3GPP TS 33.512

5G Security Assurance Specification (SCAS) for the next generation Node B (gNodeB) network product class
V18.3.0 (2024-06) — Release 18 SCAS Product Class
33-Series > SCAS > TS 33.512 (gNB)
Relationship to TS 33.117: This document extends TS 33.117 with gNB-specific security requirements and test cases. ALL tests from TS 33.117 apply to gNB in addition to the tests defined here.

1. Scope

▶

This document specifies security requirements and test cases specific to the gNodeB (gNB) network product class, supplementing the general SCAS requirements in TS 33.117. Covers the gNB's role in 5G NR access security, RRC/UP protection, N2/N3 interface security, and physical security for equipment deployed at cell sites.

2. References

▶
RefDocumentTitleLink
[1]TS 33.117General SCAS RequirementsLocal
[2]TS 33.5015G Security ArchitectureLocal
[3]TR 33.926Threats and Critical AssetsLocal
[4]TS 33.210NDS/IP SecurityLocal
[5]TS 38.401NG-RAN Architecture Portal

4. gNB Network Product Class Definition

▶
┌─────────────────────────────────┐ │ 5G Core │ │ ┌─────┐ ┌─────┐ ┌─────┐ │ │ │ AMF │ │ UPF │ │ SMF │ │ │ └──┬──┘ └──┬──┘ └─────┘ │ │ │ N2 │ N3 │ └─────┼────────┼──────────────────┘ │ │ ┌─────┴────────┴──────────────────┐ │ gNB (this product class) │ │ ┌──────────┐ ┌──────────────┐ │ │ │ gNB-CU │ │ gNB-DU │ │ │ │ (CP+UP) ├──┤ │ │ │ └──────────┘ └──────┬───────┘ │ │ F1 (CU↔DU) │ NR-Uu │ └───────────────────────┼─────────┘ │ ┌──┴──┐ │ UE │ └─────┘
InterfaceEndpointsProtocolSecurity
NR-UuUE ↔ gNB5G NR radioAS security (RRC+UP ciphering/integrity)
N2gNB ↔ AMFNGAP over SCTPIPsec per TS 33.210
N3gNB ↔ UPFGTP-UIPsec per TS 33.210
XngNB ↔ gNBXnAP over SCTPIPsec per TS 33.210
F1gNB-CU ↔ gNB-DUF1AP over SCTPIPsec per TS 33.210

5. gNB-Specific Threats

▶

In addition to all threats from TR 33.926, the gNB faces specific threats due to its physical deployment:

TR 33.926 §5.3.1 Physical tampering — gNBs are deployed at cell sites with limited physical security ▶

TR 33.926 §5.3.2 Eavesdropping — radio interface and backhaul interception ▶

TR 33.926 §5.3.3.5 IP spoofing on N3 GTP-U interface ▶

  • Rogue gNB: An attacker deploys a fake gNB to attract UEs (mitigated by NAS integrity from AMF)
  • Key extraction: Physical access to gNB could expose KgNB, KRRCint, KUPenc
  • Backhaul compromise: N2/N3 traffic intercepted if IPsec is not deployed
  • Firmware tampering: Modified firmware loaded onto gNB at cell site
  • Side-channel attacks: Power analysis or EM emanation to extract keys

6. Security Requirements (gNB-Specific)

▶

6.1 Physical Security

▶
TC_gNB_PHYSICAL_PROTECTION
gNB-Specific
Objective

Verify that the gNB provides physical tamper evidence and key zeroization on physical breach detection.

Procedure
  1. Verify that the gNB enclosure shows evidence of tampering if opened
  2. Verify that key material (KgNB, IPsec keys) is stored in a hardware security module or tamper-resistant storage
  3. If supported: verify that physical tamper detection triggers key zeroization
  4. Verify that debug ports (JTAG, serial) are disabled or require authentication in production build
  5. Verify that firmware integrity is checked at boot (secure boot chain)
Expected Result

Key material cannot be extracted through physical access. Tamper detection triggers key destruction. Secure boot prevents modified firmware.

6.2 AS Key Handling

▶
TC_gNB_KEY_HANDLING
gNB-Specific
Objective

Verify proper handling of AS security keys in the gNB per TS 33.501 clause 5/10.

Procedure
  1. Verify that KgNB received from AMF is stored securely and not exposed via any interface
  2. Verify that KRRCenc, KRRCint, KUPenc, KUPint are derived correctly from KgNB
  3. Verify that keys are deleted when the UE context is released
  4. Verify that key refresh occurs during intra-gNB handover (new NH/NCC → new KgNB*)
  5. Verify that NIA0 (null integrity) is NOT used for RRC

6.3 N2/N3 Interface Security

▶
TC_gNB_N2_N3_IPSEC
gNB-Specific
Objective

Verify that the gNB supports IPsec protection on the N2 (NGAP to AMF) and N3 (GTP-U to UPF) interfaces per TS 33.210.

Procedure
  1. Configure IPsec on N2: verify IKEv2 with certificates, ESP with AES-GCM
  2. Configure IPsec on N3: verify GTP-U traffic is ESP-encapsulated
  3. Verify cipher suites match TS 33.210 Annex E requirements
  4. Verify SA rekeying functions correctly
  5. Verify Dead Peer Detection is active

6.4 GTP-U on N3

▶
TC_gNB_GTP_U_HANDLING
gNB + GTP
Objective

Verify proper GTP-U handling on the N3 interface, including TEID management and filtering.

Procedure
  1. Verify that the gNB only accepts GTP-U packets with valid TEIDs assigned by the gNB
  2. Verify that GTP-U from unexpected source IPs is dropped
  3. Verify that the gNB does not forward GTP-U for inactive/released bearers
  4. Verify that GTP-U packet size limits are enforced
  5. Verify that GTP-in-GTP encapsulation is detected and dropped

TR 33.926 §5.3.6.15 GTP traffic isolation failure ▶

6.5 RRC Security Enforcement

▶
TC_gNB_RRC_SECURITY
gNB-Specific
Procedure
  1. Verify AS Security Mode Command is sent and RRC integrity is activated
  2. Verify that RRC messages without valid integrity are rejected after SMC
  3. Verify that UE security capability is correctly forwarded to AMF via N2
  4. Verify UP integrity protection can be activated per DRB based on SMF policy

7. SCAS Test Case Summary

▶
Test Case IDCategoryThreat RefPriority
TC_gNB_PHYSICAL_PROTECTIONPhysical Security§5.3.1Critical
TC_gNB_KEY_HANDLINGKey Management§5.3.6High
TC_gNB_N2_N3_IPSECInterface Security§5.3.2, §5.3.3Critical
TC_gNB_GTP_U_HANDLINGGTP Security§5.3.6.15Critical
TC_gNB_RRC_SECURITYAS Security§5.3.3High
Plus ALL test cases from TS 33.117