SEPP — Security Edge Protection Proxy¶

Learning objectives¶

• Understand that the role of the SEPP is border defense of inter-PLMN (inter-operator roaming) SBI signaling.
• Be able to explain the positioning of the N32 interface, which connects to the SEPP of the peer PLMN.
• Understand the concept of topology hiding, which does not expose the internal NF configuration to the outside.
• Understand why the SEPP is important in roaming and inter-operator interconnection.

Prerequisites¶

• Basics of SBA/SBI → Curriculum
• Basics of security → Security
• An overview of interfaces → Interface dictionary

What you will learn in this chapter¶

• Why: Why border defense is needed at the edge of the operator network during roaming.
• What: The protection the SEPP provides (integrity/confidentiality, topology hiding, access control) and the role of N32.
• How: How an SBI request from a home-network NF reaches the peer-network NF, protected, via home SEPP → N32 → peer SEPP → peer-network NF.

Why — Why it is needed¶

In roaming, SBI messages are exchanged with another operator's network between the visited network (VPLMN) and the home network (HPLMN). However, exposing the internal NF configuration and credentials to the outside operator network as-is is dangerous. A "gatekeeper" is needed at the outer edge of the operator network that receives, protects, and hides communication with the peer operator. The SEPP fulfills this role.

Analogy: The SEPP is the "customs/rampart at the border" of the operator network. Without the SEPP, the internal topology (which NF is where) and credentials would be exposed between operators, giving attackers a foothold.

Overview¶

When a VPLMN NF sends an SBI request to a peer-network (HPLMN) NF, the home network's SEPP first receives it. The home SEPP protects and transmits the message to the peer network's SEPP through the N32 interface. The peer network's SEPP restores it and delivers it to the peer network's NF. In this process, the SEPP provides topology hiding (not showing the internal NF configuration to the outside), integrity/confidentiality protection (protection from tampering and eavesdropping), and access control (letting only permitted peers and messages through).

Basic Concept — Explanation for beginners¶

It is easier to understand the SEPP as the "border checkpoint" of the operator network. When each department (NF) inside the country (home network) exchanges with a department in a foreign country (peer operator network), they are not allowed to exchange directly but must always pass through the border customs. At customs, the contents (messages) are protected from tampering, the detailed domestic map (internal topology) is kept hidden, and only the peer country's customs (the peer SEPP) is engaged securely. In this way, the SEPP's counter passes only the necessary communication securely without revealing the internal structure.

Network Function details¶

Architecture¶

flowchart LR
    vNF["VPLMN NF"] -->|SBI| vSEPP["SEPP (VPLMN side)"]
    vSEPP -->|N32| hSEPP["SEPP (HPLMN side)"]
    hSEPP -->|SBI| hNF["HPLMN NF"]

How to read the diagram: An SBI request sent by a VPLMN-side NF is first received by the home network's SEPP (VPLMN side) and transmitted protected to the HPLMN-side SEPP through N32. The HPLMN-side SEPP restores it and delivers it to the home network's NF. The key point is that the SEPP always guards the inter-operator border as a transit point.

Interface¶

For details, see the Interface dictionary.

Appearance in procedures¶

When, during roaming, a VPLMN NF accesses an HPLMN NF (AUSF/UDM/SMF, etc.) for authentication or PDU session establishment and the like, that SBI goes through the SEPP and passes through N32. For related procedures, see Authentication and Security. Note that the details of the specific procedures and call flows during roaming are to be confirmed.

Comparison with EPC¶

In 4G/EPC, the Diameter Edge Agent (DEA) and IPX/Diameter interconnection handled the roaming-signaling border. In 5G, as SBI became HTTP/2-based, the SEPP is standardized as the SBI-oriented border with the N32 interface (details to be confirmed).

Release differences¶

• Rel-15: Basics (introduction of SEPP/N32/PRINS).
• Rel-16/17: Extensions to be confirmed.

3GPP Specification¶

• TS 23.501 §6.2.17 defines the SEPP
• TS 33.501 = security (N32 protection/PRINS) (relevant sections to be confirmed)
• TS 29.573 = N32 (inter-PLMN interconnection) (individual section numbers to be confirmed)

Summary¶

• The SEPP is the border gateway for inter-PLMN (inter-operator roaming) SBI signaling.
• It connects to the peer PLMN's SEPP over the N32 interface and relays messages with protection.
• Through topology hiding, it does not expose the internal NF configuration to the outside operator network.
• The protection content includes integrity/confidentiality and access control (PRINS/TLS are names only; details to be confirmed).
• The impact of a failure is limited to roaming/interconnection and does not affect intra-network communication.

Next Step¶

• Security
• Authentication
• NF dictionary
• Interface dictionary