3GPP 23.501 v20.2.0 — the document's own text
5.8.2.14 Inter PLMN User Plane Security functionality
Taught in 13. Where the packets actually go (The 5G system architecture, in depth), 18. Being served by somebody else's network (The 5G system architecture, in depth), 5. The connection, and what is promised on it (The 5G system architecture, overview).
Operators can deploy UPF(s) supporting the Inter PLMN User Plane Security (IPUPS) functionality at the border of their network to protect their networks from invalid inter PLMN N9 traffic.
The IPUPS functionality forwards GTP-U packets (received via the N9 interface) only if they belong to an active PDU Session and are not malformed, as described in TS 33.501 [29].
The SMF can activate the IPUPS functionality together with other UP functionality in the same UPF, or insert a separate UPF in the UP path for the IPUPS functionality. In both cases the UPF with IPUPS functionality is controlled by the SMF via the N4 interface.