Network product

Description

In 3GPP, a network product is defined as the instantiation of one or more network product classes. This definition appears in the security assurance specifications, particularly TS 33.117, TS 33.805, and TS 33.916. The concept is central to the 3GPP security assurance framework, which provides a methodology for evaluating the security of network products. A network product class is an abstract representation of a product type, defining its security requirements and capabilities. When a vendor implements a product, it becomes a network product, which can then be evaluated against the requirements of its class(es).

The security assurance framework is built around the idea of cataloguing security requirements and test cases for different product classes. A network product class might be, for example, a Mobility Management Entity (MME), a Home Subscriber Server (HSS), or a base station. Each class has a set of security requirements that are derived from 3GPP specifications and other standards. When a vendor develops a product, it must demonstrate that the product meets these requirements. The network product is the concrete artefact that is tested and certified. This approach allows for a consistent and repeatable evaluation process, as the requirements are defined at the class level and can be applied to any product of that class.

The definition of network product is intentionally broad to accommodate the variety of implementations in the telecom industry. A network product could be a physical network element, a virtualised network function, or even a combination of multiple components. The key is that it is an instantiation of one or more product classes. This means that a single product might implement multiple classes, such as a combined MME and SGW. In such cases, the product must meet the security requirements of all the classes it instantiates. The security assurance specifications provide guidance on how to handle such composite products.

The security assurance process typically involves several stages: definition of the product class and its security requirements, development of test cases, evaluation of the product against the requirements, and issuance of a certificate. The network product is the subject of the evaluation. The evaluation may be performed by an accredited laboratory, and the results are used to demonstrate compliance with 3GPP security requirements. This process is important for building trust in the security of network equipment, especially as networks become more open and interoperable.

In terms of evolution, the term "network product" was introduced in Release 12, coinciding with the development of the security assurance specifications. The definition has remained unchanged through Release 19, indicating that the concept has been stable. The only variation is in formatting, such as line breaks, but the wording is identical. This stability reflects the maturity of the security assurance framework and the fact that the definition is sufficiently general to cover new types of products, including virtualised and cloud-native implementations. As 5G and beyond introduce new network architectures, the concept of a network product continues to be relevant for security certification.

Purpose & Motivation

The concept of a network product was created to support the 3GPP security assurance framework, which aims to provide a standardised way to evaluate the security of network equipment. Before this framework, security evaluations were often ad hoc and varied between vendors and operators. This made it difficult to compare products and to ensure a consistent level of security across networks. The introduction of network product classes and network products allowed for a more systematic approach, where security requirements are defined once for a class and then applied to all products of that class. This reduces duplication of effort and increases transparency.

The motivation for this framework came from the recognition that network security is critical for the reliable operation of mobile networks. As networks evolved to support more services and became more interconnected, the attack surface increased. Operators needed assurance that the equipment they deploy meets robust security standards. The 3GPP security assurance specifications, such as TS 33.117, provide a catalogue of security requirements and test cases that can be used to evaluate products. The network product is the tangible item that undergoes this evaluation. This helps operators make informed decisions about the security of the products they procure.

Furthermore, the definition of network product as an instantiation of one or more product classes allows for flexibility in implementation. It recognises that modern network functions are often software-based and can be deployed in various ways, including on virtual machines or containers. The concept is therefore applicable to both traditional hardware and virtualised network functions. This forward-looking approach ensures that the security assurance framework remains relevant as technology evolves. The term has been carried over unchanged since its introduction, demonstrating its enduring utility and the success of the framework it supports.