n 5G, roaming signalling crosses the N32 interface between two Security Edge Protection Proxies (SEPP), one in each network. The SEPP authenticates the partner, and PRINS (Protection of Inter-Network Signalling) encrypts and integrity-protects the messages. This replaces the open trust that made SS7 and Diameter exploitable — but only where both networks are 5G standalone.
Why SS7 and Diameter were exploitable
SS7 and Diameter interconnect were built for a small club of trusted operators, so they assumed the sender of a signalling message was who it claimed to be. There was no per-hop authentication and no confidentiality on the interconnect. Once the number of interconnected parties exploded, that implicit trust became the attack surface behind subscriber location tracking, SMS interception, and roaming fraud. Signalling firewalls and GSMA rule sets like FS.11 and FS.19 were the industry's retrofit — filtering the messages the protocols themselves could not authenticate.
How the SEPP secures 5G roaming
5G was designed with roaming security built in rather than bolted on. Every network exposes a Security Edge Protection Proxy at the edge of its 5G core, and all inter-network signalling flows through it over the N32 interface defined in the 3GPP security architecture (TS 33.501). The two SEPPs first run an N32-c control handshake to mutually authenticate and negotiate protection, then exchange the actual signalling over N32-f.
Protection on N32-f comes in two modes. Where operators interconnect directly, TLS provides transport encryption and authentication. Where IPX intermediaries need to read or modify specific fields — for routing or mediation — PRINS (Protection of Inter-Network Signalling) applies application-layer security: it encrypts sensitive information elements while allowing only explicitly permitted modifications, so an intermediary can do its job without being able to forge or read what it should not. The result is that a partner is authenticated and the message is integrity-protected, which is precisely what SS7 and Diameter lacked.
SS7/Diameter vs 5G SEPP roaming security
| Property | SS7 / Diameter interconnect | 5G roaming via SEPP |
|---|---|---|
| Peer authentication | Implicit, largely absent | Mutual, via N32-c handshake |
| Confidentiality | None on interconnect by default | TLS or PRINS on N32-f |
| Integrity protection | None inherent | Cryptographic, end to end across IPX |
| Intermediary handling | Full visibility and modification | Only explicitly permitted field changes (PRINS) |
| Primary defence | Signalling firewall (FS.11 / FS.19) | Built-in protocol security + SEPP policy |
The shift is from bolting a filter onto an untrusted protocol to running a protocol that authenticates and protects by design. But that only holds when both ends actually speak it.
Why you still need SS7 and Diameter firewalls in 2026
The SEPP secures 5G-to-5G standalone roaming. It does nothing for the enormous volume of traffic that still rides the older stacks, and that traffic is not going away soon.
- Non-standalone 5G and the huge installed base of 4G, 3G, and 2G still depend on Diameter and SS7 for roaming and messaging.
- Interworking between 5G and legacy cores means signalling is translated back down to Diameter/MAP at the boundary — reopening the old exposure.
- Roaming partners migrate on different timelines, so a modern network keeps talking legacy to partners that have not upgraded.
- GSMA guidance continues to treat SS7 and Diameter firewalling as essential during a transition that spans years, not months.
During the transition you are defending two worlds at once. BroadNet's SS7 firewall and SMS firewall protect the legacy interconnect that still carries most roaming and messaging traffic, so the exposure the SEPP closes on 5G does not simply reappear on the 4G path beside it.
Planning the transition
Treat 5G roaming security and legacy signalling security as one programme, not two. Stand up SEPPs and N32 protection for standalone roaming while keeping SS7 and Diameter firewalls fully operational for everything else, and pay special attention to the interworking boundary where 5G messages are translated down to Diameter and MAP. For the protocol detail, see our references on Diameter roaming security (DRA/DEA), SS7 security threats and FS.11, and SS7 vs SIGTRAN, and the plain-language answers on Diameter signalling security and SS7 signalling security.
Frequently asked questions
What is the SEPP in 5G?
The Security Edge Protection Proxy (SEPP) is the network function that sits at the edge of a 5G core and handles all roaming signalling with other networks. Every inter-network message passes through it over the N32 interface. It mutually authenticates the roaming partner and applies encryption and integrity protection, replacing the implicit, unauthenticated trust that characterised SS7 and Diameter interconnect.
What is the difference between TLS and PRINS on N32?
Both protect the N32-f signalling exchange, but for different topologies. TLS suits a direct interconnect between two SEPPs, providing transport-layer encryption and authentication. PRINS (Protection of Inter-Network Signalling) is application-layer security for paths that cross IPX intermediaries: it encrypts sensitive fields while permitting only explicitly authorised modifications, so a broker can mediate without being able to forge or read protected content.
Does 5G make SS7 and Diameter firewalls obsolete?
No, not for years. The SEPP only secures 5G standalone roaming, while most roaming and messaging traffic still rides 4G Diameter and SS7, and interworking translates 5G signalling back down to those protocols at the boundary. GSMA guidance continues to treat SS7 and Diameter firewalling as essential throughout the transition, so operators run both defences in parallel.
What is a cross-network signalling attack?
It is an attack that abuses interconnect signalling — SS7, Diameter, or 5G roaming messages — to do something the network should not allow, such as tracking a subscriber's location, intercepting SMS or calls, or committing roaming fraud. These attacks exploited the trust assumptions of SS7 and Diameter; 5G's SEPP-based model is designed to remove those assumptions on standalone roaming paths.
References
- 3GPP — TS 33.501, Security architecture and procedures for the 5G system: 3gpp.org
- 3GPP — TS 29.573, 5G System; Public Land Mobile Network (PLMN) interconnection (N32): 3gpp.org
- GSMA — 5G and interconnect security resources: gsma.com
- GSMA — FS.11 SS7 and FS.19 Diameter interconnect security monitoring guidelines: gsma.com