SEPP vs DEA
The Diameter Edge Agent (DEA) is the LTE-era Diameter roaming gateway. The Security Edge Protection Proxy (SEPP) is its 5G successor, terminating the N32 interface between visited and home PLMN. SEPP adds mutual TLS, JWE-protected sensitive IEs, and IPX modification schemas.
| Attribute | SEPP | DEA |
|---|---|---|
| Generation | 5G SA | 4G / LTE |
| Interface | N32-c (control), N32-f (forwarding) | S6a, S9, S13 (Diameter) |
| Transport security | Mutual TLS + PRINS/TLS on N32-f | Optional IPsec, often absent |
| IE protection | JWE-encrypted sensitive IEs (PRINS) | No standard IE-level encryption |
| IPX visibility | IPX modifies through signed schema | IPX has full plaintext visibility |
| Authorization | OAuth 2.0 client credentials | Origin-Realm trust |
Verdict
SEPP is a real security upgrade — the first roaming-edge design that assumes the IPX is untrusted. But its guarantees depend on operators actually enabling PRINS with JWE, not just TLS. Many early 5G roaming deployments run TLS-only, which leaves sensitive IEs (SUPI, keys) visible to intermediaries.