5G Roaming Architecture (SEPP / N32) in 5G NR

Introduction

Roaming in 5G is the set of architecture and security rules that let a subscriber of one operator (the home network) be served by another operator's network (the visited network) while both keep the guarantees they need — the home operator keeps authority over identity, keys, policy and charging, and the visited operator keeps control of its own radio and infrastructure. It is defined in TS 23.501 for the system architecture and TS 33.501 for the inter-operator security.

It matters because a roaming subscriber touches almost every part of the 5G Core: the visited AMF serves the UE, but authentication reaches back to the home AUSF/UDM, the session may be anchored at home or locally, and every message that crosses the operator boundary passes through a security proxy. Two questions structure the whole topic: where does the user's data break out (the two roaming models), and how do two networks that do not trust each other exchange control signalling safely (the SEPP/N32 border).

The single principle that never bends is that authentication always stays in the home network. Everything else is a design choice. This page walks the two roaming models, the visited/home function split, the guarded border, and the two cross-PLMN mechanisms — authentication and slice mapping — where "home keeps control" becomes concrete.

Why 5G roaming is designed this way

The reason for the split is asymmetric trust. The visited operator must never hold your long-term key material, because a subscriber's K compromised in one visited country would compromise them everywhere. Equally, the home operator must never lose control of who is allowed on and how they are charged, because it carries the commercial and regulatory liability for the subscription. So 5G draws the architecture along that trust boundary: identity and keys stay home, the radio and mobility anchor sit in the visited network, and everything in between is either kept home (Home-Routed) or delegated locally (Local Breakout) as a deliberate choice.

Two networks, one subscriber: VPLMN and HPLMN

When you roam, two operators are involved. The Home PLMN (HPLMN) is where your subscription lives — it owns your SUPI, your keys, your subscription profile and your policy. The Visited PLMN (VPLMN) is the network you are physically camped on: its radio, its AMF, and — depending on the roaming model — some or all of its user plane. The whole design problem of 5G roaming, defined in TS 23.501 for architecture and TS 33.501 for security, is how to let the VPLMN serve you while the HPLMN keeps ultimate authority over who you are and what you are allowed to do.

The visited network is selected by PLMN selection: the UE reads the broadcast PLMN ID (MCC+MNC) in SIB1, compares candidate PLMNs against the operator-controlled and user-controlled roaming lists on the USIM (the preferred-PLMN files), and camps on the highest-priority permitted VPLMN. Only after it camps does it send a Registration Request containing its SUCI (or a stored 5G-GUTI), whose Home Network Identifier tells the visited AMF which HPLMN to reach for authentication.

The single most important principle to carry through this whole page: authentication always stays in the HPLMN. No matter where you roam, your identity is proven against your home operator's AUSF and UDM. Everything else — where your data breaks out, who sets QoS, how charging is done — is a design choice captured by the two roaming models below.

The two roaming models: Home-Routed vs Local Breakout

5G defines two ways to carry a roamer's user plane, and the difference is simply: where does the UE's traffic leave the mobile network and reach the data network?

In Home-Routed (HR) roaming, the user plane is dragged all the way back to the home network. The VPLMN provides the radio and a visited user-plane function (V-UPF), but that V-UPF does not exit to the internet — instead it tunnels the traffic over the inter-PLMN N9 interface to a home user-plane function (H-UPF), which is the true PDU session anchor and the point of exit to the data network. Session management is split: a V-SMF in the visited network handles the local leg and the V-UPF, while an H-SMF in the home network owns the session, allocates the UE's IP address, and selects the H-UPF. This is the model the home operator prefers when it wants to keep policy and charging control in its own hands, because all the traffic passes through equipment it owns.

In Local Breakout (LBO) roaming, the visited network breaks the traffic out to the data network locally. A single V-SMF in the VPLMN manages the whole session and selects a V-UPF that acts as the anchor and exits over N6 right there in the visited country. There is no inter-PLMN N9 and no H-UPF on the data path. Policy in this case is supplied by the V-PCF, which may consult the H-PCF across N32 for the home operator's policy inputs, but the packets themselves never go home. LBO gives lower latency and shorter paths — ideal for local internet access or edge services — at the cost of the home operator giving up direct sight of the user plane.

Split functions: what runs visited, what stays home

Roaming works because several 5GC functions come in a visited and a home flavour, connected across the border. Learn which is which, because the split is exactly where authority is drawn.

Read the table top to bottom and the trust boundary becomes obvious. The AMF is always visited: it is where the UE actually attaches, so it has to be near the radio. The AUSF and UDM are always home: they hold your identity and keys, which never leave the HPLMN. The SMF, UPF and PCF are the ones that split, and how they split is exactly what distinguishes HR from LBO. The V-SMF exists in both models; the H-SMF and H-UPF appear only in Home-Routed, because only Home-Routed drags the session home.

The SEPP and the N32 interface: the guarded border

Two operator networks do not trust each other the way two functions inside one core do. So every message that crosses between a VPLMN and an HPLMN passes through a Security Edge Protection Proxy (SEPP) that sits at each network's edge. The SEPP is the only 5GC control-plane element exposed to the other operator: it hides the internal topology, applies security, and polices what may cross. Two SEPPs — one in each network — face each other across the N32 interface.

N32 has two distinct phases, and interviewers love to hear them named separately:

The PRINS mechanism is what makes 5G roaming security genuinely new. In earlier generations, an interconnect (IPX) provider between operators could see and alter signalling more or less freely — the root of many SS7/Diameter attacks. With PRINS, the originating SEPP reformats each message into a protected JSON object where sensitive information elements are encrypted and the whole thing is integrity-protected, while a defined subset of fields is left modifiable under a signed change record. An IPX provider can perform its legitimate mediation (rewriting only the permitted fields) and every change is recorded and verifiable by the receiving SEPP. Nothing else can be silently tampered with.

Two more SEPP duties are worth naming precisely. First, topology hiding: the SEPP rewrites internal NF identifiers (FQDNs, instance IDs) so the peer operator never learns the visited or home network's internal structure — it only ever addresses the SEPP. Second, the JOSE-protected message under PRINS is structured into cleartext, an encrypted block, and a modifiable block: only fields the roaming agreement marks as IPX-modifiable can be changed, and each change is appended as a signed "modifications" entry the receiving SEPP validates against the original before accepting.

Note the clean division of labour: N32 (both -c and -f) is a control-plane border between the two SEPPs, while N9 is a user-plane border between the two UPFs. All the signalling between visited and home NFs — the AMF reaching the AUSF/UDM, the V-SMF reaching the H-SMF, the V-PCF reaching the H-PCF — is funnelled through the SEPPs over N32. Only Home-Routed adds the user-plane N9 alongside it.

Putting it together: the roaming reference picture

The diagram below shows the Home-Routed case, which is the richer of the two because it uses both the N32 control border and the N9 user-plane border. Follow the control plane across the top through the two SEPPs, and the user plane along the bottom from V-UPF to H-UPF and out to the data network. For Local Breakout, mentally delete the H-SMF, the H-UPF and the N9 link: the V-UPF would exit locally over its own N6.

Authentication across networks and S-NSSAI mapping

Two cross-PLMN mechanisms deserve a closer look, because they are where "the home network keeps control" becomes concrete: authentication and slice identity.

Authentication stays home. When a roaming UE registers, the visited AMF receives the registration but cannot verify the UE itself. It sends an authentication request across N32 (through the SEPPs) to the home AUSF, which works with the home UDM to run 5G-AKA or EAP-AKA'. The home network generates the challenge and checks the response; only after the AUSF confirms success does the visited AMF proceed. A further 5G refinement: the UE's permanent identity is never sent in the clear over the air — it presents a SUCI (a concealed form of the SUPI, encrypted with the home network's public key), and only the home network can de-conceal it back to the SUPI. So even the visited operator does not learn your permanent identifier until the home network chooses to reveal it. Keys and identity never leave the HPLMN; the VPLMN receives only derived, session-scoped key material for the local security context.

Concretely, the roaming authentication call is Nausf_UEAuthentication_Authenticate from the visited SEAF/AMF to the home AUSF, carrying the SUCI (or SUPI) and the serving-network name (SN name). Binding the SN name into RES* and the anchor key K_SEAF is what prevents one VPLMN from replaying a subscriber's authentication in a different VPLMN — the anchor the visited network receives is cryptographically tied to this VPLMN. The full vector exchange (5G HE AV → 5G SE AV, K_AUSF kept home, K_SEAF released on success) is detailed on the 5G-AKA page.

S-NSSAI mapping. A slice is identified by an S-NSSAI, but that value is only guaranteed to be meaningful within a single PLMN. Your home operator's S-NSSAI for, say, its enterprise slice may mean nothing — or something entirely different — in the visited network. So when you roam, the network performs slice mapping: the UE and the visited network work with the visited operator's S-NSSAI values, each associated with a mapped home S-NSSAI. The visited vNSSF, consulting the home hNSSF where needed, resolves which visited-network slice corresponds to each requested home slice, and this mapping is carried in the Allowed NSSAI along with its mapped home values. That way the UE gets an equivalent slice in the visited network while the home network's slice semantics are preserved for policy and charging.

An S-NSSAI itself is an 8-bit Slice/Service Type (SST) — with standardised values such as SST=1 (eMBB), 2 (URLLC) and 3 (MIoT) — optionally plus a 24-bit Slice Differentiator (SD). Because operators assign their own SD values (and often non-standard SST values), the same bits mean different services in different PLMNs, which is precisely why the vNSSF/hNSSF mapping is mandatory rather than optional when roaming.

Summary

5G roaming rests on one immovable principle and one design choice. The principle: authentication and keys stay in the HPLMN — the visited AMF serves the UE but reaches the home AUSF/UDM to prove identity, over the SEPP-guarded N32 border, and never holds the subscriber's K. The choice: where the user plane breaks out — Home-Routed (back to the H-UPF over N9, home keeps policy/charging sight) or Local Breakout (out at the V-UPF locally, shorter path, less home visibility), selectable per DNN/S-NSSAI.

The function split makes the boundary concrete: AMF always visited; AUSF/UDM always home; SMF/UPF/PCF/NSSF split into visited and home halves, with the home halves (H-SMF/H-UPF) present only in Home-Routed. The SEPPs and N32 (control) plus N9 (user plane, HR only) are the only inter-operator paths, and PRINS/JOSE lets IPX intermediaries mediate only signed, permitted fields.

Finally, two cross-PLMN mechanisms show "home keeps control" in action: authentication is bound to the serving-network name so it cannot be replayed between VPLMNs, and S-NSSAI values — being PLMN-scoped — are mapped by the vNSSF/hNSSF so a visited slice can stand in for a home slice while home semantics survive for policy and charging.

Quick Q&A

The questions that separate reciting acronyms from understanding where the trust boundary actually sits.