5G New Radio (NR) introduces a flexible physical layer design centered around multiple numerologies, defined by the subcarrier spacing (SCS) configuration parameter μ (mu). Unlike LTE which fixed subcarrier spacing at 15 kHz, NR supports μ = 0 through 4, corresponding to SCS values of 15, 30, 60, 120, and 240 kHz respectively. This flexibility allows NR to operate efficiently across diverse spectrum bands and use cases. Lower numerologies (μ=0,1) with 15/30 kHz SCS are optimized for coverage-centric deployments in sub-6 GHz (FR1), providing longer cyclic prefixes and better performance in high-delay-spread environments. Higher numerologies (μ=2,3,4) with 60/120/240 kHz SCS are designed for mmWave operation in FR2, where wider channel bandwidths and shorter slot durations enable the extreme data rates and low latency required for eMBB and URLLC applications.

The slot duration scales inversely with SCS: at μ=0, one slot is 1 ms; at μ=1, it is 0.5 ms; at μ=2, 0.25 ms; at μ=3, 0.125 ms; and at μ=4, 0.0625 ms. Each slot contains 14 OFDM symbols regardless of numerology. NR also introduces the concept of mini-slots (2, 4, or 7 symbols) for ultra-low latency transmission, allowing data to start mid-slot rather than waiting for slot boundaries. The number of slots per subframe equals 2^μ. A resource block in NR spans 12 subcarriers in the frequency domain, but the bandwidth of a resource block increases with μ (180 kHz at μ=0, 360 kHz at μ=1, up to 2880 kHz at μ=4). This scalable design ensures that NR can maintain consistent scheduling granularity while adapting to channel bandwidths ranging from 5 MHz to 400 MHz.

5G NR operates across two distinct frequency ranges defined by 3GPP. Frequency Range 1 (FR1) spans 450 MHz to 7.125 GHz and encompasses traditional cellular spectrum including existing LTE bands, 3.5 GHz mid-band (n78, n77), and 600/700 MHz low-band (n71, n28). FR1 provides excellent coverage propagation characteristics, with signals penetrating buildings and traveling long distances with relatively low path loss. This makes FR1 ideal for nationwide coverage deployment and reliable connectivity in urban, suburban, and rural environments. Most initial 5G deployments worldwide utilized FR1, often through dynamic spectrum sharing (DSS) where NR and LTE share the same carriers.

Frequency Range 2 (FR2), commonly known as mmWave, covers 24.25 GHz to 52.6 GHz and represents the true "greenfield" spectrum for 5G. FR2 offers contiguous bandwidths of 400 MHz or more per carrier, enabling multi-gigabit peak data rates exceeding 10 Gbps. However, mmWave signals experience significantly higher free-space path loss (increasing with the square of frequency), limited diffraction around obstacles, and high atmospheric absorption (especially at 28 GHz and 60 GHz oxygen absorption bands). These propagation challenges necessitate dense small cell deployments, advanced beamforming, and massive MIMO to concentrate energy in narrow beams. FR2 is primarily deployed in high-density urban hotspots, stadiums, and indoor venues where capacity demands are extreme and line-of-sight conditions can be engineered.

Massive MIMO (Multiple-Input Multiple-Output) is a cornerstone technology of 5G NR, scaling traditional MIMO from 8x8 in LTE-Advanced to 64x64, 128x128, or even 256x256 antenna configurations in 5G. By deploying large arrays of antenna elements at the base station, massive MIMO enables spatial multiplexing of multiple users on the same time-frequency resources through precoding. In TDD systems, channel reciprocity allows the gNB to estimate downlink channels from uplink sounding reference signals (SRS), enabling computationally efficient precoding without explicit CSI feedback. This yields significant spectral efficiency gains — 3GPP targets 3x improvement over LTE — and enables aggressive frequency reuse.

Beamforming in NR operates in two modes: analog beamforming (using phase shifters for RF beam steering, essential for mmWave due to high cost of fully-digital architectures) and hybrid beamforming (combining analog beam steering with digital baseband precoding). NR defines a beam management framework including P1 (initial beam pair establishment), P2 (beam refinement), and P3 (UE-specific beam adjustment) procedures. The SSB (Synchronization Signal Block) burst set provides beam-sweeping during initial access, with up to 64 SSB beams in FR2. CSI-RS (Channel State Information Reference Signals) enable dynamic beam tracking and channel quality estimation. For FR2 operation, beam recovery procedures handle beam failure by triggering re-establishment through candidate beam identification and random access.

5G NR continues to use Orthogonal Frequency Division Multiplexing (OFDM) as the fundamental waveform for both downlink and uplink, a departure from LTE which used SC-FDMA in the uplink to preserve peak-to-average power ratio (PAPR) for UE power amplifiers. NR's adoption of CP-OFDM for uplink enables flexible resource allocation and simplified transceiver design, though DFT-s-OFDM (similar to SC-FDMA) remains as an optional uplink waveform for coverage-limited scenarios where PAPR matters. The OFDM waveform provides inherent robustness against multipath fading through cyclic prefix insertion and enables fine-grained frequency-domain resource allocation.

Orthogonal Frequency Division Multiple Access (OFDMA) is the multiple access scheme derived from OFDM, where different users are assigned distinct sets of resource blocks in the frequency domain. NR enhances OFDMA with several key features: flexible resource allocation starting at the symbol level (mini-slots), bandwidth parts (BWP) allowing UEs to operate on subsets of the carrier bandwidth to save power, and configurable slot formats supporting self-contained slots where downlink control, data, and uplink acknowledgment can coexist within a single slot for ultra-low latency. The resource grid in NR consists of resource elements (REs) organized into resource blocks (RBs), with each RB containing 12 subcarriers by 1 slot (14 symbols). Physical channels including PDSCH, PUSCH, PDCCH, and PUCCH are mapped to specific REs within this grid according to scheduling decisions from the MAC layer.

Network slicing is one of the defining innovations of 5G, enabling the creation of multiple virtual networks with distinct characteristics atop a shared physical infrastructure. Each network slice is an end-to-end logical network comprising dedicated or shared resources across the RAN, transport, and core domains. A slice is identified by the Single Network Slice Selection Assistance Information (S-NSSAI), a 32-bit identifier consisting of an 8-bit Slice/Service Type (SST) and a 24-bit Slice Differentiator (SD). The SST defines the slice category: eMBB (1), URLLC (2), mMTC (3), V2X (4), and others standardized by 3GPP. The SD allows operators to create multiple instances of the same slice type for different tenants or services.

The slice lifecycle is managed through the Network Slice Management Function (NSMF) in the management plane, which orchestrates slice creation, modification, and termination via interactions with the RAN NSSI (Network Slice Subnet Instance), Transport NSSI, and Core NSSI. In the control plane, the NSSF determines which slices a UE is allowed to access based on subscription data and operator policies. The AMF is slice-aware, with different AMFs potentially serving different slices. The SMF and UPF are slice-specific, ensuring isolation of session states and traffic forwarding paths. Slice isolation can be hard (dedicated physical resources), soft (dedicated virtual resources on shared hardware), or hybrid, depending on service requirements and cost constraints.

Multi-Access Edge Computing (MEC), standardized by ETSI and integrated into 3GPP 5G architecture, brings cloud computing capabilities to the edge of the network, within one to few hops of the end user. In 5G, MEC is natively supported through the UPF's flexible placement and the AF's ability to influence traffic routing. The MEC host typically co-locates with a local UPF instance (UL-CL UPF or Branching Point UPF), enabling traffic breakout to local application servers without traversing the central core. This architecture achieves end-to-end latencies of 10-20 ms, critical for applications like industrial automation, augmented reality, and autonomous vehicle coordination.

The MEC platform exposes APIs to application developers for radio network information (RNIS), location services, bandwidth management, and UE identity. Through the NEF or direct N5 interface, MEC applications can request dynamic QoS adjustments, subscribe to UE mobility events (for service continuity during handover), and influence UPF selection to ensure user plane anchoring at the optimal edge location. The MEC orchestrator, working with the 5G network orchestrator, manages the lifecycle of MEC applications, resource allocation, and service chaining. Key deployment models include: MEC at the base station site (most distributed), MEC at the aggregation point, and MEC at the network edge data center, each offering different latency/capacity tradeoffs.

Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) are foundational enablers of the 5G service-based architecture. NFV decouples network functions from proprietary hardware, allowing them to run as virtualized network functions (VNFs) or cloud-native network functions (CNFs) on commodity servers, containers, and Kubernetes orchestration platforms. The European Telecommunications Standards Institute (ETSI) NFV framework defines the Management and Orchestration (MANO) architecture comprising the NFV Orchestrator (NFVO), VNF Manager (VNFM), and Virtualized Infrastructure Manager (VIM). In 5G, core network functions are deployed as microservices in containers, managed by Kubernetes, enabling auto-scaling, self-healing, and rolling updates.

SDN provides centralized, programmable control of network forwarding behavior through the separation of control and data planes. In 5G transport networks, SDN controllers manage the fronthaul, midhaul, and backhaul segments, dynamically provisioning paths based on slice requirements. For example, a URLLC slice may require deterministic low-latency paths with Time-Sensitive Networking (TSN) support, while an eMBB slice may prioritize bandwidth over latency. The integration of SDN with 5GC allows the SMF to dynamically influence transport path selection through the Policy Control Function, creating an end-to-end programmable network spanning radio, core, and transport domains. This synergy is essential for delivering the service agility and operational efficiency promised by 5G.

5G introduces a fundamentally different Quality of Service (QoS) architecture compared to 4G LTE. While LTE used EPS bearers with a one-to-one mapping between radio bearers and core network tunnels, 5G decouples these layers through the concept of QoS Flows. A PDU (Packet Data Unit) Session is the 5G equivalent of a PDN connection, providing IP connectivity (IPv4, IPv6, or IPv4v6) or Ethernet connectivity between the UE and a Data Network (DN). Within each PDU session, one or more QoS Flows carry traffic with different QoS requirements. Each QoS Flow is identified by a QoS Flow Identifier (QFI, 1-63) and is associated with a 5G QoS Indicator (5QI) that defines standardized QoS characteristics including priority level, packet delay budget, packet error rate, and averaging window.

The mapping between QoS flows and radio bearers is many-to-one: multiple QoS flows can be mapped to a single DRB (Data Radio Bearer) if they share similar QoS requirements, or each QoS flow can have a dedicated DRB for granular handling. The SMF provisions QoS rules to the UE (via NAS) and to the RAN (via N2) and UPF (via N4). The UPF performs packet classification using Packet Detection Rules (PDRs) to map incoming packets to QoS flows based on IP 5-tuple, application IDs, or other criteria. Reflective QoS allows the UE to derive uplink QoS rules from downlink packet markings, reducing signaling overhead. The 5QI table in 3GPP TS 23.501 defines standardized 5QIs for GBR (Guaranteed Bit Rate), Non-GBR, and Delay-Critical GBR services, with values 1-4 typically reserved for GBR and 5-9 for Non-GBR traffic.

5G-AKA (Authentication and Key Agreement) is the primary authentication mechanism defined in 3GPP TS 33.501 for 3GPP access in 5G. It represents an evolution of EPS-AKA used in 4G, with enhanced security features addressing known vulnerabilities in previous generations. The 5G-AKA procedure begins when the UE sends a Registration Request containing the 5G-GUTI or SUCI. The AMF forwards the authentication request to the AUSF, which retrieves authentication vectors (RAND, AUTN, XRES*, KAUSF) from the UDM. Unlike EPS-AKA where the RES (response) was sent in plaintext over the air, 5G-AKA introduces RES* — a hashed version of the RES using the serving network name, preventing rogue base station attacks where an attacker could replay authentication challenges.

The authentication confirmation procedure adds an additional layer of security. After the UE computes RES* and sends it to the AMF, the AMF forwards it to the AUSF for verification. The AUSF compares RES* against XRES* and returns an authentication result along with the anchor key KAUSF. The AMF then derives the KAMF (AMF key) from KAUSF, and subsequently derives KNASenc, KNASint, KgNB, and other keys for NAS and AS security. 5G-AKA also supports sequence number (SQN) freshness checks to prevent replay attacks, and the AUTN includes an authentication token with MAC and SQN to verify network legitimacy to the UE. For non-3GPP access, EAP-AKA' is used, which leverages the Extensible Authentication Protocol framework for integration with enterprise Wi-Fi and untrusted access networks.

The Subscription Permanent Identifier (SUPI) is the 5G equivalent of the IMSI in 4G, uniquely identifying a subscriber within a PLMN. SUPI can take several formats: IMSI-based (starting with MCC+MNC), network-specific identifier (NSI), global line identifier (GLI), or global cable identifier (GCI). Unlike the IMSI which was transmitted in plaintext during initial registration, 5G mandates privacy protection for the SUPI through the Subscription Concealed Identifier (SUCI). The SUCI is generated by encrypting the SUPI using the home network's public key before transmission over the air interface.

The SUCI generation process uses Elliptic Curve Integrated Encryption Scheme (ECIES) with the home operator's public key provisioned in the USIM/UE. The UE encrypts the SUPI along with a fresh ephemeral public key and sends the resulting SUCI to the network. Only the home network's private key can decrypt the SUCI to recover the SUPI. This mechanism prevents passive eavesdroppers from tracking subscribers by their permanent identifiers. After successful authentication, the AMF assigns a temporary identifier (5G-GUTI) for subsequent signaling, further enhancing privacy. The 5G-GUTI is refreshed periodically or upon inter-AMF mobility to prevent long-term tracking. For emergency sessions, a null-scheme SUCI may be used when the UE lacks valid credentials.

5G security is layered into Non-Access Stratum (NAS) security and Access Stratum (AS) security, each protecting different protocol layers. NAS security protects signaling messages between the UE and AMF, including registration, session management, and mobility messages. After successful authentication, the AMF initiates a Security Mode Command (SMC) procedure, negotiating encryption and integrity algorithms for NAS signaling. 5G mandates support for 128-NEA1 (SNOW 3G), 128-NEA2 (AES), and 128-NEA3 (ZUC) for encryption, and 128-NIA1, 128-NIA2, 128-NIA3 for integrity protection. The UE must support all three algorithms, while the network must support at least NEA2/NIA2. NAS messages include a message authentication code (MAC-I) for integrity verification and a sequence number to prevent replay attacks.

AS security protects radio interface signaling (RRC) and user plane data between the UE and gNB. The gNB derives AS keys (KRRCenc, KRRCint, KUPenc, KUPint) from KgNB provided by the AMF during initial context setup. AS security algorithms are negotiated via the SecurityModeCommand RRC message. 5G introduces user plane integrity protection as an optional feature (configurable per DRB), addressing a long-standing gap in 4G where only control plane had integrity protection. This is particularly important for URLLC and mission-critical services where data integrity is paramount. Key refresh procedures (horizontal and vertical key derivation) ensure forward secrecy: horizontal derivation refreshes keys within the same gNB using a COUNT value, while vertical derivation generates fresh keys during handover or RRC state transitions.

The Security Edge Protection Proxy (SEPP) is a new network function introduced in 5G to secure inter-PLMN (roaming) signaling. In 4G LTE, roaming interfaces (S8, S9, S10) relied on IPsec or TLS at the transport layer, but application-layer messages remained unprotected end-to-end, exposing sensitive subscriber data to intermediate transit networks. The SEPP addresses this by providing application-layer security for all N32 interface messages between home and visited PLMNs. Each SEPP acts as a security gateway at the edge of its operator's network, performing mutual TLS authentication, message encryption, and integrity protection.

The SEPP operates in two modes: PRINS (Protection with IPsec and TLS for N32) and TLS-only. In PRINS mode, IPsec tunnels provide network-layer protection while TLS provides transport-layer security. The SEPP also handles topology hiding, masking internal network topology (NF FQDNs, IP addresses) from the roaming partner. For message filtering, the SEPP applies operator-defined policies to determine which IEs (Information Elements) can be passed transparently, modified, or blocked. The SEPP certificate infrastructure uses the GSMA PRD FS.38 PKI, with SEPP certificates issued by authorized certificate authorities. This end-to-end application-layer security ensures that even if transit networks are compromised, roaming signaling remains confidential and tamper-evident.