3GPP TS 33.527

Security Assurance Specification (SCAS) for the Service Communication Proxy (SCP)
V18.1.0 (2024-06) — Release 18 SCAS
Spec Library > SCAS > TS 33.527 (SCP)

1. Scope

▶

Specifies security requirements and test cases for the Service Communication Proxy (SCP) — the central SBI message routing and load balancing function in 5G Service-Based Architecture.

Critical Position: The SCP sits in the path of all inter-NF SBI traffic. A compromised SCP can intercept, modify, or redirect any service request between any NFs in the entire 5GC.

2. SCP Functional Overview

▶

SA2 (TS 23.501) defines the SCP as an optional but increasingly deployed function that provides:

  • Indirect communication: NF→SCP→NF (Model C/D)
  • Load balancing: Distribute requests across NF instances
  • Message routing: Route based on service/API/resource
  • NF discovery delegation: Query NRF on behalf of NF consumer
  • Token validation: Validate OAuth 2.0 tokens (Model D)
Direct Communication (Model A/B): NF Consumer ─────────────────► NF Producer Indirect via SCP (Model C): NF Consumer ────► SCP ────► NF Producer │ └──► NRF (discovery) Indirect with Delegated Discovery (Model D): NF Consumer ────► SCP ────► NRF (discover) │ │ │◄──────────┘ (NF addresses) │ └──────► NF Producer

2.1 Deployment Models

▶
ModelSCP RoleToken Handling
Model CProxy routing, load balancingConsumer obtains token from NRF, SCP forwards it
Model DProxy + delegated discoverySCP obtains token from NRF on behalf of consumer
In Model D, the SCP holds OAuth tokens — making it an even higher-value target for credential theft.

3. SCP-Specific Threats

▶

TR 33.926 §5.3.3 Man-in-the-middle on SBI ▶

Threat IDThreatDescriptionImpact
SCP-T1Traffic InspectionCompromised SCP reads all SBI message bodies (subscriber data, session info)Mass surveillance, privacy breach
SCP-T2Message ModificationSCP alters request/response payloads (e.g., change QoS in N7, modify auth vectors in N12)Service manipulation, security bypass
SCP-T3Token Theft (Model D)Extract cached OAuth tokens to impersonate NF consumersUnauthorized access to any NF service
SCP-T4Routing ManipulationRedirect SBI requests to attacker-controlled NF instancesData interception, fake responses
SCP-T5DoS / Single Point of FailureSCP outage disrupts all indirect SBI communicationCore network service disruption
SCP-T6Logging / Metadata LeakSCP logs contain sensitive routing metadata exploitable for traffic analysisSubscriber tracking, usage profiling

4. Security Requirements

▶
Req IDRequirementTest Category
SCP-R1mTLS termination and re-establishment on both legs (consumer-SCP, SCP-producer)Authentication
SCP-R2OAuth 2.0 token validation before forwarding (Model C/D)Authorization
SCP-R3Token caching with secure storage — encrypted at rest, bounded TTL (Model D)Credential Protection
SCP-R4Routing table integrity — prevent unauthorized modification of routing rulesIntegrity
SCP-R5Rate limiting per NF consumer and per APIAvailability
SCP-R6Log sanitization — no subscriber identifiers in logsPrivacy
SCP-R7High availability — active-active deployment, health checksAvailability
SCP-R8Input validation on all SBI headers (3gpp-Sbi-* headers)Input Validation

5. Test Cases

▶

TC-SCP-01: mTLS Enforcement on Both Legs

Mandatory

Objective: Verify SCP requires and validates mTLS on both consumer-facing and producer-facing connections.

Procedure: Connect without client cert on consumer side → verify rejection. Connect without client cert on producer side → verify SCP does not forward.

TC-SCP-02: Token Validation Before Forwarding

Mandatory

Objective: Verify SCP validates OAuth token scope before routing request to producer.

Procedure: Send request with expired/invalid/wrong-scope token via SCP → verify 401/403 before reaching producer.

TC-SCP-03: Secure Token Storage (Model D)

Conditional

Objective: Verify SCP protects cached OAuth tokens against extraction.

Procedure: Attempt to access token cache via unauthorized API/interface → verify tokens encrypted at rest and not exposed.

TC-SCP-04: Routing Integrity

Mandatory

Objective: Verify SCP routing rules cannot be modified by non-authorized entities.

Procedure: Attempt to modify routing configuration via SBI request or management interface without proper authorization → verify rejection.

TC-SCP-05: SBI Header Injection Prevention

Mandatory

Objective: Verify SCP sanitizes/validates 3gpp-Sbi-* headers to prevent header injection.

Procedure: Send request with malformed 3gpp-Sbi-Target-apiRoot pointing to external host → verify SCP rejects or strips.

TC-SCP-06: Rate Limiting

Conditional

Objective: Verify SCP rate-limits excessive requests from a single NF consumer.

Procedure: Send burst exceeding per-consumer rate → verify 429 response and service continues for other consumers.