consumer's SEPP

Description

The consumer's SEPP (cSEPP) is a key network function in the 5G Service-Based Architecture (SBA) responsible for securing inter-PLMN (Public Land Mobile Network) signaling. It is defined in 3GPP TS 29.500 (Technical Realization of Service Based Architecture; Stage 3) and TS 33.501 (Security architecture and procedures for 5G System). The cSEPP is the Security Edge Protection Proxy (SEPP) that resides in the same PLMN as the NF (Network Function) service consumer. In inter-PLMN communication, when an NF in one PLMN (the consumer's PLMN) needs to interact with an NF in another PLMN (the producer's PLMN), the cSEPP acts as the security gateway on the consumer side, while the producer's SEPP (pSEPP) handles the producer side.

The primary role of the cSEPP is to protect the confidentiality and integrity of messages exchanged over the N32 interface, which connects the SEPPs of different PLMNs. It achieves this through mutual authentication, encryption, and integrity protection of HTTP/2-based signaling messages. The cSEPP receives messages from the NF service consumer, applies security policies (such as TLS or IPsec), and forwards them to the pSEPP. It also validates incoming messages from the pSEPP before delivering them to the local NF. This ensures that inter-PLMN signaling is secure and trustworthy, preventing eavesdropping, tampering, and spoofing attacks.

The architecture of the cSEPP includes several functional components: a message filtering module that enforces security policies based on the type of message and the roaming agreement; a key management function that handles the establishment and maintenance of security associations with the pSEPP; and a topology hiding function that conceals the internal network topology of the consumer's PLMN from the producer's PLMN. The cSEPP can be deployed as a standalone network function or integrated with other security elements. It supports both direct and indirect communication models, where in the indirect model, the cSEPP may communicate with the pSEPP via intermediate SEPPs (e.g., in roaming hubs).

In operation, when an NF service consumer initiates a request to an NF in a different PLMN, the request is first sent to the cSEPP. The cSEPP authenticates the consumer, applies necessary security transformations (e.g., adding or verifying tokens, encrypting sensitive information), and then forwards the request to the pSEPP over the N32 interface. The pSEPP performs similar functions on the producer side. Responses follow the reverse path. The cSEPP also plays a role in the authorization of the consumer, ensuring that it has the right to access the requested service in the visited PLMN. This is particularly important for roaming scenarios, where the home PLMN's cSEPP and the visited PLMN's pSEPP must cooperate to enforce roaming policies.

The cSEPP is essential for enabling secure inter-PLMN communication in 5G, which is a requirement for services like network slicing, edge computing, and roaming. Without the cSEPP, NFs would be exposed to security risks when communicating across PLMN boundaries. The cSEPP, along with the pSEPP, forms a security perimeter that protects the SBA. Its introduction in Release 19 reflects the ongoing evolution of 5G security to address new threats and deployment scenarios, such as those involving multiple PLMNs and service-based interfaces.

Purpose & Motivation

The consumer's SEPP (cSEPP) was introduced to address the security challenges of inter-PLMN communication in the 5G Service-Based Architecture. In earlier generations, inter-PLMN signaling (e.g., for roaming) was handled by dedicated nodes like the GRX/IPX for GPRS roaming or the Diameter Edge Agent (DEA) for LTE. These solutions provided some level of security but were not designed for the HTTP/2-based SBA and lacked the flexibility and granularity required for 5G. The cSEPP solves the problem of securing service-based interactions between NFs in different PLMNs, ensuring that messages are authenticated, encrypted, and integrity-protected.

The motivation for the cSEPP also stems from the need to support new 5G use cases, such as network slicing and multi-access edge computing, which often involve interactions across PLMN boundaries. For example, a UE roaming in a visited PLMN may access services hosted in its home PLMN, requiring secure signaling between the two. The cSEPP, together with the pSEPP, provides a standardized security framework for such scenarios, enabling operators to interconnect their networks securely. It also supports regulatory requirements for lawful interception and data protection by allowing security policies to be enforced at the edge of the PLMN.

Furthermore, the cSEPP addresses the limitations of previous approaches by providing a scalable, cloud-native security function that can be deployed in virtualized environments. It leverages modern security protocols like TLS 1.3 and OAuth 2.0, which are more robust and efficient than legacy protocols. The cSEPP's topology hiding capability also protects the internal network from external reconnaissance, enhancing overall network security. By defining the cSEPP in Release 19, 3GPP ensures that 5G inter-PLMN communication is secure by design, facilitating global roaming and service interoperability.