Public Land Mobile Network Operational domain

Description

The PLMN Operational domain is a concept introduced in 3GPP Release 19 within the context of Non-Public Networks (NPNs) and their integration with Public Land Mobile Networks (PLMNs). It refers to the set of network entities belonging to an NPN that are deployed on the premises of the PLMN operator and are under the direct control of that PLMN operator. This domain is defined in TS 33.501 and TS 33.757, which specify the security architecture and management for 5G networks and NPNs, respectively.

In the 5G ecosystem, NPNs can be deployed in various configurations: standalone (SNPN) or as part of a PLMN (PNI-NPN). The PLMN Operational domain specifically addresses scenarios where the PLMN operator hosts NPN functions within its own infrastructure. This means that the NPN's network functions, such as the Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), and others, are instantiated in the PLMN operator's data center or cloud environment. The PLMN operator is responsible for the operation, management, and security of these entities.

The concept is crucial for understanding the security boundaries and trust relationships in NPN deployments. When NPN entities reside in the PLMN Operational domain, they are within the PLMN operator's security domain, which implies that the PLMN operator applies its own security policies, including authentication, authorization, and encryption mechanisms. This is in contrast to the PNI-NPN Operational domain, where dedicated NPN entities are outside the PLMN operator's security domain and are deployed with the support of the PLMN operator but managed by the NPN owner.

Architecturally, the PLMN Operational domain enables a PLMN operator to offer NPN services to enterprises by leveraging its existing infrastructure. The PLMN operator can slice its network to create isolated NPN instances, ensuring that the NPN traffic is separated from public traffic. The security architecture for this domain is specified in TS 33.501, which outlines the security requirements and procedures for 5G systems, including NPN-specific aspects. TS 33.757 provides further details on the security management for NPNs, including the handling of credentials and key management.

The PLMN Operational domain is part of the broader effort to support diverse deployment models for NPNs, as described in TS 22.261, which defines service requirements for 5G. It allows PLMN operators to monetize their infrastructure by hosting NPNs for enterprises, while ensuring that the enterprises' requirements for isolation, performance, and security are met. This domain is particularly relevant for scenarios where the enterprise does not have its own licensed spectrum or prefers to rely on the PLMN operator for network management.

In summary, the PLMN Operational domain is a security and deployment concept that defines the boundary of PLMN operator control over NPN entities. It is essential for designing secure and efficient NPN deployments that leverage PLMN infrastructure, and it is a key element in the 3GPP standards for 5G NPNs.

Purpose & Motivation

The PLMN Operational domain was introduced to address the need for a clear security and management framework when NPNs are deployed using PLMN operator infrastructure. As enterprises increasingly demand private 5G networks, PLMN operators seek to offer NPN services by hosting NPN functions on their premises. However, this raises questions about security boundaries, control, and responsibility. The PLMN Operational domain defines that when NPN entities are deployed on PLMN operator premises, they fall under the PLMN operator's control and security domain. This clarity is essential for trust models, liability, and regulatory compliance.

Previously, NPN deployments were primarily standalone or relied on unlicensed spectrum, with limited integration with PLMNs. The introduction of PNI-NPNs in Release 16 allowed NPNs to be integrated with PLMNs, but the security and operational aspects of hosting NPN entities within PLMN infrastructure were not fully specified. The PLMN Operational domain fills this gap by providing a standardized way to describe and manage such deployments. It enables PLMN operators to offer NPN-as-a-service, where the operator manages the NPN infrastructure and security, while the enterprise focuses on its applications and devices.

The concept also supports multi-vendor and multi-operator scenarios, where NPN entities from different vendors or operators may coexist. By defining the domain, 3GPP ensures that security policies and procedures are consistently applied, reducing the risk of misconfiguration and security breaches. Overall, the PLMN Operational domain is a foundational concept for the commercial deployment of NPNs by PLMN operators, driving the growth of private 5G networks.