UPF (User Plane Function)

The User Plane Function is the 5G core element that forwards subscriber data packets between the radio access network and external data networks, applies QoS marking, performs packet inspection for charging, and supports lawful interception. It is controlled by the SMF over PFCP. The UPF is the 5G evolution of the 4G SGW/PGW user plane and is typically deployed at the network edge for low-latency use cases, which expands its exposure surface and makes UPF hardening a core 5G security task.

Categories: Radio Access NetworkCore NetworkIdentity and Subscriber

UPF in context

The radio access network is the layer where mobile devices attach to the operator's infrastructure. Attacks in this layer include IMSI catching, rogue base stations, downgrade attacks and jamming, and defenses hinge on mutual authentication, integrity-protected signaling and Open RAN supply-chain hygiene.

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

To place UPF in the wider telecom-security picture, review MNO, Zero Trust (Telecom), UDM, UMTS, USIM and User Plane Security.

Related terms

Equipment

User plane and packet gateways (UPF, PGW, SGW, GGSN)

Articles in the P1 mobile network security guide

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.