3GPP TS 29.500
5G System — Technical Realization of Service Based Architecture — Stage 3
V18.6.0 (2024-06) 29-Series Protocol 1. Scope
▶Defines the technical framework for the 5G Service-Based Interface (SBI) — the HTTP/2 API layer that interconnects all 5G Core Network Functions. SBI replaces the point-to-point reference point model (N-interfaces) with a service-oriented approach where NFs expose services consumed by other NFs.
Security impact: SBI is the attack surface for the entire 5G core. Every NF-to-NF communication traverses SBI — making its security framework (TLS, OAuth 2.0, SCP) critical. See TS 33.501 §13 for security requirements.
2. SBI Architecture
▶
5G Core SBI Architecture:
┌─────────── SBI (HTTP/2) ───────────┐
│ │
┌──────┤ ┌─────┐ ┌─────┐ ┌─────┐ │
│ NRF ├─────┤ AMF ├───┤ SMF ├───┤ UDM │ │
│ │ └──┬──┘ └──┬──┘ └─────┘ │
└──────┤ │ │ │
│ ┌──┴──┐ ┌──┴──┐ ┌─────┐ │
│ │ PCF ├───┤ NEF ├───┤ NSSF│ │
│ └─────┘ └─────┘ └─────┘ │
│ │
│ ┌─────┐ ┌─────┐ ┌─────┐ │
│ │ AUSF├───┤ UDR ├───┤ CHF │ │
│ └─────┘ └─────┘ └─────┘ │
└──────────────────────────────────────┘
All NFs connect to the common SBI bus
NRF provides discovery and authorization
Each NF exposes services as RESTful APIs
| NF Service | API Prefix | Key Operations |
|---|---|---|
| Namf | /namf-comm/ | N1N2 message transfer, EBI assignment |
| Nsmf | /nsmf-pdusession/ | PDU session create/update/release |
| Nudm | /nudm-sdm/ | Subscriber data management |
| Nausf | /nausf-auth/ | UE authentication |
| Nnrf | /nnrf-disc/ | NF discovery, access token |
| Npcf | /npcf-smpolicycontrol/ | SM policy create/update/delete |
| Nnef | /nnef-eventexposure/ | Event subscription, monitoring |
3. HTTP/2 Transport Layer
▶| Parameter | SBI Requirement | Security Relevance |
|---|---|---|
| Protocol | HTTP/2 (RFC 7540) mandatory | Multiplexing reduces connection overhead |
| TLS Version | TLS 1.2+ mandatory, TLS 1.3 recommended | Channel encryption for all SBI traffic |
| Content Type | application/json (primary) | JSON parsing vulnerabilities apply |
| Encoding | Transfer-Encoding: chunked supported | Chunked encoding attacks possible |
| Streaming | Server-sent events for notifications | Long-lived connections need monitoring |
| URI Scheme | https:// mandatory for production | Certificate validation required |
SBI Request/Response Flow:
NF Consumer NF Producer
────────── ──────────
│ │
│──── HTTP/2 POST /nsmf-pdusession/v1/... ────▷│
│ Headers: │
│ :method = POST │
│ :path = /nsmf-pdusession/v1/... │
│ content-type: application/json │
│ 3gpp-Sbi-Target-apiRoot: ... │
│ Authorization: Bearer <token> │
│ │
│◁──── 201 Created ────────────────────────────│
│ Location: /nsmf-pdusession/v1/.../123 │
│ Body: { smContextRef: "..." } │
│ │
4. Service Discovery (NRF)
▶The NRF (NF Repository Function) is the central registry for all NF service instances. NFs register their profiles and discover other NFs through NRF APIs.
NF Registration & Discovery:
┌───────┐ ┌───────┐ ┌───────┐
│ AMF │ │ NRF │ │ SMF │
└───┬───┘ └───┬───┘ └───┬───┘
│ │ │
│── PUT /nnrf-nfm/v1/nf-instances/{id} ▷│ NF Registration
│◁──── 201 Created ─│ │
│ │ │
│ │◁── PUT /nnrf-nfm/ ──│ NF Registration
│ │──── 201 Created ──▷│
│ │ │
│── GET /nnrf-disc/v1/nf-instances? ────▷│ Discovery Query
│ service-names=nsmf-pdusession │ (find SMF)
│◁──── 200 OK ──────│ │
│ { nfInstances: [ │
│ { nfInstanceId: "smf-01", │
│ ipv4Addresses: ["10.0.1.5"], │
│ nfServices: [...] } │
│ ]} │
│ │ │
| Discovery Parameter | Description | Security Note |
|---|---|---|
| service-names | Filter by NF service name | Prevent enumeration of all services |
| target-nf-type | Filter by NF type (AMF, SMF, etc.) | Scope results to authorized types |
| requester-nf-type | Identify requesting NF type | NRF enforces access policy per type |
| target-plmn-list | Filter by PLMN for roaming | Prevent cross-PLMN discovery leaks |
| snssais | Filter by network slice | Enforce slice-level isolation |
5. Service Authorization (OAuth 2.0)
▶
OAuth 2.0 Token Flow for SBI:
NF Consumer NRF (Auth Server) NF Producer
────────── ───────────────── ──────────
│ │ │
│── POST /oauth2/token ─▷│ │
│ grant_type= │ │
│ client_credentials │ │
│ scope=nsmf-pdusession │ │
│ target_nf_instance_id │ │
│ │ │
│◁── 200 OK ────────────│ │
│ { access_token: JWT, │ │
│ token_type: Bearer,│ │
│ expires_in: 3600 } │ │
│ │ │
│── POST /nsmf-pdusession ──────────────────────▷│
│ Authorization: Bearer <JWT> │
│ │ │
│ │ NF Producer │
│ │ validates JWT: │
│ │ - signature │
│ │ - expiry │
│ │ - scope │
│ │ - audience │
│◁── 201 Created ───────────────────────────────│
│ │ │
| JWT Claim | Content | Verification |
|---|---|---|
| iss | NRF NF Instance ID | Must match known NRF |
| sub | Consumer NF Instance ID | Must match TLS client cert |
| aud | Producer NF Instance ID or type | Must match receiving NF |
| scope | Authorized service names | Must include requested service |
| exp | Token expiration timestamp | Must not be expired |
6. Communication Models
▶6.1 Direct Communication
▶
Model A — Direct with Discovery:
Consumer ──discover──▷ NRF ──response──▷ Consumer ──call──▷ Producer
Model B — Direct with Local Cache:
Consumer uses cached NF profiles (from previous discovery)
Consumer ──call──▷ Producer (no NRF query)
TLS: mTLS between Consumer and Producer. Each NF validates the other's certificate.
6.2 Indirect Communication (via SCP)
▶
Model C — Indirect with Delegated Discovery:
Consumer ──call──▷ SCP ──discover──▷ NRF
SCP ──forward──▷ Producer
SCP ◁── response ── Producer
Consumer ◁──response── SCP
Model D — Indirect without Delegated Discovery:
Consumer ──discover──▷ NRF
Consumer ──call──▷ SCP ──forward──▷ Producer
Consumer ◁──response── SCP
SCP Security: SCP sees all traffic → potential single point of compromise. mTLS required on both hops (Consumer↔SCP and SCP↔Producer). OAuth tokens validated at both SCP and Producer. See TS 33.527 (SCP SCAS).
7. Custom 3GPP SBI Headers
▶| Header | Purpose | Security Concern |
|---|---|---|
| 3gpp-Sbi-Target-apiRoot | Target NF API root (for SCP routing) | Spoofing → route to rogue NF |
| 3gpp-Sbi-Callback | Callback URI for async responses | SSRF via crafted callback URI |
| 3gpp-Sbi-Routing-Binding | Bind requests to specific NF instance | Session fixation if manipulated |
| 3gpp-Sbi-Discovery-* | Delegated discovery parameters | NF enumeration via broad queries |
| 3gpp-Sbi-Oci | Overload Control Information | Fake congestion → DoS redirection |
| 3gpp-Sbi-Max-Forward-Hops | Prevent routing loops | Set to 0 → immediate rejection |
| 3gpp-Sbi-Producer-Id | Identify producing NF | Must match TLS cert identity |
8. Error Handling & Resilience
▶| HTTP Status | 3GPP Usage | ProblemDetails cause |
|---|---|---|
| 307 / 308 | NF redirect (temporary/permanent) | TARGET_NF_MOVED |
| 400 | Malformed request / invalid IE | MANDATORY_IE_INCORRECT |
| 401 | Authentication failure | Authentication credential missing/invalid |
| 403 | Authorization failure | UNAUTHORIZED_NF, SLICE_NOT_ALLOWED |
| 404 | Resource not found | CONTEXT_NOT_FOUND, SUBSCRIPTION_NOT_FOUND |
| 429 | Rate limiting / overload | NF_CONGESTION, Retry-After header |
| 503 | Service unavailable | NF_CONGESTION_RISK, Retry-After header |
| 504 | Upstream NF timeout | UPSTREAM_CONNECTION_TIMEOUT |
9. Security Considerations
▶| Attack Vector | Mechanism | Mitigation |
|---|---|---|
| Rogue NF Registration | Attacker registers fake NF in NRF → receives redirected traffic | mTLS for NF registration, NRF validates NF type against cert |
| OAuth Token Theft | Stolen JWT used to impersonate consumer NF | Token binding to TLS cert, short expiry, audience validation |
| API Parameter Injection | Crafted JSON payloads exploit NF parsing | Strict OpenAPI schema validation, input sanitization |
| SSRF via Callbacks | Malicious callback URI targets internal services | Allowlist callback domains, validate against NF profile |
| Header Spoofing | Forged 3gpp-Sbi-* headers alter routing/identity | SCP/Producer must validate headers against TLS identity |
| Discovery Enumeration | Broad NRF queries reveal network topology | NRF enforces per-NF-type access policies on discovery |