during the session. IPsec can be used to protect data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host. 146 Chapter 1 Security edge protection proxy is a non-transparent proxy which supports message fil- tering and policing inter-PLMN control-plane interfaces and topology hiding. User equipment Access network Reference-point representation of the architecture can be used to develop detailed call flows in the normative standardization. N1 is defined to carry signaling between UE and AMF. The reference points for connecting AN and AMF and AN and UPF are defined as N2 and N3, respectively. There is no reference point between AN and SMF, but there is a reference point, N11, between AMF and SMF. Therefore, the SMF is controlled by AMF. N4 is used by SMF and UPF SO that the UPF can be configured using the control information generated by the SMF, and the UPF can report its state to the SMF. N9 is the reference point for the connection between different UPFs, and N14 is the reference point connecting different AMFs. N15 and N7 are defined for the PCF to apply policies to AMF and SMF, respec- tively. N12 is required for the AMF to perform authentication of the UE. N8 and N10 are defined to provide the UE subscription data to AMF and SMF. The 5G core network supports UE connectivity via untrusted non-3GPP access networks such as Wi-Fi. Non-3GPP access networks can connect to the 5G core network via a non- 3GPP interworking function (N3IWF). The N3IWF interfaces the 5G core network control plane and UPFs via N2 and N3 interfaces, respectively, with the external network. The N2 and N3 reference points are used to connect stand-alone non-3GPP access networks to 5G core network control plane function and UPF, correspondingly. A UE that attempts to access the 5G core network over a stand-alone non-3GPP access, after UE attachment, must support NAS signaling with 5G core network control-plane functions using N1 reference point. When the UE is connected via a NG-RAN and