3GPP TS 33.522
5G Security Assurance Specification (SCAS) for the Security Edge Protection Proxy (SEPP) network product class
V18.3.0 (2024-06) — Release 18 SCAS Product Class Inter-PLMN Security: The SEPP is the only element that handles inter-operator SBI traffic. It must protect against attacks from roaming partner networks.
1. Scope
▶Defines security requirements for the SEPP network product class. The SEPP provides inter-PLMN security for SBI traffic on the N32 interface, using either TLS (N32-c) or PRINS (N32-f) message protection.
Extends TS 33.117. Certificate requirements per TS 33.310 §6.3.
4. SEPP Network Product Class Definition
▶
PLMN A (Home) PLMN B (Visited)
┌──────────────────┐ ┌──────────────────┐
│ ┌──────┐ │ │ ┌──────┐ │
│ │ NFs │───────►│──── N32-c ──────────►│◄───────│ NFs │ │
│ └──────┘ SBI │ (TLS handshake) │ SBI └──────┘ │
│ │ │ │
│ ┌──────┐ │──── N32-f ──────────►│ ┌──────┐ │
│ │ SEPP │ │ (PRINS/JWS) │ │ SEPP │ │
│ │(this)│ │ │ │ │ │
│ └──────┘ │ │ └──────┘ │
└──────────────────┘ └──────────────────┘
| Interface | Peer | Protocol | Function |
|---|---|---|---|
| N32-c | Peer SEPP | TLS 1.2/1.3 | Control plane: capability negotiation, cipher suite agreement |
| N32-f | Peer SEPP | PRINS (JWS/JWE) | Forwarding plane: application-layer message protection |
5. SEPP-Specific Threats
▶TR 33.926 §5.3.3 MITM on inter-PLMN N32 interface ▶
TR 33.926 §5.3.2 Eavesdropping on roaming traffic ▶
- Rogue SEPP: Malicious roaming partner impersonating legitimate SEPP
- N32-f message manipulation: Modifying protected IEs in transit
- Certificate trust abuse: Inter-PLMN CA compromise
- Information leakage: Clear-text IEs visible to IPX intermediaries
6. Security Requirements and Test Cases
▶6.1 N32-c Security
▶ TC_SEPP_N32C_TLS
CRITICAL
Procedure
- Verify N32-c uses TLS 1.2 or TLS 1.3 with certificates per TS 33.310 §6.3
- Verify peer SEPP certificate validation (chain, revocation, SAN matching)
- Attempt connection with expired/revoked cert → verify REJECTED
- Verify cipher suite negotiation follows TS 33.210 requirements
6.2 N32-f / PRINS Message Protection
▶ TC_SEPP_PRINS
CRITICAL
Procedure
- Verify PRINS applies JWS (integrity) to sensitive IEs per protection policy
- Verify PRINS applies JWE (confidentiality) where required
- Send modified JWS payload → verify integrity check fails at receiving SEPP
- Verify protection policy correctly identifies which IEs need protection
- Verify clear-text IEs do not contain subscriber-identifying information
6.3 Certificate and Trust Management
▶ TC_SEPP_CERT_MGMT
HIGH
Procedure
- Verify SEPP uses inter-PLMN CA certificates per TS 33.310
- Verify certificate revocation checking (CRL or OCSP)
- Verify separate trust stores for intra-PLMN and inter-PLMN
- Verify certificate rotation without service interruption
7. SCAS Test Case Summary
▶| Test Case ID | Category | Priority |
|---|---|---|
| TC_SEPP_N32C_TLS | N32-c TLS | CRITICAL |
| TC_SEPP_PRINS | N32-f PRINS | CRITICAL |
| TC_SEPP_CERT_MGMT | Certificate Mgmt | HIGH |
| Plus ALL test cases from TS 33.117 | ||