3GPP TR 33.848

Q: What does the Scope section cover in 3GPP TR 33.848 — Security Study on Virtualization?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.848 — Security Study on Virtualization. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the NFV Architecture Context section cover in 3GPP TR 33.848 — Security Study on Virtualization?

The NFV Architecture Context section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.848 — Security Study on Virtualization. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Virtualization Threat Analysis section cover in 3GPP TR 33.848 — Security Study on Virtualization?

The Virtualization Threat Analysis section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.848 — Security Study on Virtualization. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the NF-Specific Virtualization Concerns section cover in 3GPP TR 33.848 — Security Study on Virtualization?

The NF-Specific Virtualization Concerns section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.848 — Security Study on Virtualization. This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Security Recommendations section cover in 3GPP TR 33.848 — Security Study on Virtualization?

The Security Recommendations section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TR 33.848 — Security Study on Virtualization. This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

Study on Security Impacts of Virtualization

V18.0.0 (2023-09) — Release 18 Technical Report

1. Scope

▶

Studies the security implications of deploying 5G network functions on virtualized infrastructure — VMs, containers, and cloud-native platforms. Analyzes threats from the virtualization layer that are not visible to 3GPP NF-level security specifications.

Why this matters: 3GPP SCAS specs (TS 33.51x) test NF security at the application level, but in practice NFs run on shared virtualized infrastructure. A hypervisor escape or container breakout can bypass all NF-level security controls.

2. NFV Architecture Context

▶

┌─────────────────────────────────────────────────────────┐ │ MANO (Orchestration) │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ NFVO │ │ VNFM │ │ VIM │ │ │ └──────────┘ └──────────┘ └──────────┘ │ └──────────────────────┬──────────────────────────────────┘ │ Management ┌──────────────────────▼──────────────────────────────────┐ │ NFVI (Infrastructure) │ │ ┌───────────────────────────────────────────────────┐ │ │ │ VNFs / CNFs │ │ │ │ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ │ │ │ │ │ AMF │ │ SMF │ │ UPF │ │ NRF │ │ PCF │ │ │ │ │ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ │ │ │ └──────────────────────────────────────────────────┘ │ │ ┌───────────────────────────────────────────────────┐ │ │ │ Virtualization Layer │ │ │ │ Hypervisor (KVM/VMware) or Container Runtime │ │ │ │ (containerd/CRI-O) + Kubernetes │ │ │ └───────────────────────────────────────────────────┘ │ │ ┌───────────────────────────────────────────────────┐ │ │ │ Hardware (COTS servers, SmartNICs, DPUs) │ │ │ └───────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────┘

3. Virtualization Threat Analysis

▶

3.1 Hypervisor / VM Threats

▶

Threat	Description	Impact on 5GC
VM Escape	Exploiting hypervisor vulnerability to break out of VM	Access to other NF VMs — cross-NF compromise
Side-Channel	Spectre/Meltdown-class attacks between co-located VMs	Key extraction from AMF/AUSF/UDM VMs
VM Image Tampering	Modify NF VM image in storage	Deploy backdoored NF instance
Hypervisor Compromise	Root access to hypervisor host	Complete control over all hosted NFs
Live Migration Intercept	Capture VM memory during live migration	Extract keys, session state, subscriber data

3.2 Container / Kubernetes Threats

▶

Threat	Description	Impact on 5GC
Container Breakout	Exploiting kernel vulnerability to escape container namespace	Host access → all NF containers compromised
Malicious Image	Supply chain attack via tampered container image in registry	Deploy compromised NF across cluster
K8s API Server Abuse	Unauthorized access to Kubernetes API	Deploy/modify/delete any NF pod
etcd Exposure	Direct access to K8s etcd datastore	Read all secrets (TLS certs, tokens, credentials)
Network Policy Bypass	Pod-to-pod traffic without network policies	Lateral movement between NFs
Privilege Escalation	Container running as root or with excessive capabilities	Host compromise from NF container

3.3 Orchestration / MANO Threats

▶

Threat	Description	Impact
NFVO Compromise	Attacker controls NFV Orchestrator	Deploy/scale/terminate any NF at will
VIM Credential Theft	Steal Infrastructure Manager credentials	Control compute/storage/network resources
Unauthorized Scaling	Trigger auto-scaling to exhaust resources	Resource exhaustion DoS

4. NF-Specific Virtualization Concerns

▶

NF	Virtualization Concern	Why Critical
UPF	SR-IOV/DPDK bypass OS network stack → security hooks missed	User plane fast-path may skip firewall/monitoring
AUSF/UDM	Key material in VM/container memory	Side-channel or memory dump exposes auth keys
AMF	NAS security context across pod restarts	State loss → re-authentication storm
SMF	PFCP session state consistency during scaling	Session loss → UPF forwarding rules orphaned
NRF	Service mesh dependency for discovery	NRF compromise → rogue NF registration

5. Security Recommendations

▶

Area	Recommendation	Priority
Isolation	Dedicated nodes for security-critical NFs (AUSF, UDM); no co-tenancy	Critical
Image Security	Signed images, vulnerability scanning, immutable registries	Critical
Runtime Security	Seccomp/AppArmor profiles, read-only root filesystem, no privileged containers	High
Network Policy	Default-deny K8s network policies; CNI-enforced micro-segmentation	High
Secrets Management	External secrets (HashiCorp Vault); no secrets in env vars or ConfigMaps	Critical
Monitoring	Runtime behavior analysis (Falco/Sysdig); anomaly detection for NF processes	High
etcd Encryption	Encrypt etcd at rest; restrict etcd access to API server only	Critical
Platform Hardening	CIS benchmarks for K8s/hypervisor; automated compliance checks	High

Study conclusion: SCAS testing should be extended to include virtualization platform requirements. An NF passing all TS 33.51x tests can still be compromised if the underlying platform is insecure.