Description
The Security Anchor Functionality (SEAF) is a fundamental security component within the 5G System (5GS) architecture, defined as a sub-function of the Authentication Server Function (AUSF). Its primary role is to serve as the security termination point in the serving network during primary authentication and key agreement (AKA) procedures. The SEAF does not perform authentication calculations itself but orchestrates the process by interacting with the home network's Authentication Credential Repository and Processing Function (ARPF/UDM). It receives authentication vectors from the home network and uses them to authenticate the User Equipment (UE). Upon successful authentication, the SEAF derives the anchor key (K_SEAF) from the home network key (K_AUSF), establishing a security association rooted in the serving network. This K_SEAF is then used to derive further keys for securing Non-Access Stratum (NAS) signaling between the UE and the Access and Mobility Management Function (AMF). The SEAF's location in the serving network is crucial for security localization, reducing latency and dependency on the home network for subsequent security procedures like re-authentication and key refresh. Architecturally, the SEAF is co-located with the AUSF, and its interfaces, such as Nausf, are used for communication with the AMF. Its operation is central to the 5G security framework, providing a clear separation between home and serving network security responsibilities and enabling features like seamless mobility and network slicing with isolated security contexts.
Purpose & Motivation
The SEAF was introduced in 3GPP Release 15 as part of the new 5G security architecture to address limitations of previous generations, particularly 4G EPS. In EPS, the MME in the serving network acted as the security endpoint, which created a complex key hierarchy and potential vulnerabilities during inter-MME handovers. The primary motivation for SEAF was to provide a dedicated, stable security anchor in the serving network that is separate from the mobility management function (AMF). This separation of concerns enhances security by isolating the long-term anchor key (K_SEAF) and simplifies key management during mobility events. It solves the problem of key chaining and reduces the attack surface by localizing the primary security context. Furthermore, the SEAF design supports the 5G requirement for serving network visibility and control over authentication, which is essential for regulatory compliance and enabling new business models like network slicing, where each slice may require independent security anchoring from the serving network's perspective.
Classification
Detected Changes Across Releases
from 3GPP Change RequestsSpecific changes extracted from the „Change history“ tables of 3GPP specifications (185 CRs across 6 releases). Complements the general historical overview above with the evidence-based evolution of this function.
In Release 15, the SEAF (Security Anchor Functionality) was formally introduced as part of the new 5G Core security architecture, residing within the AMF. Its primary role is to act as the termination point for primary authentication and key agreement, establishing a security anchor with the UE. This enables the derivation of separate keys for securing access stratum and non-access stratum signaling.
- Clarifications to security requirements and features (clause 5) TS 33.501CR0161
- Security Negotiation for RRC INACTIVE TS 33.501CR0183
- Security Mechanism for Steering of Roaming TS 33.501CR0214
- CR-slice-management-security TS 33.501CR0290
- Security mechanisms for non-SBA interfaces in 5GC TS 33.501CR0374
- Application layer security on the N32 interface TS 33.501CR0376
+ 60 more changes
In Release 16, the SEAF's role was enhanced to support new security procedures for emerging services and architectures. This included defining security aspects for non-public networks, 5G LAN services, and Time Sensitive Communication (TSC), ensuring secure access for TSC-enabled UEs. Furthermore, Release 16 specified security for roaming interfaces in indirect communication and introduced security requirements for the Inter-PLMN User Plane Security (IPUPS) Function.
- Description of solution 11 in 23.725 for Ethernet anchor relocation TS 23.501CR0755
- Adding UDR NF Group ID association functionality TS 23.501CR1384
- Security for non-public networks TS 33.501CR0641
- Security for SRVCC for 5G to UTRAN CS TS 33.501CR0660
- Security for roaming interfaces in indirect communication TS 33.501CR0675
- Security requirements for SeCoP TS 33.501CR0692
+ 27 more changes
In Release 17, the SEAF's scope was expanded to support new functionalities including security for Mobile Network Slice as a Service (MNSA), enhanced security for multicast/broadcast services (5MBS), and security aspects for edge computing and non-public networks (eNPN). The release also introduced clarifications and security context handling for inter-RAT mobility (IRAT) and proximity-based services (ProSe). Furthermore, specific security procedures were defined for the Service Communication Proxy (SCP) and the Inter PLMN UP Security (IPUPS) functionality within the roaming architecture.
- Additional authorization functionality in support of MPS for Data Transport Service TS 23.501CR2971
- Adding the functionality on MINT TS 23.501CR3019
- New Annex for Edge computing security TS 33.501CR1222
- Security aspects of eNPN TS 33.501CR1252
- Security aspects of 5MBS TS 33.501CR1255
- Security aspects of eNA TS 33.501CR1256
+ 25 more changes
In Release 18, the SEAF's role was enhanced to provide specific security handling in network sharing scenarios, as detailed in the corresponding Change Request. This included updates to ensure secure interconnection and topology hiding on inter-PLMN interfaces, aligning with the existing Security Edge Protection Proxy (SEPP) functionality. Furthermore, security aspects were defined for new procedures like EAS discovery via (V-)EASDF in roaming scenarios and for AI/ML model storage and sharing.
- Assistance to Member Selection Functionality for Application Operation TS 23.501CR3910
- Introduction of the MPQUIC Steering Functionality TS 23.501CR3973
- Update to UE member selection assistance functionality for application operation TS 23.501CR4622
- Security aspects of MSGin5G Service in rel-18 TS 33.501CR1565
- Security aspects of enhanced support of Non-Public Networks phase 2 TS 33.501CR1671
- Security of EAS discovery procedure via V-EASDF in roaming Scenario TS 33.501CR1741
+ 21 more changes
In Release 19, the SEAF function's enhancements are not explicitly detailed in the provided grounding context or Change Request titles. The listed CRs focus on other security and functionality areas such as UPF NAT, N6 delay measurement security, and trust anchoring for N32-f/PRINS, but do not specify new SEAF capabilities or procedures. Therefore, based solely on the given materials, no specific new feature for the SEAF in Release 19 can be described.
- Adding the NAT information exposure and Packet Inspection functionality in the UPF NF profile TS 23.501CR5420
- Exposure enhancements for static UE IP address assignment and 5G VN group's User Plane Security Policy TS 23.501CR5492
- Functional Description of Energy Efficiency Control Functionality TS 23.501CR5740
- NAT functionality in the UPF of BH PDU Session TS 23.501CR5650
- Adding security aspects of MSGin5G service Ph3 TS 33.501CR2047
- Security of Signalling Traffic Monitoring TS 33.501CR2089
+ 20 more changes
In Release 20, the SEAF's new functionality includes a defined procedure to make specific security parameters visible to RIs (Routing Instances). This enhancement is detailed alongside other system security updates, such as corrections for energy consumption calculations in specific PDU session scenarios.
Explore further
Broader topics and technologies where SEAF plays a role.
Defining Specifications
3GPP specifications that define or reference SEAF, with the latest known release. Sourced from the 3GPP document catalog — see methodology.
| Specification | Title | Release |
|---|---|---|
| TS 23.501 vk00 | 5G System Architecture Stage 2 | Rel-20 |
| TS 29.509 vj50 | AUSF Service Based Interface Protocol | Rel-19 |
| TS 33.501 vk00 | 5G Security Architecture and Procedures | Rel-20 |
| TR 33.741 vi01 | Home Network Triggered Authentication | Rel-18 |
| TS 33.835 vg10 | Study on authentication and key management for apps | Rel-16 |
| TR 33.841 vg10 | Security aspects; Study on 256-bit algorithms for 5G | Rel-16 |