5G Core Architecture: The Service-Based Design Explained

The 5G Core's defining decision wasn't adding features. It was borrowing an idea from web engineering: network functions became services that discover each other and talk over HTTP APIs.

That sounds like an implementation detail. It isn't. Nearly every capability people associate with 5G — slicing, edge computing, independent scaling, exposure to third parties — is downstream of it.

---

Reference points vs service-based interfaces

In the EPC, each pair of functions had a dedicated interface with its own protocol. MME to HSS was S6a over Diameter. MME to S-GW was S11 over GTP-C. Adding a function meant defining new interfaces to everything it needed to reach — and every peer had to be configured to know about it.

The 5G Core replaces most of that with a service-based interface (SBI). Each network function exposes an API — Namf, Nsmf, Nudm — that any authorised consumer can call.

The transport stack is deliberately unremarkable: HTTP/2 over TCP, JSON payloads, OpenAPI-specified, TLS-protected. Deliberately, because it means standard cloud tooling works. Service meshes, API gateways, load balancers, tracing — all of it applies without telco-specific adaptation.

The producer/consumer relationship is dynamic rather than configured. An AMF needing session management doesn't have a preconfigured SMF; it queries the NRF, gets back suitable candidates, and calls one.

Where reference points survive

Not everything is service-based, and the exceptions are consistent:

The pattern: user-plane paths and radio-facing interfaces stay purpose-built. HTTP/2 and JSON are fine for control signalling at session-setup rates; they're entirely wrong for forwarding packets at line rate.

---

The network functions

Access and session

AMF — Access and Mobility Management Function. Registration, reachability, mobility, NAS security, and the N1/N2 termination point. Notably it does not do session management; it relays session NAS messages to the SMF without interpreting them.

SMF — Session Management Function. Owns PDU Session establishment, modification, and release. Allocates IP addresses, selects UPFs, and programs them over N4.

UPF — User Plane Function. Forwards packets, enforces QoS, reports usage. The only function on the data path.

The AMF/SMF split is the structural change from EPC, where the MME did both. Separating them is what allows one AMF to serve a UE whose sessions terminate at different SMFs in different slices.

Subscriber data and policy

UDM — Unified Data Management. Subscription data, identifiers, access authorisation.

UDR — Unified Data Repository. The actual storage behind UDM, PCF, and NEF. Separating logic from storage means the data layer scales on its own.

AUSF — Authentication Server Function. Runs 5G-AKA or EAP-AKA′ authentication.

PCF — Policy Control Function. Generates the PCC rules that determine QoS parameters, charging, and traffic steering.

Support and discovery

NRF — Network Repository Function. The service registry. Every NF registers its profile and capabilities; consumers query for producers. Without it, SBA is just APIs with hardcoded addresses.

NSSF — Network Slice Selection Function. Determines which slice instances can serve a UE and which AMF supports them.

NEF — Network Exposure Function. The controlled boundary to external applications. QoS-on-demand, event subscription, device triggering — this is where third parties reach the network.

NWDAF — Network Data Analytics Function. Collects data across functions and produces analytics: load prediction, anomaly detection, UE behaviour. The formal hook for AI/ML in the core.

CHF and SMSF handle charging and SMS respectively.

---

Control and user plane separation

CUPS started in late EPC releases. The 5G Core makes it foundational.

The SMF makes decisions. The UPF executes them. The interface between them is N4, carrying PFCP, and the SMF installs four rule types on the UPF:

PDR (Packet Detection Rules) — how to classify arriving packets. FAR (Forwarding Action Rules) — where to send them. QER (QoS Enforcement Rules) — rate limits and QoS marking. URR (Usage Reporting Rules) — what to count and when to report.

The UPF is otherwise stateless about why — it applies rules without understanding the policy behind them.

Two consequences follow, and they're the practical payoff:

Independent scaling. A network with heavy traffic but few devices needs UPF capacity, not SMF capacity. Video streaming and IoT have opposite profiles, and CUPS lets you dimension for each.

Edge placement. The UPF can sit at an edge site while the SMF stays central. This is the entire mechanism behind low-latency edge computing — traffic breaks out locally instead of hauling to a central gateway. Uplink Classifiers (ULCL) and branching points let one PDU Session split traffic across multiple UPFs, sending some to a local edge application and the rest to the internet.

---

How slicing falls out of the design

Slicing isn't a feature bolted onto the 5G Core. It's a consequence of how the core decomposes.

Because functions discover each other dynamically through the NRF, and because S-NSSAI is a discovery criterion, slice-specific function selection needs no new machinery. The AMF asks the NRF for an SMF supporting a given S-NSSAI and gets one from that slice.

The common deployment shape: AMF shared across slices (a UE registers once regardless of how many slices it uses), SMF and UPF dedicated per slice (that's where isolation and differentiated performance actually come from).

Try the same thing in an EPC and you'd be building parallel cores. (Network slicing in detail.)

---

Stateless design

A design principle worth understanding because it's what makes cloud-native deployment real rather than aspirational.

5G Core functions are meant to be stateless — session state lives in an external repository (the UDSF) rather than inside the function instance.

The consequences are the ones you'd want: any instance can handle any request, so load balancing is trivial. An instance failing loses no sessions, because the state was never in it. Scaling out means adding instances without redistributing state. Rolling upgrades don't drop sessions.

Implementations vary in how strictly they follow this, and fully stateless designs pay a latency cost for every state read. But the direction is what enables 5G Core functions to run as containers on Kubernetes and behave like ordinary cloud workloads.

---

What a registration actually looks like

Tracing one procedure makes the architecture concrete.

A UE sends a Registration Request. The gNB selects an AMF — using Requested NSSAI if present — and forwards it over N2.

The AMF retrieves the UE's security context or triggers authentication via the AUSF, which fetches credentials from the UDM. Once authenticated, NAS security is established.

The AMF fetches subscription data from the UDM and, if slice selection needs network-wide knowledge, queries the NSSF to determine the allowed slices — potentially triggering relocation to a different AMF.

The AMF may fetch UE policy from the PCF, then returns a Registration Accept with the Allowed NSSAI.

Later, for a PDU Session: the AMF queries the NRF for an SMF supporting the selected S-NSSAI and DNN, the SMF selects a UPF, programs it over N4, and the session comes up.

Notice how much of that is dynamic discovery. In an EPC, most of these relationships would have been configured in advance.

---

The mental model

SBA means NFs are services — HTTP/2, JSON, OpenAPI, discovered through the NRF.

User-plane and radio-facing interfaces stay reference points (N1–N4, N6, N9). HTTP is wrong for packet forwarding.

AMF does mobility. SMF does sessions. Splitting the MME is what makes slicing possible.

CUPS via N4/PFCP — PDR, FAR, QER, URR. Independent scaling and edge UPF placement.

Slicing is a consequence of dynamic discovery, not a separate subsystem.

Stateless design + UDSF is what makes cloud-native deployment real.

The 5G Core is best understood as a telco network function set rebuilt with cloud-native architecture patterns. That's why it took longer to deploy than the radio, and why SA migration is a core-network project rather than a radio one.

---

Further reading

• AMF, SMF and UPF compared — the three functions in detail
• Network slicing explained
• 3GPP TS 23.501 — System architecture for the 5G System
• 3GPP TS 23.502 — Procedures for the 5G System
• 3GPP TS 29.500 — Technical realisation of service-based architecture
• 3GPP TS 29.244 — PFCP, the N4 interface