3GPP TS 33.511 V18 — ng-eNB SCAS

Q: What does the Scope section cover in 3GPP TS 33.511 V18 — ng-eNB SCAS?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.511 V18 — ng-eNB SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the ng-eNB Architecture section cover in 3GPP TS 33.511 V18 — ng-eNB SCAS?

The ng-eNB Architecture section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.511 V18 — ng-eNB SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the ng-eNB Threat Analysis section cover in 3GPP TS 33.511 V18 — ng-eNB SCAS?

The ng-eNB Threat Analysis section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.511 V18 — ng-eNB SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Requirements section cover in 3GPP TS 33.511 V18 — ng-eNB SCAS?

The Security Requirements section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.511 V18 — ng-eNB SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Test Cases section cover in 3GPP TS 33.511 V18 — ng-eNB SCAS?

The Test Cases section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.511 V18 — ng-eNB SCAS. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.511

Security Assurance Specification (SCAS) for the next generation Node B (ng-eNB)

V18.3.0 (2024-06) — Release 18 SCAS

1. Scope

▶

Specifies security assurance requirements and test cases for the ng-eNB — an evolved LTE eNB that connects to the 5G Core Network (5GC) via the N2/N3 interfaces, enabling LTE radio access within 5G System architecture (EN-DC and standalone).

ng-eNB vs gNB: The ng-eNB provides LTE (E-UTRA) radio using existing eNB hardware/software but connects to the 5GC AMF/UPF instead of the EPC MME/SGW. It's the bridge between 4G radio and 5G core.

2. ng-eNB Architecture

▶

5G Core ┌──────┐ ┌──────┐ │ AMF │ │ UPF │ └──┬───┘ └──┬───┘ N2 │ (NGAP) N3 │ (GTP-U) │ │ ┌──▼──────────────────▼──┐ │ ng-eNB │ │ ┌──────────────────┐ │ │ │ E-UTRA (LTE) │ │ │ │ Radio Protocol │ │ │ └──────────────────┘ │ └──────────┬─────────────┘ Uu │ (LTE air interface) │ ┌───▼────┐ │ UE │ └────────┘ Xn interface: ng-eNB ◄────► gNB (handover) X2 interface: ng-eNB ◄────► eNB (legacy interworking)

Interface	Protocol	Peer	Function
N2	NGAP / SCTP	AMF	NAS transport, handover, paging
N3	GTP-U / UDP	UPF	User plane tunneling
Xn	XnAP / SCTP, GTP-U	gNB, ng-eNB	Inter-node handover
X2	X2AP / SCTP	eNB	LTE interworking
Uu	E-UTRA RRC	UE	Radio resource control

3. ng-eNB Threat Analysis

▶

TR 33.926 §5.3.6.5 GTP-U attacks on N3 ▶

TR 33.926 §5.3.8.1 Physical access to RAN equipment ▶

Threat	Vector	Impact
Rogue ng-eNB	Unauthorized base station impersonating legitimate ng-eNB on N2/N3	MITM on user traffic, NAS interception
Physical Tampering	Physical access to cell site equipment (exposed location)	Key extraction, firmware modification
Xn Handover Exploit	Spoofed Xn handover to force UEs onto rogue cell	UE hijacking, downgrade attacks
RRC Injection	Man-in-the-middle on Uu before AS security activation	Bidding-down, measurement manipulation
N3 GTP-U Manipulation	TEID spoofing, GTP-in-GTP injection on N3	Traffic interception, data injection
X2/Xn Information Leak	Unprotected X2/Xn carries UE context, handover cause	Subscriber tracking across cells

4. Security Requirements

▶

Req ID	Requirement	Category
NB-R1	IPsec for N2 and N3 when transported over untrusted networks	Transport Security
NB-R2	IPsec for Xn interface (inter-node handover)	Transport Security
NB-R3	Secure boot with integrity verification of firmware	Platform Security
NB-R4	Physical tamper detection and key zeroization	Physical Security
NB-R5	NAS integrity protection before forwarding to AMF	Protocol Security
NB-R6	AS security activation before user plane data transfer	Air Interface
NB-R7	Certificate-based authentication for N2/Xn peers	Authentication

5. Test Cases

▶

TC-NB-01: N3 IPsec Validation

Mandatory

Objective: Verify ng-eNB supports IPsec ESP on N3 interface to UPF.

Procedure: Configure IPsec on N3 → verify GTP-U tunnel establishment over IPsec → verify plaintext GTP-U rejected when IPsec required.

TC-NB-02: Secure Boot Verification

Mandatory

Objective: Verify ng-eNB validates firmware integrity at boot.

Procedure: Modify firmware image → attempt boot → verify rejection of tampered image.

TC-NB-03: Xn Peer Authentication

Mandatory

Objective: Verify ng-eNB authenticates Xn peers before handover.

Procedure: Attempt Xn Setup from unauthenticated peer → verify rejection.

TC-NB-04: Physical Tamper Response

Conditional

Objective: Verify ng-eNB detects physical enclosure breach and zeroizes keys.

Procedure: Trigger tamper switch → verify key material erased, alert generated.

TC-NB-05: AS Security Activation

Mandatory

Objective: Verify ng-eNB does not send user plane data before AS security mode completion.

Procedure: Monitor N3 → verify no GTP-U user data sent before Security Mode Complete on Uu.

3GPP TS 33.511

1. Scope

2. ng-eNB Architecture

3. ng-eNB Threat Analysis

4. Security Requirements

5. Test Cases

TC-NB-01: N3 IPsec Validation

TC-NB-02: Secure Boot Verification

TC-NB-03: Xn Peer Authentication

TC-NB-04: Physical Tamper Response

TC-NB-05: AS Security Activation

3GPP TS 33.511 V18 — ng-eNB SCAS Summary

Key Sections