3GPP TS 33.518 V18 — 5G SCAS for SMF

Q: What does the Scope section cover in 3GPP TS 33.518 V18 — 5G SCAS for SMF?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.518 V18 — 5G SCAS for SMF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the SMF Network Product Class Definition section cover in 3GPP TS 33.518 V18 — 5G SCAS for SMF?

The SMF Network Product Class Definition section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.518 V18 — 5G SCAS for SMF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the SMF-Specific Threats section cover in 3GPP TS 33.518 V18 — 5G SCAS for SMF?

The SMF-Specific Threats section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.518 V18 — 5G SCAS for SMF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Requirements and Test Cases section cover in 3GPP TS 33.518 V18 — 5G SCAS for SMF?

The Security Requirements and Test Cases section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.518 V18 — 5G SCAS for SMF. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the SCAS Test Case Summary section cover in 3GPP TS 33.518 V18 — 5G SCAS for SMF?

The SCAS Test Case Summary section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.518 V18 — 5G SCAS for SMF. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.518

5G Security Assurance Specification (SCAS) for the Session Management Function (SMF) network product class

V18.3.0 (2024-06) — Release 18 SCAS Product Class

GTP Relevance: The SMF controls GTP tunnel establishment on the UPF via PFCP (N4). Compromise of SMF allows redirection or manipulation of all GTP-U tunnels.

1. Scope

▶

Defines security requirements and test cases for the SMF network product class. The SMF manages PDU session establishment, modification, and release, and controls the UPF via PFCP on the N4 interface.

Extends TS 33.117. Closely related to TS 33.513 (UPF SCAS).

4. SMF Network Product Class Definition

▶

┌──────┐ Nsmf ┌──────────┐ N4/PFCP ┌──────────┐ │ AMF │────────►│ SMF │────────────►│ UPF │ └──────┘ │ (this) │ └──────────┘ │ │ │ PDU sess │ Nsmf ┌──────┐ │ mgmt, │◄─────────│ PCF │ │ UP policy│ └──────┘ └──────────┘

Interface	Peer	Protocol	Function
N4	UPF	PFCP	Session rules: PDR, FAR, QER, URR installation
Nsmf	AMF, PCF	SBI	PDU session lifecycle
N11	AMF	SBI	Session management procedures

5. SMF-Specific Threats

▶

TR 33.926 §5.3.6.15 GTP traffic manipulation via unauthorized PFCP control ▶

TR 33.926 §6.3.1 SBI threats on Nsmf interface ▶

PFCP session manipulation: Unauthorized PFCP Modification installs malicious forwarding rules
GTP tunnel redirection: Modifying FAR to redirect user traffic to attacker-controlled destination
UP security policy bypass: SMF fails to enforce UP integrity/confidentiality policy

6. Security Requirements and Test Cases

▶

6.1 PFCP / N4 Security

▶

TC_SMF_PFCP_SECURITY

CRITICAL — GTP

Procedure

Verify N4/PFCP is protected by IPsec or TLS/DTLS
Verify SMF authenticates UPF during PFCP Association Setup
Verify PFCP session establishment includes authorization checks
Verify PDR/FAR rules installed by SMF are not modifiable by other entities
Verify TEID allocation by SMF uses random values (not sequential)

6.2 PDU Session Security

▶

TC_SMF_PDU_SESSION

HIGH

Procedure

Verify PDU session requests are authorized via AMF authentication context
Verify PDU session to non-subscribed DNN is rejected
Verify session resources are released after timeout/deregistration

6.3 UP Security Policy Enforcement

▶

TC_SMF_UP_POLICY

CRITICAL

Procedure

Verify SMF enforces UP Integrity Protection (UPIP) policy from subscription data
Verify SMF sends correct UP security policy to gNB via AMF
Verify UP confidentiality/integrity settings match subscription profile

6.4 SBI Interface Security

▶

TC_SMF_SBI

CRITICAL

Procedure

Verify Nsmf APIs require mTLS + OAuth 2.0
Verify PDU session creation from unauthorized NF is rejected
Verify SMF validates calling NF's authorization for the requested DNN/S-NSSAI

TR 33.926 §6.3.1 SBI interface threats ▶

7. SCAS Test Case Summary

▶

Test Case ID	Category	Priority
TC_SMF_PFCP_SECURITY	N4/PFCP Security	CRITICAL
TC_SMF_PDU_SESSION	Session Mgmt	HIGH
TC_SMF_UP_POLICY	UP Security Policy	CRITICAL
TC_SMF_SBI	SBI Security	CRITICAL
Plus ALL test cases from TS 33.117

3GPP TS 33.518

1. Scope

4. SMF Network Product Class Definition

5. SMF-Specific Threats

6. Security Requirements and Test Cases

6.1 PFCP / N4 Security

6.2 PDU Session Security

6.3 UP Security Policy Enforcement

6.4 SBI Interface Security

7. SCAS Test Case Summary

3GPP TS 33.518 V18 — 5G SCAS for SMF Summary

Key Sections