3GPP TS 33.536 V18 — MBS Security

Q: What does the Scope section cover in 3GPP TS 33.536 V18 — MBS Security?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.536 V18 — MBS Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the MBS Architecture section cover in 3GPP TS 33.536 V18 — MBS Security?

The MBS Architecture section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.536 V18 — MBS Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Framework section cover in 3GPP TS 33.536 V18 — MBS Security?

The Security Framework section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.536 V18 — MBS Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the MBS-Specific Threats section cover in 3GPP TS 33.536 V18 — MBS Security?

The MBS-Specific Threats section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.536 V18 — MBS Security. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the GTP Considerations for MBS section cover in 3GPP TS 33.536 V18 — MBS Security?

The GTP Considerations for MBS section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 33.536 V18 — MBS Security. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 33.536

Security Aspects of Multicast-Broadcast Services (MBS) in 5G

V18.2.0 (2024-06) — Release 18 Security Feature

1. Scope

▶

Defines security mechanisms for 5G Multicast-Broadcast Services (5MBS), covering content protection, group key management, and secure delivery of multicast/broadcast data over 5G System architecture.

5MBS: Enables efficient one-to-many content distribution (live streaming, IoT firmware updates, V2X messages) using shared radio resources instead of individual unicast bearers.

2. MBS Architecture

▶

┌──────────┐ │ Content │ (Application Server / AF) │ Provider │ └────┬─────┘ Nmb│ ┌────▼─────┐ ┌──────────┐ │ MB-SMF │◄───────►│ MB-UPF │ │ (session │ N4mb │(multicast│ │ mgmt) │ (PFCP) │ delivery)│ └────┬─────┘ └────┬─────┘ N33│ N3mb│ (GTP-U multicast) │ │ ┌────▼─────┐ ┌─────▼────┐ │ AMF │ │ gNB │ └──────────┘ └────┬─────┘ │ Uu (multicast/broadcast) ┌────▼────┐ │ UEs │ (MBS group members) └─────────┘

Entity	Role
MB-SMF	MBS Session Management — session setup, group management
MB-UPF	MBS User Plane — multicast data distribution to gNBs
N3mb	GTP-U based multicast delivery from MB-UPF to gNBs
N4mb	PFCP-based control of MB-UPF forwarding rules

3. Security Framework

▶

3.1 MBS Key Management

▶

┌──────────────────┐ │ MSK │ MBS Service Key (per MBS service) │ (from KMS/AF) │ — distributed to authorized UEs └────────┬─────────┘ │ KDF ┌────────▼─────────┐ │ MTK │ MBS Traffic Key (per session/interval) │ (short-lived) │ — encrypts actual multicast content └──────────────────┘

MSK (MBS Service Key): Long-lived group key; distributed during MBS session join
MTK (MBS Traffic Key): Short-lived; derived from MSK; rotated periodically
Key rotation: MTK rotated on group membership change (member leave/join) to maintain forward/backward secrecy

3.2 MBS Authentication & Authorization

▶

UE must be authenticated via primary 5G authentication before MBS join
MBS service authorization — UE subscription checked for MBS group membership
MSK delivery protected by existing NAS security context
Group membership management via MB-SMF with subscription data from UDM

4. MBS-Specific Threats

▶

Threat	Description	Mitigation
Unauthorized Content Access	Non-member UE receives and decrypts multicast content	MSK distribution only to authorized UEs; MTK rotation on member leave
Content Injection	Attacker injects false multicast data	Content integrity protection (MTK-based MAC); source authentication
Key Leakage → Group Compromise	Leaked MSK enables all content decryption	MSK bound to UE identity; MTK rotation limits exposure window
Free-rider Attack	Authorized UE redistributes decrypted content	Application-level DRM; watermarking (out of 3GPP scope)
N3mb GTP-U Manipulation	Inject/modify multicast GTP-U on N3mb to gNBs	IPsec on N3mb; GTP-U source validation at gNB
MBS Session Hijacking	Forged PFCP messages to MB-UPF alter multicast distribution	TLS on N4mb; MB-SMF authentication

5. GTP Considerations for MBS

▶

MBS introduces multicast GTP-U tunnels (N3mb) — a new attack surface where a single compromised GTP-U tunnel affects all UEs in the multicast group simultaneously.

N3mb transport: GTP-U with multicast outer IP → single tunnel serves multiple gNBs
TEID scope: Shared TEID across gNBs for same MBS session — TEID compromise = group-wide impact
N4mb (PFCP): MB-SMF programs MB-UPF forwarding for multicast — same PFCP security requirements as unicast N4
Content protection is independent of GTP protection: Even if N3mb is compromised, MTK-encrypted content remains secure