3GPP TS 33.520 V18 — PCF SCAS

Q: What does the Scope section cover in 3GPP TS 33.520 V18 — PCF SCAS?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.520 V18 — PCF SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the References & Dependencies section cover in 3GPP TS 33.520 V18 — PCF SCAS?

The References & Dependencies section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.520 V18 — PCF SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the PCF Functional Overview section cover in 3GPP TS 33.520 V18 — PCF SCAS?

The PCF Functional Overview section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.520 V18 — PCF SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the PCF-Specific Threats section cover in 3GPP TS 33.520 V18 — PCF SCAS?

The PCF-Specific Threats section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.520 V18 — PCF SCAS. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Requirements section cover in 3GPP TS 33.520 V18 — PCF SCAS?

The Security Requirements section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.520 V18 — PCF SCAS. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.520

Security Assurance Specification (SCAS) for the Policy Control Function (PCF)

V18.2.0 (2024-06) — Release 18 SCAS

1. Scope

▶

Specifies security assurance requirements and test cases for the Policy Control Function (PCF) in 5G System architecture. The PCF is responsible for policy decisions including QoS policies, charging rules, and access control policies that are enforced by the SMF/UPF.

PCF role in 5G: The PCF provides policy rules to the SMF (via N7), AMF (via N15), and AF (via N5). It stores subscriber policy profiles and makes access/QoS decisions. A compromised PCF can override QoS for any subscriber, disable charging, or bypass access restrictions.

2. References & Dependencies

▶

Interface	Protocol	Peer NF	Purpose
N7	HTTP/2 (SBI)	SMF	Session policy (PCC rules, QoS, charging)
N15	HTTP/2 (SBI)	AMF	Access and mobility policy
N5	HTTP/2 (SBI)	AF	Application influence on traffic routing
N36	HTTP/2 (SBI)	UDR	Policy data retrieval
Npcf	HTTP/2 (SBI)	NRF/others	Service registration and discovery

3. PCF Functional Overview

▶

┌──────┐ ┌──────┐ ┌──────┐ │ AF │ │ UDR │ │ CHF │ └──┬───┘ └──┬───┘ └──┬───┘ N5 │ N36│ │ │ │ │ ┌──▼───────────────▼───────────────▼──┐ │ PCF │ │ ┌─────────────────────────────────┐ │ │ │ Policy Decision Engine │ │ │ │ - PCC Rules (QoS, Gate, Filter) │ │ │ │ - AM Policy (RFSP, Service Area)│ │ │ │ - UE Policy (URSP, ANDSP) │ │ │ └─────────────────────────────────┘ │ └──┬──────────────────────┬────────────┘ N7 │ N15│ │ │ ┌──▼───┐ ┌───▼───┐ │ SMF │ │ AMF │ └──────┘ └───────┘

Key PCF outputs:

PCC Rules: QoS parameters (5QI, MBR, GBR), gate status, SDF filters, charging keys
AM Policies: RFSP index, service area restrictions, RAT/frequency selection
UE Policies: URSP (route selection), ANDSP (access network discovery)

4. PCF-Specific Threats

▶

TR 33.926 §5.3.5 Unauthorized policy modification ▶

TR 33.926 §5.3.3 MITM on SBI interfaces ▶

Threat ID	Threat	Attack Vector	Impact
PCF-T1	QoS Policy Escalation	Unauthorized N7 request modifies PCC rules to grant premium QoS	Service theft, unfair resource allocation
PCF-T2	Charging Rule Bypass	Manipulate PCC rules to remove charging keys	Billing fraud, revenue loss
PCF-T3	Access Policy Override	Modify AM policy via N15 to bypass service area restrictions	Unauthorized network access
PCF-T4	AF Abuse via N5	Rogue AF influences traffic routing to redirect flows	Traffic interception, service degradation
PCF-T5	Policy Data Exfiltration	Unauthorized UDR queries via N36 to extract subscriber profiles	Privacy violation, profiling
PCF-T6	Policy DoS	Flood PCF with policy requests to degrade decision-making	Service interruption for all subscribers

5. Security Requirements

▶

Req ID	Requirement	Rationale
PCF-R1	Mutual TLS on all SBI interfaces (N5/N7/N15/N36)	Prevent unauthorized NF impersonation
PCF-R2	OAuth 2.0 token-based authorization for NF consumers	Fine-grained access control per NF type
PCF-R3	Rate limiting per NF consumer on all API endpoints	Prevent policy DoS
PCF-R4	Input validation on PCC rule parameters (5QI range, MBR bounds)	Prevent QoS escalation
PCF-R5	Audit logging of all policy decisions and changes	Forensic trail, anomaly detection
PCF-R6	AF authorization — validate AF permitted to influence specific DNNs/flows	Prevent rogue AF abuse
PCF-R7	Integrity protection for policy data stored in UDR	Detect tampering of stored policies

6. Test Cases

▶

PCF SCAS test cases extend TS 33.117 general requirements with PCF-specific validations:

TC-PCF-01: SBI Authentication Enforcement

Mandatory

Objective: Verify PCF rejects SBI requests without valid mTLS client certificate.

Procedure: Send N7 SM Policy Create request without TLS client cert → verify 401/403.

Expected: PCF refuses unauthenticated policy requests.

TC-PCF-02: NF Authorization Validation

Mandatory

Objective: Verify PCF validates OAuth 2.0 access tokens and rejects unauthorized NF types.

Procedure: Present valid TLS cert but incorrect NF type in token scope → verify rejection.

Expected: PCF enforces NF-type-specific authorization.

TC-PCF-03: QoS Parameter Bounds Checking

Mandatory

Objective: Verify PCF validates QoS parameters against allowed ranges.

Procedure: Request PCC rule with out-of-range 5QI value or MBR exceeding subscription → verify rejection or capping.

Expected: PCF does not install policy exceeding subscriber authorization.

TC-PCF-04: AF Authorization Scope

Mandatory

Objective: Verify PCF validates AF is authorized for the requested DNN/S-NSSAI.

Procedure: AF on N5 requests traffic influence for DNN it is not authorized for → verify rejection.

Expected: PCF enforces per-AF authorization scope.

TC-PCF-05: Rate Limiting Enforcement

Conditional

Objective: Verify PCF rate-limits API requests to prevent resource exhaustion.

Procedure: Send burst of N7 requests exceeding configured rate → verify 429 Too Many Requests.

Expected: PCF applies per-consumer rate limiting.

TC-PCF-06: Policy Decision Audit Logging

Mandatory

Objective: Verify PCF produces audit logs for policy creation, modification, and deletion.

Procedure: Create, modify, delete PCC rules → verify audit log entries with timestamps, NF identity, and rule details.

Expected: Complete audit trail for all policy changes.

3GPP TS 33.520

1. Scope

2. References & Dependencies

3. PCF Functional Overview

4. PCF-Specific Threats

5. Security Requirements

6. Test Cases

TC-PCF-01: SBI Authentication Enforcement

TC-PCF-02: NF Authorization Validation

TC-PCF-03: QoS Parameter Bounds Checking

TC-PCF-04: AF Authorization Scope

TC-PCF-05: Rate Limiting Enforcement

TC-PCF-06: Policy Decision Audit Logging

3GPP TS 33.520 V18 — PCF SCAS Summary

Key Sections