ARCHITECTURE // 3GPP_TS_33_501

1. 5G SEPP Gateway Architecture

In 5G Standalone (SA) roaming, all HTTP/2 Service-Based Architecture (SBA) signaling between Visiting (VPLMN) and Home (HPLMN) networks must traverse a **Security Edge Protection Proxy (SEPP)** to prevent signaling eavesdropping and spoofing.

VPLMN 5G Core
➔ N32-c (mTLS) ➔
vSEPP
🔒 IPX Transit (N32-f JOSE) 🔒
hSEPP
➔ N32-c (mTLS) ➔
HPLMN 5G Core
PROTOCOL // N32_PROTECTION

2. N32-c & N32-f Interface Encryption

  • N32-c Control Plane: Establishes security capability negotiation and mTLS session keys between vSEPP and hSEPP.
  • N32-f Data Plane: Encapsulates HTTP/2 messages using JWE (JSON Web Encryption) and JWS (JSON Web Signature) so IPX carriers cannot tamper with subscriber IMSI/SUPI identities.
  • IPX PRH Modification Tracking: PRH (PRoxied HTTP) rules allow IPX carriers to modify specific headers while Cryptographically Binding modifications to prevent rogue roaming injection.
VERIFICATION // NIS2_AUDIT_READY

3. SEPP Audit & Compliance Checklist