5G Security
Understand how 5G protects subscriber identities, authenticates access, establishes keys, and secures communication across the radio network, core network, and roaming boundaries.
This is the main reference hub for 5G security. Start with the overview, explore the security architecture, or use the procedure and troubleshooting links to connect the concepts to network traces.
| System | 5G System (5GS): UE, NG-RAN, and 5G Core |
|---|---|
| Main specification | 3GPP TS 33.501 — Security architecture and procedures for 5G System |
| Core subjects | Identity privacy, authentication, keys, signaling protection, and network security |
| Access protection | NAS between UE and AMF; NR AS between UE and gNB |
| Architecture scope | Security entities, trust boundaries, non-3GPP access, roaming, and context lifecycle |
5G security topics
The reference is organized from fundamentals to architecture and deployment boundaries. Use each topic description to choose the next page.
Start here
- 5G Security OverviewStart with the security goals, terminology, and relationship between identity, authentication, and protection.
- 5G Security ArchitectureBrowse the architecture subsection for entities, protection boundaries, keys, and deployment scenarios.
- Security Architecture OverviewRead the system-level map before exploring individual security functions and interfaces.
Entities, identity, and authentication
- Security EntitiesConnect UE, AMF/SEAF, AUSF, UDM/ARPF, and SIDF responsibilities to the existing core-network reference.
- Identity and PrivacyExplore SUPI, SUCI, temporary identities, and the boundaries of subscriber identity protection.
- Authentication ArchitectureFollow home-network and serving-network roles in primary authentication, including 5G AKA and EAP-AKA′.
Keys and access protection
- Key HierarchyTrace the relationship between authentication-derived keys and the keys used for NAS and radio protection.
- NAS and AS SecurityCompare security endpoints, signaling procedures, and the protection applied at each access layer.
- Security Context LifecycleFollow context creation, reuse, mobility updates, and replacement across the life of a connection.
Perimeter, interconnect, and other access
- Perimeter SecurityExamine the 5G Core boundary and distinguish signaling protection from user-plane perimeter controls.
- Non-3GPP Access SecurityExplore security when the UE reaches the 5G Core through access outside NG-RAN.
- Roaming and Interconnect SecurityConnect home and visited network trust with SEPP and N32 interconnect protection.
- Network Domain SecurityStudy protection between network elements, security gateways, and the NDS/IP framework.
What is 5G security?
5G security spans several relationships: the subscriber and home network, the UE and serving network, the UE and radio access network, and communication between network functions. Each relationship has its own endpoints, credentials, and protection requirements.
Authentication establishes trust and key material. Integrity protection detects unauthorized changes; ciphering protects confidentiality. Identity privacy, replay protection, and context management address different parts of the security problem. A successful authentication exchange is therefore only one part of a protected connection.
For the system map, read Security Architecture Overview. For the underlying network functions, use the existing 5G Core Network reference.
Where protection applies
First identify the endpoints of the protection you are investigating. NAS and radio security do not terminate at the same network function.
| Area | Question to answer | Read next |
|---|---|---|
| Identity | Which identity is exposed, concealed, or temporary? | Identity and Privacy |
| Authentication | Which home and serving functions participate in establishing trust? | Authentication Architecture |
| Access protection | Is the failure at the NAS or radio security boundary? | NAS and AS Security |
| Core perimeter | Which signaling or user-plane traffic crosses the network boundary? | Perimeter Security |
| Network domain | How is communication between network elements protected? | Network Domain Security |
| Other access | Which access type and gateway determine the security procedure? | Non-3GPP Access Security |
Suggested reading path
- Build the system picture. Read the security overview and architecture hub, then identify the security entities.
- Follow identity into authentication. Connect identity privacy with authentication architecture.
- Follow the keys into protection. Read the key hierarchy, then compare NAS and AS security.
- Follow the connection over time. Use the security context lifecycle to understand later updates and mobility.
- Choose a deployment boundary. Continue with non-3GPP access, perimeter protection, network domain security, or roaming and interconnect security.
Security in procedures and messages
Use the architecture pages to establish who holds each responsibility, then follow the exchanges in the 5G Security Procedures collection. Context reuse and procedure-specific branches can change the sequence seen in a trace.
- 5G Authentication ProcedureFollow the authentication exchange and its relationship to subscriber and serving-network functions.
- NAS Security Mode ProcedureRead the NAS security activation exchange between the UE and AMF.
- AS Security Activation ProcedureFollow radio-side security activation and the RRC response.
- Security Context UpdateConnect later security handling with context changes and mobility.
For individual fields, open the NAS message library for Authentication and Security Mode messages, and the RRC message library for SecurityModeCommand, SecurityModeComplete, and SecurityModeFailure.
Choose a troubleshooting starting point
Keep identity handling, authentication, NAS activation, and AS activation separate when locating a failure. Record the last successful exchange before following the relevant branch.
| Symptom | First checks | Architecture companion |
|---|---|---|
| Identity handling fails before authentication | Identity type, home-network routing, and subscriber provisioning | Identity and Privacy |
| Authentication is rejected or fails | Authentication method, failure cause, and home/serving function responses | Authentication Architecture |
| Security Mode does not complete | NAS versus RRC exchange, selected algorithms, UE capabilities, and active context | NAS and AS Security |
| Protected signaling fails after mobility | Context selection, key update, and counter continuity | Security Context Lifecycle |
| Failure occurs only while roaming | Home/visited-network routing and the interconnect protection boundary | Roaming and Interconnect Security |
Continue with 5G Security, Authentication, and Identity Issues for symptom-led analysis.
Standards and references
Use TS 33.501 as the security architecture starting point and the protocol specifications for individual procedures and messages. Match the specification version to the release implemented by the network under investigation.
- 3GPP TS 33.501, version 18.8.0 (Release 18) — 5G System security architecture and procedures; clauses 4–6 introduce the architecture, requirements, and UE security procedures.
- 3GPP TS 33.210 — Network Domain Security (NDS); IP network layer security.
- 3GPP TS 24.501 — NAS protocol for the 5G System.
- 3GPP TS 38.331 — NR Radio Resource Control protocol.
- 3GPP TS 23.501 — System architecture for the 5G System.
Frequently asked questions
What does 5G security cover?
It covers subscriber identity privacy, authentication, key management, access signaling and traffic protection, and security across network and interconnect boundaries. This hub organizes those subjects and connects them to call flows and protocol references.
Where should I start learning 5G security?
Start with the security overview, then the architecture overview and security entities. Continue through identity, authentication, and the key hierarchy before studying NAS and AS security or deployment-specific topics.
What is the difference between NAS and AS security?
NAS security protects signaling between the UE and AMF. For NR, AS security protects radio signaling and user traffic between the UE and gNB, subject to the applicable security configuration and policy. They use separate security procedures and keys.
Does SUCI encrypt all subscriber traffic?
No. SUCI concerns concealment of the permanent subscriber identity. Traffic confidentiality and signaling integrity belong to other security mechanisms. Identity privacy also depends on the selected protection scheme and provisioning.
Is 5G radio security end-to-end application encryption?
No. Radio protection terminates in the access network. Application security, such as TLS between a device application and its server, has different endpoints and remains a separate protection layer.
Which specification defines 5G security architecture?
3GPP TS 33.501 is the main reference for 5G System security architecture and procedures. Read it alongside TS 24.501 for NAS, TS 38.331 for NR RRC, and TS 33.210 for network domain IP security.