TR 33.926 [4], clause E.2.2.1, Incorrect SUCI de-concealment.

De-concealment of SUPI from the SUCI based on the protection scheme used to generate the SUCI.

TS 33.501 [2], clause 5.8.2.

The SIDF resolves the SUPI from the SUCI based on the protection scheme used to generate the SUCI as specified in TS 33.501 [2], clause 5.8.2.

Verify that the SIDF De-conceals the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

• UDM network product is connected in simulated/real network environment including an AUSF and AMF.

• Tester shall have access to the subscription data stored in UDR.

• Tester shall record the SUPI from the UE.

Tester shall capture the entire authentication procedure between UE and AMF over N1, N12 and N13 interface using any network analyser.

1. Tester shall filter the Nudm_UEAuthentication_Get Response message sent from UDM to AUSF over N13 interface containing the SUPI.

2. Tester shall compare the SUPI gotten from UE and the SUPI retrieved from Nudm_UEAuthentication_Get Response message.

NOTE: The tester may filter the Nausf_UEAutentication_Authenticate Response message sent from the UDM/AUSF to the AMF over N12 interface containing the SUPI, if the UDM and AUSF network products are collocated without an open N13 interface.

SIDF resolves the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

Evidence suitable for the interface, e.g., evidence can be presented in the form of screenshot/screen-capture.

TR 33.926 [4], clause E.2.2.1, Incorrect SUCI de-concealment.

De-concealment of SUPI from the SUCI based on the protection scheme used to generate the SUCI.

TS 33.501 [2], clause 5.8.2.

Verify that the SIDF De-conceals the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

• UDM network product is connected in simulated/real network environment including an AUSF and AMF.

• Tester shall have access to the subscription data stored in UDR.

• Tester shall record the SUPI from the UE.

Tester shall capture the entire authentication procedure between UE and AMF over N1, N12 and N13 interface using any network analyser.

1. Tester shall filter the Nudm_Authentication_Get Response message sent from UDM to AUSF over N13 interface containing the SUPI.

2. Tester shall compare the SUPI gotten from UE and the SUPI retrieved from Nudm_Authentication_Get Response message.

NOTE: The tester may filter the Nausf_UEAutentication_Authenticate Response message sent from the UDM/AUSF to the AMF over N12 interface containing the SUPI, if the UDM and AUSF network products are collocated without an open N13 interface.

SIDF resolves the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

Evidence suitable for the interface, e.g., evidence can be presented in the form of screenshot/screen-capture.

TR 33.926 [4], clause E.2.2.2, Synchronization failure.

Synchronization failure handling

TS 33.501 [2], clause 6.1.3.3.2.

When the UDM/ARPF receives an Nudm_UEAuthentication_Get Request message with a "synchronisation failure indication" it acts as described in TS 33.102 [7], clause 6.3.5 where ARPF is mapped to HE/AuC. The UDM/ARPF sends an Nudm_UEAuthentication_Get Response message with a new authentication vector for either EAP-AKA' or 5G-AKA depending on the authentication method applicable for the user to the AUSF as specified in TS 33.501 [2], clause 6.1.3.3.2.

Verify that synchronization failure is recovered correctly in the home network.

Test environment with an AUSF. The AUSF or AMF may be simulated.

1. The AUSF sends an Nudm_UEAuthentication_Get Request message to the UDM with a "synchronisation failure indication" and parameters RAND and AUTS.

2. The UDM/ARPF performs steps 1-5 as described in TS 33.102, clause 6.3.5.

The UDM sends an Nudm_UEAuthentication_Get Response message with a new authentication vector to the AUSF.

NOTE: The expected results would be that the UDM/AUSF sends an Nausf_UEAuthentication_Authenticate Response message with EAP Request/AKA'-Challenge for EAP AKA', or 5G SE AV for 5G AKA to the AMF, if the UDM and AUSF network products are collocated without an open N13 interface.

TR 33.926 [4], clause E.2.2.2, Synchronization failure.

Synchronization failure handling

TS 33.501 [2], clause 6.1.3.3.2.

Verify that synchronization failure is recovered correctly in the home network.

Test environment with an AUSF. The AUSF or AMF may be simulated.

1. The AUSF sends an Nudm_UEAuthentication_Get Request message to the UDM with a "synchronisation failure indication" and parameters RAND and AUTS.

2. The UDM/ARPF performs steps 1-5 as described in TS 33.102, clause 6.3.5.

The UDM sends an Nudm_UEAuthentication_Get Response message with a new authentication vector to the AUSF.

NOTE: The expected results would be that the UDM/AUSF sends an Nausf_UEAuthentication_Authenticate Response message with EAP Request/AKA'-Challenge for EAP AKA', or 5G SE AV for 5G AKA to the AMF, if the UDM and AUSF network products are collocated without an open N13 interface.

TR 33.926 [4], clause E.2.2.3, Failure to store of authentication status.

Storing of authentication status of UE by UDM.

TS 33.501 [2], clause 6.1.4.1a

The UDM stores the authentication status of the UE (SUPI, authentication result, timestamp, and the serving network name) after authentication as specified in TS 33.501 [2], clause 6.1.4.1a.

Verify that the UDM under test stores the authentication status of UE, which is identical to the UE authentication information sent to/from the AUSF and the AMF.

• UDM network product is connected with an AUSF in simulated/real network environment involving AMF, eNB.

• The tester shall have access to all the authentication specific data sent over N1 interface, N12 interface and N13 interface.

• The tester shall have access to the UDM under test.

1. The tester shall capture the entire authentication procedure and authentication confirmation procedure over N12 and N13 interface using any network analyser.

2. the tester shall filter the Nudm_UEAuthentication_Get Request message sent over the N13 interface to retrieve serving network name.

3. The ester shall filter the Nudm_UEAuthentication_Get Response message sent over N13 interface to find the SUPI.

4. The tester shall filter the Nausf_UEAuthentication_Authenticate Response message sent over N12 interface to retrieve the Authentication result (EAP success/failure for EAP-AKA' or Result for 5G AKA).

5. The tester shall filter the Nudm_UEAuthentication_ResultConfirmation Request message to retrieve the authentication result and time of authentication procedure sent from the AUSF to the UDM over N13 interface.

6. The tester shall compare the serving network name stored in the UDM against the serving network name retrieved from the Nudm_UEAuthentication_Get Request message and the serving network name retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

7. The tester shall compare the authentication status stored in the UDM against the authentication result retrieved from N12 interface.

8. The tester shall compare the SUPI stored in the UDM against the SUPI retrieved from the Nudm_UEAuthentication_Get Response message and the SUPI retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

9. The tester shall compare the timestamp stored in the UDM against the time of authentication procedure retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

The storing of authentication status (SUPI, authentication result, timestamp, and the serving network name) of UE at the UDM is verified.

Evidence suitable for the interface, e.g., evidence can be presented in the form of screenshot/screen-capture.

NOTE: this test case does not apply to the deployment scenario where the UDM and AUSF network products are collocated without an open N13 interface.

TR 33.926 [4], clause E.2.2.3, Failure to store of authentication status.

Storing of authentication status of UE by UDM.

TS 33.501 [2], clause 6.1.4.1a

Verify that the UDM under test stores the authentication status of UE, which is identical to the UE authentication information sent to/from the AUSF and the AMF.

• UDM network product is connected with an AUSF in simulated/real network environment involving AMF, eNB.

• The tester shall have access to all the authentication specific data sent over N1 interface, N12 interface and N13 interface.

• The tester shall have access to the UDM under test.

1. The tester shall capture the entire authentication procedure and authentication confirmation procedure over N12 and N13 interface using any network analyser.

2. the tester shall filter the Nudm_UEAuthentication_Get Request message sent over the N13 interface to retrieve serving network name.

3. The ester shall filter the Nudm_Authentication_Get Response message sent over N13 interface to find the SUPI.

4. The tester shall filter the Nausf_UEAuthentication_Authenticate Response message sent over N12 interface to retrieve the Authentication result (EAP success/failure for EAP-AKA' or Result for 5G AKA).

5. The tester shall filter the Nudm_UEAuthentication_ResultConfirmation Request message to retrieve the authentication result and time of authentication procedure sent from the AUSF to the UDM over N13 interface.

6. The tester shall compare the serving network name stored in the UDM against the serving network name retrieved from the Nudm_Authentication_Get Request message and the serving network name retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

7. The tester shall compare the authentication status stored in the UDM against the authentication result retrieved from N12 interface.

8. The tester shall compare the SUPI stored in the UDM against the SUPI retrieved from the Nudm_Authentication_Get Response message and the SUPI retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

9. The tester shall compare the timestamp stored in the UDM against the time of authentication procedure retrieved from the Nudm_UEAuthentication_ResultConfirmation Request message.

The storing of authentication status (SUPI, authentication result, timestamp, and the serving network name) of UE at the UDM is verified.

Evidence suitable for the interface, e.g., evidence can be presented in the form of screenshot/screen-capture.

NOTE: this test case does not apply to the deployment scenario where the UDM and AUSF network products are collocated without an open N13 interface.

TR 33.926 [4].

NOTE: The test case below only applies to the UDMs which support the setting and providing of User Plane Security Policy for dedicated TSC service.

UP security enforcement configuration

TS 33.501 [2], clause L.3, TS 23.501 [5], clause 5.10.3.

"After the 5GS TSC-enabled UE is authenticated and data connection is set up, any data received from a TSC bridge or another 5GS TSC-enabled UE shall be transported between DS-TT (in the UE) and NW-TT (in the UPF) in a protected way using the mechanisms for UP security as described in clause 6.6.

The UP security enforcement information shall be set to "required" for data transferred from gNB to a 5GS TSC-enabled UE. This is also applicable to the gPTP messages sent in the user plane."

as specified in TS 33.501 [2], clause L.3.

"The SMF determines at PDU session establishment a User Plane Security Enforcement information for the user plane of a PDU session based on:

• subscribed User Plane Security Policy which is part of SM subscription information received from UDM; and

• User Plane Security Policy locally configured per (DNN, S-NSSAI) in the SMF that is used when the UDM does not provide User Plane Security Policy information.

• The maximum supported data rate per UE for integrity protection for the DRBs, provided by the UE in the Integrity protection maximum data rate IE during PDU Session Establishment. The UE supporting NR as primary RAT, i.e. NG-RAN access via Standalone NR, shall set the Integrity protection maximum data rate IE for Uplink and Downlink to full rate at PDU Session Establishment as defined in TS 24.501 [47]."

as specified in TS 23.501 [5], clause 5.10.3.

Verify that UP security enforcement information is set to "required" for dedicated TSC service.

Test environment with SMF. The SMF may be simulated.

A dedicated DNN/S-NSSAI combination is defined to identify the TSC service.

The security policy is configured in the UDM.

1. During the PDU session establishment procedure, the SMF sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination.

2. The UDM under test sends the Nudm_SDM_Get Response back to the SMF with UP security enforcement information.

The confidentiality and integrity protection requirements of the UP security enforcement information are set to "required".

Save the logs and the communication flow in a .pcap file.

TR 33.926 [4].

NOTE: The test case below only applies to the UDMs which support the setting and providing of User Plane Security Policy for dedicated TSC service.

UP security enforcement configuration

TS 33.501 [2], clause L.3, TS 23.501 [5], clause 5.10.3.

"After the 5GS TSC-enabled UE is authenticated and data connection is set up, any data received from a TSC bridge or another 5GS TSC-enabled UE shall be transported between DS-TT (in the UE) and NW-TT (in the UPF) in a protected way using the mechanisms for UP security as described in clause 6.6.

The UP security enforcement information shall be set to "required" for data transferred from gNB to a 5GS TSC-enabled UE. This is also applicable to the gPTP messages sent in the user plane."

as specified in TS 33.501 [2], clause L.3.

"The SMF determines at PDU session establishment a User Plane Security Enforcement information for the user plane of a PDU session based on:

• subscribed User Plane Security Policy which is part of SM subscription information received from UDM; and

• User Plane Security Policy locally configured per (DNN, S-NSSAI) in the SMF that is used when the UDM does not provide User Plane Security Policy information.

• The maximum supported data rate per UE for integrity protection for the DRBs, provided by the UE in the Integrity protection maximum data rate IE during PDU Session Establishment. The UE supporting NR as primary RAT, i.e. NG-RAN access via Standalone NR, shall set the Integrity protection maximum data rate IE for Uplink and Downlink to full rate at PDU Session Establishment as defined in TS 24.501 [47]."

as specified in TS 23.501 [5], clause 5.10.3.

Verify that UP security enforcement information is set to "required" for dedicated TSC service.

Test environment with SMF. The SMF may be simulated.

A dedicated DNN/S-NSSAI combination is defined to identify the TSC service.

The security policy is configured in the UDM.

1. During the PDU session establishment procedure, the SMF sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination.

2. The UDM under test sends the Nudm_SDM_Get Response back to the SMF with UP security enforcement information.

The confidentiality and integrity protection requirements of the UP security enforcement information are set to "required".

Save the logs and the communication flow in a .pcap file.

TR 33.926 [4].

NOTE 1: The test case below only applies to the UDMs which support the setting and providing of User Plane Security Policy for 5G LAN service.

UP security enforcement configuration

TS 33.501 [2], clause K.3, TS 23.501 [5], clause 5.10.3.

"To reduce incremental complexity added by security, all PDU sessions associated with a specific 5G LAN group should have the same UP security policy. When generating the policy enforcement information, and to avoid the redundant double protection, the SMF may consider information by a DN-AAA about DN protection mechanisms already applied."

as specified in TS 33.501 [2], clause K.3.

"The SMF determines at PDU session establishment a User Plane Security Enforcement information for the user plane of a PDU session based on:

• subscribed User Plane Security Policy which is part of SM subscription information received from UDM; and

• User Plane Security Policy locally configured per (DNN, S-NSSAI) in the SMF that is used when the UDM does not provide User Plane Security Policy information.

• The maximum supported data rate per UE for integrity protection for the DRBs, provided by the UE in the Integrity protection maximum data rate IE during PDU Session Establishment. The UE supporting NR as primary RAT, i.e. NG-RAN access via Standalone NR, shall set the Integrity protection maximum data rate IE for Uplink and Downlink to full rate at PDU Session Establishment as defined in TS 24.501 [47]."

as specified in TS 23.501 [5], clause 5.10.3.

Verify that UP security policy is set to the same for all the 5G LAN UEs.

Test environment with SMF. The SMF may be simulated.

A dedicated DNN/S-NSSAI combination is defined to identify the 5G LAN service.

The security policy of the 5G LAN service is configured in the UDM.

1. During the PDU session establishment procedure initiated by the UE1, the SMF1 sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination, and SUPI1.

2. The UDM under test sends the Nudm_SDM_Get Response back to the SMF1 with UP security policy1.

3. During the PDU session establishment procedure initiated by the UE2, the SMF2 sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination, and SUPI2.

4. The UDM under test sends the Nudm_SDM_Get Response back to the SMF2 with UP security policy2.

NOTE 2: SMF1 and SMF2 could be the same network function.

The confidentiality and integrity protection requirements of the UP security policy1 and UP security policy2 are the same.

Save the logs and the communication flow in a .pcap file.

TR 33.926 [4].

NOTE 1: The test case below only applies to the UDMs which support the setting and providing of User Plane Security Policy for 5G LAN service.

UP security enforcement configuration

TS 33.501 [2], clause K.3, TS 23.501 [5], clause 5.10.3.

"To reduce incremental complexity added by security, all PDU sessions associated with a specific 5G LAN group should have the same UP security policy. When generating the policy enforcement information, and to avoid the redundant double protection, the SMF may consider information by a DN-AAA about DN protection mechanisms already applied."

as specified in TS 33.501 [2], clause K.3.

"The SMF determines at PDU session establishment a User Plane Security Enforcement information for the user plane of a PDU session based on:

• subscribed User Plane Security Policy which is part of SM subscription information received from UDM; and

• User Plane Security Policy locally configured per (DNN, S-NSSAI) in the SMF that is used when the UDM does not provide User Plane Security Policy information.

• The maximum supported data rate per UE for integrity protection for the DRBs, provided by the UE in the Integrity protection maximum data rate IE during PDU Session Establishment. The UE supporting NR as primary RAT, i.e. NG-RAN access via Standalone NR, shall set the Integrity protection maximum data rate IE for Uplink and Downlink to full rate at PDU Session Establishment as defined in TS 24.501 [47]."

as specified in TS 23.501 [5], clause 5.10.3.

Verify that UP security policy is set to the same for all the 5G LAN UEs.

Test environment with SMF. The SMF may be simulated.

A dedicated DNN/S-NSSAI combination is defined to identify the 5G LAN service.

The security policy of the 5G LAN service is configured in the UDM.

1. During the PDU session establishment procedure initiated by the UE1, the SMF1 sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination, and SUPI1.

2. The UDM under test sends the Nudm_SDM_Get Response back to the SMF1 with UP security policy1.

3. During the PDU session establishment procedure initiated by the UE2, the SMF2 sends a Nudm_SDM_Get Request message to the UDM under test with a dedicated DNN/S-NSSAI combination, and SUPI2.

4. The UDM under test sends the Nudm_SDM_Get Response back to the SMF2 with UP security policy2.

NOTE 2: SMF1 and SMF2 could be the same network function.

The confidentiality and integrity protection requirements of the UP security policy1 and UP security policy2 are the same.

Save the logs and the communication flow in a .pcap file.