5G Core Network Functions

From Monolith to Microservices: The 5G Core Paradigm

The 4G Evolved Packet Core (EPC) that we've touched upon was built around large, multi-functional components like the MME (Mobility Management Entity) and HSS (Home Subscriber Server). In contrast, the 5G Core takes a fundamentally different approach. It disaggregates these monolithic functions into smaller, more specialized, and independent components.

If we were to draw an analogy to your web security background, the 4G EPC is like a traditional monolithic web application, where all the logic is bundled together. The 5G Core, on the other hand, is designed like a modern microservices architecture. Each Network Function (NF) is a self-contained service that offers specific capabilities through well-defined APIs.

This architectural shift from hardware-centric boxes to software-based services is key to 5G's flexibility and scalability. It also radically changes the security landscape, moving from network protocol security to API and service security—a topic that should be very familiar to you.

The image below shows a high-level mapping of how the functions of the 4G EPC are re-allocated in the 5G Core.

Notice how the MME's job is split between the AMF and SMF, and the HSS's functions are taken over by the AUSF and UDM. Let's explore what each of these new functions does.

The Key Players of the 5G Core

To get a clear and concise overview of the main 5G core components, we'll start with a video that walks through each one.

Now that you've seen the overview, let's solidify those concepts with precise definitions and place them within the broader architecture.

The diagram below shows the 5G Service-Based Architecture (SBA), which we will cover in detail in the next lesson. For now, use it to visualize where each component we discuss fits into the system.

Here is a breakdown of the key functions based on the video and official documentation. For a more detailed, technical description of each, I recommend referencing the BSI's report on the 5G Core Network.

1. Access and Mobility Management Function (AMF)

• 4G Counterpart: Mobility & connection management part of the MME.
• Primary Roles:
  • Connection & Mobility Management: The AMF is the primary point of contact for the UE in the control plane. It handles the registration of a device onto the network, tracks its location when idle, and manages handovers between base stations.
  • Authentication & Security: It initiates the authentication process for the UE but doesn't perform it itself. It receives the UE's identity and forwards the authentication request to the AUSF.

2. Session Management Function (SMF)

• 4G Counterpart: Session management part of the MME + Control Plane parts of the SGW and PGW.
• Primary Roles:
  • PDU Session Management: This is the core role. A "PDU Session" is the 5G equivalent of a PDN connection in 4G; it's the logical connection that gives the user IP connectivity. The SMF is responsible for establishing, modifying, and releasing these sessions.
  • IP Address Allocation: It assigns an IP address to the UE.
  • UPF Selection & Control: It selects the appropriate UPF for the user's session and instructs it on how to handle the user's traffic (e.g., applying Quality of Service rules).

3. User Plane Function (UPF)

• 4G Counterpart: User Plane parts of the SGW and PGW.
• Primary Roles:
  • Packet Routing and Forwarding: The UPF is the workhorse of the user plane. It's essentially a sophisticated router that forwards data packets between the radio network (gNodeB) and the external Data Network (e.g., the internet).
  • Policy Enforcement: It inspects traffic and applies rules sent by the SMF, such as enforcing Quality of Service (QoS), redirecting traffic, or performing packet inspection.
  • Anchor Point: It acts as the mobility anchor, ensuring a stable IP address for the UE even as it moves between different base stations.

4. Authentication Server Function (AUSF)

• 4G Counterpart: Part of the HSS.
• Primary Roles:
  • Authentication: As the name implies, the AUSF's main job is to authenticate the user. It receives the authentication request from the AMF and executes the authentication algorithm (5G-AKA), validating the subscriber against the information held in the UDM. It makes the final "yes/no" decision on whether the subscriber is legitimate.

5. Unified Data Management (UDM)

• 4G Counterpart: Part of the HSS.
• Primary Roles:
  • Subscriber Data Management: The UDM is the central repository for all subscriber information. This includes subscription profiles (e.g., what services a user is allowed to access) and security credentials.
  • Authentication Credential Generation: It generates the authentication vectors used by the AUSF to challenge the UE during the authentication process.
  • Privacy Protection: It holds the long-term keys needed to de-conceal the subscriber's permanent identity (SUPI) from their concealed identity (SUCI), a key 5G privacy feature we will explore later.

Why This Matters for Hacking

Understanding these distinct roles is not just an academic exercise. It's critical for identifying attack vectors. In a microservices architecture, the attack surface shifts to the interfaces and access control policies between the services.

For example, a security research paper, "Identifying Over-Privilege Between 5G Core Network Functions" (LINK), found real-world vulnerabilities by analyzing these very interactions. The researchers discovered that the access control policies defined by the 3GPP standards were too permissive.

• One flaw (Finding 1 in the paper) allowed a compromised SMF to send a malicious command to an AMF, forcing a UE to disconnect or be handed over to a malicious base station.
• Another flaw (Finding 2) allowed an SMF or AMF to access sensitive subscription data from the UDM that it didn't need, violating the principle of least privilege.

This is a perfect example of how your web security expertise—analyzing API permissions, identifying insecure direct object references, and spotting privilege escalation—is directly applicable to the 5G core. The "network" is now an intricate web of APIs, and securing it requires a different mindset than traditional network security.

Conclusion

In this lesson, we have moved beyond the high-level view of the 5G core and identified its most critical components.

Key Takeaways:

• The 5G Core (5GC) replaces the monolithic 4G EPC with a disaggregated, service-based architecture similar to microservices.
• AMF (Access and Mobility Management Function): Manages user connection, registration, and mobility. The UE's entry point to the control plane.
• SMF (Session Management Function): Manages user data sessions (PDU Sessions), allocates IP addresses, and controls the UPF.
• UPF (User Plane Function): The data-plane workhorse. It routes and forwards user traffic between the radio and the internet.
• AUSF (Authentication Server Function): The authentication gatekeeper. It verifies the subscriber's identity.
• UDM (Unified Data Management): The master database for subscriber profiles and security credentials.

Preview of the Next Lesson:

Now that you know who the key players are, the next logical question is how do they talk to each other? In the next lesson, we will explore the Service-Based Architecture (SBA) of the 5G core and its reliance on web protocols. We'll see how these NFs use RESTful APIs, HTTP/2, and JSON to communicate, officially bridging the worlds of telecommunications and modern web technology—and opening up a whole new realm of security analysis.