4 What each network function does

4.1 Why the document lists functions at all

A 4G core was a small set of boxes with fixed cables between them. 5G broke that apart: the specification names about forty network functions, each one a bundle of jobs with a name, and says nothing about how many machines they run on or which ones share a process.

Clause 6 is where those bundles are written down §6.1. It is the reference half of the document: the flow chapters tell you what happens during a registration, this one tells you what the names in those flows own.

Three things are deliberately not here. The radio network is specified in TS 38.300 and TS 38.401, the security functions in TS 33.501, and the media streaming functions in TS 26.501 §6.1.

4.2 How to read one of these clauses

Each function's clause is a bullet list opening with "includes the following functionality". The bullets are unweighted: "Termination of NAS (N1)" and "Support for charging" sit side by side in the AMF's list even though one is the reason the function exists and the other is bookkeeping §6.2.1.

Several clauses are one line long and point somewhere else. The LMF §6.2.16 and the GMLC §6.2.16A go to TS 23.273, the W-AGF §6.2.20 to TS 23.316, and the four multicast functions — MB-SMF §6.2.27, MB-UPF §6.2.27a, MBSF §6.2.27b and MBSTF §6.2.27c — to TS 23.247.

Clause 6.2.5a is the word "Void": a number used once and retired rather than reused §6.2.5a.

4.3 The four that carry a session

4.3.1 AMF — everything about the device itself

The Access and Mobility Management Function is the phone's one contact point in the core. It terminates N2, the control interface from the radio network, and N1, the signalling connection to the device itself, and it ciphers and integrity-protects that signalling §6.2.1.

Its own work is registration, connection and reachability management, mobility management, access authentication and access authorization. It is also the Security Anchor Function of TS 33.501, which is why the keys hang off it.

Almost everything else it does is carrying somebody else's messages. Session management messages travel between the device and the SMF through the AMF, which is named a transparent proxy for them. SMS travels through it to the SMSF, and location messages to the LMF.

The AMF also allocates EPS Bearer IDs so a session can move to 4G, notifies other functions of mobility events, and reaches other AMFs over N14 for re-allocation and context transfer — an interface that may cross a PLMN border during roaming.

For non-3GPP access it holds a second, separate security context and keeps a combined registration context valid over both accesses at once §6.2.1.

4.3.2 SMF — everything about one connection

The Session Management Function establishes, changes and releases PDU sessions, and maintains the tunnel between the UPF and the access node §6.2.2.

What it owns:

• The device's IP address. It allocates and manages it, and may take it from a UPF or from the external data network. It contains DHCPv4 and DHCPv6, as both server and client.

• The user-plane function. It selects the UPF, controls it, and configures traffic steering there so packets reach the right destination.

• The answers to ARP and IPv6 Neighbour Solicitation for Ethernet sessions, from a local cache — either itself, or by telling the UPF to proxy them.

• The SM parts of the signalling messages, the downlink data notification, the SSC mode of the session, and charging data collection at the UPF.

It also discovers the P-CSCF for IMS calls, selects the EASDF and hands the device its DNS server address for edge computing, and turns the assistance container it gets from the PCF into TSC assistance information §6.2.2.

In roaming it can act as V-SMF, keeping local quality enforcement, charging and lawful intercept in the visited network, or as I-SMF, an intermediate instance that can be inserted, moved and removed while the session runs.

4.3.3 UPF — the only function that touches packets

Everything above is signalling. The User Plane Function is the data path: the anchor for mobility, the point where a session meets the data network, and the thing that forwards, inspects, counts and shapes packets §6.2.3.

Its jobs read like a router's feature list: uplink classifier and branching point routing, packet inspection against service data flow templates, and enforcement of the user-plane half of a policy rule — gating, redirection, steering.

Then the traffic work: uplink and downlink rate enforcement, transport-level marking, downlink buffering with a notification back to the SMF, and "end marker" packets to the old radio node after a handover.

It also does the awkward jobs nothing else can: packet duplication downlink and elimination uplink for reliability, inter-PLMN user plane security at a network border §5.8.2.14, usage reporting, and lawful intercept collection.

4.3.4 PCF — the rules

The Policy Control Function has the shortest clause of the four and the widest reach: it holds one policy framework for the whole network's behaviour, hands rules to control-plane functions that then enforce them, and reads the subscription data it needs from a UDR in its own PLMN §6.2.4.

The detail lives in TS 23.503, not here.

4.4 Where the data lives

UDM — the Unified Data Management is the subscriber's home. It generates the 3GPP AKA authentication credentials, handles the permanent identity (SUPI) and de-conceals the privacy-protected form of it (SUCI).

It also authorizes access against subscription data such as roaming restrictions, and records which AMF is currently serving a device and which SMF is serving each of its sessions §6.2.7.

UDR — the Unified Data Repository is the store behind it: subscription data for the UDM, policy data for the PCF, structured data for exposure, and application data such as packet flow descriptions and 5G-VN group information. Its interface, Nudr, never crosses a PLMN border §6.2.11.

UDSF — optional, and the odd one out: it stores unstructured data, which means data whose shape 3GPP never defined, for any function that wants a place to put its state. It also offers a timer service §6.2.12.

AUSF — the Authentication Server Function has a two-line clause: it runs authentication for 3GPP and untrusted non-3GPP access, and for disaster roaming §6.2.8. The division with the UDM is worth holding on to — the UDM makes the credentials, the AUSF runs the exchange with the device.

4.5 Finding each other, and talking safely

NRF — the Network Repository Function is the directory. Functions register a profile with it, it answers discovery requests, it notifies subscribers when something registers, changes or disappears, and it tracks health §6.2.6.1.

Multiple NRFs can exist at PLMN level, per group of slices, or per single slice, and in roaming a visited NRF reaches a home NRF over N27.

The profile is the interesting part, because it decides what a caller can search on: instance ID, type, PLMN, slice identifiers, address, capacity, priority, load, set membership, service names and endpoints, location and tracking areas.

On top of those come per-type extras such as the GUAMIs of an AMF, or the ranges of subscriber identities a UDM, UDR, AUSF, PCF or CHF is responsible for §6.2.6.2. That last one is how "find the UDM for this subscriber" works at all.

The SCP has a profile of its own, listing the domains it bridges and the other PLMNs reachable through it §6.2.6.3.

SCP — the Service Communication Proxy sits in the middle of calls that do not go direct. It forwards and routes messages, possibly to a next-hop SCP, carries out discovery on the caller's behalf ("delegated discovery"), and adds authorization, load balancing and overload control.

It may resolve group identities against the UDR, and it may register itself in the NRF so other SCPs can find it §6.2.19.

SEPP — the Security Edge Protection Proxy is the only thing at the border between two operators. Every inter-PLMN control-plane message goes through it; it filters and polices, hides the internal topology, and relays so that both sides see what looks like a direct interaction.

Messages between two SEPPs may pass through IPX entities on the way §6.2.17.

4.6 Opening the network to the outside

NEF — the Network Exposure Function is the door. Outward, it exposes capabilities, events and analytics to third parties.

Inward, it takes information from an application — expected device behaviour, group definitions, time synchronization settings — and authenticates, authorizes and throttles the sender §6.2.5.0.

Its third job is translation. Outside callers speak in application identifiers and external group names; inside, the system speaks in DNN and S-NSSAI, and the NEF converts between them while masking anything sensitive.

What it collects it stores as structured data in the UDR, from where it can be re-exposed. It can also carry non-IP data delivery for small devices §5.31.5, and it supports the common API framework of TS 23.222 when it is used for external exposure §6.2.5.1.

AF — the Application Function is whatever wants something from the network: influence over traffic routing, a quality request, a time synchronization service, an IMS interaction.

The one rule that matters is trust. An AF the operator trusts may talk to network functions directly; one it does not must go through the NEF §6.2.10.

4.7 Slices, analytics and the rest

NSSF — the Network Slice Selection Function picks the slice instances that will serve a device, works out the Allowed NSSAI and the Configured NSSAI and their mapping to what the subscription actually allows, and names the AMF Set that should serve the device, querying the NRF if it must §6.2.14.

NSACF counts: registered devices per slice, and established sessions per slice, with a central or primary role in larger deployments §6.2.28.

NSSAAF does the slice-specific authentication against an external AAA server, and the same for private networks whose credentials live with a third party §6.2.23.

NWDAF — the Network Data Analytics Function collects data from network functions, applications, the management system and the location system, and gives analytics back. It also trains machine-learning models and hands them to other analytics functions §6.2.18.

Three helpers sit around it: the DCCF decides who the data source is and avoids collecting the same thing twice §6.2.24, the MFAF bridges to a messaging framework that 3GPP does not specify §6.2.25, and the ADRF stores the analytics and the trained models §6.2.26.

N3IWF and TNGF are the two doors from Wi-Fi. The N3IWF handles untrusted access: it terminates IPsec with the device, relays signalling to the AMF, carries user traffic to the UPF, and acts as a local mobility anchor §6.2.9.

The TNGF does the same for trusted access and additionally acts as the authenticator for the EAP-5G exchange §6.2.9A.

TSCTSF — the Time Sensitive Communication and Time Synchronization Function is the clock manager. It holds PTP instance configurations and watches the timing status reported by radio nodes and the UPF.

It also does the arithmetic that turns an application's requested end-to-end delay into a packet delay budget the PCF can act on, by subtracting the device-side residence time §6.2.29.

UCMF — the UE radio Capability Management Function is a dictionary. Radio capability lists are long, so each gets a short identifier instead.

The UCMF assigns the PLMN-assigned ones, stores the manufacturer-assigned ones, ties each to the device model's type allocation code, and lets an AMF subscribe for new values to cache. Where the PLMN is configured that way, retired identifiers are quarantined, never reused §6.2.21.

4.8 Every function in one line

Function	What it owns	Clause
AMF	Registration, reachability, mobility; the device's one signalling endpoint	§6.2.1
SMF	Sessions, IP addresses, control of the UPF	§6.2.2
UPF	The packets: forwarding, inspection, rate enforcement, buffering	§6.2.3
PCF	Policy rules, from subscription and operator policy	§6.2.4
NEF	Exposure to and from the outside, with translation and masking	§6.2.5.0
NRF	The directory of functions, their profiles and their health	§6.2.6.1
UDM	Subscriber identity, credentials, which function serves whom	§6.2.7
AUSF	Runs the authentication exchange	§6.2.8
N3IWF	Untrusted non-3GPP access: IPsec, N2, N3	§6.2.9
TNGF	Trusted non-3GPP access, plus EAP-5G authenticator	§6.2.9A
AF	An application asking the network for something	§6.2.10
UDR	Structured storage: subscription, policy, exposure, application data	§6.2.11
UDSF	Optional storage of unstructured data, plus a timer service	§6.2.12
SMSF	SMS over signalling, in both directions	§6.2.13
NSSF	Which slices serve this device, and which AMF Set	§6.2.14
5G-EIR	Optional; checks whether a device identity is barred	§6.2.15
LMF / GMLC	Location, defined in TS 23.273	§6.2.16 §6.2.16A
SEPP	The border between two operators' control planes	§6.2.17
NWDAF	Data collection, analytics, model training	§6.2.18
SCP	Indirect communication, routing and delegated discovery	§6.2.19
W-AGF	Wireline access, defined in TS 23.316	§6.2.20
UCMF	The radio capability identifier dictionary	§6.2.21
TWIF	Trusted WLAN for devices without 5G signalling	§6.2.22
NSSAAF	Slice and private-network authentication against an AAA server	§6.2.23
DCCF	Coordinates who collects which data	§6.2.24
MFAF	Adapter to a non-3GPP messaging framework	§6.2.25
ADRF	Stores analytics and trained models	§6.2.26
MB-SMF / MB-UPF / MBSF / MBSTF	Multicast and broadcast, in TS 23.247	§6.2.27 §6.2.27a §6.2.27b §6.2.27c
NSACF	Counts devices and sessions per slice	§6.2.28
TSCTSF	Time synchronization and time-sensitive communication	§6.2.29
5G DDNMF	Direct discovery between devices, in TS 23.304	§6.2.30
EASDF	Edge application server discovery, in TS 23.548	§6.2.31
TSN AF	Makes the 5G system look like a TSN bridge	§6.2.32
NSWOF	Plain WLAN offload, bridging SWa to the AUSF	§6.2.33
EIF	Works out the energy the user plane consumed, and exposes it	§6.2.34

4.9 The two with no clause of their own

The CHF (CHarging Function) is named as a network function in the architecture clause §4.2.2, and that clause says the functional descriptions are in §6 — but no clause 6.2 describes it.

The BSF (Binding Support Function) is not named in §4.2.2 at all. Both are used throughout the document anyway.

What the document does say: the CHF provides spending-limit control to the PCF and converged online and offline charging to everyone else §7.2.17, and the SMF, AMF, SMSF and PCF each pick one for their own charging §6.3.11.

The BSF provides a single service, Nbsf_Management, with which a PCF registers itself so that others can find it §7.2.15.

Its practical use shows up in a different clause entirely: a function that knows only a device's IP address, its data network name and its slice asks the BSF to turn that triple back into the subscriber identity §6.3.3.1.

4.10 Where this meets the rest

The profile a function registers and the way another one searches it is How one function finds another. What a "service" is, and why these functions call each other instead of wiring interfaces together, is Services instead of interfaces.

The identifiers in the profiles — SUPI, GUAMI, S-NSSAI, PEI — are Every name the system uses, and the picture the whole set sits in is The shape of the 5G core.