Producer's Security Edge Protection Proxy

Description

The producer's SEPP (pSEPP) is a critical security element in the 5G Service-Based Architecture (SBA) that resides in the home PLMN of a Network Function (NF) service producer. In 5G, NFs communicate via service-based interfaces (SBIs) using HTTP/2, and when these communications cross PLMN boundaries, they must be secured. The pSEPP acts as the ingress/egress security proxy for the producer's PLMN, terminating the Transport Layer Security (TLS) or other security associations from the consumer's SEPP (cSEPP) in the visiting PLMN. It enforces security policies, performs message filtering, and applies topology hiding to protect the internal network topology of the producer's PLMN from external exposure.

The pSEPP is defined in 3GPP TS 33.501 (Security architecture and procedures for 5G System) and its role in the service-based architecture is further detailed in TS 29.500 (5G System; Technical Realization of Service Based Architecture; Stage 3). It works in tandem with the cSEPP: the cSEPP secures outbound messages from the consumer's PLMN, while the pSEPP secures inbound messages to the producer's PLMN. Together, they form a security gateway pair that enables secure inter-PLMN communication for services like roaming, network slicing, and edge computing.

Architecturally, the pSEPP sits at the edge of the producer's PLMN, typically co-located with the IP border gateway. It receives HTTP/2 requests from the cSEPP over the N32 interface, which is the inter-PLMN interface between SEPPs. The pSEPP validates the incoming messages, applies security policies (e.g., rate limiting, message filtering, JSON Web Token (JWT) validation), and forwards them to the appropriate NF service producer within the PLMN. For outbound responses, it performs similar functions in reverse. The pSEPP also handles key management, including the establishment of security associations with cSEPPs using certificates or pre-shared keys.

Key functions of the pSEPP include: (1) mutual authentication with the cSEPP using TLS or other mechanisms; (2) integrity and confidentiality protection of signaling messages; (3) topology hiding to prevent disclosure of internal NF addresses and identifiers; (4) authorization checks to ensure the consumer is allowed to access the requested service; and (5) attack mitigation, such as DDoS protection and message flooding prevention. The pSEPP may also perform protocol interworking if different security mechanisms are used in different PLMNs.

The pSEPP was introduced in Release 19 as part of the ongoing evolution of 5G security. While SEPP concepts existed in earlier releases (the SEPP was introduced in Release 15), the specific term "producer's SEPP" was formalized in Release 19 to clearly distinguish the roles of the two SEPPs in inter-PLMN communication. This distinction is important for roaming scenarios, where the visited PLMN's cSEPP communicates with the home PLMN's pSEPP to access services like Unified Data Management (UDM) or Authentication Server Function (AUSF). The pSEPP ensures that only authorized requests reach the producer NF and that responses are securely returned.

Purpose & Motivation

The pSEPP exists to secure inter-PLMN control plane signaling in 5G networks, addressing the security challenges introduced by the service-based architecture (SBA). In earlier generations (2G/3G/4G), inter-PLMN signaling used dedicated protocols like SS7 or Diameter, which had their own security mechanisms (or lack thereof). With 5G's SBA, NFs expose services via HTTP/2 APIs, which are more open and vulnerable to attacks if not properly secured. The pSEPP, along with the cSEPP, provides a standardized security gateway that protects these APIs across PLMN boundaries.

The primary motivation for the pSEPP is to enable secure roaming and inter-PLMN services without exposing the internal network topology or allowing unauthorized access. Without a pSEPP, a malicious actor in a visited PLMN could potentially access sensitive services in the home PLMN, launch denial-of-service attacks, or intercept signaling messages. The pSEPP enforces security policies, authenticates the cSEPP, and ensures that only legitimate traffic reaches the producer NFs. It also simplifies security management by centralizing inter-PLMN security functions in a single logical entity.

The formalization of the term "producer's SEPP" in Release 19 reflects the maturation of 5G security standards and the need for precise terminology in specifications. As 5G networks become more complex with network slicing, edge computing, and multi-operator deployments, the pSEPP's role in securing service-based interactions across PLMNs becomes increasingly critical. It is a key enabler for global roaming and seamless service delivery in 5G.