N11 Reference Point (AMF to SMF)

Also known as: N11 reference point, N11 interface

N11 is the 3GPP service-based reference point between the AMF and the SMF, implemented over HTTP/2 with Nsmf and Namf APIs. It carries PDU session establishment, modification and release messages, N1/N2 tunnelled NAS content and QoS updates. Attacks or misconfigurations on N11 can cause session hijack, forced re-authentication or QoS downgrade, so it must be TLS-protected with OAuth 2.0 token validation as defined in 3GPP TS 33.501.

Categories: Core NetworkSecurity ControlsEncryption and Cryptography

N11 in context

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

Security controls in telecom span signaling firewalls (SS7/Diameter/GTP screening at the network edge), transport encryption (IPsec, TLS, PRINS), identity and access on OSS/BSS, and monitoring at both the packet and log level. Controls are audited against GSMA FS.11/FS.19/FS.20/FS.36 and, in Europe, NIS2 sectoral rules.

To place N11 in the wider telecom-security picture, review SBI, N12, N8, N6, HTTP and SCP.