5G is not just "faster 4G". It is three things at once: a new radio (NR), a new cloud-native core (5GC), and a design for many kinds of customers (phones, factories, cars, sensors) through network slicing.
1. The three use cases (ITU IMT-2020)
| Use case | Full name | Goal | Examples |
|---|---|---|---|
| eMBB | enhanced Mobile Broadband | Huge speed and capacity | 4K/8K video, AR/VR, fixed wireless |
| URLLC | Ultra-Reliable Low-Latency Communication | ~1 ms latency, 99.999% reliability | Factory robots, remote surgery, autonomous cars |
| mMTC | massive Machine-Type Communication | Up to 1 million devices / km² | Smart meters, agriculture, city sensors |
Targets: peak 20 Gbit/s down, ~1 ms radio latency, 10× devices density, 100× energy efficiency (design goals).
2. Deployment options
| Option | Name | Meaning |
|---|---|---|
| NSA (Option 3x) | Non-Standalone | 5G radio (gNB) anchored on the 4G core (EPC) and an LTE anchor; uses the EN-DC dual connectivity (LTE + NR together) |
| SA (Option 2) | Standalone | 5G radio + 5G core; unlocks slicing, low latency, VoNR |
| DSS | Dynamic Spectrum Sharing | LTE and NR share the same carrier |
| NR-DC / NE-DC | Dual connectivity variants |
First networks (2019) were NSA; real 5G features require SA.
3. 5G Radio (NR)
| Concept | Explanation |
|---|---|
| gNB | next-generation NodeB — the 5G radio site |
| ng-eNB | an LTE eNB that connects to 5GC |
| NG-RAN | the 5G radio access network (gNBs + ng-eNBs) |
| CU / DU / RU | Central Unit / Distributed Unit / Radio Unit — the gNB split into three parts |
| Fronthaul / midhaul / backhaul | RU↔DU / DU↔CU / CU↔core links |
| gNB-CU-CP / CU-UP | Control-plane and user-plane parts of the CU |
| F1, E1, Xn, NG | Interfaces: DU–CU (F1), CU-CP–CU-UP (E1), gNB–gNB (Xn), gNB–core (NG: NG-C to AMF, NG-U to UPF) |
| FR1 | Frequency Range 1: sub-6 GHz (450 MHz – 7.125 GHz), e.g. n78 = 3.5 GHz — the workhorse |
| FR2 | Frequency Range 2: mmWave (24–52 GHz), e.g. n257/n258/n260 — huge speed, short range, blocked by walls |
| Bandwidth | up to 100 MHz (FR1), 400 MHz (FR2) per carrier |
| Numerology (µ) | Subcarrier spacing 15 / 30 / 60 / 120 kHz — shorter slots for low latency |
| Modulation | up to 256QAM, in Rel-17+ also 1024QAM |
| OFDM | CP-OFDM in both directions (DFT-s-OFDM optional uplink) |
| Massive MIMO | 32–256+ antenna elements; many users served at once |
| Beamforming | Narrow steerable beams that follow the user |
| Beam management | SSB beams, beam sweeping, beam recovery |
| TDD dominant | Mid-band 5G is mostly TDD with flexible slot formats |
| Mini-slots / URLLC | Transmit in a few symbols for ~ms latency |
| BWP | Bandwidth Part — a phone uses a slice of the carrier to save power |
| LDPC / Polar | Channel coding: LDPC for data, Polar for control |
| RedCap (NR-Light) | Reduced Capability devices (wearables, cameras) — cheaper 5G |
Radio protocol stack
SDAP (QoS flow → data radio bearer mapping, new in 5G) · PDCP · RLC · MAC · PHY · RRC (with the new RRC_INACTIVE state). NAS (5GMM/5GSM) runs UE ↔ AMF.
4. The 5G Core (5GC) — Service-Based Architecture
The core is split into small network functions (NFs) that talk to each other by calling HTTP/2 REST APIs (JSON) — like microservices in the cloud.
| NF | Full name | Job | 4G analogue |
|---|---|---|---|
| AMF | Access and Mobility Management Function | Registration, mobility, paging, NAS signalling | MME (mobility part) |
| SMF | Session Management Function | PDU sessions, IP allocation, UPF selection | MME (session) + SGW-C + PGW-C |
| UPF | User Plane Function | Forwards user data, anchors sessions, applies QoS and counts usage | SGW-U + PGW-U |
| UDM | Unified Data Management | Subscriber data, auth credentials, SUCI de-concealment | HSS |
| UDR | Unified Data Repository | The actual database behind UDM/PCF | HSS DB |
| AUSF | Authentication Server Function | Runs 5G-AKA / EAP-AKA' | HSS (auth) |
| PCF | Policy Control Function | Policy rules, QoS, slice policy | PCRF |
| NRF | Network Repository Function | Directory: NFs register here, others discover them | DNS-like, new |
| NSSF | Network Slice Selection Function | Chooses the slice for a user | new |
| NEF | Network Exposure Function | Exposes network capabilities to third-party apps through APIs | SCEF |
| SCP | Service Communication Proxy | Routes and load-balances NF-to-NF calls | new |
| SEPP | Security Edge Protection Proxy | Secures signalling between different operators (roaming) | new (replaces open interconnect) |
| BSF | Binding Support Function | Finds which PCF handles a session | |
| CHF | Charging Function | Converged online/offline charging (Nchf) | OCS/OFCS |
| SMSF | SMS Function | SMS over NAS in 5G (talks to UDM and SMSC) | SGs/MSC |
| UDSF / N3IWF / TNGF | Unstructured Data Storage / Non-3GPP Interworking Function / Trusted Non-3GPP GW | Wi-Fi access | ePDG |
| LMF / GMLC | Location Management Function / Gateway Mobile Location Centre | Positioning | SMLC |
| NWDAF | Network Data Analytics Function | AI/ML analytics | new |
Reference points and service names
- Point-to-point (N-interfaces): N1 (UE–AMF, NAS) · N2 (gNB–AMF, NGAP) · N3 (gNB–UPF, GTP-U) · N4 (SMF–UPF, PFCP) · N6 (UPF–data network) · N9 (UPF–UPF) · N8, N10, N11, N12, N13, N15… (control interfaces between NFs).
- Service-based (SBI): each NF exposes services named after it:
Namf,Nsmf,Nudm,Nausf,Npcf,Nnrf,Nnssf,Nnef,Nchf. Example: Nudm_UEAuthentication_Get. - Protocols: NGAP (gNB–AMF, over SCTP) · PFCP (SMF–UPF, over UDP) · GTP-U (user data) · HTTP/2 + JSON + TLS (SBA) · OAuth 2.0 (NF authorization).
Sessions and QoS
| Term | Meaning |
|---|---|
| Registration | UE gets known to the AMF (like attach, but without a session) |
| PDU session | The data connection (IP / Ethernet / unstructured), anchored in a UPF |
| DNN | Data Network Name (= APN in 4G) |
| QoS flow | Finest QoS granularity (replaces bearer). Identified by QFI |
| 5QI | 5G QoS Identifier (like QCI): 1 voice, 2 video, 5 IMS signalling, 9 default, 82–85 delay-critical GBR (URLLC) |
| S-NSSAI | Single Network Slice Selection Assistance Information = slice type (SST) + optional differentiator (SD) |
| SST | Slice/Service Type: 1 eMBB, 2 URLLC, 3 MIoT, 4 V2X |
| Allowed NSSAI | The slices the UE may use |
| SUPI / SUCI | Subscription Permanent Identifier (= IMSI) / Concealed identifier (encrypted so the IMSI is never sent in clear) |
| 5G-GUTI | Temporary identity |
| TAI / NCGI | Tracking Area Identity / NR Cell Global Identity |
| CM-IDLE / CM-CONNECTED | Connection management states |
| RM-REGISTERED / DEREGISTERED | Registration management states |
5. Network slicing
A slice is a logical end-to-end network (radio + transport + core) sold with its own guarantees, running on shared hardware. Example slices: one for consumers (eMBB), one for factory robots (URLLC), one for meters (mMTC), one private for a hospital. Enabled by virtualization (NFV), SDN, and the SA core.
6. Cloud, virtualisation and edge
| Term | Meaning |
|---|---|
| NFV | Network Functions Virtualisation — network nodes as software on standard servers |
| VNF / CNF | Virtual / Cloud-native Network Function (VM vs container) |
| MANO | Management and Orchestration (NFVO, VNFM, VIM) |
| SDN | Software-Defined Networking — central controller programs switches |
| Kubernetes / containers | Cloud-native platform for CNFs |
| MEC | Multi-access Edge Computing — compute near the radio (low latency apps, CDN, gaming) |
| Cloud RAN / vRAN | RAN functions (CU/DU) virtualised on servers |
| Open RAN / O-RAN | Open interfaces (O-RU, O-DU, O-CU, RIC = RAN Intelligent Controller with xApps / rApps) so vendors can be mixed |
| eCPRI / CPRI | Fronthaul protocols between DU and RU |
| Private 5G / NPN | Non-Public Network — a company's own 5G (standalone or via slice) |
| Neutral host | Shared infrastructure for several operators |
7. 5G security improvements
- SUCI: the permanent identity is encrypted with the home network's public key (ECIES) — IMSI catchers get nothing useful.
- 5G-AKA / EAP-AKA' with home-network control of authentication confirmation.
- Integrity-protected user plane (optional) and 256-bit algorithms (NEA/NIA).
- SEPP at the border: N32-c (negotiation) and N32-f (forwarding) with TLS or PRINS (application-layer protection per field) between operators.
- OAuth2 between NFs, mTLS inside the core.
- Still weak: fallback to 4G/3G/2G keeps old attacks alive; misconfigured SEPP/roaming; supply chain; slice isolation.
8. 5G-Advanced and 6G
- 5G-Advanced (Rel-18, 19): AI/ML in RAN, better uplink, NTN (Non-Terrestrial Networks — satellites), RedCap, XR optimisation, positioning, energy savings.
- 6G (research, target ~2030): sub-THz bands, ISAC (Integrated Sensing and Communication — the network as radar), AI-native design, ubiquitous satellite+terrestrial coverage, even lower latency.
Remember this: 5G = gNB + AMF/SMF/UPF + UDM/AUSF/PCF connected by HTTP/2 APIs, with slices for different customers, SUCI for privacy and SEPP at the operator border. NSA = 5G radio on 4G core; SA = real 5G.