Every function is a service.
Every service is discoverable.

Point-to-point is out. A service bus is in.

In the EPC, every interface was a bespoke protocol — S1, S5, S8, S11… In 5G, every NF speaks the same web-native stack and registers itself so any other NF can discover and call it. No hard-wiring, so functions can be added, scaled or relocated independently.

From EPC boxes to 5GC services.

The 4G EPC was four monoliths speaking a dozen bespoke protocols — Diameter here, GTP-C there. 5GC re-cuts the same responsibilities along two clean lines — control vs user plane (CUPS) and compute vs state — then puts every control-plane function behind one web API. The study that chose the stack, TR 29.891, picked HTTP/2 + JSON over Diameter for a simple reason: the entire cloud ecosystem already speaks it.

Reading the releases — Rel-15 defined SBA + all core NFs; Rel-16 added the SCP, NF Sets and eSBA hardening; Rel-17 brought the first NTN support (and satellite-backhaul awareness in the core); Rel-18 network-verified UE location; Rel-19 regenerative payloads — gNB and UPF on the satellite.

The whole 5G Core — click any function.

The full service-based architecture of TS 23.501: the control-plane NFs hang off the shared SBI bus up top, while the AMF and SMF bridge down to the reference-point world of UE, gNB, UPF and Data Network. Click any block — a rich panel opens with its role, service operations, interfaces and NTN relevance. Drag nodes to explore; zoom with the controls.

The supporting cast every real core runs.

Eight more functions that never make the marketing slide but exist in every production 5GC — and each one has a satellite angle.

The SBI wire format — what actually crosses the bus.

"REST over HTTP/2" is the slogan. Here is the engineering: how a service URI is built, which HTTP method does what, the 3GPP custom headers, and the exact JSON an NF sends the NRF to come alive.

#Anatomy of a service URI

Versioning (TS 29.501) — only the major version appears in the URI; the full apiFullVersion lives in the NF profile. Optional capabilities are negotiated per-request via the supportedFeatures attribute — a bitmask both sides intersect.

#HTTP methods → 5GC semantics

#Two interaction patterns

#The 3GPP custom headers (TS 29.500 §5.2.3)

#Birth of an NF — the NRF lifecycle, on the wire

This is the JSON that makes an SMF discoverable. Register with PUT, prove liveness with a heart-beat PATCH every heartBeatTimer seconds (the NRF grants the value in its 201 response), miss it and the NRF marks you SUSPENDED — you drop out of discovery results until you recover.

{
  "nfInstanceId": "8f2b0a76-3f4d-4e21-9a01-c4fe6e9d2b11",
  "nfType": "SMF",
  "nfStatus": "REGISTERED",          // REGISTERED | SUSPENDED | UNDISCOVERABLE
  "heartBeatTimer": 60,
  "plmnList": [{ "mcc": "999", "mnc": "01" }],
  "sNssais": [{ "sst": 1, "sd": "0A1B2C" }],   // which slices I serve
  "fqdn": "smf1.5gc.mnc001.mcc999.3gppnetwork.org",
  "ipv4Addresses": ["10.60.0.11"],
  "priority": 1, "capacity": 100, "load": 12,
  "locality": "ground-dc-east",          // NTN: gateway-site affinity lives here
  "nfServices": [{
    "serviceInstanceId": "nsmf-pdusession-1",
    "serviceName": "nsmf-pdusession",
    "versions": [{ "apiVersionInUri": "v1", "apiFullVersion": "1.0.3" }],
    "scheme": "https",
    "ipEndPoints": [{ "ipv4Address": "10.60.0.11", "port": 8443 }],
    "allowedNfTypes": ["AMF"]
  }]
}

GET /nnrf-disc/v1/nf-instances?target-nf-type=SMF&requester-nf-type=AMF
     &snssais=[{"sst":1,"sd":"0A1B2C"}]&dnn=internet
Authorization: Bearer eyJhbGciOiJFUzI1NiIs…   // OAuth2 token issued by the NRF itself

200 OK → { "nfInstances": [ …matching profiles, ranked by priority/capacity/load… ] }

Zero-trust between functions.

SBA assumes the core network is a hostile place. Three mechanisms stack up inside the PLMN — and a fourth guards the border when signalling roams.

#Roaming — the SEPP and N32

Inter-PLMN signalling never flows NF-to-NF. Each operator's SEPP terminates the border: N32-c (TLS) negotiates the relationship, then N32-f carries the messages — over TLS, or over PRINS when an IPX in the middle must read or modify specific IEs under cryptographic control. NTN angle: a satellite operator running its own PLMN is exactly this — every Nudm/Nausf call from the satellite core to your home core crosses the SEPPs.

And the subscriber? — the SUPI never crosses the air in clear. The UE sends a SUCI, ECIES-encrypted with the home network's public key; only the UDM/SIDF can de-conceal it. Works identically over a satellite link — privacy is end-to-end to the home core (TS 33.501 Annex C).

Communication models A–D — and staying alive at scale.

TS 23.501 Annex E defines four ways a consumer reaches a producer, along two axes: direct vs indirect (is an SCP in the path?) and who performs NRF discovery.

#NF Sets — how the core survives losing an instance

Rel-16 formalized resilience: interchangeable NF instances form an NF Set (equivalent services, shared access to context); services within an instance form NF Service Sets. A consumer's binding indication (3gpp-Sbi-Binding) says "keep my transactions on this instance/set" — and when an instance dies, the consumer or SCP reselects inside the set and the new instance picks the context up from the UDSF/UDR. The UE never notices (TS 23.501 §5.21.3).

GUAMI = PLMN + those 24 bits (TS 23.003 §2.10). It's embedded in the 5G-GUTI, which is how a gNB routes a returning UE straight back to the right AMF — or, if that AMF is gone, to any member of its Set. For an NTN constellation this is the mechanism that lets mobility survive a gateway failover without re-registration.

Two call flows you must know cold.

Everything above becomes concrete here. Step through Registration and PDU Session Establishment message by message — every SBI operation named exactly as in TS 23.502. Then flip the orbit toggle: each message that crosses the satellite air path gets priced with TR 38.821 one-way delays, and the counter shows what the whole procedure costs on LEO vs GEO.

How the pricing works — first-order model: each NAS/RRC message crossing the service(+feeder) path costs one one-way trip ≈ RTT/2. TR 38.821 transparent-payload RTTs: LEO-600 = 25.77 ms · GEO = 541.46 ms. Ground-side SBI hops are counted as ≈0 by comparison. Registration makes 9 air crossings — ≈ 2.4 s of pure propagation on GEO before the UE is even registered. That, in one number, is why NTN system design obsesses over signalling reduction.

QoS: flows, 5QIs — and the orbit reality check.

5G QoS is flow-based: the finest unit is the QoS flow, tagged by a QFI that rides the GTP-U extension header on N3. A 5QI is just a pointer into a standardized table of characteristics — resource type, priority, Packet Delay Budget, Packet Error Rate, averaging window, burst volume. The PDB is where satellite physics collides with the spec.

#The standardized 5QI table vs the orbits

Select an orbit: each 5QI's PDB (TS 23.501 Table 5.7.4-1) is checked against the one-way air delay (≈ RTT/2, TR 38.821 transparent payload). This is the first-order feasibility check every NTN service designer runs.

Read the GEO column and you understand NTN service strategy instantly — voice (100 ms PDB) cannot meet spec over transparent GEO (270.7 ms one-way); buffered video and default internet (300 ms) barely fit; anything delay-critical is terrestrial-only. This is why GEO sells broadband + IoT, while conversational services need LEO — or a regenerative payload that removes the feeder leg.

One core, many logical networks.

A network slice is identified by an S-NSSAI = SST + SD. The NSSF selects the slice(s) and the AMF Set for each UE, so a dedicated satellite slice can run beside terrestrial eMBB / URLLC on the very same core.

TN ↔ NTN slice continuity — a dedicated S-NSSAI can be provisioned for satellite access, and the URSP rules the PCF pushes to the UE steer each application between the terrestrial and non-terrestrial slice as coverage changes. Bit layout & SST values: TS 23.003 §28.4, TS 23.501 §5.15.2.

The NTN SBA architecture — end to end.

Now assemble everything into one picture: UE → service link → satellite → feeder link → gateway → gNB → N2/N3 → the SBA bus → N6 → internet. Because SBA decouples every function, you lift only the latency-sensitive pieces into space — the gNB (regenerative, Rel-19) and optionally the UPF — while the control plane and data repositories stay on the ground. Trace the two planes below, then flip payload types in the interactive explorer.

#The TR 38.821 architecture options

#What each hop means for the SBA

#Fly it yourself — payload explorer