SECURE · EdgeGuard
One pipeline for every signal.
Sit between NF consumers and producers. Authenticate, rate-limit, transform, and route — across 5G SBI and 4G Diameter — without dropping peers on reload.
consumer → proxy → producer
2
protocol planes
1
policy pipeline
1
path for SBI and Diameter
ms
decision path
The pipeline
Six stages. One policy. Both protocols.
Every SBI and Diameter request runs through the same ordered filter chain. Any filter can deny and short-circuit.
1
Authenticate
Verify Bearer JWT — RS256, JWKS by kid, required scopes, optional jti replay rejection. Skipped when oauth2_required is off.
2
Allow / deny
Walk policy rules in priority order; first match wins. Match on NF type, method, path, SUPI / GPSI / DNN / S-NSSAI, or Diameter AVPs.
3
Rate-limit
Token-bucket per rule, keyed by consumer, SUPI, NF type, or a Diameter dimension. Exhausted buckets deny and short-circuit.
4
Transform
Request-phase header and body edits before forwarding — inject, remove, rewrite, mask, redact. Failures log and skip, never block.
5
Route
Pick a producer or realm peer by content, SUPI range, or time window — weighted targets, sticky sessions, ordered failover.
6
Forward
Re-originate to the producer; on the way back strip headers, hide topology, and run response-phase transforms.
Capabilities
A proxy that does the signaling work.
SBI and Diameter, policy and transforms, routing and rate limits — one config, one rule set, reloaded live.
SBI reverse proxy
HTTP/2 with h2c by default, mTLS-capable. Registers at the NRF, heartbeats, discovers producers, pools and load-balances per NF.
Diameter relay
RFC 6733 over TCP or SCTP with S6a, Gx, and Rx filters. Per-peer initiator/responder modes, watchdogs, realm-based selection.
Policy engine
Allow/deny by NF type, method, path, SUPI / GPSI / DNN / S-NSSAI, or AVP — one rule set across SBI and Diameter. Deny by default.
Transformation engine
Header inject/remove/rewrite, body-field set/remove/mask/map by JSON Pointer, regex, and Diameter AVP edits — request and response phases.
Content-based routing
Route by path, method, NF type, SUPI range, or time window. Weighted canary targets, sticky sessions, ordered failover.
Rate limiting
Per-consumer and per-SUPI token buckets with rps rate and burst ceiling. Cap a noisy peer without touching the NFs behind the proxy.
Observability
Prometheus /metrics, deep health, OTLP tracing, and a structured JSON decision log for every allow/deny. Log level hot-changeable.
Hot reload
Policy, rate limits, transforms, routes, and producer weights swap as one atomic filter-chain rebuild — zero dropped connections.
Operations
Built to run in front of production.
Deny by default, change live, roll back fast. Every mutation and data-path decision is a structured log line.
- Admin API — full CRUD for policy, rate-limit, transformation, and routing rules through one /admin/rules surface
- d3x-edgectl CLI — thin client over the admin API: status, rules, transforms, routing, and config validation
- Deny-by-default posture — a fresh proxy denies every request until you add an allow rule
- Policy snapshots — capture live policy as an immutable snapshot, restore to roll an entire change back
- Dry-run / validate — check a config or candidate transform before it goes live; ideal as a CI gate
- SQLite or PostgreSQL control-plane store — SQLite by default; Postgres for shared multi-instance state
One rule set
Policy as data.
Rules live in the control-plane store. Every write hot-reloads with no dropped connections.
policy-rule.yaml
# allow nudm-sdm reads
type: policy
name: allow-sdm-reads
priority: 100
action: allow
methods: ["GET"]
path_patterns:
- /nudm-sdm/v2/.*Next step
One pipeline for every signal.
Put dflux EdgeGuard in front of your NFs and govern SBI and Diameter with one policy.