Skip to main content

OmniSEPP

OmniSEPP is the Security Edge Protection Proxy (SEPP) for the Omnitouch 5G Core. It sits on the inter-PLMN (roaming) edge and terminates the N32 interface between a home network and its roaming partners, protecting signalling that crosses the PLMN boundary.

The SEPP is defined by 3GPP TS 23.501 §6.2.17. Its security behaviour is specified in 3GPP TS 33.501 (N32-f TLS mode in §13.1, topology hiding in §13.2) and the N32 interface itself in 3GPP TS 29.573 (the N32-c handshake in §5.2.3 / §6.1.5.2, N32-f message forwarding in §5.3).

The N32-c capability handshake (responder and initiator, the latter driven automatically at start-up), the roaming-partner registry, topology hiding, and the TLS-mode N32-f relay (inbound and outbound) are implemented and wired. The SBI/N32 listener terminates TLS itself when sbi_scheme is https, including mutual (client-certificate) TLS against a configured CA, and the N32 association context is persisted so it survives a restart.

Documentation​

Architecture Overview​

OmniSEPP straddles the boundary between the home PLMN and one or more roaming partners. Partner SEPPs first negotiate an N32 security association over N32-c, then exchange service-based signalling over N32-f. On the home side, OmniSEPP relays inbound N32-f traffic to internal network functions and registers itself with the NRF.

The N32 interface has two logical channels:

  • N32-c (control): a short-lived HTTP/2 handshake in which the two SEPPs negotiate a single mutually-supported N32-f security capability and establish the N32 association.
  • N32-f (forwarding): the ongoing relay of service-based (SBI) messages between the PLMNs, in TLS mode today.

Features Overview​

Core Functionality​

  • N32-c Security Capability Negotiation - Responder and initiator roles. The SEPP negotiates a single mutually-supported N32-f security capability from its locally-preferred list. The initiator handshake toward each configured roaming partner is driven automatically at start-up.
  • N32 association context store - Persistent (DETS-backed) record of each established association, keyed by the remote SEPP FQDN, that survives a process or node restart.
  • N32-f relay (TLS mode) - Relays partner traffic inbound to the internal NF addressed by the 3gpp-Sbi-Target-apiRoot header, and relays consumer-originated traffic outbound to the roaming-partner SEPP selected by target PLMN.
  • In-app N32 TLS - When sbi_scheme is https the listener terminates TLS using the configured certificate and key, and requires and verifies the peer SEPP's client certificate when a CA is configured (N32-f TLS mode, TS 33.501 §13.1).
  • Topology hiding - Operator-configured, whole-host FQDN rewriting that masks internal NF identities outbound and reverses them inbound (TS 33.501 §13.2).
  • Roaming-partner registry - Static allow-list of partner PLMNs; only configured partners are relayed to or from.

Integration Points​

  • Roaming Partner SEPP (N32-c / N32-f) - The peer SEPP in a partner PLMN.
  • Internal NFs (SBI) - AMF, SMF, AUSF, UDM and other producers that inbound partner traffic is relayed to.
  • NRF (SBI) - OmniSEPP registers with the local NRF as NFType SEPP and heartbeats, so local consumers and the SCP can discover it (TS 29.573 cl 4.2.1). The remote peer SEPP is resolved from the static roaming_partners configuration per roaming agreement, not by NRF discovery, which is the intended model for inter-PLMN peer resolution.

Configuration Summary​

All configuration lives under the :omnisepp application key. A subset of keys can be overridden by environment variables in the production runtime configuration; the nested maps (roaming_partners, topology_hiding_map) are set through the application config file only. See the Configuration Reference for the complete parameter tables.

config :omnisepp,
  sbi_scheme: "http",
  sbi_addr: "127.0.0.22",
  sbi_port: 7777,
  # TLS material for the N32 listener, used only when sbi_scheme is "https"
  sbi_certfile: nil,
  sbi_keyfile: nil,
  sbi_cacertfile: nil,
  nrf_uri: "http://127.0.0.10:7777",
  mcc: "999",
  mnc: "70",
  heartbeat_interval: 10_000,
  supported_sec_capabilities: ["TLS"],
  roaming_partners: %{},
  topology_hiding_map: %{}

Documentation Structure​

By Role​

Operators and Administrators:

  1. Start with the Operations Guide
  2. Review Metrics and Monitoring
  3. Keep Troubleshooting to hand

System Integrators:

  1. Start with the Configuration Reference
  2. Review the endpoint and flow sections of the Operations Guide

By Topic​

Last updated on