Find Your Focus
Components
- UE (User Equipment): This is the device the end-user uses to connect to the network, such as a smartphone or tablet.
- (R)AN ((Radio) Access Network): This network component provides the radio connection between the UE and the core network. It’s responsible for all radio-related functionalities.
- UPF (User Plane Function): The UPF is part of the 5G core network that handles user data packets’ routing and forwarding.
- DN (Data Network): This refers to external networks, such as the internet or a corporate network, that the user wants to access.
- AMF (Access and Mobility Management Function): The AMF is responsible for all access and mobility management aspects in 5G.
- SMF (Session Management Function): The SMF is responsible for session management within the network.
- PCF (Policy Control Function): The PCF aids in policy control decision-making and provides policy rules to control plane functions.
- NEF (Network Exposure Function): The NEF provides a secure means to expose the services and capabilities provided by 3GPP network functions.
- NRF (Network Repository Function): This function supports the discovery and selection of network functions within the network.
- AF (Application Function): The AF interacts with the 5G core to influence traffic routing, get events notifications, and access data.
- NSSF (Network Slice Selection Function): The NSSF assists in selecting network slices for the UE.
- UDM (Unified Data Management): The UDM handles user data and subscription information.
- AUSF (Authentication Server Function): The AUSF is responsible for the authentication of the user.
- NSSAAF (Network Slice-Specific Authentication and Authorization Function) handles authentication and authorization for network slices.
- SEPP (Security Edge Protection Proxy): The SEPP provides a security layer for the interconnection between different PLMNs (Public Land Mobile Networks).
What is SEPP?
SEPP is a network function designed to protect messages exchanged between different 5G networks (home and visited networks during roaming, for instance). It acts as a security gateway that filters and secures cross-border signaling traffic between network operators.
Role of SEPP
The primary roles of SEPP include:
- Message Protection: SEPP applies security mechanisms to protect the integrity and confidentiality of signaling data. It uses encryption and integrity protection to prevent eavesdropping and tampering.
- Topology Hiding: SEPP conceals the internal structure and network topology of an operator’s 5G network from outside entities. This helps prevent potential attackers from gaining insights into the network that could be used for malicious purposes.
- Traffic Verification and Filtering: SEPP verifies the authenticity of incoming signaling messages and can filter out unauthorized or malformed traffic. This protects the network from various attacks, including spoofing and Denial of Service (DoS).
- Supporting Roaming: In roaming scenarios, SEPPs are responsible for the secure exchange of signaling data between the home network (HPLMN) and the visited network (VPLMN). It ensures that a roaming subscriber’s data is securely handled.
- Enabling Interconnectivity: SEPP facilitates secure interconnectivity between different network operators that may use different security algorithms and parameters. It acts as a bridge, translating security mechanisms as needed.
Roaming Architecture Explanation:
-
- VPLMN (Visited Public Land Mobile Network): This is the network in which the roaming UE is located.
-
- HPLMN (Home Public Land Mobile Network): This is the network where the UE’s subscription is held.
When a UE is roaming, it connects to the (R)AN of the VPLMN. In a local breakout scenario, the data does not go back to the HPLMN but is instead handled locally by the VPLMN. This means that the UE’s data traffic is routed to the DN directly through the UPF of the VPLMN.
Interactions between network functions like AMF, SMF, PCF, NEF, and others within the VPLMN manage the UE’s session and apply policies. The NRF plays a critical role in helping these functions discover each other and establish the necessary control plane connections.
The AUSF and UDM of the HPLMN are still involved in the UE’s authentication, ensuring that it’s a legitimate subscriber. The SEPPs on both sides (vSEPP in VPLMN and hSEPP in HPLMN) ensure communication security between the VPLMN and HPLMN.
Interface Representations:
The lines (N1, N2, N3, etc.) represent interfaces between different network functions, enabling them to communicate and exchange information necessary for network operations, management, and security.
Step-by-Step Roaming Process:
Let’s understand with real network Scenario
- Search for Signal
- UE powers on and searches for a 5G signal in the USA.
- Select VPLMN
- UE selects a Visited Public Land Mobile Network based on the roaming agreements.
- Send Attach Request to VPLMN
- UE sends an attach request to the VPLMN via the (R)AN.
- Authentication Request to HPLMN
- VPLMN’s AMF sends an authentication request to the user’s HPLMN in India.
- Authentication and Security
- HPLMN’s AUSF and UDM authenticate the user.
- hSEPP secures the communication.
- Secure Communication to VPLMN
- vSEPP receives the authentication response, ensuring secure inter-network communication.
- Session Management and Network Slice Selection
- AMF and SMF in VPLMN establish a session for the UE.
- NSSF selects an appropriate network slice.
- Policy and Charging Rules
- PCF applies policies and charging rules for the session.
- Data Routing via UPF
- UPF in the VPLMN routes the UE’s data directly to the Data Network (DN), enabling local breakout.
- Access Data Network
- UE accesses the internet or services through the DN.
End → User is Connected to 5G Network in the USA
- Arrival and First Contact: When the Indian user arrives in the USA, their device (User Equipment, UE) will search for a 5G signal. It selects a Visited Public Land Mobile Network (VPLMN) based on the roaming agreements in place between the user’s Home PLMN (HPLMN) in India and networks in the USA.
- Network Discovery and Selection: The UE will identify a VPLMN and perform a network attachment request. This involves the UE sending its credentials (typically via a SIM card) to the Visited Network’s (R)AN (Radio Access Network).
- Authentication: The (R)AN passes the credentials to the Visited Network’s Access and Mobility Management Function (AMF), which forwards them to the Authentication Server Function (AUSF) of the HPLMN. The AUSF works with the Unified Data Management (UDM) system that holds your subscription data to authenticate your identity.
- Security: Once authenticated, the Security Edge Protection Proxy (SEPP) comes into play. The hSEPP in the Home Network and the vSEPP in the Visited Network ensure secure communication between the two networks. They encrypt and decrypt the signaling traffic and make sure that the user’s data is not intercepted or tampered with during the inter-network communication.
- Session Establishment and Network Slice Selection: After successful authentication, the AMF in the VPLMN interacts with the Session Management Function (SMF) to establish a session for the UE. The Network Slice Selection Function (NSSF) selects an appropriate network slice based on the UE’s subscription profile, ensuring the user receives a service equivalent to what they’d get in their home network.
- Policy and Charging: The Policy Control Function (PCF) in the VPLMN will then determine the policies and charging rules (based on the user’s subscription data and roaming agreements) and apply them to the session.
- Local Breakout and UPF Role: The user’s data does not return to their home network in a local breakout scenario. Instead, the VPLMN’s User Plane Function (UPF) routes the user’s data directly to the internet, significantly reducing latency and improving the user experience. The UPF handles the data plane traffic, ensuring it is correctly forwarded to and from the UE.
- Data Network (DN) Access: The user’s data requests are handled by the UPF, which connects to the Data Network (usually the Internet or a specific service) to fulfil those requests.
Roaming Architecture Explanation:
- vSEPP: The SEPP in the visited network (vSEPP) is responsible for the security of the user’s data and signaling as it enters and exits the visited network. It ensures the confidentiality and integrity of the data as per the security agreements.
- hSEPP: The SEPP in the home network (hSEPP) coordinates with the vSEPP to secure and validate the roaming user’s information. It uses security mechanisms to protect the user’s credentials and the network’s sensitive information.
How UPF Works in Roaming:
- The UPF in the visited network is critical in the local breakout scenario. It is the point where user data enters and leaves the 5G network, acting as a gateway to external networks.
- The UPF conducts traffic routing and forwarding, packet inspection, charging data collection, and applies any policy rules dictated by the SMF.
- For a roaming UE, the UPF will also ensure that the data is treated according to the roaming agreements, which may include data caps, speed limitations, or priority levels.
