The 5G Core (5GC) is the core network defined by 3GPP for 5G networks: the set of control and user plane functions that authenticates subscribers, sets up data sessions, tracks mobility, enforces policy and connects the radio access network to the internet and to operator services. In telecommunications it replaces the Evolved Packet Core (EPC) used by 4G LTE.
Unlike its predecessors, the 5GC is designed as a service-based architecture of software functions that run on general-purpose cloud infrastructure. That design is what makes standalone 5G, network slicing and edge computing possible, and it is the main difference between 5G SA and 5G NSA deployments, which still rely on a 4G core.
How the 5G Core is built
The 5GC is built from network functions (NFs) that each own one job and expose it as a service to the others. Control plane functions talk over a common service-based interface (SBI) using HTTP/2 with JSON payloads, so any authorized function can call any other instead of using fixed point-to-point links as in the EPC.
A second principle is control and user plane separation (CUPS). Signaling logic lives in central control functions, while packet forwarding happens in the User Plane Function (UPF), which can be placed close to users. Because NFs are typically packaged as containers orchestrated by Kubernetes, operators can scale each function independently and roll out upgrades without replacing hardware.
The table below lists the core network functions that appear in almost every 5GC deployment and what each one is responsible for.
| Function | Full name | Main responsibility |
|---|---|---|
| AMF | Access and Mobility Management Function | Registration, connection and mobility of devices |
| SMF | Session Management Function | Creating PDU sessions, IP address allocation, UPF selection |
| UPF | User Plane Function | Packet routing, forwarding, QoS enforcement, usage reporting |
| AUSF | Authentication Server Function | Running 5G AKA and EAP-AKA’ authentication |
| UDM | Unified Data Management | Subscriber profiles, credentials and identifiers |
| PCF | Policy Control Function | Charging and QoS policy rules for sessions |
| NRF | Network Repository Function | Registry where functions discover one another |
| NSSF | Network Slice Selection Function | Choosing the slice instance for a device |
Interfaces and procedures in the 5GC
The 5GC connects to the radio side through reference points with standard names. The gNodeB sends signaling to the AMF over N2 using the NGAP protocol, and user traffic to the UPF over N3 using GTP-U tunnels. The SMF controls the UPF over N4 with PFCP, and the UPF reaches external data networks over N6.
| Reference point | Between | Protocol | Carries |
|---|---|---|---|
| N1 | Device and AMF | NAS | Registration and session signaling |
| N2 | gNodeB and AMF | NGAP over SCTP | Radio control signaling |
| N3 | gNodeB and UPF | GTP-U over UDP | User data packets |
| N4 | SMF and UPF | PFCP | Forwarding rules and reports |
| N6 | UPF and data network | IP | Traffic to the internet or services |
| N9 | UPF and UPF | GTP-U | Traffic between chained UPFs |
A typical attach follows a fixed sequence. The device sends a registration request to the AMF, the AUSF and UDM perform mutual authentication, and the device receives a temporary identifier. It then requests a PDU session, the SMF selects a UPF and assigns an address, and the PCF supplies the QoS flows and charging rules that apply.
Privacy is stronger than in 4G: the permanent identity, the SUPI, is never sent in clear text. The device encrypts it into a SUCI with the home network public key, which defeats the simple IMSI catchers that plagued earlier generations.
5G Core compared with the 4G EPC
The 5GC keeps the same broad duties as the Evolved Packet Core but splits and redistributes them. The MME of 4G roughly maps to the AMF plus part of the SMF, while the gateways SGW and PGW are split into control logic in the SMF and forwarding in the UPF.
| Aspect | 4G EPC | 5G Core |
|---|---|---|
| Architecture | Point-to-point interfaces | Service-based interfaces |
| Signaling protocol | Diameter and GTP-C | HTTP/2 with JSON, plus NGAP and PFCP |
| Deployment model | Often dedicated appliances | Cloud-native containers |
| Session model | Bearers | PDU sessions with QoS flows |
| Network slicing | Limited, via dedicated cores | Native slicing with S-NSSAI |
| Access types | Mainly 3GPP radio | 3GPP and non-3GPP access, including Wi-Fi |
| Subscriber privacy | IMSI can be exposed | SUPI concealed as SUCI |
The QoS model is also finer. Instead of a few bearers per device, a PDU session carries multiple QoS flows identified by a 5QI value, which lets operators treat a video call, a sensor stream and a game differently within one session. This matters for services such as URLLC and mMTC, which have very different needs from eMBB.
Deployment choices for operators
Operators move to the 5GC in stages, and the chosen deployment option determines which features are available. In non-standalone (NSA) Option 3, 5G NR radios attach to the existing EPC, so slicing and the new QoS model are unavailable. In standalone (SA) Option 2, the gNodeB connects directly to the 5GC and every feature is usable.
| Situation | Typical choice | Reason |
|---|---|---|
| Fast 5G launch on 4G assets | NSA with EPC | Reuses existing core, no 5GC needed |
| Slicing or URLLC services | SA with 5GC | Requires native slicing and QoS flows |
| Low-latency industrial sites | Distributed UPF at the edge | Shortens the user plane path |
| Private campus network | Compact 5GC on local servers | Keeps data and control on site |
| Mixed 4G and 5G subscribers | Converged EPC and 5GC | Shares subscriber data and policy |
UPF placement is the decision with the largest effect on latency. A centralized UPF simplifies operations, while a local breakout UPF in an edge data center can cut round-trip time to a few milliseconds for local applications. Many operators combine both, chaining UPFs over N9.
Limitations and common pitfalls
The flexibility of the 5GC brings operational complexity. A cloud-native core consists of dozens of microservices, so troubleshooting needs strong observability, and an error in the NRF or in service discovery can affect many functions at once.
- Interoperability gaps remain between vendors, because the standards leave room for interpretation in optional features.
- Running a core on shared cloud hosts makes performance isolation harder; the UPF often needs accelerated packet processing such as DPDK or SmartNICs to reach hundreds of gigabits per second.
- HTTP/2 signaling opens the core to API-level attacks, so mutual TLS and the Security Edge Protection Proxy (SEPP) for roaming are essential.
- Device and radio support limit what the core can deliver: a fully capable 5GC adds little if most devices are still served through NSA.
A frequent misconception is that a 5G icon on a phone means a 5G core is in use. In NSA mode the icon shows 5G NR radio, yet sessions are still anchored in the 4G EPC.
Stripped to the essentials
The 5G Core is the central brain of a 5G mobile network. The antennas only carry radio signals. The core decides who is allowed in. It gives each phone an address and keeps track of where it is. It also makes sure data reaches the internet with the right priority.
Older cores were like a building with fixed rooms and private corridors. The 5G Core works more like specialist teams in the cloud. Each team calls the others when it needs help. When one team gets busy, the operator simply adds more staff to it.
Where it is applied
A car manufacturer builds a private 5G network at a factory with automated guided vehicles and hundreds of wireless sensors. It installs a compact 5GC on two servers in the plant, with the AMF, SMF and UPF running locally and subscriber data stored on site, so production traffic never leaves the premises.
The integrator defines two slices: one for vehicle control with a low-latency QoS flow and one for sensor telemetry with modest bandwidth. Because the UPF sits in the factory, round-trip time between a vehicle and its controller stays under about 10 milliseconds, and a link failure toward the public internet does not stop the line. The result is predictable, isolated connectivity that Wi-Fi in the same metal-heavy hall had struggled to provide.