Glossary

Terms

AMF — Access and Mobility Management Function

5G NF responsible for connection and mobility management. Anchors NAS signaling.

AUSF — Authentication Server Function

5G NF that authenticates the UE; sits between the AMF and UDM.

AVP — Attribute-Value Pair

The atomic unit of a Diameter message. Identified by code + vendor id, carries a typed value (string, integer, grouped, etc.).

CER / CEA — Capabilities-Exchange-Request / Answer

Diameter handshake messages exchanged when a peer connection opens.

DPR / DPA — Disconnect-Peer-Request / Answer

Diameter messages exchanged for graceful peer disconnect.

DWR / DWA — Device-Watchdog-Request / Answer

Diameter heartbeat. Missing too many DWAs drops the peer.

DNN — Data Network Name

5G identifier for the data network a session connects to (the LTE APN, conceptually).

edge — the dflux EdgeGuard proxy binary (d3x-edge)

Used in diagram labels, log fields, and metric names; prose calls it the proxy.

GPSI — Generic Public Subscription Identifier

The publicly-visible identifier for a 5G subscriber. Typically an MSISDN (msisdn-…).

Gx

Diameter application between PCEF (in the PGW) and PCRF. Carries policy and charging rules. App id 16777238, vendor id 10415.

HSS — Home Subscriber Server

4G EPC element holding subscriber data; speaks Diameter on S6a.

HTTP/2

Required transport for 5G SBI (3GPP TS 29.500). The proxy serves h2c (cleartext) or HTTPS+h2.

h2c

HTTP/2 cleartext. Used inside trusted boundaries when TLS is provided at a different layer.

MCC / MNC

Mobile Country Code / Mobile Network Code. Together form the PLMN identifier.

MME — Mobility Management Entity

4G EPC element responsible for connection and mobility. Speaks Diameter on S6a toward the HSS.

mTLS

Mutual TLS — both client and server present certificates. The proxy supports mTLS on the SBI and admin listeners.

NEF — Network Exposure Function

5G NF that exposes 3GPP capabilities to external applications via REST.

NF — Network Function

3GPP shorthand for any of the 5G core elements (AMF, SMF, UDM, …).

NRF — Network Repository Function

5G service registry. NFs register their profiles with the NRF; consumers discover producers through it.

NSSF — Network Slice Selection Function

5G NF that selects the slice (S-NSSAI) for a UE.

NSSAI / S-NSSAI

Network Slice Selection Assistance Information. The single-slice form (S-NSSAI) is a (sst, sd) tuple identifying one network slice.

OAuth2 / JWT

The 5G SBI access-token model (3GPP TS 33.501). The proxy enforces token signature, expiry, and scope on inbound requests.

PCEF — Policy and Charging Enforcement Function

The point where PCC rules are enforced; typically sits in the PGW/SMF.

PCF — Policy Control Function

5G NF that issues policy rules to consumers.

PCRF — Policy and Charging Rules Function

4G analog of PCF. Speaks Diameter on Gx and Rx.

PGW — Packet Data Network Gateway

4G EPC gateway between the operator's IP network and the public internet.

PLMN — Public Land Mobile Network

Identifier for an operator's network — (MCC, MNC) pair. Policy and routing rules can match on visited_plmns.

Rx

Diameter application between AF and PCRF (IMS use case). App id 16777236, vendor id 10415.

S6a / S6d

Diameter application between MME / SGSN and HSS. Carries authentication and location-update procedures. App id 16777251, vendor id 10415.

SBI — Service-Based Interface

3GPP's term for the HTTP/2 + REST service interfaces between 5G core NFs.

SCTP — Stream Control Transmission Protocol

Transport layer protocol (RFC 4960). The typical 3GPP transport for Diameter; the proxy supports both SCTP and TCP.

SMF — Session Management Function

5G NF responsible for session establishment and management.

SUPI — Subscription Permanent Identifier

5G subscriber identifier; typically encodes an IMSI (imsi-…) or NAI (nai-…).

SUCI — Subscription Concealed Identifier

Privacy-preserving encrypted form of SUPI exchanged over the radio.

UDM — Unified Data Management

5G NF holding subscription data. Equivalent in role to the 4G HSS.

UDR — Unified Data Repository

5G data backing store behind UDM, PCF, NEF, etc.

UE — User Equipment

The end-user device — phone, modem, IoT module.

dflux EdgeGuard terms

Filter chain

The request filter chain, built in a fixed order: Auth (only when oauth2_required) → Policy (always) → one Rate-limit filter per rate_limits[] entry → Transformation (request phase) → Application server (when configured) → Signature verification (when enabled). Swapped atomically on hot reload.

Phase

Either request or response. Transformation rules and the response stage are phase-aware.

Control-plane store

The database that holds rules, transforms, routes, producer configs, and NRF profiles. SQLite or Postgres.

Producer pool

The in-memory list of reachable producers per NF type, populated from NRF discovery and/or static config.

Shadow profile

An NRF NF profile that the proxy registers on its own behalf so consumers discover the proxy instead of the real producer.

Connection mode

Per-peer Diameter setting: initiator / responder / both. Replaces the legacy diameter.mode field.

Sticky session

Routing-target option that consistent-hashes a configurable key (sticky_key: one of supi, gpsi, imsi, session_id, origin_host, or request_id) to pin a subscriber to the same producer for the duration of sticky_ttl.

Dry-run

A read-only validation endpoint that checks a candidate config or Diameter dictionary without committing it.