Network Architecture: The Dark Side of 5G, First Edition. Edited by Sasha Sirotkin. © 2021 John Wiley & Sons Ltd. Published 2021 by John Wiley & Sons Ltd. 3 5G System Overview Tracking the location of the UE at different levels of granularity depending on whether a UE is involved in active communication or not; Establishing data sessions to different networks for different payloads types (e.g. IPv4, IPv6, Ethernet, etc.) as requested by a UE; Traffic forwarding in both uplink and downlink directions between RAN and the data networks a UE has established a session to; Deriving Quality of Service (QoS) and charging rules based on operator polices; Enforcing charging and QoS rules (the latter in tandem with the RAN); Performing lawful interception, i.e. providing meta data and access to payload of intercep- tion targets in line with legal obligations. While fulfilling similar tasks as the core network of earlier generations, 5GC follows novel paradigms in various areas: Service-based architecture (SBA): in contrast to the Evolved Packet Core (EPC), the core network of the Evolved Packet System (EPS), 5GC procedures are defined based on generic services that are exposed by 5GC network functions. The benefit of generic services is that they can be reused for different system procedures and can be accessed by different network functions (now or in a future release) or can also be leveraged for proprietary operator-specific services. This not only simplifies standardization of new system features but also reduces implementation and testing effort. Most importantly, the SBA approach, as well as the decision to define network function services as application programming interfaces (APIs) using well-established web technologies, addresses the market demand for programmability and extensibility of the 3GPP system by mobile network operators (MNOs) and third parties. Control- and user-plane separation (CUPS): separating control and user plane allows for independent scaling and evolution of control-plane functions and user-pl