3GPP TR 33.818

Q: What does the Scope section cover in 3GPP TR 33.818 — Security Study on User Plane Function (UPF)?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.818 — Security Study on User Plane Function (UPF). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Key References section cover in 3GPP TR 33.818 — Security Study on User Plane Function (UPF)?

The Key References section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.818 — Security Study on User Plane Function (UPF). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the UPF Architecture & Interfaces section cover in 3GPP TR 33.818 — Security Study on User Plane Function (UPF)?

The UPF Architecture & Interfaces section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.818 — Security Study on User Plane Function (UPF). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Threat Analysis section cover in 3GPP TR 33.818 — Security Study on User Plane Function (UPF)?

The Threat Analysis section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.818 — Security Study on User Plane Function (UPF). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Edge/MEC Security Considerations section cover in 3GPP TR 33.818 — Security Study on User Plane Function (UPF)?

The Edge/MEC Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.818 — Security Study on User Plane Function (UPF). This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

Study on Security of the User Plane Function (UPF)

V18.1.0 (2024-03) — Release 18 Technical Report

1. Scope

▶

This Technical Report studies the security aspects of the User Plane Function (UPF) in 5G System architecture, covering threat analysis, security requirements, and potential solutions for UPF deployments including edge computing (MEC) scenarios.

Why a dedicated UPF study? The UPF handles all user data traffic and can be deployed in diverse locations (central DC, edge, enterprise premises). This distributed deployment model introduces new attack surfaces not fully covered by TS 33.513 (UPF SCAS).

2. Key References

▶

Spec	Title	Relevance
TS 33.501	5G Security Architecture	Baseline security requirements
TS 33.513	UPF SCAS	Normative test cases for UPF
TS 29.244	PFCP	N4 protocol details
TS 29.281	GTPv1-U	N3/N9 protocol details
TS 33.117	General SCAS	Common security requirements

3. UPF Architecture & Interfaces

▶

┌──────────┐ │ SMF │ └────┬─────┘ │ N4 (PFCP) │ ┌─────────┐ ┌─────▼─────┐ ┌──────────┐ │ gNB │────│ UPF │────│ DN │ └─────────┘ N3 │ │ N6 └──────────┘ (GTP-U) │ ┌─────┐ │ │ │Rules│ │ ┌──────────┐ │ │PDR │ │ │ I-UPF │ │ │FAR │ │ │ (Edge) │ │ │QER │ │─────│ │ │ │URR │ │ N9 └──────────┘ └───┴─────┴──┘ Key: N3 = gNB↔UPF (GTP-U), N4 = SMF↔UPF (PFCP), N6 = UPF↔DN (IP), N9 = UPF↔UPF (GTP-U)

3.1 Deployment Scenarios Studied

▶

Scenario	Location	Trust Level	New Risks
Central DC	Operator core	High	Standard — insider threat, misconfiguration
Edge (MEC)	Cell site / aggregation	Medium	Physical access, shared infrastructure
Enterprise	Customer premises	Low	Third-party hosting, supply chain risk
Multi-cloud	Public cloud	Medium-Low	Shared tenancy, cloud provider access

4. Threat Analysis

▶

4.1 N3 Interface Threats (gNB↔UPF)

▶

N3-T1 GTP-U TEID hijacking — inject traffic into UPF via spoofed TEID ▶

N3-T2 GTP-in-GTP encapsulation — bypass UPF PDR filtering ▶

N3-T3: TEID Correlation Attack

Adversary observing N3 traffic correlates TEID allocation patterns to track subscriber sessions across handovers.

Risk: Subscriber tracking, privacy violation

Study finding: UPF should randomize TEID allocation and avoid sequential assignment.

N3-T4: Bandwidth Flooding via N3

Malicious or compromised gNB floods UPF N3 interface with high-rate GTP-U traffic.

Risk: UPF resource exhaustion, impact on all subscribers

Study finding: UPF requires per-gNB rate limiting and N3 traffic policing.

4.2 N4 Interface Threats (SMF↔UPF)

▶

N4-T1: PFCP Session Hijacking

Attacker impersonates SMF and sends PFCP Session Modification to redirect user traffic via modified FAR.

Risk: Complete traffic interception for targeted subscribers

Study finding: TLS/DTLS on N4 mandatory; UPF must authenticate SMF identity per PFCP Association.

N4-T2: Unauthorized PFCP Association

Rogue node establishes PFCP Association with UPF and creates sessions to siphon traffic.

Risk: Shadow sessions, unauthorized data access

Study finding: UPF must maintain allowlist of authorized CP peers; log all Association Setup attempts.

N4-T3: Charging Manipulation

Compromised SMF or MITM modifies URR rules to suppress usage reports.

Risk: Revenue loss, billing inaccuracy

Study finding: UPF should support local URR integrity validation and anomaly detection.

4.3 N6 Interface Threats (UPF↔DN)

▶

N6-T1: Ingress Filtering Bypass

External attacker sends spoofed IP packets into UPF N6 that match a Core-side PDR.

Risk: Traffic injection into subscriber sessions

Study finding: UPF needs BCP38/BCP84 ingress filtering on N6, strict SDF filter matching.

N6-T2: DDoS Amplification

UPF used as amplification vector — small incoming N6 packets trigger large GTP-U encapsulated responses on N3.

Risk: Network saturation, impact on RAN

Study finding: Rate limiting on N6 ingress, reflective traffic analysis.

4.4 N9 Interface Threats (UPF↔UPF)

▶

N9-T1: Inter-UPF Tunnel Manipulation

Attack on N9 GTP-U tunnel between anchor UPF and intermediate/edge UPF.

Risk: Data path compromise in multi-UPF deployments

Study finding: N9 security especially critical for I-UPF at edge. IPsec or GTP-U integrity protection recommended.

N9-T2: Edge UPF Compromise Lateral Movement

Compromised edge UPF uses N9 tunnel to pivot into core network.

Risk: Core network breach from edge

Study finding: Zero-trust between UPFs; anchor UPF must validate all N9 traffic from edge UPFs.

5. Edge/MEC Security Considerations

▶

Key finding: Edge UPF deployments operate in lower-trust environments. Physical security, platform integrity, and network isolation requirements increase significantly.

Concern	Edge-Specific Risk	Recommendation
Physical Access	Cell site tampering, hardware theft	TPM-based boot, tamper detection, remote attestation
Shared Infrastructure	Multi-tenant edge → side-channel attacks	Hardware isolation (SR-IOV), encrypted memory
Limited Monitoring	Reduced SOC visibility at edge	Local security agents, centralized log aggregation
Update Latency	Delayed patching at remote sites	Automated update pipelines, canary deployments
Supply Chain	Third-party hardware/software at edge	SBOM verification, signed images, integrity checks

6. Security Solutions & Recommendations

▶

Solution Area	Recommendation	Priority
N4 Protection	Mandatory TLS 1.3 / DTLS 1.3 with mutual certificate authentication	Critical
N3/N9 Protection	IPsec (ESP) for GTP-U tunnels; at minimum between untrusted segments	High
TEID Randomization	Cryptographically random TEID allocation, no sequential patterns	High
Platform Integrity	Secure boot, runtime integrity monitoring, remote attestation	Critical (edge)
Rule Auditing	Continuous validation of PDR/FAR/QER/URR against policy; anomaly detection	Medium
Network Segmentation	Separate N3/N4/N6/N9 into distinct VLANs/VRFs	High
Rate Limiting	Per-interface, per-gNB rate limiting at UPF	High
Zero-Trust UPF	Assume edge UPFs are untrusted; validate at anchor UPF	Medium

7. Conclusions

▶

UPF is the highest-value target in the 5G user plane — controls all subscriber data flows
Edge deployment scenarios introduce new attack surfaces not covered by central-DC-focused security models
N4 (PFCP) protection is the single most impactful security control
Multi-UPF architectures (I-UPF + PSA UPF) require inter-UPF trust verification
Existing SCAS tests in TS 33.513 should be extended for edge-specific scenarios