5G Core (5GC) is the heart of a 5G mobile network; it handles a wide variety of essential functions in the mobile network, such as connectivity and mobility management, authentication and authorization, and policy management, among others. Like 4G networks, the new 5G core domain supports the PCC (Policy and Charging Control) architecture where the PCF (Policy Control Function) takes the role of a central network component interacting with other network functions (SMF, AMF, NEF/AF…) and feeds them with policy rules needed for requesting and managing service quality on a per session basis.
With the advent of 5G, PCC networks are expected to support massive number of devices with various data, transmission, and bandwidth requirements. These requirements are driven mainly by use cases ranging from mobile broadband (eMBB), ultra-reliable low-latency communications (URLLC), and massive machine-type communications (mMTC). To cope with the growing number of connected devices and huge amount of policy traffic, Communication Service Providers (CSP) are opting for deploying multiple PCFs as a scalability solution and thus securing their policy networks. However, having numerous PCFs in a network comes at a cost, mainly increasing the complexity of selecting a PCF when many NFs are getting involved during a session.
In PCC architecture with multiple PCFs, policy rules shall be applied from the access network to the core with consistency and the PCF needs to be able to maintain the relations of different sessions over different interfaces. Therefore, all messages of the same subscriber from different interfaces and for a specific session must be routed to the same PCF. This routing mechanism is called “Session Binding” and it is handled by a new 5G network function called BSF (Binding Support Function).
4G session binding
BSF concept is borrowed directly from the experiences of 4G. In EPC networks with multiple PCRFs (Policy and Charging Rules Function) deployed, it is recommended that all Diameter sessions established over different interfaces (Gx, Rx, S9) for a specific session; use the same PCRF instance. This intelligent routing is called “PCRF Session Binding” and it is provided by the Diameter Routing Agent (DRA). Based on subscriber identity (e.g. IMSI or IP address), DRA ensures that all sessions related to the same subscriber will be routed to the same PCRF.
A good example here is Gx/Rx binding during a VoLTE call (figure 1). The DRA binds Gx and Rx interfaces to one PCRF based on IMSI/IP address. It first establishes Gx session by selecting a PCRF and then creates/stores the PCRF instance ID. When another Rx session is created, the DRA uses the included IP address to find the associated binding information in its session storage and route Rx messages to the selected PCRF.
For subsequent Gx and Rx messages, Gx and Rx session ID are used to select the same PCRF even if the UE IP address is not present in the received message.
N.B: In 4G, session binding is also applicable to OCS and AAA solutions.
5G session binding
The session binding function used in 4G is comparable to the 5G BSF. In 5G, subscribers are dynamically assigned to a PCF when the initial session is created. All subscriber Policy sessions from anywhere in the network are routed to the assigned PCF until that subscriber’s last session ends, at which point the next session may be routed to a different PCF. This dynamic mapping of subscribers to PCFs is provided by the BSF that ensures that all messages of a session received over different interfaces (such as N5 and N7) go to the same PCF with which a subscriber registers.
Main 5G use case
As of today, the main scenario that necessitates a binding is voice call over new radio (VoNR). As you know, IMS networks will continue to manage voice calls for 5G subscribers, as there is no SBA solution for voice services at the moment. A 5G subscriber who wants to make a voice call, will initiate the voice session on the IMS network via Rx diameter interface but it should be connected to the same PCF which was previously selected while creating the N7 session in 5GC. The BSF then will correlate between 5GC and IMS sessions and bind them to select the same PCF instance. (See figure 2)
In 5G, N7 sessions are established first, well before associated Rx sessions are created. Therefore, the SMF selects a PCF when a subscriber makes a service request. In the following, PCF asks the BSF to create a new entry in its session binding storage, which mainly includes the mapping between the UE IP address and selected PCF. Subsequently, when a request for a new Rx session is received, DRA uses the included UE IP address to find the associated binding information in its session storage. Otherwise, it sends the Rx message to the BSF to get the PCF address serving the subscriber and thus routing the message to the indicated PCF.
Upon session termination, all associated information is removed from the BSF and DRA session storages, which opens the door to selecting another PCF when the subscriber starts another session.
According to 3GPP, the only use cases that need a binding are:
1. Application Function (AF): it interacts with the BSF via HTTP2 N5 or Diameter Rx interfaces. For VoNR use case, the P-CSCF is the IMS AF.
2. Network Exposure Function (NEF): A NF that exposes 5G core network capabilities to third parties (same as 4G SCEF). It uses HTTP N5 interface to interact with the PCF.
3. Network Data Analytics Function (NWDAF): NWDAF brings analytics capabilities to 5GC and define how other NFs should interact with it.
BSF Services
BSF is one of the control plane network functions of the 5G core network. It provides Protocol Data Unit (PDU) session binding functionality and ensures that an Application Function (AF) request for a certain PDU session, reaches the PCF holding the PDU session information. BSF stores the binding information and allow NF service consumers to register, update, remove and discover a binding information by exposing Nbsf_management service. (see table 1 below)
The following table shows the BSF services and service operations:
According to 3GPP, the only NF that is responsible for creating a session binding is PCF. It uses the “Register” operation to instruct the BSF to create a new entry in its session storage based on the “PcfBinding” information. The “PcfBinding” field contains the mapping between the user identity (SUPI and GPSI), the UE addresses (IP or Ethernet), network ID (DNN, S-NSSAI) and the selected PCF.
The “PcfBinding” info shall include:
· UE address (IPv4 and/or IPv6 and/or MAC)
· PCF address
· DNN (same as 4G APN)
· S-NSSAI (slice ID)
It may include:
· SUPI (or IMSI)
· GPSI (or MSISDN)
BSF binding types
BSF provides the session binding function for :
• Voice services: via two modes, proxy or redirect.
• Data services
BSF binding for voice services
For voice services, two modes are supported: Proxy agent and Redirect agent. The call flow below illustrates differences between the two modes.
As already explained, 5G voice services are still managed by the IMS network. In this regard, the BSF needs to be able to interwork with the DRA over the Rx interface to enable session correlation between Diameter and HTTP2. In this case, the BSF can act as a proxy agent or a redirect agent (See above):
• Proxy agent mode: Upon receiving AAR message from the DRA, the BSF queries its own binding database to obtain the host name of the selected PCF. It then inserts the PCF host name in the AAR message, and sends it to the target PCF over the Diameter link.
• Redirect agent mode: After receiving an AAR message from the DRA, the BSF queries its own binding database to get the host name of the selected PCF and returns a response carrying the host name to the DRA. The DRA then constructs a new AAR message and sends it to the target PCF.
Here is a brief comparison between the two modes:
For voice service binding, BSF offers both scenarios (proxy or redirect) and it is up to the designer to choose the most suitable mode based on operator’s requirements.
BSF binding for data services
The session binding during data services is the same as that during voice services, except that in data services the whole process is HTTP based between two SBA interfaces N5 and N7. (See call flow below)
Call flow description:
· Steps 1/2: N7 session is established first, before the associated N5 session is created
· Steps 3/4: At the request of the PCF, the BSF creates a new entry in its session storage that includes the mapping between the user equipment (UE) IP address and the selected PCF.
· Step 5: When a request for a new session is received, NEF/AF discovers the BSF using the NRF.
· Steps 6/7: NEF/AF uses the Nbsf_Management_Discovery service to request the PCF address from the BSF. The BSF uses the included UE IP address to find the associated binding information in its session storage.
· Steps 8/9: After receiving the PCF address from the BSF, the NEF/AF initiate a new request and sends it via N5 interface to the target PCF.
BSF Deployment Options
As per 3GPP, the BSF is a function that can be deployed standalone or as a functionality provided by other network functions, such as PCF, UDR, NRF and SMF. However, 4G experiences have shown that the best option for session binding function is to be managed by a node in the middle (like DRA) as it belongs to the signaling controlling framework. Therefore, the best choice for BSF deployment is a standalone node acting as a middleware or co-located with signaling controllers like SCP (Service Communication Proxy). That is why 5GC vendors like Ericsson, Huawei, and Nokia include the BSF in their signaling controller package:
Conclusion
The 5GC network is expected to support massive number of devices with various data, transmission, and bandwidth requirements. A solid signaling architecture must have the flexibility to control all parts of a 5G core network, while also allowing the core network to scale with zero impact on QoS. In a network with multiple PCFs, it is important to ensure continuous communication between various NFs in any scenario. Therefore, different NFs need to coordinate when selecting a PCF to ensure that various sessions belonging to a single subscriber originating on different interfaces are bound together and routed towards the same PCF. Which brings a new entity called BSF in the 5GC architecture.
To conclude, carriers need a BSF as soon as they have two or more PCFs serving a subscriber and a binding use case either VoNR or an AF/NEF need. When a carrier deploy multiple PCFs, but each subscriber is assigned to a unique PCF (range based PCFs); in this case there is no need for a BSF and the SCP is capable of handling this kind of selection.
