2 Who does what in the core

2.1 Why there are thirty of them

The architecture lists about thirty network functions, and a first reading feels like an inventory nobody could hold in their head §4.2.2. It is more manageable than it looks, for two reasons.

Most of the thirty are small. A dozen of them get a paragraph each in §6.2 and never come up again unless you are working on that feature.

And the split was made on purpose. The design brief asks for modular functions so a network can be sliced and scaled piece by piece §4.1, which is why a job one box did in 4G is three functions here.

This chapter takes the ones that appear in every conversation. The functional description of all of them is §6.2, and how a consumer finds one of them and calls it is How one function calls another §6.1.

2.2 The three that carry the work

The AMF — Access and Mobility Management Function — keeps track of where a device is and whether it can be reached. It terminates the signalling from the radio network on N2 and from the device itself on N1.

It does registration, connection and reachability management, mobility, access authentication and authorisation, and it carries session and text messages through to the functions that own them §6.2.1.

That last part matters: the AMF is a post office for session signalling, not its reader. It is also the only place the device's own signalling ends up.

The SMF — Session Management Function — sets up, changes and tears down a device's connections to a data network. It allocates the address, picks the forwarding function and programs it, and terminates the session half of the device's signalling §6.2.2.

The UPF — User Plane Function — is the one that actually forwards packets. It anchors the session, is the point of interconnect to the data network, detects traffic, enforces the rate limits and the policy the SMF gave it, marks packets, reports usage, and buffers downlink data §6.2.3.

2.3 Where the data lives

A function that is supposed to be stateless has to keep its state somewhere, and the document gives it two homes, split by one question: does 3GPP define the shape of this data §4.2.5?

The UDR — Unified Data Repository — holds the standardised sets: subscription data, policy data, structured data for exposure, application data and Ambient IoT data. It is reached over Nudr, and Nudr never leaves the operator's own network §6.2.11.

The UDSF — Unstructured Data Storage Function — holds whatever a function needs to keep in whatever shape it likes, and a UE context is the example the clause gives.

Any instance in the same group of interchangeable instances may read what another one wrote, which is how a failed instance's work is picked up §4.2.5.

Two functions sit in front of that storage:

• The UDM — Unified Data Management — is the subscriber's home record: it generates authentication credentials, un-conceals the hidden subscriber identity, authorises access from the subscription, and remembers which AMF and which SMF are currently serving the subscriber §6.2.7.

• The AUSF — Authentication Server Function — runs the authentication itself, for 3GPP access and untrusted non-3GPP access, to the recipe in TS 33.501 §6.2.8.

2.4 The ones that decide

• The PCF — Policy Control Function — governs network behaviour with policy rules and hands them to the functions that enforce them. What a rule contains is TS 23.503, not this document §6.2.4.

• The NSSF — Network Slice Selection Function — picks which slices serve a device and which set of AMFs can do it §6.2.14.

• The NRF — Network Repository Function — is the directory. Functions register with it and ask it who can do a job §4.2.2.

• The CHF — Charging Function — is what the SMF, AMF, SMSF and NEF report usage to, under TS 32.240 §4.2.2.

2.5 The doors, and the two that are not functions

The AF — Application Function — is anything outside the core that wants something from it: influence over where traffic is routed, a policy change, a time synchronisation service. An operator may let a trusted AF talk to network functions directly. One it does not trust has to go through the NEF §6.2.10.

The NEF — Network Exposure Function — is that controlled door, and it is where monitoring, provisioning, policy and analytics are offered outward.

The clause list then stops and starts again. After the network functions it says the architecture also comprises the following network entities, and names two §4.2.2:

• The SCP — Service Communication Proxy — forwards and routes other functions' calls, and can do their looking-up for them. It offers no service of its own, which is why it is not a function §6.2.19.

• The SEPP — Security Edge Protection Proxy — stands at the border between two operators and filters and polices every control plane message crossing it, and hides the topology behind it §6.2.17.

2.6 Where to look next

The list of every function and entity is §4.2.2 and the functional descriptions are under §6.2 — one subclause each, in no useful order, so read them by name. The storage split is §4.2.5.

The in-depth course of this track has a chapter that walks the whole of §6.2, including every function this chapter left out.