3GPP TR 33.899
1. Scope
▶The foundational 5G security study that catalogued threats, identified security requirements, and proposed solutions that became the basis for TS 33.501 (5G Security Architecture). Contains 21 key issues across authentication, architecture, user plane, privacy, and vertical industries.
2. 5G Threat Landscape Overview
▶3. Authentication & Key Management Threats
▶Key Issue #1: Unified Authentication Framework
Threat: Multiple access types (3GPP, non-3GPP, fixed) require consistent authentication. Inconsistent auth allows cross-access attacks.
Resolution: → 5G-AKA and EAP-AKA' as unified primary authentication methods (TS 33.501 §6.1)
Key Issue #2: IMSI Protection
Threat: Permanent subscriber identity (IMSI) sent in cleartext enables IMSI catching and subscriber tracking.
Resolution: → SUCI (Subscription Concealed Identifier) using ECIES encryption (TS 33.501 §6.12)
Key Issue #3: Key Hierarchy Enhancement
Threat: EPS key hierarchy lacks separation between anchor and serving keys; compromise of serving node exposes anchor key.
Resolution: → Enhanced key hierarchy with K_AUSF, K_SEAF, K_AMF separation (TS 33.501 §6.2)
Key Issue #4: Roaming Security
Threat: Inter-PLMN signaling (GTP, Diameter) lacks E2E authentication; SEPP not yet defined.
Resolution: → SEPP for inter-PLMN SBI, TLS/PRINS for signaling protection (TS 33.501 §13)
4. Architecture Threats
▶4.1 Service-Based Architecture Threats
▶Key Issue #8: NF Trust in SBA
Threat: SBA replaces point-to-point interfaces with service APIs. Any NF can potentially call any other NF's API — need authorization model.
Resolution: → OAuth 2.0 token-based NF authorization (TS 33.501 §13.4), NRF as token issuer
Key Issue #9: NF Registration Security
Threat: Rogue NF registers in NRF → receives traffic intended for legitimate NF.
Resolution: → mTLS for NF-to-NRF communication, NF type validation at registration
Key Issue #10: API Security
Threat: SBI exposes HTTP/2 APIs — subject to web API attacks (injection, parameter tampering, DoS).
Resolution: → Input validation, rate limiting, API gateway controls (implemented per NF SCAS)
4.2 Network Slicing Threats
▶Key Issue #11: Slice Isolation
Threat: Shared infrastructure between slice instances → cross-slice attacks. Compromise of one slice affects others.
Resolution: → Slice-specific security policies, resource isolation requirements (TS 33.501 §16)
Key Issue #12: Slice-Specific Authentication
Threat: Certain slices (e.g., enterprise, URLLC) may require additional authentication beyond primary 5G auth.
Resolution: → NSSAA (Network Slice Specific Authentication and Authorization) framework (TS 33.501 §16.2)
5. User Plane Threats
▶TR 33.926 §5.3.6.5 GTP-U protocol vulnerabilities ▶
Key Issue #14: User Plane Integrity Protection
Threat: EPS has no UP integrity protection → data can be modified in transit (e.g., DNS response injection).
Resolution: → Optional UP integrity protection in 5G NR (TS 33.501 §6.6). Data rate limit ~4 Gbps due to IPsec overhead.
Key Issue #15: GTP Security
Threat: GTP-U/C protocols have no built-in security. TEID prediction, tunnel injection, GTP-in-GTP attacks possible.
Resolution: → IPsec for N3/N9, PFCP security for N4. Detailed in TS 29.281, TS 29.274, TS 29.244.
Key Issue #16: Edge/MEC Security
Threat: UPF at edge operates in lower-trust environment → physical attacks, reduced monitoring.
Resolution: → Platform integrity, zero-trust UPF model. Studied further in TR 33.818.
6. Privacy Threats
▶| Privacy Threat | Mechanism | 5G Solution |
|---|---|---|
| IMSI Catching | Over-the-air capture of permanent ID | SUCI encryption |
| Location Tracking | Paging, TA update correlation | 5G-GUTI refresh, paging restrictions |
| Activity Monitoring | Traffic analysis on encrypted channels | Padding, dummy packets (limited) |
| SUPI Correlation | Cross-service linkability | SUCI changes per registration |
| Lawful Intercept Abuse | Unauthorized use of LI interfaces | Strict LI access controls, auditing |
7. IoT / mMTC Threats
▶| Threat | IoT-Specific Factor | Consideration |
|---|---|---|
| Device Compromise | Low-cost devices, limited update capability | Long lifecycle → legacy vulnerabilities accumulate |
| Credential Theft | SIM/eSIM in unattended devices | Physical extraction, side-channel on embedded SIMs |
| Botnet DDoS | Massive device counts (millions) | Compromised IoT fleet generates amplified DDoS via 5G |
| Group Authentication | Individual AKA for millions of devices impractical | Group auth schemes needed but increase attack surface |
| Lightweight Crypto | Constrained devices can't run full 5G security | Need optimized crypto suites without security compromise |
8. Study Conclusions
▶- 21 key security issues identified → majority addressed in TS 33.501 (Rel-15/16/17)
- GTP security remains dependent on IPsec — no native protocol-level protection
- Network slicing isolation is an ongoing challenge — shared infrastructure conflicts with strict isolation
- IoT/mMTC security at scale requires new approaches (group auth, lightweight crypto)
- Privacy improvements (SUCI) are significant but false base stations still exploit pre-auth messages
- Core network virtualization introduces infrastructure-level threats outside 3GPP SCAS scope