3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security

Q: What does the Scope section cover in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the References section cover in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security?

The References section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Definitions section cover in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security?

The Definitions section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the NDS/IP Architecture section cover in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security?

The NDS/IP Architecture section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Domains and Zones section cover in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security?

The Security Domains and Zones section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.210 V18 — Network Domain Security; IP Network Layer Security. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.210

Network Domain Security (NDS); IP network layer security

V18.1.0 (2024-03) — Release 18 33-Series Security

1. Scope

▶

This specification defines the security mechanisms for protecting communication at the IP network layer between network elements. It covers IPsec-based protection of signaling and user plane traffic on reference points between 3GPP network elements.

This is the IPsec specification. TS 33.501 references this document for securing GTP-U (N3, N9), GTP-C, and other network domain interfaces. All NDS/IP IPsec deployments follow this spec.

2. References

▶

Ref	Document	Title	Link
[1]	IETF RFC 4301	Security Architecture for the Internet Protocol	RFC 4301
[2]	IETF RFC 4303	IP Encapsulating Security Payload (ESP)	RFC 4303
[3]	IETF RFC 7296	IKEv2	RFC 7296
[4]	IETF RFC 8221	Cryptographic Algorithm Implementation Requirements for ESP and AH	RFC 8221
[5]	IETF RFC 8247	Cryptographic Algorithm Implementation Requirements for IKEv2	RFC 8247
[6]	3GPP TS 33.310	NDS Authentication Framework (certificates)	Local \| Portal

3. Definitions

▶

Term	Definition
NDS/IP	Network Domain Security for IP-based protocols
SEG	Security Gateway — IPsec endpoint at security domain borders
Za interface	Interface between NE and SEG within a security domain
Zb interface	Interface between SEGs across security domains
ESP	Encapsulating Security Payload — IPsec protocol
SAD	Security Association Database
SPD	Security Policy Database

4. NDS/IP Architecture

▶

Security Domain A Security Domain B ┌─────────────────────────┐ ┌─────────────────────────┐ │ │ │ │ │ NE-A1 NE-A2 │ │ NE-B1 NE-B2 │ │ │ │ │ │ │ │ │ │ └────┬───┘ │ │ └───┬────┘ │ │ │ Za │ │ │ Za │ │ ┌────┴────┐ │ │ ┌────┴────┐ │ │ │ SEG-A │◄─────────────── Zb ──────────────►│ SEG-B │ │ │ └─────────┘ IPsec │ │ └─────────┘ │ │ tunnel │ │ │ └─────────────────────────┘ └─────────────────────────┘

Two deployment models for IPsec protection:

Model	Description	When Used
Hub-and-spoke (SEG)	NEs connect to a SEG via Za; SEGs connect via Zb IPsec tunnel	Cross-domain communication, inter-PLMN
End-to-end (NE-to-NE)	IPsec established directly between two NEs	Intra-domain direct protection (e.g., gNB↔UPF)

5. Security Domains and Zones

▶

Za Interface (NE to SEG)

▶

Za provides optional IPsec protection between NE and SEG within the same domain
If deployed on a physically secure internal network, Za protection may be omitted
When required: ESP in tunnel mode with IKEv2

Zb Interface (SEG to SEG)

▶

Zb provides mandatory IPsec protection between SEGs across security domain boundaries
ESP in tunnel mode is mandatory
Both confidentiality and integrity protection
IKEv2 with certificates (per TS 33.310) for mutual authentication

Inter-PLMN Zb is mandatory. All GTP and signaling traffic crossing PLMN boundaries must be protected by IPsec on the Zb interface.

6. IPsec Requirements

▶

ESP Requirements

▶

Requirement	Specification
Protocol	ESP (RFC 4303) — AH is NOT used
Mode	Tunnel mode (mandatory for Zb); Transport mode (optional for Za end-to-end)
Confidentiality	Mandatory on Zb; optional on Za
Integrity	Mandatory on all interfaces
Anti-replay	Mandatory with 64-bit extended sequence numbers
NAT traversal	Per RFC 3948 — required when NAT is present

IKEv2 Requirements

▶

Requirement	Specification
Version	IKEv2 (RFC 7296) — IKEv1 is NOT supported
Authentication	X.509 certificates (per TS 33.310); PSK NOT recommended for production
DH Groups	Group 14 (2048-bit MODP), Group 19 (256-bit ECP), Group 20 (384-bit ECP)
SA Lifetime	Configurable; rekeying must be supported
Dead Peer Detection	Mandatory (RFC 3706)

7. Key Management

▶

IKEv2 is the mandatory key management protocol
Certificate-based authentication is preferred (see TS 33.310)
Pre-shared keys may be used only for initial bootstrap; must be transitioned to certificates
SA rekeying must occur before key exhaustion
Perfect Forward Secrecy (PFS) is recommended (DH exchange during CHILD_SA rekeying)

8. Cryptographic Requirements

▶

Category	MUST Support	SHOULD Support	MUST NOT Use
ESP Encryption	AES-128-GCM, AES-256-GCM	AES-128-CBC, AES-256-CBC	DES, 3DES, NULL (on Zb)
ESP Integrity	AES-GMAC (with GCM), HMAC-SHA-256	HMAC-SHA-384, HMAC-SHA-512	HMAC-MD5, HMAC-SHA-1-96
IKEv2 Encryption	AES-128-GCM, AES-256-GCM	AES-128-CBC	DES, 3DES
IKEv2 PRF	PRF-HMAC-SHA-256	PRF-HMAC-SHA-384	PRF-HMAC-MD5
DH Groups	Group 14, 19, 20	Group 21 (521-bit ECP)	Groups 1, 2, 5

Deprecated algorithms must not be used: DES, 3DES, MD5, SHA-1, DH groups 1/2/5 are all prohibited.

9. GTP Traffic over IPsec

▶

When GTP-U or GTP-C traffic traverses untrusted networks, it must be protected by IPsec per this specification:

Interface	Protocol	IPsec Mode	Requirement
N3 (gNB↔UPF)	GTP-U	Tunnel or Transport	Required if not physically secured
N9 (UPF↔UPF)	GTP-U	Tunnel	Required for inter-domain
S1-U (eNB↔SGW)	GTP-U	Tunnel	Required if not physically secured
S5/S8 (SGW↔PGW)	GTP-U/C	Tunnel	Mandatory on S8 (inter-PLMN)
S11 (MME↔SGW)	GTP-C v2	Tunnel	Required if not physically secured
N4 (SMF↔UPF)	PFCP	Tunnel or TLS	Either IPsec or TLS

TR 33.926 §5.3.6.15 GTP traffic without IPsec is vulnerable to interception and injection ▶

Annex E — Recommended TLS/IPsec Cipher Suites

▶

Annex E of TS 33.210 is referenced by TS 33.501 clause 13.1 for SBI TLS cipher suite requirements. The following are the recommended suites:

Protocol	Cipher Suite	Status
TLS 1.3	`TLS_AES_128_GCM_SHA256`	MUST
TLS 1.3	`TLS_AES_256_GCM_SHA384`	MUST
TLS 1.2	`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`	MUST
TLS 1.2	`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`	MUST
TLS 1.2	`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`	SHOULD
IPsec ESP	ENCR_AES_GCM_16 (128-bit / 256-bit)	MUST
IPsec IKEv2	AES-GCM-128/256 + PRF-HMAC-SHA256 + ECP-256	MUST