Understanding Mobile Internet Access

What Is Mobile Internet Access?

Mobile internet access is the process by which a subscriber's device (User Equipment or UE) establishes a connection to the global internet through a mobile network operator's infrastructure. Unlike wired broadband connections, mobile internet access involves a complex series of wireless protocols, authentication mechanisms, and network function interactions that occur automatically every time a device connects to a mobile network and requests data connectivity.

The process begins when a SIM card is inserted into a device and ends when data packets are successfully exchanged between the device and a server on the public internet. In between, dozens of signalling messages are exchanged across multiple network interfaces, authentication is performed, IP addresses are assigned, and data paths are established through the operator's core network.

Step 1 — SIM and Network Registration

Every mobile internet session begins with the SIM card (or eSIM) and the network registration process. The SIM contains the subscriber's permanent identity (SUPI in 5G, IMSI in 4G), authentication keys, and cryptographic credentials that allow the network to verify the subscriber's identity.

SUPI and Identity Concealment

When a device attaches to a 5G network, it never transmits the Subscription Permanent Identifier (SUPI) in plaintext. Instead, it encrypts the SUPI using the Home Network Public Key to produce a Subscription Concealed Identifier (SUCI). This is transmitted to the Access and Mobility Management Function (AMF), which forwards it to the Authentication Server Function (AUSF) and Unified Data Management (UDM) for verification. This mechanism prevents the IMSI/SUPI harvesting attacks that were a security vulnerability in earlier network generations.

5G-AKA Authentication

Authentication uses the 5G Authentication and Key Agreement (5G-AKA) protocol, which is a mutual authentication mechanism — both the device and the network verify each other's identity. The UDM generates an Authentication Vector using the subscriber's root key (K) stored in both the SIM and the network. The AMF sends an authentication challenge to the UE, which responds with a signed response. Upon successful verification, security keys are derived for encrypting both the NAS (Non-Access Stratum) and AS (Access Stratum) signalling and user data.

Step 2 — APN and Data Network Configuration

The Access Point Name (APN) — known as a Data Network Name (DNN) in 5G — is a logical identifier that specifies which external data network a mobile device should connect to. The APN acts as a gateway label, telling the core network which User Plane Function (UPF) and external data network to route the subscriber's traffic through.

APN Structure and Components

An APN consists of two logical parts: the Network Identifier (NI), which specifies the external service (e.g., "internet" or "mms"), and the Operator Identifier (OI), which identifies the operator's network domain. For most consumer internet access, the default internet APN is pre-configured on the SIM or device and is selected automatically during data session establishment.

Step 3 — PDU Session Establishment

In 5G, mobile internet access is delivered through a Protocol Data Unit (PDU) Session. A PDU session is a logical connection between the UE and a specific Data Network (DN), which in most cases is the public internet. The session establishment process involves coordination between the SMF, UPF, AMF, and PCF to create the data path and enforce the appropriate quality of service and policy rules.

PDU Session Types

5G supports three types of PDU sessions, each suited to different use cases. IPv4 sessions assign a single IPv4 address to the device, while IPv6 sessions use the more modern addressing scheme that provides a vastly larger address space. IPv4v6 dual-stack sessions are the most common in consumer networks, providing both an IPv4 and IPv6 address within a single session. Ethernet PDU sessions are used for industrial and enterprise applications where Layer 2 connectivity is required.

IP Address Allocation

IP address allocation in 5G can be handled in several ways. The most common approach for consumer mobile internet access is through the operator's own DHCP server or through the UPF's built-in address allocation function. The allocated IP address is used for the duration of the PDU session and returned to the pool when the session is released. For enterprise customers, static IP addresses may be assigned from a dedicated pool managed through the UDM subscription profile.

Step 4 — QoS Flows and Data Bearers

Once a PDU session is established, data is carried through QoS flows — logical channels within the session that have specific quality-of-service characteristics. Each QoS flow is identified by a QoS Flow Identifier (QFI) and is associated with a 5G QoS Identifier (5QI) that determines its scheduling priority, packet delay budget, and packet error rate target.

5QI Values and Their Characteristics

Step 5 — Data Path: Device to Internet

Once the PDU session and QoS flows are established, actual user data travels through a specific path from the device to the internet. Understanding this path requires following the data packet through each hop in the network.

The Complete Data Path

A data packet originates in an application on the user's device — for example, an HTTP GET request to a web server. The packet is processed by the device's IP stack, which routes it to the 5G modem. The modem encapsulates the packet using the 5G NR protocols and transmits it over the air interface to the gNB base station. At the gNB, the packet is decapsulated from the air interface protocols and re-encapsulated using GTP-U (GPRS Tunnelling Protocol — User Plane) tunnelling for transport over the backhaul network to the UPF.

The UPF is the critical anchor point for user plane traffic. It receives the GTP-U tunnel packet from the gNB, decapsulates it, inspects the inner IP packet, applies any necessary packet detection and enforcement rules (PDR/FAR), and forwards the packet toward the internet. The UPF also performs any required NAT translation if the device has a private IP address, and applies metering and reporting for the Online Charging System (OCS).

DNS Resolution in Mobile Networks

Domain Name System (DNS) resolution is a critical part of the internet access process. When an application on a mobile device tries to connect to a hostname such as "www.example.com", the device first needs to resolve this hostname to an IP address. The DNS query is sent to the DNS resolver address provided during PDU session establishment — typically an operator-managed recursive resolver.

In 5G networks, DNS queries travel through the same data path as other internet traffic, through the UPF and out to the internet. Modern networks increasingly support DNS over HTTPS (DoH) and DNS over TLS (DoT) for encrypted DNS queries, preventing DNS hijacking and providing privacy for the subscriber's browsing activity.

Policy Control and Fair Usage

The Policy Control Function (PCF) plays a central role in managing how subscribers access mobile internet services. The PCF holds policy rules that define the subscriber's entitled Quality of Service (QoS), maximum bandwidth (AMBR — Aggregate Maximum Bit Rate), and any traffic management rules such as throttling after reaching a data threshold.

Aggregate Maximum Bit Rate (AMBR)

AMBR is a key QoS parameter that limits the total aggregate data rate across all non-GBR QoS flows in a PDU session. There are two levels of AMBR: UE-AMBR, which limits the total throughput across all PDU sessions for a given UE, and Session-AMBR, which limits throughput within a single PDU session. These values are stored in the subscriber's profile in the UDM and enforced by the UPF in real-time.

Policy-Based Throttling

When a subscriber's high-speed data quota is exhausted, the PCF updates the active QoS policy to reduce the AMBR to a lower value — commonly 128 Kbps or 1 Mbps for "unlimited" plans at reduced speed. This policy update is pushed to the UPF via the SMF and takes effect immediately without interrupting the existing PDU session. The subscriber continues to have internet access, but at reduced throughput until the next recharge or plan renewal cycle.

Roaming and Internet Access

When a subscriber travels outside their home network's coverage area and connects to a visited network (VPLMN), mobile internet access follows one of two roaming architectures: Home Routed (HR) or Local Breakout (LBO). In Home Routed roaming, all user plane traffic is tunnelled back to the subscriber's home network (HPLMN) for internet access, passing through the home network's UPF before reaching the internet. In Local Breakout, the visited network provides local internet access, reducing latency but requiring commercial roaming agreements between operators.

Mobile Internet Access vs Fixed Broadband