5G Core SBA & Web Protocols

From Point-to-Point Wires to a "Network of Services"

Previous cellular generations, including 4G, used a reference point architecture. You can think of this as a blueprint with specific, point-to-point connections between different network components, each using a specialized telecom protocol. This was rigid and made adding new functions complex.

5G introduces the Service-Based Architecture (SBA), a paradigm shift in how the core network is designed.

To understand this shift, let's watch a brief segment from the following video. It contrasts the old reference point architecture with the new SBA.

As the video explained, the 5G core is a collection of NFs that expose and consume services from one another over a common Service-Based Interface (SBI). Instead of being hard-wired, NFs can now register their services and discover other services they need, much like modern cloud applications.

The Language of the Web in the 5G Core

The most significant aspect of the SBA is that the SBI doesn't use proprietary telecom protocols. Instead, it's built entirely on the foundation of modern web technologies. This was a deliberate design choice to make the network more flexible, scalable, and compatible with cloud infrastructure.

Let's begin exploring this by reading the introduction to a blog post from P1 Security, a telecom security company.

As the article highlights, the 5G core is built on an IT-native foundation. The protocol stack for communication between control plane NFs is defined as:

• Application: RESTful APIs using standard HTTP methods (GET, POST, etc.).
• Data Format: JavaScript Object Notation (JSON).
• Transport: HTTP/2.
• Security: Transport Layer Security (TLS).
• Network: TCP/IP.

This stack should look very familiar to you. Let's look at a visual representation of how radically the protocol stack has evolved over generations.

The SBA in Action: REST APIs Driving the Network

So, what does it mean for the 5G core to be "API-driven"? It means that network procedures are executed by NFs making API calls to each other.

The architecture is designed around two main roles:

• NF Service Producer: An NF that exposes an API to offer a specific capability (e.g., the UDM offers a service to provide subscriber data).
• NF Service Consumer: An NF that calls an API to use a capability from another NF (e.g., the AMF consumes the UDM's service to get authentication data).

The image below shows the SBA, where each NF can be both a producer and a consumer, interacting via the common SBI. A special NF, the Network Repository Function (NRF), acts as a service registry or "phone book," allowing NFs to discover the addresses and capabilities of other NFs.

To understand the specifics of how REST principles are applied, let's consult a more technical resource.

Let's tie this together with a simple example. Imagine a UE is attaching to the network:

1. The AMF (consumer) needs to authenticate the user. It needs authentication vectors from the UDM.
2. The AMF queries the NRF to find the API endpoint for the UDM's authentication service.
3. The AMF then sends an HTTP POST request to the UDM's API endpoint (e.g., /nudm-ueau/v1/{supi}/authentication-data/generate-av). The body of the request is a JSON object containing information about the request.
4. The UDM (producer) processes the request, generates the authentication vector, and sends it back in a 200 OK response with a JSON payload.

This entire interaction, which is at the heart of network security, is a standard REST API call.

A New Attack Surface: Web Security Meets Telecom

The adoption of web protocols is not just an architectural detail; it fundamentally changes the security landscape of the mobile network. The good news for you is that it brings the core network's security model into your area of expertise. The bad news for operators is that their networks are now exposed to a class of vulnerabilities they have historically not had to consider.

Let's return to the P1 Security article to explore these security implications.

The threats described—API vulnerabilities, HTTP/2-specific exploits, TLS misconfigurations—are all concepts from the world of web and application security. An attacker with a foothold in the core network could potentially:

• Exploit a broken access control vulnerability in the UDM's API to access subscriber data for any user.
• Launch a Denial-of-Service attack against the AMF by abusing HTTP/2 stream multiplexing.
• Manipulate session parameters by sending malicious, but syntactically valid, JSON objects to the SMF.

Understanding the SBA and its reliance on HTTP/2 and REST is therefore the first step to identifying and exploiting these modern 5G vulnerabilities.

Conclusion

In this lesson, we've unpacked the revolutionary design of the 5G core network. You've learned that the communication backbone of 5G is no longer built on proprietary, obscure telecom protocols, but on the very same web technologies that you work with every day.

Key Takeaways:

• The Service-Based Architecture (SBA) is a flexible, microservices-like design where Network Functions (NFs) act as service producers and consumers.
• NFs communicate over the Service-Based Interface (SBI), which uses a standard web technology stack: RESTful APIs over HTTP/2 with JSON payloads.
• This shift from point-to-point protocols to an API-driven architecture enables greater flexibility, scalability, and integration with cloud environments.
• Crucially, this change introduces a new attack surface, making the 5G core vulnerable to traditional web and API security threats, bridging the gap between your cybersecurity expertise and the world of telecom.

Preview of the Next Lesson:

Now that we understand how the NFs communicate, we can dive into one of the most critical security procedures that uses this architecture. In the next lesson, we will examine the 5G-AKA authentication process and the role of SUCI in enhancing subscriber privacy. You will see exactly how the AMF, AUSF, and UDM use these REST APIs to verify a subscriber's identity and establish a secure connection.