N32 Interface

N32 is the one place where two different operators' 5G cores meet directly, and it's deliberately the most scrutinised interface in roaming. It connects the SEPP of one PLMN to the SEPP of another, carrying the service-based signalling that has to cross between networks. Because that traffic leaves your security domain, N32 protects it: peer authentication between the SEPPs, plus integrity and confidentiality for the messages.

It comes in two flavours, and which one you use depends on whether intermediaries in the path need to touch the messages. If the SEPPs connect directly, plain TLS over N32 (sometimes called N32-c for the control/negotiation and N32-f for the forwarded messages) is enough. But roaming hubs in the IPX often need to read or modify specific header fields, and you can't do that through end-to-end TLS. For that case there's PRINS (PRotocol for N32 INterconnect Security), an application-layer scheme that protects message content while allowing authorised intermediaries to alter only agreed, specific parts — and proving exactly what was changed.