Watch freeFree preview · Cryptographic inventory: where 5G uses key pairs — opens in the course player
5G Security: SUCI to Post-Quantum
On the 5G Security Engineer route →Security read the way a specification writes it: what is implemented against what is actually used, what a token reaches by default, what a protection policy may not lower, and which assurance evidence answers which question. It ends on post-quantum as an inventory exercise with owners and clocks, not a horizon.
The first module of every course, free
This course ends in a graded exam and a publicly verifiable TELCOMA certificate.
- Lessons
- 32
- Video
- ≈4.6h
- Hands-on
- 15 exercises
- Before you start
- 5G Core & E2E Specialist
About this course
Who it's for. Core and security engineers, interconnect and roaming teams, and anyone who has to answer an audit about a network they did not configure.
Career route. Part of the 5G Security Engineer route: 5G Foundation → 5G Core & E2E Specialist → 5G Security.
Before you start. 5G Core & E2E Specialist — this course opens the constructions that one seals, and reads the interfaces it builds. Comfort with the service-based architecture is assumed throughout.
This course includes
- 32 video lessons — the first needs no account, and Module 1 is free with one
- 15 hands-on exercises — interactive labs and checkpoints
- Study pack — question bank and slides
- A free mock exam to find your gaps
- Certification exam and a QR-verifiable certificate — with Prime Membership or this certification
- “Stuck?” help on every exercise — a nudge, the method, the worked answer, and the lesson moment to rewatch
Skills you'll gain
- SUCI & ECIES
- 5G-AKA & EAP-AKA′
- SBI mutual TLS & OAuth tokens
- SEPP & N32 security
- Slice isolation
- NESAS & SCAS
- Post-quantum migration
Syllabus
7 modules · 32 lessons · certification exam
Module 1 — Cryptographic inventory, threat register and SUCI concealment
Sort the estate into symmetric-only and asymmetric surfaces, write threat-register rows carrying an attacker level, and walk a SUCI stage by stage.
4 lessons · 1 lab · 2 checkpoints · ≈36 min
- Lesson 1Cryptographic inventory: where 5G uses key pairsWatch free9:04
- Lesson 2Threat-model register: assets before adversariesFree with an account9:04
- Lesson 3SUCI concealment with ECIES: confidentiality, not authenticationFree with an account8:55
- Lesson 4Protection scheme identifiers: provisioned, selected, computed whereFree with an account8:31
- CheckpointFollow the Key to Its Parent · Checkpoint~8 min
- CheckpointSeal It, Then Open It · Checkpoint~9 min
- Interactive labRead the SIM's Scheme List · Interactive lab~8 min
Module 2 — Identity exposure, credentials and the keys below the anchor
Map identity exposure per access type, tell 5G-AKA from EPS-AKA by what the response binds, and inventory every key below the anchor.
6 lessons · 1 lab · 2 checkpoints · ≈51 min
- Lesson 1Identity exposure after SUCI: concealment is not unlinkabilityPrime Membership10:10
- Lesson 25G-AKA versus EPS-AKA: the response binds the networkPrime Membership8:41
- Lesson 3EAP-AKA′: the second primary method, same anchorPrime Membership7:33
- Lesson 4NAS, RRC and user-plane keys: two parents, six keysPrime Membership7:57
- Lesson 5NAS Security Mode Command: how bidding-down is caughtPrime Membership8:04
- Lesson 6NSSAA: slice authorisation with someone else’s credentialsPrime Membership8:18
- CheckpointWhat Did They Walk Away With · Checkpoint~9 min
- Interactive labFlip the Serving Network · Interactive lab~7 min
- CheckpointDoes the Phone Accept This Command? · Checkpoint~8 min
Module 3 — The service-based interface: TLS, tokens and delegated trust
Record what mutual TLS each SBI segment actually uses, read NRF access-token claims and lifetimes, and score 3GPP against the zero-trust tenets.
5 lessons · 1 lab · 1 checkpoint · ≈47 min
- Lesson 1Mutual TLS on the SBI: support is not usePrime Membership9:58
- Lesson 2NRF Access-Token Claims: type-level by defaultPrime Membership9:02
- Lesson 3NRF Access-Token Theft: containment without revocationPrime Membership9:19
- Lesson 4SCP Indirect Communication: what the proxy removesPrime Membership9:15
- Lesson 5Zero-Trust Tenets Against 3GPP: the scored gapPrime Membership9:54
- Interactive labHow Far Does the Pass Reach? · Interactive lab~10 min
- CheckpointThree Answers per Segment · Checkpoint~8 min
Module 4 — N32 interconnect beyond the border guard
Pick the N32 mode each roaming path demands, enforce PRINS modification policy, and read every SEPP hardening requirement by the failure it prevents.
4 lessons · 2 labs · ≈34 min
- Lesson 1N32-c and N32-f: the rule that picks the modePrime Membership9:17
- Lesson 2PRINS on N32-f: encrypt some, sign the editsPrime Membership9:01
- Lesson 3N32-f protection floor: what the protection policy cannot lowerPrime Membership6:50
- Lesson 4SEPP hardening requirements: read each one by its failurePrime Membership8:45
- Interactive labWhat the Middle Can Read · Interactive lab~10 min
- Interactive labRun the Day’s Traffic Through Your SEPP · Interactive lab~10 min
Module 5 — Transport, substrate, slices and the management plane
Decide where transport IPsec is used rather than merely implemented, test the assumptions a virtualised function cannot check, and read assurance evidence honestly.
5 lessons · 1 lab · 1 checkpoint · ≈35 min
- Lesson 1RAN transport IPsec: implemented, then decidedPrime Membership8:04
- Lesson 2Virtualised network-function trust: four assumptions to verifyPrime Membership7:57
- Lesson 3Slice isolation security: what an SLA can promisePrime Membership5:23
- Lesson 4OAM and orchestration plane: where recorded intrusions landedPrime Membership7:05
- Lesson 5NESAS and SCAS: what assurance evidence provesPrime Membership6:43
- CheckpointWhat the Folder Proves · Checkpoint~7 min
- Interactive labDraw the Perimeter · Interactive lab~8 min
Module 6 — Post-quantum readiness: the honest threat model
Separate what Shor breaks from what Grover weakens, class every asset as harvest, forge or SUCI risk, and name who owns each migration.
4 lessons · 2 checkpoints · ≈36 min
- Lesson 1Shor versus Grover on 5G: what breaks, what weakensPrime Membership8:32
- Lesson 2Harvest-now, forge-later and SUCI: three exposure timelinesPrime Membership8:27
- Lesson 3Asymmetric surface map: who owns each migrationPrime Membership10:05
- Lesson 4Cryptographic agility and diversity: a slot, not a weldPrime Membership9:22
- CheckpointWhat They Had to Hold Already · Checkpoint~7 min
- CheckpointConfiguration Change or Re-provision? · Checkpoint~9 min
Module 7 — Post-quantum readiness: the migration
Rank the GSMA migration phases against your own inventory, weigh standalone against hybrid SUCI profiles, and match each asset to the clock that binds it.
4 lessons · 1 checkpoint · ≈37 min
- Lesson 1GSMA post-quantum migration phases: the ranking is yoursPrime Membership8:06
- Lesson 2Post-quantum SUCI profiles: standalone and hybrid, bothPrime Membership9:56
- Lesson 3Hybrid key exchange in IKEv2: the measured costPrime Membership9:20
- Lesson 4Post-quantum migration clocks: which one binds which assetPrime Membership9:22
- CheckpointEvery Row Names Its Source · Checkpoint~9 min
Certification exam
Earns a certificate49 questions · 60 min · 65% to pass — earns your TELCOMA Certified 5G Security Specialist, a QR-verifiable certificate.
Not ready yet? Take a free 20-question mock exam first.
Look up any acronym in the telecom glossary
Certification
Earn the TELCOMA Certified 5G Security Specialist
Pass the 49-question exam with 65% or more, and you hold a certificate any employer can check.
- Show any employerEvery certificate is numbered, with a QR code to a public verification page anyone can check.
- Add it to LinkedInUnder Licenses & certifications on your profile, in one click.
- Build your routeEvery course on a career route earns its own certificate — 13 courses in all.
The first module free with an account, no card. The exam comes with Prime Membership or this certification.
Study materials
PrimeDownload the 5G Security: SUCI to Post-Quantum question bank and slide deck — every signal check in the course, with answers, plus every figure.
- Question BankPDF45 KB
- Slide DeckPPTX21 MB
The question bank and slides come with Prime Membership or this certification. A free account opens the first module of every course — no card.
Hands-on learning
Do it, don't just watch it
Modules end with a hands-on exercise — 15 in this course. You move the controls, the numbers answer back, and a wrong turn tells you why.
Stuck? Every exercise points you to the exact lesson moment to rewatch, and TelcoMentor answers on the exercise itself. TelcoMentor comes with Prime Membership.
Try this one first:
Follow the Key to Its Parent · Checkpoint · ~8 min
Try it freeFree with an account — no card.
What you'll build
3 of 15 — the rest are in the syllabus
- Lab 1FreeRead the SIM's Scheme ListWrite a subscriber’s SUCI settings and watch two handset generations read them. Then work field tickets on batches somebody else provisioned, and read a whole estate for the conditions that put a subscription number in the clear.Module 1~8 min
- Lab 2Flip the Serving NetworkThe phone and the serving core disagree about which network this is. Predict how authentication ends in 5G and in 4G, fix the core’s name, and call the configuration that only one generation catches.Module 2~7 min
- Lab 3How Far Does the Pass Reach?Set up a call on the service bus, read the pass it produces and call how far it reaches before you run it — then hand a copy to somebody it was never issued to, and call what stops it, and when.Module 3~10 min
Ways to learn
One certification, or every career route.
| Feature | This certification Price loadingonce One credential, yours for good | Recommended Prime Membership Price loadingonce, for life 13 courses · 404 lessons · ~52 h · 184 hands-on exercises | Free account Free The first module of every course |
|---|---|---|---|
| Lessons and labs in this course | First module | ||
| Study pack — question bank and slides | |||
| Certification exams and verifiable certificates | 1, for this course | All 13 | |
| Every other course | First module | All, and new ones | First module |
| Full-length practice exams | |||
| TelcoMentor AI coach | |||
| Hands-on scenarios — traces, logs, configs | Selected traces | Selected traces | |
One payment · no renewal | Get Prime Membership You create a free account first, then go straight to Prime. Paid once · nothing to renew | Join for free No card needed |
Prime Membership
Price loadingonce, for life
13 courses · 404 lessons · ~52 h · 184 hands-on exercises
- Lessons and labs in this course
- Study pack — question bank and slides
- Certification exams and verifiable certificates — all 13
- Every other course — all, and new ones
- Full-length practice exams
- TelcoMentor AI coach
- Hands-on scenarios — traces, logs, configs
You create a free account first, then go straight to Prime.
Paid once · nothing to renew
This certification
Price loadingonce
One credential, yours for good
- Lessons and labs in this course
- Study pack — question bank and slides
- Certification exams and verifiable certificates — 1, for this course
- Every other course — first module
- Not included: Full-length practice exams
- Not included: TelcoMentor AI coach
- Hands-on scenarios — traces, logs, configs — selected traces
One payment · no renewal
Free account
Free
The first module of every course
- Lessons and labs in this course — first module
- Not included: Study pack — question bank and slides
- Not included: Certification exams and verifiable certificates
- Every other course — first module
- Not included: Full-length practice exams
- Not included: TelcoMentor AI coach
- Hands-on scenarios — traces, logs, configs — selected traces
No card needed
A free account opens the first module of every course, for good — no card needed. Both paid options come with a 7-day money-back guarantee.
Explore more courses
See all 13 courses →
Telco CloudKubernetes for CNFsStatefulSets & probesCPU pinning & HugePagesAdvanced36 lessons~4.7h
Private 5GSNPN & PNI-NPN designNetwork function placementEAP-TLS & credentials holdersIntermediate34 lessons~3.6h
RedCap, eRedCap & Ambient IoTIoT device-class selectionRedCap & eRedCap trade-offsIoT link budgetsIntermediate29 lessons~3h