twork nodes, specifically Serving Gateway (S-GW) and PDN Gateway (P-GW), as originally defined in 3GPP, also contain control-plane functions, for example, UE IP address management. In Release-14, the principle was applied to S-GW and P-GW, creating two pairs of logical nodes, that is, S-GW-C and S-GW-U, and P-GW-C and P-GW-U. As a result, most control-plane functions including UE IP address management are hosted in S-GW-C or P-GW-C, leaving S-GW-U or P-GW-U as a user-plane node to simply forward and route user's packets. 5G development takes this principle one step further. To allow independent scalability, evolution, and flexible deployments, 3GPP adopts control- and user-plane separation as one of the key principles to design the 5G core network (3GPP TS 23.501). A single logical node UPF, rather than two as in 4G is defined to perform user plane functions, such as packet routing and forwarding, packet inspection, anchor point for intra-/inter-RAT mobility, etc. Unlike the P-GW, which should be deployed centrally to support functions like UE IP address management and lawful intercept, the UPF is either responsible for part of some functions, for example, user-plane collection of lawful intercept, or does not have to support functions like UE IP address management. Therefore, UPF is appropriate for distributed deployment and offers native support of edge computing. The role of UPF in 5G core network is similar to that of gNB-CU-UP in 5G RAN as: UPF routes user's packets between data network and gNB under the control of AMF, while gNB-CU-UP processes and forwards user's packets between UPF and gNB-DU under the control of gNB-CU-CP. Neither processes control-plane messages, but only routes them to the control-plane functions. For example, UPF routes the Dynamic Host Configuration Protocol (DNCP) request to SMF, which allocates an IP address for the UE while the user plane of gNB (if gNB-DU is regarded as part of the user-plane function) routes RRC to gNB-CU-CP. The fact that both 5GC and NG-RAN support control- us