Service-Based Architecture & Reference Points

The 5G Core abandons the point-to-point interface model of the 4G EPC in favour of a Service-Based Architecture (SBA). In the SBA, the control plane is a set of loosely coupled network functions (NFs) that expose RESTful services over a common Service-Based Interface (SBI) and discover one another dynamically through the NRF. The user plane is kept separate (Control/User Plane Separation, CUPS) so it can scale and be placed independently - at the edge, on bare metal, or behind an eBPF/XDP fast path.

This page explains the NFs, the user plane, and the reference points that connect them. For protocol-level detail on the SBI and PFCP/N4, see the SBI & N4 Interface Reference.

Two planes, one design principle

Control plane (SBA)

Stateless NFs expose REST/HTTP-2 service operations. They register with the NRF and call each other by service discovery, not hard-wired peers. This makes NFs horizontally scalable and Kubernetes-friendly.

User plane (CUPS)

The UPF forwards packets and is controlled by the SMF over N4 using PFCP. Decoupling forwarding from session logic lets the UPF sit at the edge and be accelerated independently of the control plane.

Control-plane network functions

Each NF owns a bounded responsibility. The list below covers the NFs TOSSI routinely deploys and validates; an SBA core may add more (CHF, NEF, BSF) depending on the use case.

NF	Name	Responsibility
AMF	Access & Mobility Management	Terminates N1 (NAS) and N2 (NGAP); handles registration, connection, mobility, and reachability.
SMF	Session Management	Manages PDU session lifecycle, IP address allocation, and controls the UPF over N4 (PFCP).
UPF	User Plane Function	Forwards user packets between RAN (N3) and the data network (N6); enforces QoS and policy rules.
AUSF	Authentication Server	Performs UE authentication (5G-AKA / EAP-AKA’) on behalf of the home network.
UDM	Unified Data Management	Generates authentication vectors, manages subscriber identity and access authorization.
UDR	Unified Data Repository	Stores subscription, policy, and structured data consumed by UDM/PCF.
NRF	Network Repository Function	The service registry: NFs register here and discover peers. The backbone of SBA.
PCF	Policy Control Function	Provides policy rules (QoS, charging) to SMF/AMF.
NSSF	Network Slice Selection	Selects the network slice (S-NSSAI) and serving AMF set for a UE.

The NRF is the keystone

In a point-to-point world you configure peer addresses statically. In the SBA, NFs register their profile (NF type, services, FQDN, supported slices) with the NRF and query it to find providers. TOSSI’s core interop test is therefore an NRF registration + discovery check across mixed implementations - if an AMF cannot discover a foreign-vendor SMF via the NRF, the integration has failed regardless of any single NF’s conformance.

The Service-Based Interface (SBI)

All control-plane NF-to-NF communication uses the SBI:

• Transport: HTTP/2 (typically over TLS), per 3GPP TS 29.500.
• Style: RESTful resources with JSON payloads, defined by OpenAPI 3 descriptions that 3GPP publishes per service.
• Naming: services are addressed as /{nf}/{apiName}/{apiVersion}/..., e.g. /nnrf-nfm/v1/nf-instances.

NFs are both producers and consumers. For example, the AMF (consumer) discovers an SMF (producer) via the Nnrf_NFDiscovery service, then invokes the SMF’s Nsmf_PDUSession service to create a session.

        Nnrf (registration / discovery)
   AMF ───────────► NRF ◄─────────── SMF
    │  Nsmf_PDUSession (REST/HTTP-2)   │
    └──────────────►──────────────────┘

Reference points

The SBA uses service names for control-plane calls, but the architecture still defines classic reference points for the interfaces that cross plane or domain boundaries. These are the interfaces TOSSI wires when integrating the core with the RAN and the data network.

Reference point	Between	Protocol	Purpose
N1	UE ↔ AMF	NAS (over RRC/NGAP)	Registration, session, and mobility signalling to the device.
N2	gNB ↔ AMF	NGAP (over SCTP)	RAN control signalling - UE context, PDU session resource setup.
N3	gNB ↔ UPF	GTP-U (over UDP)	User-plane tunnel carrying subscriber packets from the RAN.
N4	SMF ↔ UPF	PFCP (over UDP/8805)	The CUPS control channel - SMF programs forwarding/QoS rules into the UPF.
N6	UPF ↔ Data Network	IP	The interface to the internet/enterprise/edge data network.

Where TOSSI plugs the core into the stack

N2/N3 point at the RAN & O-RAN Integration pillar (O-CU-CP terminates N2, O-CU-UP/UPF terminate N3). N6 exits to the data network, where the eBPF & Dataplane pillar can accelerate forwarding. N4 is the seam where an eBPF-based UPF must speak the same PFCP feature set as the chosen SMF.

A registration + PDU session walk-through

The two procedures TOSSI exercises first when validating a core (per TS 23.502):

1. Registration (N1/N2): the UE sends a NAS Registration Request via the gNB over N2 to the AMF. The AMF discovers an AUSF/UDM via the NRF, runs 5G-AKA, and registers the UE.
2. PDU session establishment (N1/N2/N4): the UE requests a PDU session. The AMF discovers an SMF via the NRF and invokes Nsmf_PDUSession_CreateSMContext. The SMF selects a UPF, programs it over N4 (PFCP), and the user-plane tunnel (N3) is set up. The UE now has IP connectivity through the UPF to the data network (N6).

Network slicing and statelessness

Two SBA properties matter for the integrator:

• Network slicing (S-NSSAI): a UE’s traffic is mapped to a slice. The NSSF selects the slice and serving AMF; the SMF/UPF selection honours the slice. TOSSI validates that slice identifiers propagate consistently from N1 through to UPF selection.
• Stateless, scalable NFs: because NFs externalise state (often to a UDR or a shared data store), they scale horizontally as Kubernetes deployments. This is what makes the Cloud-Native & Kubernetes Operators pillar the natural deployment fabric for the core.

Roadmap

A planned conformance asset: an automated NRF interop matrix that cross-tests every supported core’s NF registration/discovery against every other core’s NFs, plus a slice-propagation tracer that follows an S-NSSAI from N1 to N4 UPF selection. Not yet published.

Continue

Deploy a core in 15 minutes Stand up an SBA core on Kubernetes and watch NRF discovery happen.

SBI & N4 reference Protocol-level detail on the SBI and PFCP/N4, with 3GPP spec pointers.