5G • Security
5G Key Hierarchy & NAS Security
5G Cryptographic Key Derivation Tree (K_AUSF, K_SEAF, K_AMF, K_gNB)
The hierarchical key derivation architecture in 5G that generates distinct ciphering and integrity keys for control plane and user plane traffic.
Technical Explanation
5G defines a multi-tier cryptographic tree rooted in the permanent key K stored inside the USIM and ARPF/UDM: • K → K_AUSF (derived in Home UDM) • K_AUSF → K_SEAF (derived in Home AUSF) • K_SEAF → K_AMF (derived in Serving AMF) • K_AMF → K_gNB (for RAN AS security) and K_NASint / K_NASenc (for NAS signaling security). This ensures that compromise of a base station (gNodeB) key does not expose other gNodeBs or the core network control plane.
Key Functions
- Strict cryptographic separation between core network (NAS) and radio network (AS) keys
- Independent 128-bit and 256-bit encryption (NEA1/NEA2/NEA3) and integrity (NIA1/NIA2/NIA3)
- Forward and backward security during handovers via vertical and horizontal key chaining
- Tamper-proof storage of root secret K in tamper-resistant USIM hardware
Specifications
3GPP TS 33.501 Section 6.2
Interfaces
N1 (NAS)Uu (AS Security)N2 (Key distribution)
Related 5G Concepts
Want to memorize 5G concepts like this one?
Study it with SuperMemo SM-2 spaced repetition flashcards.