- 01Access and Mobility Management FunctionAMF
- 02Unified Data ManagementUDM
- 03Policy Control FunctionPCF
- 04Network Repository FunctionNRF
- 05Non-3GPP Interworking FunctionN3IWF
- 06Security Edge Protection ProxySEPP
- 07Network Slice Selection FunctionNSSF
- 08Service Communication ProxySCP
- 09Application FunctionAF
- 10Location Management FunctionLMF
- 11Cell Broadcast CentreCBCF
- 12Gateway Mobile Location CentreGMLC
- 13Session Management FunctionSMF
- 14User Plane FunctionUPF
- 15SMS FunctionSMSF
- 16Equipment Identity RegisterEIR
5G roaming opens your core to every partner network. The SEPP makes sure that it is the only thing they ever reach.
In a 5G standalone core, the network functions talk to each other over HTTP/2. When a subscriber roams, those requests cross the border: the visited AMF authenticates the subscriber through the home AUSF, reads its profile in the home UDM, and the visited SMF reaches the home SMF for home-routed sessions. Without a gateway, every one of these functions would have to be reachable from every roaming partner.
SS7 and Diameter interconnects have shown what happens when signalling from partners is trusted by default: location tracking, interception of authentication data, fraud. 5G roaming needs a control point at the edge, with its own security, from the first partner onwards.
N32-c: agree on the security
Each pair of SEPPs, one in the visited network and one in the home network, runs a handshake on N32-c over mutual TLS. They exchange their security capabilities and choose how the messages will be protected between them: TLS end to end, or PRINS when an IPX sits in the middle.
N32-f: protect and forward
Every SBI request and answer of the roaming partner goes through N32-f. With TLS, the SEPPs are connected directly or through an IPX that does not touch the messages. With PRINS, the sensitive parts of each message — keys, authentication vectors, location — are encrypted and signed, and the IPX can only read or modify what the protection policy allows, with signed modifications.
Hide and filter
Toward the partner, the SEPP replaces the addresses of the core by telescopic FQDNs: the partner only ever sees the SEPP. Each message is checked against the policy of the partner: allowed services and operations, and consistency between the PLMN of the N32 connection and the identities carried by the message, so that a partner cannot speak for another network.
SEPP — secure 5G roaming between two operators
5G SA roaming, home-routed data, IPX interconnect, group networks, signalling security — one edge.
Inbound and outbound 5G SA roaming
Visitors are authenticated by their home AUSF and served with their home UDM profile; your own subscribers abroad are handled the same way by your hSEPP.
Home-routed sessions
The visited SMF reaches the home SMF through the two SEPPs, so roaming data sessions can be anchored in the home network.
Interconnect through an IPX or a roaming hub
PRINS keeps the sensitive information elements out of reach of the intermediaries, while the IPX can still apply the modifications you allow.
Operator groups and MVNOs
The networks of a group, or an MVNO running its own 5G core, interconnect through their SEPPs with a policy per relationship.
Protecting the core
Message filtering and PLMN checks at the edge stop the spoofing and tracking attacks known from SS7 and Diameter before they reach the core.
We've selected Ouroboros because it was the best company capable of fulfilling our need for a scalable and virtualised full MVNO platform. Moreover, the Ouroboros team is pragmatic, flexible and responsive.
Pascal Prot
CEO-CTO · Legos
Single entry and exit point
All inter-PLMN SBI traffic goes through the SEPP. No AMF, SMF, UDM or AUSF is exposed to a partner.
N32 handshake per partner
Security capabilities are negotiated with each roaming partner. Each relationship gets the protection it needs.
TLS or PRINS
Mutual TLS for direct links, PRINS application layer security with JWE and JWS when an IPX is involved. Both are available on the same SEPP.
Controlled IPX modifications
Protection policies list which elements are encrypted and which ones the IPX may modify. Modifications are signed and checked.
Topology hiding
Telescopic FQDNs replace the addresses of the core. The internal architecture stays private.
Filtering and anti-spoofing
Allowed services and operations per partner, rate limiting, and consistency checks between the N32 PLMN and the message content.
Certificates from the operator CA
SEPP certificates are issued by the operator CA, with CSR, CMPv2, import and revocation lists.
IPv4, IPv6 and dual-stack
Every interface runs over IPv4, IPv6 or both. The element fits an IPv6 core or a mixed network without a separate configuration.
The SEPP comes from the same platform as the AMF, SMF, UDM, AUSF, PCF and NRF it protects, tested together in the Ouroboros TechLab. The services it lets through and the checks it applies are aligned with the functions behind it. It also works with third-party network functions over the standard SBI.
Ouroboros has secured SS7 and Diameter interconnects for years with its STP and DRA. The SEPP brings the same approach to 5G: one edge, one policy per partner, everything logged.
Tell us your roaming partners, your IPX and your 5G core. We'll propose a SEPP configuration and security policies to match, on OPEX or CAPEX.
Product datasheet5G Standalone · 5G Standalone
Security Edge Protection Proxy (SEPP)
5G roaming opens your core to every partner network. The SEPP makes sure that it is the only thing they ever reach.
In production since 2004 · 148M+ subscribers · 99.999% availability
The service-based core was not built to face other operators
In a 5G standalone core, the network functions talk to each other over HTTP/2. When a subscriber roams, those requests cross the border: the visited AMF authenticates the subscriber through the home AUSF, reads its profile in the home UDM, and the visited SMF reaches the home SMF for home-routed sessions. Without a gateway, every one of these functions would have to be reachable from every roaming partner.
SS7 and Diameter interconnects have shown what happens when signalling from partners is trusted by default: location tracking, interception of authentication data, fraud. 5G roaming needs a control point at the edge, with its own security, from the first partner onwards.
One edge, one policy per partner.
N32-c: agree on the security
Each pair of SEPPs, one in the visited network and one in the home network, runs a handshake on N32-c over mutual TLS. They exchange their security capabilities and choose how the messages will be protected between them: TLS end to end, or PRINS when an IPX sits in the middle.
N32-f: protect and forward
Every SBI request and answer of the roaming partner goes through N32-f. With TLS, the SEPPs are connected directly or through an IPX that does not touch the messages. With PRINS, the sensitive parts of each message — keys, authentication vectors, location — are encrypted and signed, and the IPX can only read or modify what the protection policy allows, with signed modifications.
Hide and filter
Toward the partner, the SEPP replaces the addresses of the core by telescopic FQDNs: the partner only ever sees the SEPP. Each message is checked against the policy of the partner: allowed services and operations, and consistency between the PLMN of the N32 connection and the identities carried by the message, so that a partner cannot speak for another network.
SEPP — secure 5G roaming between two operators
How operators use it.
5G SA roaming, home-routed data, IPX interconnect, group networks, signalling security — one edge.
Inbound and outbound 5G SA roaming
Visitors are authenticated by their home AUSF and served with their home UDM profile; your own subscribers abroad are handled the same way by your hSEPP.
Home-routed sessions
The visited SMF reaches the home SMF through the two SEPPs, so roaming data sessions can be anchored in the home network.
Interconnect through an IPX or a roaming hub
PRINS keeps the sensitive information elements out of reach of the intermediaries, while the IPX can still apply the modifications you allow.
Operator groups and MVNOs
The networks of a group, or an MVNO running its own 5G core, interconnect through their SEPPs with a policy per relationship.
Protecting the core
Message filtering and PLMN checks at the edge stop the spoofing and tracking attacks known from SS7 and Diameter before they reach the core.
Specifications.
Inside the platform.
Single entry and exit point
All inter-PLMN SBI traffic goes through the SEPP. No AMF, SMF, UDM or AUSF is exposed to a partner.
N32 handshake per partner
Security capabilities are negotiated with each roaming partner. Each relationship gets the protection it needs.
TLS or PRINS
Mutual TLS for direct links, PRINS application layer security with JWE and JWS when an IPX is involved. Both are available on the same SEPP.
Controlled IPX modifications
Protection policies list which elements are encrypted and which ones the IPX may modify. Modifications are signed and checked.
Topology hiding
Telescopic FQDNs replace the addresses of the core. The internal architecture stays private.
Filtering and anti-spoofing
Allowed services and operations per partner, rate limiting, and consistency checks between the N32 PLMN and the message content.
Certificates from the operator CA
SEPP certificates are issued by the operator CA, with CSR, CMPv2, import and revocation lists.
IPv4, IPv6 and dual-stack
Every interface runs over IPv4, IPv6 or both. The element fits an IPv6 core or a mixed network without a separate configuration.
The SEPP comes from the same platform as the AMF, SMF, UDM, AUSF, PCF and NRF it protects, tested together in the Ouroboros TechLab. The services it lets through and the checks it applies are aligned with the functions behind it. It also works with third-party network functions over the standard SBI.
Ouroboros has secured SS7 and Diameter interconnects for years with its STP and DRA. The SEPP brings the same approach to 5G: one edge, one policy per partner, everything logged.
Unified Data Management (UDM)
The home UDM and AUSF serve roaming subscribers through the hSEPP.
Network Repository Function (NRF)
Discovery of the partner's network functions is relayed between the NRFs through the SEPPs.
Diameter Routing Agent (DRA)
The edge of the 4G roaming signalling, next to the SEPP for 5G.
Next step
Opening 5G SA roaming?
Tell us your roaming partners, your IPX and your 5G core. We'll propose a SEPP configuration and security policies to match, on OPEX or CAPEX.