Tutorial: Learn 5G Technology from Scratch (2026)
5G is the fifth generation of mobile networking, promising not just faster phones but a platform for massive IoT, ultra-reliable low-latency communications, and network slicing. After working on 5G core network deployments for smart factory and connected vehicle projects, I have seen how the architecture differs fundamentally from 4G — it is a service-based, cloud-native system designed for programmability.
This tutorial covers the 5G architecture (NR, Core, gNB), network slicing, edge computing integration, massive IoT (NB-IoT, LTE-M), and the MEC (Multi-access Edge Computing) framework for ultra-low-latency applications.
5G Architecture: NR and Core
The 5G system consists of the Radio Access Network (RAN) with gNodeB base stations and the 5G Core (5GC). The New Radio (NR) air interface supports two frequency ranges: FR1 (sub-7 GHz, wide coverage) and FR2 (mmWave 24-52 GHz, high capacity, short range). Sub-6 GHz frequencies provide the coverage layer; mmWave provides high-speed hotspots in urban areas and venues.
The 5GC is a service-based architecture: each network function (AMF for access management, SMF for session management, UPF for user plane, AUSF for authentication) exposes APIs. This replaces the 4G's point-to-point interfaces with HTTP/2-based services, enabling flexible deployment and scaling.
# 5G Core Network Functions
# AMF - Access and Mobility Management Function
# SMF - Session Management Function
# UPF - User Plane Function
# AUSF - Authentication Server Function
# NRF - Network Repository Function
# PCF - Policy Control Function
# UDM - Unified Data Management
# Register an NF in the NRF (simplified)
curl -X PUT http://nrf:8080/nnrf-nfm/v1/nf-instances/{nfInstanceId} \
-H "Content-Type: application/json" \
-d '{
"nfType": "UPF",
"nfStatus": "REGISTERED",
"ipv4Addresses": ["192.168.1.100"],
"capacity": 100,
"priority": 50
}'Network Slicing
Network slicing creates multiple virtual networks on a shared physical infrastructure, each optimized for a specific service type. An eMBB slice (enhanced Mobile Broadband) prioritizes throughput for video streaming. An URLLC slice (Ultra-Reliable Low-Latency Communications) guarantees <1ms latency for industrial control. A massive IoT slice optimizes for thousands of low-power devices per cell.
Each slice has its own SMF, UPF, and policy configuration. The Network Slice Selection Function (NSSF) routes each UE to the correct slice based on subscription data and requested Network Slice Selection Assistance Information (NSSAI).
# NSSAI configuration for three slices
slices:
- sst: 1 # eMBB
sd: "000001"
description: "Enhanced Mobile Broadband"
qos:
qci: 6
priority: 10
upf: upf-embb
- sst: 2 # URLLC
sd: "000002"
description: "Ultra-Reliable Low-Latency"
qos:
qci: 3
priority: 5
upf: upf-urllc
- sst: 3 # MIoT
sd: "000003"
description: "Massive IoT"
qos:
qci: 9
priority: 20
upf: upf-miotEdge Computing (MEC)
Multi-access Edge Computing (MEC) brings compute and storage to the 5G base station or aggregation point, reducing latency to single-digit milliseconds. The UPF locally breaks out traffic to the MEC host instead of backhauling to a central data center. This enables real-time applications: autonomous vehicle coordination, industrial robot control, and cloud gaming.
The MEC platform exposes service APIs (location, bandwidth, UE identity) to applications running at the edge. Standard ETSI MEC APIs include RNIS (Radio Network Information Service) for real-time radio conditions and location services.
# MEC traffic steering via local UPF
apiVersion: edge.com/v1
kind: TrafficRule
metadata:
name: local-breakout
spec:
priority: 100
dnsRules:
- domain: "factory-control.local"
target: "mec-host.factory.net"
applicationFilter:
ipProtocol: "udp"
destPort: 5005
action: "FORWARD_TO_LOCAL"
localBreakout: trueMassive IoT (NB-IoT and LTE-M)
Massive IoT connects millions of low-cost, low-power devices per square kilometer. NB-IoT (Narrowband IoT) uses 200 KHz bandwidth for extremely power-efficient devices that transmit small payloads — ideal for smart meters, environmental sensors, and asset trackers. LTE-M (eMTC) offers higher throughput and mobility support for wearables and medical devices.
Power saving features: Power Saving Mode (PSM) lets devices sleep for days or weeks, waking only to send data. Extended Discontinuous Reception (eDRX) extends paging cycles to hours. Battery life of 10+ years is achievable with a daily transmission schedule.
# AT commands for NB-IoT module (e.g., BG96, Quectel)
AT+CFUN=0 # Enter minimum functionality (deep sleep)
AT+CPSMS=1 # Enable Power Saving Mode
AT+EDRXCMD=2,12 # Configure eDRX cycle (periodic tracking area update)
AT+CGDCONT=1,"IP","iot.apn" # Set APN
AT+NIOT=4 # Set NB-IOT mode (1=CAT-M, 4=NB-IoT)
AT+COPS=1,2,"310410" # Register on network
AT+NSOCR="DGRAM",17,1234,1 # Open UDP socket
AT+NSOST=0,"192.168.1.1",8888,4,"48656C6C6F" # Send "Hello"5G Positioning and Location Services
5G NR positioning delivers sub-meter accuracy without GPS, using Observed Time Difference Of Arrival (OTDOA), uplink Time Difference of Arrival (UTDOA), and multi-cell Round Trip Time (RTT). Combined with angle-of-arrival from massive MIMO arrays, 5G can locate devices indoors where GPS fails.
The Location Management Function (LMF) in the 5GC coordinates positioning. Applications request location via the LCS (LoCation Services) API with accuracy and response time requirements. Use cases include indoor navigation, emergency services (E911), and asset tracking in warehouses.
# LMF positioning request (NRPPa protocol)
curl -X POST http://lmf:8080/nlmf-loc/v1/determine-location \
-H "Content-Type: application/json" \
-d '{
"suci": "imsi-310150123456789",
"qos": {
"lcsQosClass": "ASSURED",
"horizontalAccuracy": 10,
"verticalAccuracy": 20,
"responseTime": 5000
},
"positioningMethods": ["otdoa", "utdoa"]
}'5G Security
5G security improves on 4G in several critical areas: Subscriber Permanent Identifier (SUPI) replaces IMSI to prevent tracking. The home network remains in control of authentication (SEAF, AUSF, UDM). Network function communication uses TLS/mTLS between all core NFs. Service-Based Architecture (SBA) security includes OAuth 2.0 for NF authorization.
The major concern is the expanded attack surface: more NFs, more APIs, edge computing nodes, and massive IoT devices. Use network slicing isolation, NFV security (hardened VMs/containers), and continuous monitoring with Security Information and Event Management (SIEM).
// SUPI concealment - Subscription Concealed Identifier (SUCI)
// The home network public key encrypts the SUPI into SUCI
import crypto from 'node:crypto';
function generateSUCI(supi, hnPublicKey) {
const scheme = 'ecies';
const ephemeralKey = crypto.generateKeyPairSync('ec', { namedCurve: 'secp256r1' });
const sharedSecret = crypto.ecdh.computeSecret(hnPublicKey, ephemeralKey.publicKey);
const cipher = crypto.createCipheriv('aes-128-ctr', sharedSecret.slice(0, 16), iv);
return {
scheme,
publicKey: ephemeralKey.publicKey.export({ format: 'der', type: 'spki' }),
ciphertext: cipher.update(supi).final()
};
}Frequently Asked Questions
Do I need 5G hardware to develop 5G applications?
No. Use open-source 5G core implementations like Open5GS or free5GC with software gNodeB simulators (UERANSIM). These run on standard Linux servers and let you test network slicing, edge computing, and IoT connectivity in a lab environment.
How fast is 5G compared to 4G?
Peak rates: 20 Gbps downlink, 10 Gbps uplink (theoretical). Real-world: 100-500 Mbps on sub-6 GHz, 1-4 Gbps on mmWave. Latency drops from 30-50ms (4G) to 1-10ms (5G). The improvements compound for real-time applications.
What is the difference between standalone (SA) and non-standalone (NSA)?
NSA uses a 5G radio with a 4G core — faster deployment but limited features. SA uses the full 5G core with network slicing and service-based architecture. SA is required for URLLC and advanced slicing.
How do I test 5G applications at scale?
Use network emulators (Keysight, Spirent) for performance testing. For development, the Open5GS + UERANSIM stack supports hundreds of simulated UEs. For field testing, use software-defined radios (USRP) with srsRAN.
Originally published on Ayodhyyya. Last updated June 1, 2026.