SEPP Security
The Security Edge Protection Proxy (SEPP) is the 5G network function that mediates all inter-PLMN service-based interface traffic between operators. It replaces the Diameter Edge Agent (DEA) of 4G roaming in role and criticality: every N32 exchange between a visited-PLMN NF and a home-PLMN NF terminates at the SEPP on each side, and everything the roaming attacker sees or influences at the interconnect boundary goes through it. 3GPP TS 33.501 defines its security architecture, and getting that architecture right decides whether 5G roaming is materially more secure than 4G — or whether the Diameter interconnect attack surface simply re-appears under a new protocol name.
SEPP security splits cleanly along the two N32 sub-interfaces. N32-c is the negotiation channel between two SEPPs and is always protected by mutual TLS, using operator-provisioned certificates to establish trust and negotiate the security mode for N32-f. N32-f carries the actual JSON-based service traffic and runs in one of two modes: plain TLS end-to-end (when no IPX modification is needed), or PRINS (PRotocol for N32 INterconnect Security, TS 33.501 Annex F) when IPX providers must legitimately modify messages in transit — with sensitive IEs (SUPI, location, keys) JWE-encrypted end-to-end and non-sensitive IEs left modifiable under a signed patch schema.
This hub aggregates everything the Ultimate Guide covers on SEPP: the N32-c/N32-f split, PRINS vs. TLS decision criteria, JWE payload construction and sensitive-IE allowlisting, IPX modification schemas, OAuth 2.0 token issuance by the home NRF for cross-boundary NF authorization, and the operational hardening (certificate rotation, replay protection, JSON-schema validation, rate limiting) that separates a paper-compliant SEPP from an actually-secure one. It also cross-links to the wider 5G Security and Roaming Security hubs for context on where the SEPP sits inside the 5G core.
Frequently asked questions about sepp security
What are the SEPP requirements for 5G roaming under 3GPP Release 16+?
Under 3GPP TS 33.501 the SEPP is mandatory for inter-PLMN N32 signaling: mutual TLS on N32-c for the negotiation of security capabilities, and either TLS or PRINS on N32-f for the actual JSON-based service traffic. When IPX providers must modify messages, PRINS is required so that sensitive IEs (SUPI, location, keys) are JWE-encrypted end-to-end while non-sensitive IEs remain modifiable under a signed patch. OAuth 2.0 tokens issued by the home NRF authorize NF-to-NF calls across the boundary.
What is PRINS and when is it required on N32?
PRINS (PRotocol for N32 INterconnect Security), specified in 3GPP TS 33.501 Annex F, is the application-layer security mode for N32-f between SEPPs. It is required when the roaming path traverses IPX providers that must legitimately modify messages: sensitive IEs (SUPI, location, keys) are JWE-encrypted end-to-end while non-sensitive IEs remain modifiable under a signed patch schema. If no IPX modification is needed, plain TLS on N32-f is allowed instead.
How does the 5G Service-Based Architecture (SBA) improve security?
The 5G SBA decomposes monolithic network functions into modular, independently deployable services communicating over HTTP/2 with TLS. This enables fine-grained access control via the Network Repository Function (NRF), OAuth 2.0-based service authorization, and clear separation of concerns—making it easier to apply security policies and isolate compromised functions.
What is the Security Edge Protection Proxy (SEPP) in 5G?
The SEPP is a mandatory 5G network function that sits at the operator's roaming boundary, replacing the unsecured SS7/Diameter interconnect model. It provides end-to-end message-level security (via JOSE/JWE) and transport-layer protection (TLS 1.3) for all inter-operator signaling, enforcing topology hiding and message filtering at the roaming edge.
What is the GRX/IPX and why is it security-relevant?
The GRX (GPRS Roaming Exchange) and its successor IPX (IP Packet Exchange) are private interconnect networks that carry roaming traffic between mobile operators. Because they transport sensitive signaling (Diameter, GTP) between operator boundaries, they are prime targets for interception and injection attacks. Securing IPX requires end-to-end encryption and mutual authentication between roaming partners.
Related glossary terms
- SEPP Security Security Edge Protection Proxy Security
- N32-c N32 Control Plane
- N32-f N32 Forwarding Plane
- Inter-PLMN Security
- Service-Based Architecture (SBA) Security
- PRINS PRotocol for N32 INterconnect Security
- TLS 1.3 Transport Layer Security 1.3
- SEPP Security Edge Protection Proxy
- N32 Tampering
- N32 Interface (5G)
Related comparisons
Compliance crosswalks
More on Sepp Security
Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.