6.9.3 | Key handling in mobility registration update | Supported | |
| 6.9.4 | Key-change-on-the-fly | Not supported | |
| 6.9.5 | Rules on concurrent running of security procedures | Not supported | |
| 6.9.5.1 | Rules related to AS and NAS security context synchronization | Not supported | |
| 6.9.6 | Security handling in registration with AMF reallocation via direct NAS reroute | Supported | currently NAS reroute via gNB is not supported |
| 6.12.4 | Subscription identification procedure | Supported | |
| 6.15.2 | Security mechanisms | Supported | |
| 6.15.2.1 | Procedure for UE Parameters Update | Supported | |
| 6.15.2.2 | UE Parameters Update Counter | Supported | |
| 6.16.2.3 | Connection Resume in CM-IDLE with Suspend to a new ng-eNB | Not supported | |
| 6.16.2.4 | Connection Resume in CM-IDLE with Suspend to the same ng-eNB | Not supported | |
| 6.16.3 | Protection of Non-IP Data Delivery (NIDD) interfaces | Not supported | |
| 6.16.4 | Security handling in NAS based redirection from 5GS to EPS | Not supported | |
| 7.0 | Security for non-3GPP access to the 5G core network | Not supported | |
| 7.1 | General | Not supported | |
| 7.1 a | Determining trust relationship in the UE | Not supported | |
| 7.2 | Security procedures | Not supported | |
| 7.2.1 | Authentication for Untrusted non-3GPP Access | Not supported | |
| 7A | Security for trusted non-3GPP access to the 5G core network | Not supported | |
| 7A.1 | General | Not supported | |
| 7A.2 | Security procedures | Not supported | |
| 7A.2.1 | Authentication for trusted non-3GPP access | Not supported | |
| 7A.2.2 | Mobility handling for trusted non-3GPP access | Not supported | |
| 7A.2.3 | Key hierarchy for trusted non-3GPP access | Not supported | |
| 7A.2.4 | Authentication for devices that do not support 5GC NAS over WLAN access | Not supported | |
| 7B | Security for wireline access to the 5G core network | Not supported | |
| 7B.1 | General | Not supported | |
| 7B.2 | Authentication for 5G-RG | Not supported | |
| 7B.3 | Authentication for FN-RG | Not supported | |
| 7B.4 | Authentication for UE behind 5G-RG and FN-RG | Not supported | |
| 7B.5 | Subscriber privacy for wireline access | Not supported | |
| 7B.6 | Subscriber privacy for N5CW over trusted WLAN access | Not supported | |
| 8.2 | Registration procedure for mobility from EPS to 5GS over N26 | Not applicable (4G/5G interworking over N26) | |
| 8.3 | Handover procedure from 5GS to EPS over N26 | Not applicable (4G/5G interworking over N26) | |
| 8.3.1 | General | Not applicable (4G/5G interworking over N26) | |
| 8.3.2 | Procedure | Not applicable (4G/5G interworking over N26) | |
| 8.4 | Handover from EPS to 5GS over N26 | Not applicable (4G/5G interworking over N26) | |
| 8.4.1 | General | Not applicable (4G/5G interworking over N26) | |
| 8.4.2 | Procedure | Not applicable (4G/5G interworking over N26) | |
| 8.5 | Idle mode mobility from 5GS to EPS over N26 | Not applicable (4G/5G interworking over N26) | |
| 8.5.1 | General | Not applicable (4G/5G interworking over N26) | |
| 8.5.2 | TAU Procedure | Not applicable (4G/5G interworking over N26) | |
| 8.6 | Mapping of security contexts | Not applicable (4G/5G interworking over N26) | |
| 8.6.1 | Mapping of a 5G security context to an EPS security context | Not applicable (4G/5G interworking over N26) | |
| 8.6.2 | Mapping of an EPS security context to a 5G security context | Not applicable (4G/5G interworking over N26) | |
| 10.0 | Security aspects of IMS emergency session handling | Not supported | |
| 10.1 | General | Not supported | |
| 10.2 | Security procedures and their applicability | Not supported | |
| 10.2.1 | Authenticated IMS Emergency Sessions | Not supported | |
| 10.2.1.1 | General | Not supported | |
| 10.2.1.2 | UE in RM-DEREGISTERED state requests a PDU Session for IMS Emergency services | Not supported | |
| 10.2.1.3 | UE in RM-REGISTERED state requests a PDU Session for IMS Emergency services | Not supported | |
| 10.2.2 | Unauthenticated IMS Emergency Sessions | Not supported | |
| 10.2.2.1 | General | Not supported | |
| 10.2.2.2 | UE sets up an IMS Emergency session with emergency registration | Not supported | |
| 10.2.2.3 | Key generation for Unauthenticated IMS Emergency Sessions | Not supported | |
| 10.2.2.3.1 | General | Not supported | |
| 10.2.2.3.2 | Handover | Not supported | |
| 11.0 | Security procedures between UE and external data networks via the 5G Network | Not supported | |
| 11.1 | EAP based secondary authentication by an external DN-AAA server | Not supported | |
| 11.1.1 | General | Not supported | |
| 11.1.2 | Authentication | Not supported | |
| 11.1.3 | Re-Authentication | Not supported | |
| 11.1.4 | Secondary Authentication and Authorization Revocation | Not supported | |
| 13.1.0 | General | Partial | HTTPS is supported between the network functions. |
| 13.1.1 | TLS protection between NF and SEPP | Not supported | |
| 13.1.1.0 | General | Not supported | |
| 13.1.1.1 | TLS protection based on telescopic FQDN and wildcard certificate | Not supported | |
| 13.1.1.2 | TLS protection based on 3gpp-Sbi-Target-apiRoot HTTP header | Not supported | |
| 13.1.2 | Protection between SEPPs | Not supported | |
| 13.3.1 | Authentication and authorization between network functions and NRF | Not supported | |
| 13.3.1.1 | Direct communication | Not supported | |
| 13.3.1.2 | Indirect communication | Not supported | |
| 13.3.1.3 | Authorization of discovery request and error handling | Not supported | |
| 13.4 | Authorization of NF service access | Not supported | |
| 13.4.1 | OAuth 2.0 based authorization of Network Function service access | Not supported | |
| 13.4.1.0 | General | Not supported | |
| 13.4.1.1 | Service access authorization within the PLMN | Not supported | |
| 13.4.1.1.1 | OAuth 2.0 roles | Not supported | |
| 13.4.1.1.2 | Service Request Process | Not supported | |
| 13.4.1.2 | Service access authorization in roaming scenarios | Not supported | |
| 13.4.1.2.1 | OAuth 2.0 roles | Not supported | |
| 13.4.1.2.2 | Service Request Process | Not supported | |
| 13.4.1.3 | Service access authorization in indirect communication scenarios | Not supported | |
| 13.4.1.3.1 | Authorization for indirect communication without delegated discovery procedure | Not supported | |
| 13.4.1.3.1.1 | With mutual authentication between NF Service Consumer and NRF at the transport layer | Not supported | |
| 13.4.1.3.1.2 | Without mutual authentication between NF and NRF at the transport layer | Not supported | |
| 13.4.1.3.2 | Authorization for indirect communication with delegated discovery procedure | Not supported | |
| 14.0 | Security related services | Partial | Supported Nausf_UEAuthentication service |
| 14.1 | Services provided by AUSF | Partial | Assessed per sub-clause. |
| 14.1.3 | Nausf_SoRProtection service | Supported | |
| 14.1.4 | Nausf_UPUProtection service | Not supported | |
| 14.3 | Services provided by NRF | Supported | |
| 14.3.1 | General | Supported | |
| 14.3.2 | Nnrf_AccessToken_Get Service Operation | Supported | |
| 14.4 | Services provided by NSSAAF | Not supported | |
| 14.4.1 | Nnssaaf_NSSAA services | Not supported | |
| 14.4.1.1 | General | Not supported | |
| 14.4.1.2 | Nnssaaf_NSSAA_Authenticate service operation | Not supported | |
| 14.4.1.3 | Nnssaaf_NSSAA_Re-AuthenticationNotification service operation | Not supported | |
| 14.4.1.4 | Nnssaaf_NSSAA_RevocationNotification service operation | Not supported | |
| 15.0 | Management security for network slices | Not supported | |
| 15.1 | General | Not supported | |
| 15.2 | Mutual authentication | Not supported | |
| 15.3 | Protection of management interactions between the management service consumer and the management service producer | Not supported | |
| 15.4 | Authorization of management service consumer’s request | Not supported | |
| 16.0 | Security procedures for network slices | Not supported | |
| 16.1 | General | Not supported | |
| 16.2 | Authorization for network slice access | Not supported | |
| 16.3 | Network slice specific authentication | Not supported | |
| 16.4 | AAA Server triggered Network Slice-Specific Re-authentication and Re-authorization procedure | Not supported | |
| 16.5 | AAA Server triggered Slice-Specific Authorization Revocation | Not supported |
Assessed 2026-09-15 against TS 33.501 version 16.5.0.