3GPP TS 33.521
5G Security Assurance Specification (SCAS) for the Network Repository Function (NRF) network product class
V18.3.0 (2024-06) — Release 18 SCAS Product Class Critical Role: The NRF is the OAuth 2.0 authorization server and service registry for the entire 5GC SBA. Compromise of NRF enables unauthorized service access across all NFs.
1. Scope
▶Defines security requirements for the NRF. The NRF provides NF registration, NF discovery, and OAuth 2.0 access token issuance for the 5GC SBA.
4. NRF Network Product Class Definition
▶
┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐
│ AMF │ │ SMF │ │ AUSF │ │ UDM │ │ NEF │
└──┬───┘ └──┬───┘ └──┬───┘ └──┬───┘ └──┬───┘
│ │ │ │ │
│ Nnrf │ Nnrf │ Nnrf │ Nnrf │
└──────────┼─────────┼─────────┼─────────┘
│ │ │
┌────▼─────────▼─────────▼────┐
│ NRF (this) │
│ │
│ ┌─────────────────────┐ │
│ │ NF Profile Registry │ │
│ └─────────────────────┘ │
│ ┌─────────────────────┐ │
│ │ OAuth 2.0 AuthZ │ │
│ │ (Access Token) │ │
│ └─────────────────────┘ │
└─────────────────────────────┘
5. NRF-Specific Threats
▶TR 33.926 §6.3.1 SBI interface threats — rogue NF registration ▶
TR 33.926 §5.3.5 Unauthorized token issuance ▶
- Rogue NF registration: Attacker registers malicious NF to intercept service requests
- Token forgery: Compromised NRF issues tokens granting access to any service
- Discovery abuse: NF discovery reveals topology and NF locations
6. Security Requirements and Test Cases
▶ TC_NRF_REGISTRATION_AUTH
CRITICAL
Procedure
- Verify NF registration (NFRegister) requires mTLS with valid NF certificate
- Verify NF type in certificate matches claimed NF type in registration
- Attempt registration with mismatched cert → verify REJECTED
- Verify NF profile updates only accepted from the registered NF itself
TC_NRF_TOKEN_ISSUANCE
CRITICAL
Procedure
- Verify access token includes: NF instance ID, NF type, scope, expiry, audience
- Verify token scope is limited to the requested service
- Request token for service NF is not authorized for → verify DENIED
- Verify token signing key is securely stored and rotated
- Verify expired tokens are rejected by NF consumers
TC_NRF_DISCOVERY_AUTHZ
HIGH
Procedure
- Verify NF discovery results are filtered by authorized NF type and slice
- Verify discovery does not expose NFs from unauthorized network slices
- Verify discovery responses do not leak internal IP addresses unnecessarily
7. SCAS Test Case Summary
▶| Test Case ID | Category | Priority |
|---|---|---|
| TC_NRF_REGISTRATION_AUTH | NF Registration | CRITICAL |
| TC_NRF_TOKEN_ISSUANCE | OAuth 2.0 Tokens | CRITICAL |
| TC_NRF_DISCOVERY_AUTHZ | NF Discovery | HIGH |
| Plus ALL test cases from TS 33.117 | ||