Watch freeFree preview · Cryptographic inventory: where 5G uses key pairs — opens in the course player
5G Security: SUCI to Post-Quantum
Security read the way a specification writes it: what is implemented against what is actually used, what a token reaches by default, what a protection policy may not lower, and which assurance evidence answers which question. It ends on post-quantum as an inventory exercise with owners and clocks, not a horizon.
Every 5G & 6G course free for 7 days
- Lessons
- 32
- Video
- ≈4.6h
- Hands-on
- 2 labs · 5 checkpoints
- Before you start
- 5G Core & E2E Specialist
About this course
Who it's for. Core and security engineers, interconnect and roaming teams, and anyone who has to answer an audit about a network they did not configure.
Before you start. 5G Core & E2E Specialist — this course opens the constructions that one seals, and reads the interfaces it builds. Comfort with the service-based architecture is assumed throughout.
This course includes
- 32 video lessons — the first needs no account, and all are free for your first 7 days
- Hands-on labs and checkpoints
- Study pack — question bank and slides
- A free mock exam to find your gaps
- Certification exam and a QR-verifiable certificate
Skills you'll gain
- SUCI & ECIES
- 5G-AKA & EAP-AKA′
- SBI mutual TLS & OAuth tokens
- SEPP & N32 security
- Slice isolation
- NESAS & SCAS
- Post-quantum migration
Syllabus
7 modules · 32 lessons · certification exam
Module 1 — Cryptographic inventory, threat register and SUCI concealment
Sort the estate into symmetric-only and asymmetric surfaces, write threat-register rows carrying an attacker level, and walk a SUCI stage by stage.
4 lessons · 1 checkpoint · ≈36 min
- Lesson 1Cryptographic inventory: where 5G uses key pairsWatch free9:04
- Lesson 2Threat-model register: assets before adversariesFree with an account9:04
- Lesson 3SUCI concealment with ECIES: confidentiality, not authenticationFree with an account8:55
- Lesson 4Protection scheme identifiers: provisioned, selected, computed whereFree with an account8:31
- CheckpointFollow the Key to Its Parent · Checkpoint~7 min
Module 2 — Identity exposure, credentials and the keys below the anchor
Map identity exposure per access type, tell 5G-AKA from EPS-AKA by what the response binds, and inventory every key below the anchor.
6 lessons · 1 checkpoint · ≈51 min
- Lesson 1Identity exposure after SUCI: concealment is not unlinkabilityFree for 7 days with a free account, then with Prime Membership10:10
- Lesson 25G-AKA versus EPS-AKA: the response binds the networkFree for 7 days with a free account, then with Prime Membership8:41
- Lesson 3EAP-AKA′: the second primary method, same anchorFree for 7 days with a free account, then with Prime Membership7:33
- Lesson 4NAS, RRC and user-plane keys: two parents, six keysFree for 7 days with a free account, then with Prime Membership7:57
- Lesson 5NAS Security Mode Command: how bidding-down is caughtFree for 7 days with a free account, then with Prime Membership8:04
- Lesson 6NSSAA: slice authorisation with someone else’s credentialsFree for 7 days with a free account, then with Prime Membership8:18
- CheckpointWhat Did They Walk Away With · Checkpoint~7 min
Module 3 — The service-based interface: TLS, tokens and delegated trust
Record what mutual TLS each SBI segment actually uses, read NRF access-token claims and lifetimes, and score 3GPP against the zero-trust tenets.
5 lessons · 1 lab · ≈47 min
- Lesson 1Mutual TLS on the SBI: support is not useFree for 7 days with a free account, then with Prime Membership9:58
- Lesson 2NRF Access-Token Claims: type-level by defaultFree for 7 days with a free account, then with Prime Membership9:02
- Lesson 3NRF Access-Token Theft: containment without revocationFree for 7 days with a free account, then with Prime Membership9:19
- Lesson 4SCP Indirect Communication: what the proxy removesFree for 7 days with a free account, then with Prime Membership9:15
- Lesson 5Zero-Trust Tenets Against 3GPP: the scored gapFree for 7 days with a free account, then with Prime Membership9:54
- Interactive labHow Far Does the Pass Reach? · Interactive lab~8 min
Module 4 — N32 interconnect beyond the border guard
Pick the N32 mode each roaming path demands, enforce PRINS modification policy, and read every SEPP hardening requirement by the failure it prevents.
4 lessons · 1 lab · ≈34 min
- Lesson 1N32-c and N32-f: the rule that picks the modeFree for 7 days with a free account, then with Prime Membership9:17
- Lesson 2PRINS on N32-f: encrypt some, sign the editsFree for 7 days with a free account, then with Prime Membership9:01
- Lesson 3N32-f protection floor: what the protection policy cannot lowerFree for 7 days with a free account, then with Prime Membership6:50
- Lesson 4SEPP hardening requirements: read each one by its failureFree for 7 days with a free account, then with Prime Membership8:45
- Interactive labWhat the Middle Can Read · Interactive lab~8 min
Module 5 — Transport, substrate, slices and the management plane
Decide where transport IPsec is used rather than merely implemented, test the assumptions a virtualised function cannot check, and read assurance evidence honestly.
5 lessons · 1 checkpoint · ≈35 min
- Lesson 1RAN transport IPsec: implemented, then decidedFree for 7 days with a free account, then with Prime Membership8:04
- Lesson 2Virtualised network-function trust: four assumptions to verifyFree for 7 days with a free account, then with Prime Membership7:57
- Lesson 3Slice isolation security: what an SLA can promiseFree for 7 days with a free account, then with Prime Membership5:23
- Lesson 4OAM and orchestration plane: where recorded intrusions landedFree for 7 days with a free account, then with Prime Membership7:05
- Lesson 5NESAS and SCAS: what assurance evidence provesFree for 7 days with a free account, then with Prime Membership6:43
- CheckpointWhat the Folder Proves · Checkpoint~6 min
Module 6 — Post-quantum readiness: the honest threat model
Separate what Shor breaks from what Grover weakens, class every asset as harvest, forge or SUCI risk, and name who owns each migration.
4 lessons · 1 checkpoint · ≈36 min
- Lesson 1Shor versus Grover on 5G: what breaks, what weakensFree for 7 days with a free account, then with Prime Membership8:32
- Lesson 2Harvest-now, forge-later and SUCI: three exposure timelinesFree for 7 days with a free account, then with Prime Membership8:27
- Lesson 3Asymmetric surface map: who owns each migrationFree for 7 days with a free account, then with Prime Membership10:05
- Lesson 4Cryptographic agility and diversity: a slot, not a weldFree for 7 days with a free account, then with Prime Membership9:22
- CheckpointWhat They Had to Hold Already · Checkpoint~6 min
Module 7 — Post-quantum readiness: the migration
Rank the GSMA migration phases against your own inventory, weigh standalone against hybrid SUCI profiles, and match each asset to the clock that binds it.
4 lessons · 1 checkpoint · ≈37 min
- Lesson 1GSMA post-quantum migration phases: the ranking is yoursFree for 7 days with a free account, then with Prime Membership8:06
- Lesson 2Post-quantum SUCI profiles: standalone and hybrid, bothFree for 7 days with a free account, then with Prime Membership9:56
- Lesson 3Hybrid key exchange in IKEv2: the measured costFree for 7 days with a free account, then with Prime Membership9:20
- Lesson 4Post-quantum migration clocks: which one binds which assetFree for 7 days with a free account, then with Prime Membership9:22
- CheckpointEvery Row Names Its Source · Checkpoint~7 min
Certification exam
Earns a certificate49 questions · 60 min · 65% to pass — earns your TELCOMA Certified 5G Security Specialist, a QR-verifiable certificate.
Not ready yet? Take a free 20-question mock exam first.
Look up any acronym in the telecom glossary
Certification
Earn the TELCOMA Certified 5G Security Specialist
Pass the 49-question exam with 65% or more, and the certificate is yours to show anyone.
- Show proofEvery certificate carries a QR code and a public page that anyone can check.
- Add it to LinkedInPut it in the Licenses & certifications section of your profile in one click.
- Build a collectionEach of our 11 courses earns its own certificate.
Study materials
Download the 5G Security: SUCI to Post-Quantum question bank and slide deck — every signal check in the course, with answers, plus every figure.
- Question BankPDF45 KB
- Slide DeckPPTX21 MB
Hands-on learning
Do it, don't just watch it
Modules end with a hands-on exercise — 2 labs · 5 checkpoints in this course. You move the controls, the numbers answer back, and a wrong turn tells you why.
Try this one first:
Follow the Key to Its Parent · Checkpoint · ~7 min
Try it freeFree with an account — no card.
What you'll build
3 of 7 — the rest are in the syllabus
- Lab 1How Far Does the Pass Reach?Assemble a call on the service bus, read what its pass opens — then hand a copy to somebody it was never issued to and see what is left standing.Module 3~8 min
- Lab 2What the Middle Can ReadOne roaming border. Settle what sits in the path, take the mode the specification leaves you, then switch the policy on one kind at a time and watch how little moves.Module 4~8 min
- CheckpointFreeFollow the Key to Its ParentNine parts of one reference network, filed by where their keys came from rather than by the algorithm sitting on the row.Module 1~7 min
Ways to learn
Choose the way that fits you.
| Feature | This certification Price loadingonce One credential, yours for good | Recommended Prime Membership Price loading/year Every course, including new ones | Free account Free Every course for your first 7 days, then the first module of each |
|---|---|---|---|
| Lessons and labs in this course | All for your first 7 days, then the first module | ||
| Study pack — question bank and slides | For your first 7 days | ||
| Certification exam and verifiable certificate | This course | Every course | |
| Every other course | First module | All, and new ones | All for your first 7 days, then the first module |
| Full-length practice exams | For your first 7 days | ||
| TelcoMentor AI coach | For your first 7 days, at a smaller daily limit | ||
| Hands-on scenarios — traces, logs, configs | Selected traces | All for your first 7 days, then selected traces | |
One payment · no renewal | See Prime Membership Renews yearly · cancel anytime | Join for free No card needed |
This certification
Price loadingonce
One credential, yours for good
- Lessons and labs in this course
- Study pack — question bank and slides
- Certification exam and verifiable certificate — this course
- Every other course — first module
- Not included: Full-length practice exams
- Not included: TelcoMentor AI coach
- Hands-on scenarios — traces, logs, configs — selected traces
One payment · no renewal
Prime Membership
Price loading/year
Every course, including new ones
- Lessons and labs in this course
- Study pack — question bank and slides
- Certification exam and verifiable certificate — every course
- Every other course — all, and new ones
- Full-length practice exams
- TelcoMentor AI coach
- Hands-on scenarios — traces, logs, configs
Renews yearly · cancel anytime
Free account
Free
Every course for your first 7 days, then the first module of each
- Lessons and labs in this course — all for your first 7 days, then the first module
- Study pack — question bank and slides — for your first 7 days
- Not included: Certification exam and verifiable certificate
- Every other course — all for your first 7 days, then the first module
- Full-length practice exams — for your first 7 days
- TelcoMentor AI coach — for your first 7 days, at a smaller daily limit
- Hands-on scenarios — traces, logs, configs — all for your first 7 days, then selected traces
No card needed
A new free account opens every course for its first 7 days, no card needed: every lesson and lab, the study packs, the full-length practice exams and TelcoMentor. In those 7 days only the certification exam needs a paid option. After them, the first module of every course stays free. Both paid options come with a 7-day money-back guarantee.
